open-webui/helm-charts
1
0
Fork 0
mirror of https://github.com/open-webui/helm-charts.git synced 2026-07-22 09:55:25 -04:00
Code Issues 13 Packages Projects Releases 10 Wiki Activity

[PR #227] [MERGED] feat(open-webui): Make it possible to configure Storage credentials via k8s secrets #263

New Issue
Closed
opened 2026-02-15 19:17:07 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 19:17:07 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/open-webui/helm-charts/pull/227
Author: @mjtrangoni
Created: 4/26/2025
Status: ✅ Merged
Merged: 5/6/2025
Merged by: @westbrook-ai

Base: main ← Head: feature-azure-storage-key

📝 Commits (3)

  • e6c33ca feat(open-webui): Make it possible to configure Azure Storage credentials via k8s secrets
  • 86e4268 feat(open-webui): Make it possible to configure Google Cloud Storage Application Credentials JSON file via k8s secrets
  • a5073d4 feat(open-webui): Make it possible to configure Amazon S3 Storage secret key via k8s secrets

📊 Changes

4 files changed (+89 additions, -18 deletions)

View changed files

📝 charts/open-webui/Chart.yaml (+1 -1)
📝 charts/open-webui/README.md (+33 -12)
📝 charts/open-webui/templates/workload-manager.yaml (+21 -0)
📝 charts/open-webui/values.yaml (+34 -5)

📄 Description

Hi,

This PR extends the Open WebUI Helm chart to allow the Storage Key to be defined either directly in the values.yaml file or via a Kubernetes Secret. I took the opportunity to define new README.md sections called "Azure Storage configuration", "Google Cloud Storage configuration", and "Amazon S3 Storage configuration" respectively.

The changes were tested locally using helm template, and the rendering works as expected.

Given a k8s secret like,

kubectl create secret generic azure-storage-account --from-literal=azure-account-key=REDACTED

And a values-test.yaml file,

# Disable bundled dependencies
ollama:
  enabled: false

pipelines:
  # -- Automatically install Pipelines chart to extend Open WebUI functionality using Pipelines: https://github.com/open-webui/pipelines
  enabled: false
  # -- This section can be used to pass required environment variables to your pipelines (e.g. Langfuse hostname)
  extraEnvVars: []

tika:
  # -- Automatically install Apache Tika to extend Open WebUI
  enabled: false

# -- A list of Ollama API endpoints. These can be added in lieu of automatically installing the Ollama Helm chart, or in addition to it.
ollamaUrls: []

# -- Disables taking Ollama Urls from `ollamaUrls`  list
ollamaUrlsFromExtraEnv: false

websocket:
  # -- Enables websocket support in Open WebUI with env `ENABLE_WEBSOCKET_SUPPORT`
  enabled: true
  # -- Specifies the websocket manager to use with env `WEBSOCKET_MANAGER`: redis (default)
  manager: redis
  # -- Deploys a redis
  redis:
    # -- Enable redis installation
    enabled: false

# -- Deploys a Redis cluster with subchart 'redis' from bitnami
redis-cluster:
  # -- Enable Redis installation
  enabled: true
  # -- Redis cluster name (recommended to be 'open-webui-redis')
  # - In this case, redis url will be 'redis://open-webui-redis-master:6379/0' or 'redis://[:<password>@]open-webui-redis-master:6379/0'
  fullnameOverride: open-webui-redis
  # -- Redis Authentication
  auth:
    # -- Enable Redis authentication (disabled by default). For your security, we strongly suggest that you switch to 'auth.enabled=true'
    enabled: false
  # -- Replica configuration for the Redis cluster
  replica:
    # -- Number of Redis replica instances
    replicaCount: 3


replicaCount: 2

serviceAccount:
  enable: true

ingress:
  enabled: true
  class: "external"
  # -- Use appropriate annotations for your Ingress controller, e.g., for NGINX:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-expires: "172800"
    nginx.ingress.kubernetes.io/session-cookie-max-age: "172800"
    nginx.ingress.kubernetes.io/session-cookie-name: "route"
  host: "REDACTED"
  tls: true

persistence:
  enabled: true
  # -- Sets the storage provider, availables values are `local`, `s3`, `gcs` or `azure`
  provider: azure
  azure:
    # -- Sets the endpoint URL for Azure Storage
    endpointUrl: "REDACTED"
    # -- Sets the container name for Azure Storage
    container: "data"
    key: "test"
    keyExistingSecret: "azure-storage-account"
    keyExistingSecretKey: "azure-account-key"

# -- Enables the use of OpenAI APIs
enableOpenaiApi: true

# -- OpenAI base API URL to use. Defaults to the Pipelines service endpoint when Pipelines are enabled, and "https://api.openai.com/v1" if Pipelines are not enabled and this value is blank
openaiBaseApiUrl: "https://api.openai.com/v1"

# -- Env vars added to the Open WebUI deployment. Most up-to-date environment variables can be found here: https://docs.openwebui.com/getting-started/env-configuration/
extraEnvVars:
  # -- Default API key value for Pipelines. Should be updated in a production deployment, or be changed to the required API key if not using Pipelines
  # OpenAI config
  - name: OPENAI_API_KEY
    valueFrom:
      secretKeyRef:
        name: openai-api-key
        key: api-key
  - name: ENABLE_MODEL_FILTER
    value: "true"
  - name: MODEL_FILTER_LIST
    value: "gpt-4o-mini;gpt-4o-2024-08-06;ask_hr_policies"
  - name: DEFAULT_MODELS
    value: "gpt-4o-mini"
  - name: DEFAULT_LOCALE
    value: "en_US"
  - name: DEFAULT_USER_ROLE
    value: "user"
  # Blob storage key
  - name: AZURE_STORAGE_KEY
    valueFrom:
      secretKeyRef:
        name: azure-storage-account
        key: azure-account-key
  # Database URL
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: postgres-db-url
        key: postgres-url
  # Redis
  - name: WEBSOCKET_REDIS_URL
    value: "redis://infra-openwebui-redis.infra-openwebui.svc.cluster.local:26379/0"
  - name: WEBSOCKET_REDIS_MASTER_NAME
    value: "mymaster"
  - name: WEBSOCKET_REDIS_PASSWORD
    valueFrom:
      secretKeyRef:
        name: redis
        key: secret
  # Log Level
  - name: GLOBAL_LOG_LEVEL
    value: "debug"

sso:
  # -- **Enable SSO authentication globally** must enable to use SSO authentication
  # @section -- SSO Configuration
  enabled: true
  # -- Enable account creation when logging in with OAuth (distinct from regular signup)
  # @section -- SSO Configuration
  enableSignup: false
  # -- Allow logging into accounts that match email from OAuth provider (considered insecure)
  # @section -- SSO Configuration
  mergeAccountsByEmail: false
  # -- Enable OAuth role management through access token roles claim
  # @section -- SSO Configuration
  enableRoleManagement: false
  # -- Enable OAuth group management through access token groups claim
  # @section -- SSO Configuration
  enableGroupManagement: false

  microsoft:
    # -- Enable Microsoft OAuth
    enabled: true
    # -- Microsoft OAuth client ID
    clientId: "REDACTED"
    # -- Microsoft tenant ID - use 9188040d-6c67-4c5b-b112-36a304b66dad for personal accounts
    tenantId: "REDACTED"
    clientSecret: "test"

  roleManagement:
    # -- The claim that contains the roles (can be nested, e.g., user.roles)
    # @section -- Role management configuration
    rolesClaim: "roles"
    # -- Comma-separated list of roles allowed to log in (receive open webui role user)
    # @section -- Role management configuration
    allowedRoles: ""
    # -- Comma-separated list of roles allowed to log in as admin (receive open webui role admin)
    # @section -- Role management configuration
    adminRoles: ""

  groupManagement:
    # -- The claim that contains the groups (can be nested, e.g., user.memberOf)
    # @section -- SSO Configuration
    groupsClaim: "groups"

  trustedHeader:
    # -- Enable trusted header authentication
    # @section -- SSO trusted header authentication
    enabled: false
    # -- Header containing the user's email address
    # @section -- SSO trusted header authentication
    emailHeader: ""
    # -- Header containing the user's name (optional, used for new user creation)
    # @section -- SSO trusted header authentication
    nameHeader: ""

# -- Postgresql configuration (see. https://artifacthub.io/packages/helm/bitnami/postgresql)
postgresql:
  enabled: false

With helm template

helm template . --values values-test.yaml > redacted-secret.yaml

Now with values-test.yaml changed to,

persistence:
  enabled: true
  # -- Sets the storage provider, availables values are `local`, `s3`, `gcs` or `azure`
  provider: azure
  azure:
    # -- Sets the endpoint URL for Azure Storage
    endpointUrl: "REDACTED"
    # -- Sets the container name for Azure Storage
    container: "data"
    key: "test"
    keyExistingSecret: ""
    keyExistingSecretKey: ""

The difference is,

 diff -u redacted-secret.yaml redacted-raw.yaml
--- redacted-secret.yaml        2025-05-06 09:33:30
+++ redacted-raw.yaml   2025-05-06 09:37:04
@@ -499,10 +499,7 @@
         - name: "AZURE_STORAGE_CONTAINER_NAME"
           value: data
         - name: "AZURE_STORAGE_KEY"
-          valueFrom:
-            secretKeyRef:
-              name: azure-storage-account
-              key: azure-account-key
+          value: test
         - name: "ENABLE_WEBSOCKET_SUPPORT"
           value: "True"
         - name: "WEBSOCKET_MANAGER"

Thank you!

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/helm-charts/pull/227 **Author:** [@mjtrangoni](https://github.com/mjtrangoni) **Created:** 4/26/2025 **Status:** ✅ Merged **Merged:** 5/6/2025 **Merged by:** [@westbrook-ai](https://github.com/westbrook-ai) **Base:** `main` ← **Head:** `feature-azure-storage-key` --- ### 📝 Commits (3) - [`e6c33ca`](https://github.com/open-webui/helm-charts/commit/e6c33ca07c60b60fc74ae7c92626a3ed61e42b5c) feat(open-webui): Make it possible to configure Azure Storage credentials via k8s secrets - [`86e4268`](https://github.com/open-webui/helm-charts/commit/86e42681ca82195c248486d0e667c03f25fcdc26) feat(open-webui): Make it possible to configure Google Cloud Storage Application Credentials JSON file via k8s secrets - [`a5073d4`](https://github.com/open-webui/helm-charts/commit/a5073d40f230a1068fb05a4c403c589fab9f3c3a) feat(open-webui): Make it possible to configure Amazon S3 Storage secret key via k8s secrets ### 📊 Changes **4 files changed** (+89 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `charts/open-webui/Chart.yaml` (+1 -1) 📝 `charts/open-webui/README.md` (+33 -12) 📝 `charts/open-webui/templates/workload-manager.yaml` (+21 -0) 📝 `charts/open-webui/values.yaml` (+34 -5) </details> ### 📄 Description Hi, This PR extends the Open WebUI Helm chart to allow the Storage Key to be defined either directly in the values.yaml file or via a Kubernetes Secret. I took the opportunity to define new README.md sections called "Azure Storage configuration", "Google Cloud Storage configuration", and "Amazon S3 Storage configuration" respectively. The changes were tested locally using helm template, and the rendering works as expected. Given a k8s secret like, ```console kubectl create secret generic azure-storage-account --from-literal=azure-account-key=REDACTED ``` And a values-test.yaml file, ```yaml # Disable bundled dependencies ollama: enabled: false pipelines: # -- Automatically install Pipelines chart to extend Open WebUI functionality using Pipelines: https://github.com/open-webui/pipelines enabled: false # -- This section can be used to pass required environment variables to your pipelines (e.g. Langfuse hostname) extraEnvVars: [] tika: # -- Automatically install Apache Tika to extend Open WebUI enabled: false # -- A list of Ollama API endpoints. These can be added in lieu of automatically installing the Ollama Helm chart, or in addition to it. ollamaUrls: [] # -- Disables taking Ollama Urls from `ollamaUrls` list ollamaUrlsFromExtraEnv: false websocket: # -- Enables websocket support in Open WebUI with env `ENABLE_WEBSOCKET_SUPPORT` enabled: true # -- Specifies the websocket manager to use with env `WEBSOCKET_MANAGER`: redis (default) manager: redis # -- Deploys a redis redis: # -- Enable redis installation enabled: false # -- Deploys a Redis cluster with subchart 'redis' from bitnami redis-cluster: # -- Enable Redis installation enabled: true # -- Redis cluster name (recommended to be 'open-webui-redis') # - In this case, redis url will be 'redis://open-webui-redis-master:6379/0' or 'redis://[:<password>@]open-webui-redis-master:6379/0' fullnameOverride: open-webui-redis # -- Redis Authentication auth: # -- Enable Redis authentication (disabled by default). For your security, we strongly suggest that you switch to 'auth.enabled=true' enabled: false # -- Replica configuration for the Redis cluster replica: # -- Number of Redis replica instances replicaCount: 3 replicaCount: 2 serviceAccount: enable: true ingress: enabled: true class: "external" # -- Use appropriate annotations for your Ingress controller, e.g., for NGINX: annotations: cert-manager.io/cluster-issuer: letsencrypt nginx.ingress.kubernetes.io/affinity: "cookie" nginx.ingress.kubernetes.io/session-cookie-expires: "172800" nginx.ingress.kubernetes.io/session-cookie-max-age: "172800" nginx.ingress.kubernetes.io/session-cookie-name: "route" host: "REDACTED" tls: true persistence: enabled: true # -- Sets the storage provider, availables values are `local`, `s3`, `gcs` or `azure` provider: azure azure: # -- Sets the endpoint URL for Azure Storage endpointUrl: "REDACTED" # -- Sets the container name for Azure Storage container: "data" key: "test" keyExistingSecret: "azure-storage-account" keyExistingSecretKey: "azure-account-key" # -- Enables the use of OpenAI APIs enableOpenaiApi: true # -- OpenAI base API URL to use. Defaults to the Pipelines service endpoint when Pipelines are enabled, and "https://api.openai.com/v1" if Pipelines are not enabled and this value is blank openaiBaseApiUrl: "https://api.openai.com/v1" # -- Env vars added to the Open WebUI deployment. Most up-to-date environment variables can be found here: https://docs.openwebui.com/getting-started/env-configuration/ extraEnvVars: # -- Default API key value for Pipelines. Should be updated in a production deployment, or be changed to the required API key if not using Pipelines # OpenAI config - name: OPENAI_API_KEY valueFrom: secretKeyRef: name: openai-api-key key: api-key - name: ENABLE_MODEL_FILTER value: "true" - name: MODEL_FILTER_LIST value: "gpt-4o-mini;gpt-4o-2024-08-06;ask_hr_policies" - name: DEFAULT_MODELS value: "gpt-4o-mini" - name: DEFAULT_LOCALE value: "en_US" - name: DEFAULT_USER_ROLE value: "user" # Blob storage key - name: AZURE_STORAGE_KEY valueFrom: secretKeyRef: name: azure-storage-account key: azure-account-key # Database URL - name: DATABASE_URL valueFrom: secretKeyRef: name: postgres-db-url key: postgres-url # Redis - name: WEBSOCKET_REDIS_URL value: "redis://infra-openwebui-redis.infra-openwebui.svc.cluster.local:26379/0" - name: WEBSOCKET_REDIS_MASTER_NAME value: "mymaster" - name: WEBSOCKET_REDIS_PASSWORD valueFrom: secretKeyRef: name: redis key: secret # Log Level - name: GLOBAL_LOG_LEVEL value: "debug" sso: # -- **Enable SSO authentication globally** must enable to use SSO authentication # @section -- SSO Configuration enabled: true # -- Enable account creation when logging in with OAuth (distinct from regular signup) # @section -- SSO Configuration enableSignup: false # -- Allow logging into accounts that match email from OAuth provider (considered insecure) # @section -- SSO Configuration mergeAccountsByEmail: false # -- Enable OAuth role management through access token roles claim # @section -- SSO Configuration enableRoleManagement: false # -- Enable OAuth group management through access token groups claim # @section -- SSO Configuration enableGroupManagement: false microsoft: # -- Enable Microsoft OAuth enabled: true # -- Microsoft OAuth client ID clientId: "REDACTED" # -- Microsoft tenant ID - use 9188040d-6c67-4c5b-b112-36a304b66dad for personal accounts tenantId: "REDACTED" clientSecret: "test" roleManagement: # -- The claim that contains the roles (can be nested, e.g., user.roles) # @section -- Role management configuration rolesClaim: "roles" # -- Comma-separated list of roles allowed to log in (receive open webui role user) # @section -- Role management configuration allowedRoles: "" # -- Comma-separated list of roles allowed to log in as admin (receive open webui role admin) # @section -- Role management configuration adminRoles: "" groupManagement: # -- The claim that contains the groups (can be nested, e.g., user.memberOf) # @section -- SSO Configuration groupsClaim: "groups" trustedHeader: # -- Enable trusted header authentication # @section -- SSO trusted header authentication enabled: false # -- Header containing the user's email address # @section -- SSO trusted header authentication emailHeader: "" # -- Header containing the user's name (optional, used for new user creation) # @section -- SSO trusted header authentication nameHeader: "" # -- Postgresql configuration (see. https://artifacthub.io/packages/helm/bitnami/postgresql) postgresql: enabled: false ``` With helm template ```console helm template . --values values-test.yaml > redacted-secret.yaml ``` Now with values-test.yaml changed to, ```yaml persistence: enabled: true # -- Sets the storage provider, availables values are `local`, `s3`, `gcs` or `azure` provider: azure azure: # -- Sets the endpoint URL for Azure Storage endpointUrl: "REDACTED" # -- Sets the container name for Azure Storage container: "data" key: "test" keyExistingSecret: "" keyExistingSecretKey: "" ``` The difference is, ```bash diff -u redacted-secret.yaml redacted-raw.yaml --- redacted-secret.yaml 2025-05-06 09:33:30 +++ redacted-raw.yaml 2025-05-06 09:37:04 @@ -499,10 +499,7 @@ - name: "AZURE_STORAGE_CONTAINER_NAME" value: data - name: "AZURE_STORAGE_KEY" - valueFrom: - secretKeyRef: - name: azure-storage-account - key: azure-account-key + value: test - name: "ENABLE_WEBSOCKET_SUPPORT" value: "True" - name: "WEBSOCKET_MANAGER" ``` Thank you! --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 19:17:07 -05:00
yindo closed this issue 2026-02-15 19:17:07 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
awaiting-user-feedback
awaiting-user-feedback
bug
bug
documentation
enhancement
good first issue
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
upstream
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: open-webui/helm-charts#263
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?