open-webui/helm-charts
1
0
Fork 0
mirror of https://github.com/open-webui/helm-charts.git synced 2026-07-22 01:45:23 -04:00
Code Issues 13 Packages Projects Releases 10 Wiki Activity

WEBUI_URL environment variable is not created with version 6.20.0, which breaks EntraID SSO that requires that variable since open-webui 0.6.11 #88

New Issue
Closed
opened 2026-02-15 19:16:10 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 19:16:10 -05:00
Owner
Copy Link
Copy Source

Originally created by @oboudry-mvp on GitHub (Jun 11, 2025).

open-webui 0.6.11 impact on EntraID SSO

Version 0.6.11 of Open-Webui deployed with helm chart 6.17.0 did break EntraID Single-Sign-On. The proposed fix was to set the WEBUI_URL as an environment variable.

problem reoccurence with helm chart 6.20.0

When upgrading helm chart from 6.19.0 to 6.20.0, this SSO bug re-occured again.

I first suspected a reoccurence of the bug in open-webui, but after looking at code changes did not find anything that would explain it. As a test, I deployed helm chart 6.19.0, but manually forced the open-webui image to 0.6.14. In that situation all works fine.

I then compared YAML generated by helm chart 6.19.0 and 6.20.0 and noticed that the WEBUI_URL environment value was not present in 6.20.0 generation.

$ kustomize build . --enable-helm > v6.19.yaml
$ vim kustomization.yaml
$ kustomize build . --enable-helm > v6.20.yaml
$ diff v6.19.yaml v6.20.yaml
17,18c17,18
<     app.kubernetes.io/version: 0.6.13
<     helm.sh/chart: open-webui-6.19.0
---
>     app.kubernetes.io/version: 0.6.14
>     helm.sh/chart: open-webui-6.20.0
41,42c41,42
<     app.kubernetes.io/version: 0.6.13
<     helm.sh/chart: open-webui-6.19.0
---
>     app.kubernetes.io/version: 0.6.14
>     helm.sh/chart: open-webui-6.20.0
183,184c183,184
<     app.kubernetes.io/version: 0.6.13
<     helm.sh/chart: open-webui-6.19.0
---
>     app.kubernetes.io/version: 0.6.14
>     helm.sh/chart: open-webui-6.20.0
200,201c200,201
<         app.kubernetes.io/version: 0.6.13
<         helm.sh/chart: open-webui-6.19.0
---
>         app.kubernetes.io/version: 0.6.14
>         helm.sh/chart: open-webui-6.20.0
206,207d205
<         - name: WEBUI_URL
<           value: http://open-webui.marvinpac.com
265c263
<         image: ghcr.io/open-webui/open-webui:0.6.13
---
>         image: ghcr.io/open-webui/open-webui:0.6.14
281c279
<         image: ghcr.io/open-webui/open-webui:0.6.13
---
>         image: ghcr.io/open-webui/open-webui:0.6.14
351,352c349,350
<     app.kubernetes.io/version: 0.6.13
<     helm.sh/chart: open-webui-6.19.0
---
>     app.kubernetes.io/version: 0.6.14
>     helm.sh/chart: open-webui-6.20.0

When looking at code changes between helm chart 6.19.0 and 6.20.0, I notice some WEBUI_URL relevant code that I suspect is the source of this issue.

--- a/charts/open-webui/templates/_helpers.tpl
+++ b/charts/open-webui/templates/_helpers.tpl
@@ -239,9 +239,18 @@ Constructs a string containing the URLs of the Open WebUI based on the ingress c
 used to populate the variable WEBUI_URL
 */ -}}
 {{- define "openweb-ui.url" -}}
-  {{- $proto := "http" -}}
-  {{- if .Values.ingress.tls -}}
-    {{- $proto = "https" -}}
-  {{- end -}}
-  {{- printf "%s://%s" $proto $.Values.ingress.host }}
+  {{- $url := "" -}}
+  {{- range .Values.extraEnvVars }}
+    {{- if and (eq .name "WEBUI_URL") .value }}
+      {{- $url = .value }}
+    {{- end }}
+  {{- end }}
+  {{- if not $url }}
+    {{- $proto := "http" -}}
+    {{- if .Values.ingress.tls }}
+      {{- $proto = "https" -}}
+    {{- end }}
+    {{- $url = printf "%s://%s" $proto .Values.ingress.host }}
+  {{- end }}
+  {{- $url }}
 {{- end }}
diff --git a/charts/open-webui/templates/workload-manager.yaml b/charts/open-webui/templates/workload-manager.yaml
index bad45df..6bf1242 100644
--- a/charts/open-webui/templates/workload-manager.yaml
+++ b/charts/open-webui/templates/workload-manager.yaml
@@ -119,9 +119,15 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
         env:
-        {{- if .Values.ingress.enabled }}
+        {{- $hasCustomWebUIUrl := false }}
+        {{- range .Values.extraEnvVars }}
+          {{- if eq .name "WEBUI_URL" }}
+            {{- $hasCustomWebUIUrl = true }}
+          {{- end }}
+        {{- end }}
+        {{- if and .Values.ingress.enabled (not $hasCustomWebUIUrl) }}
         - name: WEBUI_URL
-          value: {{ include "openweb-ui.url" . }}
+          value: {{ include "openweb-ui.url" . | quote }}
         {{- end }}
         {{- if .Values.ollamaUrlsFromExtraEnv}}
         {{- else if or .Values.ollamaUrls .Values.ollama.enabled }}

I suppose the environment variable is used in some if tests, but is not output as a variable.

Originally created by @oboudry-mvp on GitHub (Jun 11, 2025). ## open-webui 0.6.11 impact on EntraID SSO Version 0.6.11 of Open-Webui deployed with helm chart 6.17.0 did break EntraID Single-Sign-On. The proposed fix was to set the WEBUI_URL as an environment variable. ## problem reoccurence with helm chart 6.20.0 When upgrading helm chart from 6.19.0 to 6.20.0, this SSO bug re-occured again. I first suspected a reoccurence of the bug in open-webui, but after looking at code changes did not find anything that would explain it. As a test, I deployed helm chart 6.19.0, but manually forced the open-webui image to 0.6.14. In that situation all works fine. I then compared YAML generated by helm chart 6.19.0 and 6.20.0 and noticed that the WEBUI_URL environment value was not present in 6.20.0 generation. ```diff $ kustomize build . --enable-helm > v6.19.yaml $ vim kustomization.yaml $ kustomize build . --enable-helm > v6.20.yaml $ diff v6.19.yaml v6.20.yaml 17,18c17,18 < app.kubernetes.io/version: 0.6.13 < helm.sh/chart: open-webui-6.19.0 --- > app.kubernetes.io/version: 0.6.14 > helm.sh/chart: open-webui-6.20.0 41,42c41,42 < app.kubernetes.io/version: 0.6.13 < helm.sh/chart: open-webui-6.19.0 --- > app.kubernetes.io/version: 0.6.14 > helm.sh/chart: open-webui-6.20.0 183,184c183,184 < app.kubernetes.io/version: 0.6.13 < helm.sh/chart: open-webui-6.19.0 --- > app.kubernetes.io/version: 0.6.14 > helm.sh/chart: open-webui-6.20.0 200,201c200,201 < app.kubernetes.io/version: 0.6.13 < helm.sh/chart: open-webui-6.19.0 --- > app.kubernetes.io/version: 0.6.14 > helm.sh/chart: open-webui-6.20.0 206,207d205 < - name: WEBUI_URL < value: http://open-webui.marvinpac.com 265c263 < image: ghcr.io/open-webui/open-webui:0.6.13 --- > image: ghcr.io/open-webui/open-webui:0.6.14 281c279 < image: ghcr.io/open-webui/open-webui:0.6.13 --- > image: ghcr.io/open-webui/open-webui:0.6.14 351,352c349,350 < app.kubernetes.io/version: 0.6.13 < helm.sh/chart: open-webui-6.19.0 --- > app.kubernetes.io/version: 0.6.14 > helm.sh/chart: open-webui-6.20.0 ``` When looking at code changes between helm chart 6.19.0 and 6.20.0, I notice some WEBUI_URL relevant code that I suspect is the source of this issue. ```diff --- a/charts/open-webui/templates/_helpers.tpl +++ b/charts/open-webui/templates/_helpers.tpl @@ -239,9 +239,18 @@ Constructs a string containing the URLs of the Open WebUI based on the ingress c used to populate the variable WEBUI_URL */ -}} {{- define "openweb-ui.url" -}} - {{- $proto := "http" -}} - {{- if .Values.ingress.tls -}} - {{- $proto = "https" -}} - {{- end -}} - {{- printf "%s://%s" $proto $.Values.ingress.host }} + {{- $url := "" -}} + {{- range .Values.extraEnvVars }} + {{- if and (eq .name "WEBUI_URL") .value }} + {{- $url = .value }} + {{- end }} + {{- end }} + {{- if not $url }} + {{- $proto := "http" -}} + {{- if .Values.ingress.tls }} + {{- $proto = "https" -}} + {{- end }} + {{- $url = printf "%s://%s" $proto .Values.ingress.host }} + {{- end }} + {{- $url }} {{- end }} diff --git a/charts/open-webui/templates/workload-manager.yaml b/charts/open-webui/templates/workload-manager.yaml index bad45df..6bf1242 100644 --- a/charts/open-webui/templates/workload-manager.yaml +++ b/charts/open-webui/templates/workload-manager.yaml @@ -119,9 +119,15 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} env: - {{- if .Values.ingress.enabled }} + {{- $hasCustomWebUIUrl := false }} + {{- range .Values.extraEnvVars }} + {{- if eq .name "WEBUI_URL" }} + {{- $hasCustomWebUIUrl = true }} + {{- end }} + {{- end }} + {{- if and .Values.ingress.enabled (not $hasCustomWebUIUrl) }} - name: WEBUI_URL - value: {{ include "openweb-ui.url" . }} + value: {{ include "openweb-ui.url" . | quote }} {{- end }} {{- if .Values.ollamaUrlsFromExtraEnv}} {{- else if or .Values.ollamaUrls .Values.ollama.enabled }} ``` I suppose the environment variable is used in some if tests, but is not output as a variable.
yindo closed this issue 2026-02-15 19:16:10 -05:00
yindo commented 2026-02-15 19:16:10 -05:00
Author
Owner
Copy Link
Copy Source

@oboudry-mvp commented on GitHub (Jun 13, 2025):

I'll create a new issue, my initial diagnostic is wrong. The WEBUI_URL environment variable is properly created by the helm chart, but helm chart 6.19.0 was creating it twice, hence finding it in the diff from 6.19.0 to 6.20.0. I'll close this issue and open a new one when I have better understanding of the issue.

@oboudry-mvp commented on GitHub (Jun 13, 2025): I'll create a new issue, my initial diagnostic is wrong. The WEBUI_URL environment variable is properly created by the helm chart, but helm chart 6.19.0 was creating it twice, hence finding it in the diff from 6.19.0 to 6.20.0. I'll close this issue and open a new one when I have better understanding of the issue.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
awaiting-user-feedback
awaiting-user-feedback
bug
bug
documentation
enhancement
good first issue
help wanted
pull-request
Mirrored from GitHub Pull Request
 question
upstream
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: open-webui/helm-charts#88
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?