Skip to content

feat(chart): allow setting env vars on the console container - #7759

Open
pingsutw wants to merge 3 commits into
mainfrom
feat/console-env-oidc-logout-url
Open

feat(chart): allow setting env vars on the console container#7759
pingsutw wants to merge 3 commits into
mainfrom
feat/console-env-oidc-logout-url

Conversation

@pingsutw

@pingsutw pingsutw commented Aug 4, 2026

Copy link
Copy Markdown
Member

Tracking issue

Related to unionai-oss/flyte2-ui#28

Why are the changes needed?

The console's Sign out action needs OIDC_LOGOUT_URL set to the identity provider's logout endpoint. Without it, signing out expires the proxy's session cookie only — if the IdP session is still live, the next request re-authenticates silently and the user looks signed back in.

templates/console/deployment.yaml had no env passthrough, so the value could only be set out-of-band (kubectl set env), which the next helm upgrade reverts.

What changes were proposed in this pull request?

Adds console.env, empty by default and rendered only when set — the same {{- with }} shape the chart already uses for resources, nodeSelector, and friends. Nothing changes for existing installs.

console:
  env:
    - name: OIDC_LOGOUT_URL
      value: https://<okta-org>/login/signout

How was this patch tested?

helm template with and without the value:

$ helm template t charts/flyte-binary -s templates/console/deployment.yaml | grep -c 'env:'
0
$ helm template t charts/flyte-binary \
    --set 'console.env[0].name=OIDC_LOGOUT_URL' \
    --set 'console.env[0].value=https://x/login/signout' \
    -s templates/console/deployment.yaml
...
          env:
            - name: OIDC_LOGOUT_URL
              value: https://x/login/signout

Deployed on flyte-development: the console redirects /v2/logout to the configured endpoint and expires the AWSELBAuthSessionCookie-* shards.

README regenerated with helm-docs.

Labels

added

Check all the applicable boxes

  • I updated the documentation accordingly.
  • All new and existing tests passed.
  • All commits are signed-off.

Related PRs

The console needs OIDC_LOGOUT_URL to point Sign out at the identity
provider's logout endpoint — without it, signing out only clears the
proxy's session cookie and the next request re-authenticates silently.
The console container template had no env passthrough, so the value could
only be set out-of-band with kubectl, which a helm upgrade then reverts.

Adds `console.env`, empty by default (rendered only when set).

Signed-off-by: Kevin Su <pingsutw@apache.org>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the flyte-binary Helm chart to allow users to pass environment variables directly into the console container, enabling configuration like OIDC_LOGOUT_URL for proper IdP logout behavior without requiring out-of-band kubectl set env changes.

Changes:

  • Adds a new console.env values entry (default []) for specifying console container environment variables.
  • Renders env: in the console Deployment template only when console.env is non-empty.
  • Regenerates chart documentation to include the new value in the README.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
charts/flyte-binary/values.yaml Introduces console.env (default empty) and documents intended use for OIDC_LOGOUT_URL.
charts/flyte-binary/templates/console/deployment.yaml Conditionally renders the console container env: block from console.env.
charts/flyte-binary/README.md Updates generated values table to include console.env.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign out expires AWS ALB's session cookie shards by default; deployments
behind a proxy that has its own sign-out endpoint should point
OIDC_LOGOUT_URL there and clear the list.

Signed-off-by: Kevin Su <pingsutw@apache.org>
Copilot AI review requested due to automatic review settings August 4, 2026 01:12

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Signed-off-by: Kevin Su <pingsutw@apache.org>
Copilot AI review requested due to automatic review settings August 4, 2026 05:16

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants