feat(chart): allow setting env vars on the console container - #7759
Open
pingsutw wants to merge 3 commits into
Open
feat(chart): allow setting env vars on the console container#7759pingsutw wants to merge 3 commits into
pingsutw wants to merge 3 commits into
Conversation
The console needs OIDC_LOGOUT_URL to point Sign out at the identity provider's logout endpoint — without it, signing out only clears the proxy's session cookie and the next request re-authenticates silently. The console container template had no env passthrough, so the value could only be set out-of-band with kubectl, which a helm upgrade then reverts. Adds `console.env`, empty by default (rendered only when set). Signed-off-by: Kevin Su <pingsutw@apache.org>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the flyte-binary Helm chart to allow users to pass environment variables directly into the console container, enabling configuration like OIDC_LOGOUT_URL for proper IdP logout behavior without requiring out-of-band kubectl set env changes.
Changes:
- Adds a new
console.envvalues entry (default[]) for specifying console container environment variables. - Renders
env:in the console Deployment template only whenconsole.envis non-empty. - Regenerates chart documentation to include the new value in the README.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| charts/flyte-binary/values.yaml | Introduces console.env (default empty) and documents intended use for OIDC_LOGOUT_URL. |
| charts/flyte-binary/templates/console/deployment.yaml | Conditionally renders the console container env: block from console.env. |
| charts/flyte-binary/README.md | Updates generated values table to include console.env. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sign out expires AWS ALB's session cookie shards by default; deployments behind a proxy that has its own sign-out endpoint should point OIDC_LOGOUT_URL there and clear the list. Signed-off-by: Kevin Su <pingsutw@apache.org>
Signed-off-by: Kevin Su <pingsutw@apache.org>
ursucarina
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tracking issue
Related to unionai-oss/flyte2-ui#28
Why are the changes needed?
The console's Sign out action needs
OIDC_LOGOUT_URLset to the identity provider's logout endpoint. Without it, signing out expires the proxy's session cookie only — if the IdP session is still live, the next request re-authenticates silently and the user looks signed back in.templates/console/deployment.yamlhad no env passthrough, so the value could only be set out-of-band (kubectl set env), which the nexthelm upgradereverts.What changes were proposed in this pull request?
Adds
console.env, empty by default and rendered only when set — the same{{- with }}shape the chart already uses forresources,nodeSelector, and friends. Nothing changes for existing installs.How was this patch tested?
helm templatewith and without the value:Deployed on
flyte-development: the console redirects/v2/logoutto the configured endpoint and expires theAWSELBAuthSessionCookie-*shards.README regenerated with helm-docs.
Labels
added
Check all the applicable boxes
Related PRs
/v2/logoutroute that readsOIDC_LOGOUT_URL.