From 2bb6ffa0bb2921770643817440dc9a5eecfc5927 Mon Sep 17 00:00:00 2001 From: viniciusdc Date: Tue, 12 May 2026 12:35:00 -0300 Subject: [PATCH 1/5] chore: bump nebari-landing chart to v0.1.0-alpha.5 --- pkg/argocd/templates/apps/nebari-landingpage.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/argocd/templates/apps/nebari-landingpage.yaml b/pkg/argocd/templates/apps/nebari-landingpage.yaml index 70b31e40..5fa6e61d 100644 --- a/pkg/argocd/templates/apps/nebari-landingpage.yaml +++ b/pkg/argocd/templates/apps/nebari-landingpage.yaml @@ -15,7 +15,7 @@ spec: source: repoURL: https://github.com/nebari-dev/nebari-landing - targetRevision: v0.1.0-alpha.4 + targetRevision: v0.1.0-alpha.5 path: charts/nebari-landing helm: releaseName: nebari-landing From e7b6c34009f553ed7ed182d35dde21087fc1270d Mon Sep 17 00:00:00 2001 From: viniciusdc Date: Tue, 12 May 2026 12:41:28 -0300 Subject: [PATCH 2/5] chore: drop dead frontend.oauth2Proxy values --- pkg/argocd/templates/apps/nebari-landingpage.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkg/argocd/templates/apps/nebari-landingpage.yaml b/pkg/argocd/templates/apps/nebari-landingpage.yaml index 5fa6e61d..57878d00 100644 --- a/pkg/argocd/templates/apps/nebari-landingpage.yaml +++ b/pkg/argocd/templates/apps/nebari-landingpage.yaml @@ -25,8 +25,6 @@ spec: # External public Keycloak URL - used by the browser for OIDC login. url: "{{ .KeycloakIssuerURL }}" realm: "{{ .KeycloakRealm }}" - oauth2Proxy: - oidcIssuerUrl: "{{ .KeycloakIssuerURL }}/realms/{{ .KeycloakRealm }}" webapi: keycloak: From 9f7623ff107efc8f7a55d050ccc9307dcc699b92 Mon Sep 17 00:00:00 2001 From: viniciusdc Date: Tue, 12 May 2026 12:45:21 -0300 Subject: [PATCH 3/5] test(argocd): drop OIDC issuer URL assertion after oauth2-proxy removal The landing chart at v0.1.0-alpha.5 dropped the oauth2-proxy sidecar, so our values block no longer renders the /realms/ concatenation that this assertion was checking. The remaining wantIssuerURL and realm checks already cover what stays in the template. --- pkg/argocd/writer_test.go | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/pkg/argocd/writer_test.go b/pkg/argocd/writer_test.go index 0a3b6bf9..f1fb9ea4 100644 --- a/pkg/argocd/writer_test.go +++ b/pkg/argocd/writer_test.go @@ -445,22 +445,19 @@ func TestHTTPToHTTPSRedirectRoute(t *testing.T) { func TestLandingPageTemplate(t *testing.T) { tests := []struct { - name string - keycloakBasePath string - wantIssuerURL string - wantOIDCIssuerURL string + name string + keycloakBasePath string + wantIssuerURL string }{ { - name: "no base path", - keycloakBasePath: "", - wantIssuerURL: "https://keycloak.test.example.com", - wantOIDCIssuerURL: "https://keycloak.test.example.com/realms/nebari", + name: "no base path", + keycloakBasePath: "", + wantIssuerURL: "https://keycloak.test.example.com", }, { - name: "auth base path included in issuer URL", - keycloakBasePath: "/auth", - wantIssuerURL: "https://keycloak.test.example.com/auth", - wantOIDCIssuerURL: "https://keycloak.test.example.com/auth/realms/nebari", + name: "auth base path included in issuer URL", + keycloakBasePath: "/auth", + wantIssuerURL: "https://keycloak.test.example.com/auth", }, } @@ -495,9 +492,6 @@ func TestLandingPageTemplate(t *testing.T) { if !strings.Contains(output, tt.wantIssuerURL) { t.Errorf("expected issuer URL %q in rendered output, got:\n%s", tt.wantIssuerURL, output) } - if !strings.Contains(output, tt.wantOIDCIssuerURL) { - t.Errorf("expected OIDC issuer URL %q in rendered output, got:\n%s", tt.wantOIDCIssuerURL, output) - } if !strings.Contains(output, data.KeycloakServiceURL) { t.Errorf("expected in-cluster service URL %q in rendered output, got:\n%s", data.KeycloakServiceURL, output) } From 13d964c3e2647860b461dc015e844e36d1c926b4 Mon Sep 17 00:00:00 2001 From: viniciusdc Date: Tue, 12 May 2026 12:47:16 -0300 Subject: [PATCH 4/5] docs(argocd): drop stale oauth2-proxy reference from KeycloakIssuerURL note --- pkg/argocd/writer.go | 9 --------- 1 file changed, 9 deletions(-) diff --git a/pkg/argocd/writer.go b/pkg/argocd/writer.go index e745cc76..772e7aa8 100644 --- a/pkg/argocd/writer.go +++ b/pkg/argocd/writer.go @@ -133,15 +133,6 @@ func NewTemplateData(cfg *config.NebariConfig, settings provider.InfraSettings) // Only set when a real domain is configured. When no domain is provided // (e.g. cloud deployments using a bare LoadBalancer IP), KeycloakIssuerURL // is left empty and KEYCLOAK_ISSUER_URL is not injected into workloads. - // - // NOTE: The nebari-landingpage template uses KeycloakIssuerURL to construct - // oidcIssuerUrl for oauth2-proxy (rendered as "/realms/"). - // If KeycloakIssuerURL is empty this collapses to a relative path like - // "/realms/nebari", which oauth2-proxy would reject. In practice this - // function defaults Domain to "nebari.local" (see above), so - // KeycloakIssuerURL is always populated through normal code paths. However, - // if bare-LB-IP deployments (cfg.Domain == "") are ever supported, the - // template will need a guard or a separate value for the OIDC issuer URL. if cfg.Domain != "" { data.KeycloakIssuerURL = fmt.Sprintf("https://keycloak.%s%s", data.Domain, settings.KeycloakBasePath) } From 9edb552a638722ea445f769a8c15b2fa7baa37f1 Mon Sep 17 00:00:00 2001 From: viniciusdc Date: Tue, 12 May 2026 14:17:19 -0300 Subject: [PATCH 5/5] chore(keycloak): pin landing image tags to chart release The nebari-landing chart defaults both frontend.image.tag and webapi.image.tag to "latest". The release workflow tags every published image with the chart version, semver minor, semver major, sha, AND latest, so :latest content floats with every upstream release. Pinning to 0.1.0-alpha.5 here makes the rendered Application reproducible and decouples image churn from chart version. Tracked upstream for a chart-side default fix. --- pkg/argocd/templates/apps/nebari-landingpage.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/pkg/argocd/templates/apps/nebari-landingpage.yaml b/pkg/argocd/templates/apps/nebari-landingpage.yaml index 57878d00..ce9ffa65 100644 --- a/pkg/argocd/templates/apps/nebari-landingpage.yaml +++ b/pkg/argocd/templates/apps/nebari-landingpage.yaml @@ -21,12 +21,19 @@ spec: releaseName: nebari-landing values: | frontend: + # Pin the image tag to the chart release. The chart defaults to + # ":latest", which floats with every upstream release and would + # silently change the running image on the next pod restart. + image: + tag: "0.1.0-alpha.5" keycloak: # External public Keycloak URL - used by the browser for OIDC login. url: "{{ .KeycloakIssuerURL }}" realm: "{{ .KeycloakRealm }}" webapi: + image: + tag: "0.1.0-alpha.5" keycloak: # In-cluster URL for JWK fetching (fast, no TLS hop). url: "{{ .KeycloakServiceURL }}"