From 34701e8d2f3a45851be7ad090b8cfe1cbea910c4 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Date: Wed, 11 Mar 2026 22:02:05 +0100 Subject: [PATCH] fix(chart): resolve Dex OIDC issuer URL mismatch in development mode When installing with --set development=true, the controlplane panics because the OIDC issuer URL doesn't match what Dex reports (chainloop-dex-dex vs chainloop-dex). Remove redundant -dex suffix from the Dex external URL template and fix the parent chart's dexContext to use a synthetic chart name so common.names.fullname resolves correctly. Fixes #2837 Signed-off-by: Miguel Martinez Entire-Checkpoint: 07412b504e7d --- CLAUDE.md | 1 + deployment/chainloop/Chart.yaml | 2 +- deployment/chainloop/charts/dex/templates/_helpers.tpl | 2 +- deployment/chainloop/templates/_helpers.tpl | 3 ++- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 393941a9f..a700ce226 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -271,3 +271,4 @@ Code reviews are required for all submissions via GitHub pull requests. - when creating a commit or PR message, NEVER add co-authored by or generated by Claude code - any call to authorization Enforce done from the biz or svc layer must be done using biz.AuthzUseCase - if you modify a schema, remember to run `make migration_sync` +- after changing Helm chart source code (`deployment/chainloop/`), bump the **patch** version (not minor, not major) in the chart's `Chart.yaml` diff --git a/deployment/chainloop/Chart.yaml b/deployment/chainloop/Chart.yaml index 84e2ad4c1..3c853632f 100644 --- a/deployment/chainloop/Chart.yaml +++ b/deployment/chainloop/Chart.yaml @@ -7,7 +7,7 @@ description: Chainloop is an open source software supply chain control plane, a type: application # Bump the patch (not minor, not major) version on each change in the Chart Source code -version: 1.342.0 +version: 1.342.1 # Do not update appVersion, this is handled automatically by the release process appVersion: v1.81.2 diff --git a/deployment/chainloop/charts/dex/templates/_helpers.tpl b/deployment/chainloop/charts/dex/templates/_helpers.tpl index 7a231f980..c4b33c818 100644 --- a/deployment/chainloop/charts/dex/templates/_helpers.tpl +++ b/deployment/chainloop/charts/dex/templates/_helpers.tpl @@ -49,7 +49,7 @@ Figure out the external URL for Dex service {{- else if (and (eq $service.type "NodePort") $service.nodePorts (not (empty $service.nodePorts.http))) }} {{- printf "http://localhost:%s" $service.nodePorts.http }} {{- else -}} -{{- printf "http://%s-dex:%d/dex" ( include "chainloop.dex.fullname" . ) ( int $service.ports.http ) }} +{{- printf "http://%s:%d/dex" ( include "chainloop.dex.fullname" . ) ( int $service.ports.http ) }} {{- end -}} {{- end -}} diff --git a/deployment/chainloop/templates/_helpers.tpl b/deployment/chainloop/templates/_helpers.tpl index 162e24d12..37447d265 100644 --- a/deployment/chainloop/templates/_helpers.tpl +++ b/deployment/chainloop/templates/_helpers.tpl @@ -183,7 +183,8 @@ OIDC settings, will fallback to development settings if needed {{- define "controlplane.oidc_settings" -}} {{- if .Values.development }} {{- with .Values.controlplane.auth }} - {{- $dexContext := dict "Values" $.Values.dex "Chart" $.Chart "Release" $.Release "Capabilities" $.Capabilities "Template" $.Template }} + {{- $dexChart := dict "Name" "dex" }} + {{- $dexContext := dict "Values" $.Values.dex "Chart" $dexChart "Release" $.Release "Capabilities" $.Capabilities "Template" $.Template }} domain: "{{ coalesce .oidc.url (include "chainloop.dex.external_url" $dexContext ) }}" client_id: "{{ coalesce .oidc.clientID "chainloop-dev" }}" client_secret: "{{ coalesce .oidc.clientSecret "ZXhhbXBsZS1hcHAtc2VjcmV0" }}"