feat(identity): add identity service to selfhosted controlplane chart by jmonty42 · Pull Request #346 · unionai/helm-charts

jmonty42 · 2026-04-17T21:17:24Z

Overview

Adds the `identity` service to the selfhosted controlplane Helm chart, enabling the User Management page for selfhosted deployments.

The service defaults to `provider: noop` (returns empty results, no external system required). To enable Azure/Entra ID user management, set `provider: azure` and configure the `azure` block with tenant ID, client ID, and a secret reference.

The client secret is read from the mounted K8s secret (`KUBERNETES_SECRET_NAME`) at runtime via `clientSecretName` — never stored in config.

Linked cloud PR: unionai/cloud#15155 (Azure/Entra ID identity provider backend)

What Mike's refactor (#348–353) covered vs. what this PR still adds

Mike's stack added the organizations service (distinct from identity), ingress identity header forwarding, OIDC globals consolidation, and shrank overlays to cloud-specific-only config. The identity service is not included in that stack — this PR remains the sole source of it.

One rebase decision: the executions: GCP overlay block that was in an earlier version of this PR was dropped. Mike's #352 established that overlays should contain only cloud-specific items (IAM, storage, region); the base values.yaml default (flyteadmin.{{ .Release.Namespace }}.svc.cluster.local:81) is correct for GCP intra-cluster.

Customer-Facing Change Log

Selfhosted deployments now include the identity service, enabling the User Management page. Default provider is noop (no impact on existing deployments). Azure/Entra ID provider can be enabled via services.identity.configMap.identity.app.identityProviderConfig.

Test Plan (required)

make generate-expected && make test passes (snapshots regenerated on top of Add selfhosted authorizer defaults and dashboard fixes #348–353)
Deploy to monty-selfhosted staging with provider: azure and verify User Management page lists Entra ID users

Rollout Plan (required)

Chart change only — no infrastructure changes. Existing selfhosted deployments get the identity service pod on next ArgoCD sync. The noop default means no behavior change until provider is explicitly set.

Rollback Plan (required)

Set services.identity.disabled: true in values overlay to skip the identity service deployment.

Issue

ref unionai/cloud#15155

Stack

main
- feat(identity): add identity service to selfhosted controlplane chart 👈

aviator-app · 2026-04-17T21:17:29Z

Current Aviator status

Aviator will automatically update this comment as the status of the PR changes.
Comment /aviator refresh to force Aviator to re-examine your PR (or learn about other /aviator commands).

This pull request is currently open (not queued).

How to merge

To merge this PR, comment /aviator merge or add the mergequeue label.

See the real-time status of this PR on the Aviator webapp.

Use the Aviator Chrome Extension to see the status of your PR within GitHub.

Copilot

Pull request overview

Adds an identity service to the selfhosted controlplane Helm chart so selfhosted deployments can enable the User Management page (defaulting to a no-op provider).

Changes:

Adds services.identity defaults/config to the controlplane chart values.
Updates generated Helm snapshot manifests to include identity resources (PDB, ServiceAccount, ConfigMap, Service, Deployment, HPA) across multiple test fixtures.

Reviewed changes

Copilot reviewed 1 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
charts/controlplane/values.yaml	Introduces `services.identity` configuration (provider defaults + adminClient wiring).
tests/generated/controlplane.userclouds.yaml	Updates rendered manifests snapshot to include identity resources.
tests/generated/controlplane.external-authz.yaml	Updates rendered manifests snapshot to include identity resources.
tests/generated/controlplane.aws.yaml	Updates rendered manifests snapshot to include identity resources.
tests/generated/controlplane.aws.billing-enable.yaml	Updates rendered manifests snapshot to include identity resources.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Add service override to suppress dangling connect port (83) that would have targeted a non-existent named container port - Fix azure clientSecretName example: remove erroneous union/ prefix (K8s secret keys cannot contain slashes) - Remove FLYTEADMIN_ENDPOINT reference from base values; endpoint is environment-specific and should be set via overlay values Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ues file Documents how to configure the identity service with provider: azure when using Entra ID, using outputs from the authn/entraid Terraform module. Includes an extraObjectsOverrides ExternalSecret example to merge the Graph API client secret from GCP Secret Manager into the shared K8s secret. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Add service override to suppress dangling connect port (83) that would have targeted a non-existent named container port - Fix azure clientSecretName example: remove erroneous union/ prefix (K8s secret keys cannot contain slashes) - Remove FLYTEADMIN_ENDPOINT reference from base values; endpoint is environment-specific and should be set via overlay values Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Snapshots updated to reflect Mike's PRs #348-#353 (base values consolidation, organizations service, OIDC globals) plus the identity service defaults from this PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…e-selfhosted

…n slashes

…e-selfhosted

The identity service registers both gRPC and Connect hooks. Both defaulted to port 8080 causing a bind conflict on startup. Add sharedService.connectPort: 8081 to move the Connect server to 8081. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…e-selfhosted

The upstream flyte-core chart doesn't render the `private` config section into a separate YAML file. This adds a new ConfigMap template that renders `.Values.flyte.configmap.adminServer.private` into `private.yaml` and mounts it at `/etc/flyte/config/private.yaml` via additionalVolumeMounts. This enables flyteadmin-private config like `logoutUrl` and `supportsTokenRevocation` to be read from Helm values rather than requiring changes to the flyte-core subchart. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…e-selfhosted

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Mount private-config to /etc/flyte/private/ instead of attempting a subPath mount into /etc/flyte/config/ which conflicts with the existing clusters-config-volume projected mount. Update configPath to /etc/flyte/*/*.yaml to include both config directories. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

…e-selfhosted

jmonty42 requested a review from Copilot April 17, 2026 21:21

Copilot started reviewing on behalf of jmonty42 April 17, 2026 21:22 View session

Copilot AI reviewed Apr 17, 2026

View reviewed changes

Comment thread charts/controlplane/values.yaml

Comment thread charts/controlplane/values.yaml

Comment thread charts/controlplane/values.yaml

jmonty42 mentioned this pull request Apr 20, 2026

Consolidate auth config into base values.yaml #351

Merged

4 tasks

jmonty42 and others added 4 commits April 21, 2026 10:55

feat(identity): add identity service to selfhosted controlplane chart

4d38852

test(identity): regenerate snapshots after rebase onto main

321b997

Snapshots updated to reflect Mike's PRs #348-#353 (base values consolidation, organizations service, OIDC globals) plus the identity service defaults from this PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

jmonty42 force-pushed the monty/identity-service-selfhosted branch from 40867ce to 321b997 Compare April 21, 2026 18:36

jmonty42 and others added 14 commits April 21, 2026 12:44

Replacing a comment that Claude deleted

0248377

Merge remote-tracking branch 'origin/main' into monty/identity-servic…

c6f1218

…e-selfhosted

Merge remote-tracking branch 'origin/main' into monty/identity-servic…

8d57dfb

…e-selfhosted

Regenerate expected test output for 2026.4.9

200e1c2

fix(identity): correct clientSecretName example — key must not contai…

f3d4ba2

…n slashes

Merge remote-tracking branch 'origin/main' into monty/identity-servic…

6e11628

…e-selfhosted

feat(identity): enable identity cache by default

7cd2e7a

Merge remote-tracking branch 'origin/main' into monty/identity-servic…

e60a549

…e-selfhosted

Merge remote-tracking branch 'origin/main' into monty/identity-servic…

6659dfd

…e-selfhosted

Regenerate test snapshots after main merge

3f291d7

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/main' into monty/identity-servic…

c138e37

…e-selfhosted

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(identity): add identity service to selfhosted controlplane chart#346

feat(identity): add identity service to selfhosted controlplane chart#346
jmonty42 wants to merge 18 commits intomainfrom
monty/identity-service-selfhosted

jmonty42 commented Apr 17, 2026 •

edited

Loading

Uh oh!

aviator-app Bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jmonty42 commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

What Mike's refactor (#348–353) covered vs. what this PR still adds

Customer-Facing Change Log

Test Plan (required)

Rollout Plan (required)

Rollback Plan (required)

Issue

Stack

Uh oh!

aviator-app Bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Current Aviator status

How to merge

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jmonty42 commented Apr 17, 2026 •

edited

Loading

aviator-app Bot commented Apr 17, 2026 •

edited

Loading