Empty server.oidc.adminRole/userRole silently enables RBAC instead of authentication-only mode

Open

#3,045 opened on Aug 31, 2026 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 68/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Active
Tech stack: helm, kubernetes, rust, yaml
Domain: authentication, devops, infrastructure

Research direction

Start with values.yaml and the Helm template that conditionally emits admin_role and user_role, then inspect OidcConfig and its default role behavior. Render or install the chart with both role values empty and inspect the generated ConfigMap. Done means the documentation matches the behavior and the chart provides a verified authentication-only deployment method.

Written by the indexing model from the issue text.

Description

state:triage-needed

User Story

As a cluster operator, I want to deploy OpenShell gateway in auth-only mode.

Problem Statement

values.yaml documents authentication-only mode thusly:

    # -- Role name for admin access. Leave empty (with userRole also empty) for
    # authentication-only mode. Both must be set or both empty.
    adminRole: ""
    # -- Role name for standard user access.
    userRole: ""

But the chart guards both keys on truthiness:

{{- if .Values.server.oidc.adminRole }}
admin_role    = {{ .Values.server.oidc.adminRole | quote }}
{{- end }}

so empty strings are omitted from the rendered TOML rather than emitted as "". OidcConfig then applies #[serde(default = "default_admin_role")], restoring openshell-admin / openshell-user. The gateway starts in RBAC mode with the stock role names.

Impact / Why This Matters

The chart provides no way to deploy in auth-only mode and its documentation is misleading.

Acceptance Criteria

Documentation is changed to reflect actual chart behavior.
Method to deploy in auth-only mode is added to the chart.

Reproduction Steps

Install the chart with server.oidc.issuer set and server.oidc.adminRole / server.oidc.userRole left at their "" defaults.
kubectl -n openshell get cm openshell-config -o yaml — the [openshell.gateway.oidc] table contains no admin_role or user_role key.

Environment

OpenShell: 0.0.116 (gateway image and Helm chart)
OS: Talos Linux v1.13.7
Runtime: Kubernetes v1.36.2
Deployment: See https://github.com/jfroy/flatops/blob/main/kubernetes/apps/openshell/openshell/app/helmrelease.yaml

Dominant language: Rust
Stars: 8.7k
Forks: 1.3k
Avg merge: 2d 6h
Merged PRs (30d): 297

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

«Todas» en la barra lateral no hace nada Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

xlCyanz/cantoral#111 · Opened Sep 23, 2026
Codex via fails to launch: "Missing optional dependency @openai/codex-darwin-arm64", no way to reinstall/re-auth from UI Open

state:needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

zed-industries/zed#64680 · 2 comments · Opened Sep 23, 2026
Reflection database: Lighting.LightingStyle and PrioritizeLightingQuality are plugin-writable as of v740 Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

rojo-rbx/rbx-dom#665 · Opened Sep 23, 2026
Potentially sensitive environment variables logged during build Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

RustPython/RustPython#8802 · Opened Sep 23, 2026
[coverage-improver] Cover hard_link::assemble remove_dir_all error branch Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

TheLarkInn/aipm#2390 · Opened Sep 23, 2026

More Rust issues