[GH-ISSUE #323] feature request: Ability to pass clientId as environment variable #108

New issue

Closed

opened 2026-10-18 21:06:07 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-18 21:06:07 +00:00

Owner

Originally created by @perpective2410 on GitHub (Dec 11, 2025).
Original GitHub issue: https://github.com/open-webui/helm-charts/issues/323

Can we please support getting the clientId from a kubernetes secret? WIth the following configuration, it will say that clientId is already passed (which is normal, see source)

Suggested configuration:

  extraEnvVars:
    - name: OAUTH_CLIENT_ID
      valueFrom:
        secretKeyRef:
          name: openwebui-sso-client-id
          key: clientID

Alternatively

clientIdExistingSecret: "openwebui-sso-client-id"
clientIdExistingKey: "clientId"

Many thanks

Originally created by @perpective2410 on GitHub (Dec 11, 2025). Original GitHub issue: https://github.com/open-webui/helm-charts/issues/323 Can we please support getting the clientId from a kubernetes secret? WIth the following configuration, it will say that clientId is already passed (which is normal, see [source](https://github.com/open-webui/helm-charts/blob/7820447a8ea0ea0b97876c29d461186e95125646/charts/open-webui/templates/workload-manager.yaml#L322)) Suggested configuration: ``` extraEnvVars: - name: OAUTH_CLIENT_ID valueFrom: secretKeyRef: name: openwebui-sso-client-id key: clientID ``` Alternatively ``` clientIdExistingSecret: "openwebui-sso-client-id" clientIdExistingKey: "clientId" ``` Many thanks

bsakaguchi closed this issue

2026-10-18 21:06:07 +00:00

bsakaguchi commented

2026-10-18 21:06:08 +00:00

Author

Owner

@james-westbrook commented on GitHub (Dec 11, 2025):

Hi @perpective2410, are you saying that using the suggested configuration you provided fails when .Values.sso.oidc.enabled is set to true?

@james-westbrook commented on GitHub (Dec 11, 2025): Hi @perpective2410, are you saying that using the suggested configuration you provided fails when `.Values.sso.oidc.enabled` is set to true?

bsakaguchi commented

2026-10-18 21:06:08 +00:00

Author

Owner

@perpective2410 commented on GitHub (Dec 11, 2025):

Sorry, it is not what I meant

At the moment, we can only provide the clientId statically as a string in the value. It would be good if we could also provide it as a kubernetes secret.
We create the app registration with Terraform. The clientId is then injected into azure keyvault. External secret sync from kv to kubernetes secret.

I've suggested two ways we could pass this as kubernetes secret. The first one fails because it's already passing OAUTH_CLIENT_ID.
The second one is suggestion for implementation

@perpective2410 commented on GitHub (Dec 11, 2025): Sorry, it is not what I meant At the moment, we can only provide the clientId statically as a string in the value. It would be good if we could also provide it as a kubernetes secret. We create the app registration with Terraform. The clientId is then injected into azure keyvault. External secret sync from kv to kubernetes secret. I've suggested two ways we could pass this as kubernetes secret. The first one fails because it's already passing OAUTH_CLIENT_ID. The second one is suggestion for implementation

bsakaguchi commented

2026-10-18 21:06:08 +00:00

Author

Owner

@james-westbrook commented on GitHub (Apr 8, 2026):

This capability exists now: https://github.com/open-webui/helm-charts/blob/main/charts/open-webui/templates/workload-manager.yaml#L349

@james-westbrook commented on GitHub (Apr 8, 2026): This capability exists now: https://github.com/open-webui/helm-charts/blob/main/charts/open-webui/templates/workload-manager.yaml#L349

bsakaguchi referenced this issue

2026-10-18 21:07:10 +00:00

[PR #109] [MERGED] fix: make copy-app-data resource quotas configurable #204

No Branch/Tag specified