refactor(helm): scope resource names by release

[cmdoret]

summary

• define helpers to build resource name for each service
• include release name in all resource names
• gate resources on service toggle

additional changes

• improve debugging vaules
• fix helm template args forwarding in just

[Copilot]

Pull request overview

Scopes Helm-managed resources and references by release name to support multiple releases per namespace.

Changes:

• Prefixes Open WebUI, model, init, and Envoy resource names.
• Updates dependent Secret, Service, backend, and hostname references.
• Adds release-specific workload selectors.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
templates/postgres_secret.yaml	Scopes the PostgreSQL Secret.
templates/openwebui/service.yaml	Scopes the Service and selector.
templates/openwebui/oauth_secret.yaml	Scopes the OAuth Secret.
templates/openwebui/deployment.yaml	Updates selectors and Secret references.
templates/models/network_policy.yaml	Scopes model policy names and selectors.
templates/models/model_secret.yaml	Scopes model Secrets.
templates/models/knative-serving.yaml	Scopes Knative Services and Secret references.
templates/init_job/init_secret.yaml	Scopes the init Secret.
templates/init_job/init_job.yaml	Updates init Job resource references.
templates/envoy/security-policy.yaml	Scopes the JWT policy.
templates/envoy/openwebui-httproute.yaml	Targets the scoped Open WebUI Service.
templates/envoy/client-traffic-policy.yaml	Scopes the client traffic policy.
templates/envoy/backend.yaml	Targets scoped model hostnames.
templates/envoy/backend-traffic-policy.yaml	Scopes the rate-limit policy.
templates/envoy/backend-security-policy.yaml	Scopes backend policies and Secret references.

Suppressed comments (1)

templates/models/knative-serving.yaml:120

• This internal-model branch has the same 63-character Knative Service name limit: a valid 53-character Helm release plus most model keys renders an invalid name. Use the shared, length-safe model name helper here as well so this branch stays aligned with its Secret, Backend hostname, and policies.

  name: {{ $.Release.Name }}-model-{{ $name }}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

templates/openwebui/deployment.yaml:15

• Adding release to spec.selector makes upgrades of an existing release fail because a Deployment's selector is immutable. The pod template can retain the new release label (and the Service can select it) without changing this selector.

      release: {{ .Release.Name }}

templates/init_job/init_job.yaml:54

• The volume was renamed, but it still resolves the old init-secret Secret below. Since the Secret is now created as <release>-init, the hook pod will fail to mount this volume and the init job cannot start.

        - name: {{ .Release.Name }}-init

[Copilot]

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.

Suppressed comments (2)

templates/init_job/init_job.yaml:55

• The Secret was renamed to <release>-init, but this volume still references the old init-secret below. Every install with OpenWebUI enabled will leave the hook pod unable to mount its config Secret; update secretName to match the new resource name.

        - name: {{ .Release.Name }}-init

templates/openwebui/deployment.yaml:15

• This changes the selector of the existing <release>-openwebui Deployment. Deployment selectors are immutable, so helm upgrade from a released chart will fail with spec.selector: Invalid value ... field is immutable. Keep the existing selector and use the release label only on the pod template and Service selector, or migrate to a newly named Deployment.

      release: {{ .Release.Name }}