From be7138739cf4a36f723e6a15ac1b22150ee5c8af Mon Sep 17 00:00:00 2001 From: Prashanth K Nalubandhu Date: Mon, 6 Jul 2026 17:13:01 -0400 Subject: [PATCH 1/4] Add shared-cluster note to self-managed OpenShift docs On a shared cluster, two W&B installs with the same release name collide on the cluster-scoped -oidc-reviewer ClusterRoleBinding. Add a short note to use a unique release name (plus internalJWTMap and namespaceIsolation). --- platform/hosting/self-managed/operator.mdx | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/platform/hosting/self-managed/operator.mdx b/platform/hosting/self-managed/operator.mdx index a40d197787..a929656714 100644 --- a/platform/hosting/self-managed/operator.mdx +++ b/platform/hosting/self-managed/operator.mdx @@ -330,6 +330,21 @@ After the MCP server is healthy, configure your MCP client to use `https://-oidc-reviewer` ClusterRoleBinding. If two installs use the same release name, the second one fails with an ownership error like: + +```text +ClusterRoleBinding "wandb-oidc-reviewer" ... cannot be imported into the current release: +... annotation validation error: key "meta.helm.sh/release-namespace" must equal ... +``` + +To avoid this on a shared cluster: + +- Use a unique release/CR name for each install (for example `wandb-team-a`, not `wandb`). +- Set `app.internalJWTMap: []` unless you need internal JWT mapping. This skips rendering the `oidc-reviewer` ClusterRoleBinding. +- Install the operator with `namespaceIsolation.enabled=true`. + ### On-premises and bare metal When deploying to on-premises or bare-metal Kubernetes, pay attention to the following. From fcf27235ef0ada94aa9871c65eef7290ac9bdb23 Mon Sep 17 00:00:00 2001 From: Prashanth K Nalubandhu Date: Tue, 7 Jul 2026 10:57:54 -0400 Subject: [PATCH 2/4] Drop namespaceIsolation from shared-cluster remedies MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review feedback: namespaceIsolation doesn't avoid the oidc-reviewer collision — with it on, the operator's namespaced SA can't manage the cluster-scoped binding at all. The working remedies (unique release name, app.internalJWTMap: []) stay. --- platform/hosting/self-managed/operator.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/platform/hosting/self-managed/operator.mdx b/platform/hosting/self-managed/operator.mdx index a929656714..8cf0de6da5 100644 --- a/platform/hosting/self-managed/operator.mdx +++ b/platform/hosting/self-managed/operator.mdx @@ -343,7 +343,6 @@ To avoid this on a shared cluster: - Use a unique release/CR name for each install (for example `wandb-team-a`, not `wandb`). - Set `app.internalJWTMap: []` unless you need internal JWT mapping. This skips rendering the `oidc-reviewer` ClusterRoleBinding. -- Install the operator with `namespaceIsolation.enabled=true`. ### On-premises and bare metal From 8f090e5a2040ff4f2a0a8553791f4bfa5148670c Mon Sep 17 00:00:00 2001 From: John Mulhausen Date: Thu, 9 Jul 2026 12:56:57 -0400 Subject: [PATCH 3/4] Polish added content per Google Developer Style Guide --- platform/hosting/self-managed/operator.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/platform/hosting/self-managed/operator.mdx b/platform/hosting/self-managed/operator.mdx index 8cf0de6da5..cb9fd9f725 100644 --- a/platform/hosting/self-managed/operator.mdx +++ b/platform/hosting/self-managed/operator.mdx @@ -341,7 +341,7 @@ ClusterRoleBinding "wandb-oidc-reviewer" ... cannot be imported into the current To avoid this on a shared cluster: -- Use a unique release/CR name for each install (for example `wandb-team-a`, not `wandb`). +- Use a unique release (CR) name for each install (for example `wandb-team-a`, not `wandb`). - Set `app.internalJWTMap: []` unless you need internal JWT mapping. This skips rendering the `oidc-reviewer` ClusterRoleBinding. ### On-premises and bare metal From 0dd92247c8913dbd2f2f231a23aa90bebe648d71 Mon Sep 17 00:00:00 2001 From: pnalubandhu Date: Thu, 9 Jul 2026 18:32:05 -0400 Subject: [PATCH 4/4] docs(openshift): scope internalJWTMap remedy to native-Kubernetes-OIDC on-prem --- platform/hosting/self-managed/operator.mdx | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/platform/hosting/self-managed/operator.mdx b/platform/hosting/self-managed/operator.mdx index cb9fd9f725..4fb5760192 100644 --- a/platform/hosting/self-managed/operator.mdx +++ b/platform/hosting/self-managed/operator.mdx @@ -342,7 +342,7 @@ ClusterRoleBinding "wandb-oidc-reviewer" ... cannot be imported into the current To avoid this on a shared cluster: - Use a unique release (CR) name for each install (for example `wandb-team-a`, not `wandb`). -- Set `app.internalJWTMap: []` unless you need internal JWT mapping. This skips rendering the `oidc-reviewer` ClusterRoleBinding. +- Set `app.internalJWTMap: []` unless you need internal JWT mapping, such as native-Kubernetes-OIDC on-premises installs that rely on the `oidc-reviewer` binding. This skips rendering the `oidc-reviewer` ClusterRoleBinding. ### On-premises and bare metal @@ -1253,13 +1253,13 @@ Self-Managed deployments that use an external ClickHouse cluster must verify Cli ### Unsupported ClickHouse versions -W&B Self-Managed deployments using W&B Weave or Models OLAP features require a supported version of both ClickHouse Server and ClickHouse Keeper. - -- Weave does not work with ClickHouse 26.1 or 26.2. -- The Models OLAP features described in the next section require ClickHouse 26.2+. -- Deployments using both Weave and Models OLAP features require ClickHouse 26.3. - -If your W&B Self-Managed deployment uses neither Weave nor Models OLAP features, ClickHouse is not required. +W&B Self-Managed deployments using W&B Weave or Models OLAP features require a supported version of both ClickHouse Server and ClickHouse Keeper. + +- Weave does not work with ClickHouse 26.1 or 26.2. +- The Models OLAP features described in the next section require ClickHouse 26.2+. +- Deployments using both Weave and Models OLAP features require ClickHouse 26.3. + +If your W&B Self-Managed deployment uses neither Weave nor Models OLAP features, ClickHouse is not required. ### Models OLAP features