Add support for the namespaces feature#331
Open
jfrancoa wants to merge 2 commits into
Open
Conversation
- Introduce a top-level `namespaces.enabled` flag (default false). When enabled, the statefulset sets `NAMESPACES_ENABLED=true` and `DISABLE_GRAPHQL=true`, since the server rejects startup if these two are not aligned. - Surface the OIDC claim fields needed for namespace-aware identities (`namespace_claim`, `global_principal_claim`, `skip_client_id_check`) as commented-out entries under `authentication.oidc`, rendered into the weaviate-config ConfigMap when set. - Add chart tests covering: defaults (envs absent), explicit `namespaces.enabled=false`, `namespaces.enabled=true` (both envs rendered), the namespaces + apikey + RBAC combination, and the OIDC claim fields propagating into the ConfigMap. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
![orca-security-eu[bot]](https://avatars.githubusercontent.com/in/276244?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Secrets |  0  0  0  0 |
View in Orca |
The core server fatals at startup when NAMESPACES_ENABLED=true unless REPLICATION_MAXIMUM_FACTOR=1. Pin it alongside DISABLE_GRAPHQL in the namespaces block (after the generic env loop so it overrides any user-supplied value) and add test coverage. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds an opt-in Helm chart toggle for Weaviate’s namespaces feature, ensuring the server-required environment variables are rendered together, and extends CI templating tests to cover the new behavior and related auth config propagation.
Changes:
- Introduces
namespaces.enabled(defaultfalse) invalues.yaml. - When enabled, the StatefulSet renders
NAMESPACES_ENABLED=true,DISABLE_GRAPHQL=true, andREPLICATION_MAXIMUM_FACTOR=1. - Extends
.cicd/test.shwith template assertions for defaults, enabled/disabled cases, override behavior, and OIDC claim passthrough.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
weaviate/values.yaml |
Adds namespaces.enabled and documents additional OIDC claim fields in values. |
weaviate/templates/weaviateStatefulset.yaml |
Conditionally injects namespaces-required env vars into the Weaviate container spec. |
.cicd/test.sh |
Adds Helm template tests for namespaces env rendering and OIDC claim propagation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+515
to
+521
| {{- if index .Values "namespaces" "enabled" }} | ||
| - name: NAMESPACES_ENABLED | ||
| value: "true" | ||
| - name: DISABLE_GRAPHQL | ||
| value: "true" | ||
| - name: REPLICATION_MAXIMUM_FACTOR | ||
| value: "1" |
Comment on lines
+467
to
+469
| # The pinned REPLICATION_MAXIMUM_FACTOR=1 is rendered after the generic env loop, so it overrides | ||
| # any user-supplied env.REPLICATION_MAXIMUM_FACTOR (Kubernetes keeps the last duplicate env entry). | ||
| check_setting_has_value "--set namespaces.enabled=true --set env.REPLICATION_MAXIMUM_FACTOR=3" "name: REPLICATION_MAXIMUM_FACTOR" "value: \"1\"" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
namespaces.enabledflag (defaultfalse). When enabled, the statefulset emitsNAMESPACES_ENABLED=true,DISABLE_GRAPHQL=true, andREPLICATION_MAXIMUM_FACTOR=1together — Weaviate refuses to start (fatal) unless all three are aligned withNAMESPACES_ENABLED.REPLICATION_MAXIMUM_FACTOR=1is a hard server precondition, not a tunable, so it is pinned in the chart rather than exposed as a configurable value (a value other than1would crash every pod when namespaces is on).namespace_claim,global_principal_claim,skip_client_id_check) as commented-out entries underauthentication.oidc. They flow throughtoYaml .Values.authenticationinto theweaviate-configConfigMap when set.namespaces.enabled=false,namespaces.enabled=true(all three envs rendered), theREPLICATION_MAXIMUM_FACTORoverride case, namespaces + apikey + RBAC end-to-end, and OIDC claim propagation into the ConfigMap.Notes for reviewers
env.*loop inweaviateStatefulset.yaml, so user combinations like--set namespaces.enabled=true --set env.DISABLE_GRAPHQL=falseor--set env.REPLICATION_MAXIMUM_FACTOR=3still end up with the server-required values (last-value-wins: runc dedupes duplicate env vars keeping the last occurrence), matching the server's invariant.Test plan
bash .cicd/test.shpasses locally (exit 0, "Tests successful."), including the namespaces +REPLICATION_MAXIMUM_FACTORassertions.helm template . --set namespaces.enabled=trueshows all three required envs.helm template . --set namespaces.enabled=true --set env.REPLICATION_MAXIMUM_FACTOR=3renders the pinnedREPLICATION_MAXIMUM_FACTOR=1last, overriding the user value.helm template . --set authentication.oidc.namespace_claim=... --set authentication.oidc.global_principal_claim=...renders the claim fields into the ConfigMap.🤖 Generated with Claude Code