Skip to content

Open WebUI

Personal Open WebUI chat for one person behind the OpenShift login, with models from an OpenAI-compatible gateway
Chart openwebui
Version 0.3.2
Application version 0.12.3
Kind Application
Source charts/openwebui

The values are listed under Values, the changes per version under Changelog.

Purpose

Runs one personal Open WebUI chat for one person in your project. The person logs in with their OpenShift account and lands in Open WebUI as its admin; nobody else is admitted. Without an owner, everyone who may edit the project logs in, and the first one becomes admin. Models come from an OpenAI-compatible gateway (gateway.upstream), which the instance calls with its own ServiceAccount token, so no API key is stored anywhere.

One pod holds three containers:

  • team (default: empty): Team of the tenant the app serves. Every object goes into <tenant>-<team>, a namespace the team already has; Argo CD's destination namespace stays empty. Empty: the release namespace.
  • tenant (default: empty): Tenant the app belongs to; required with team.
  • openwebui listens on 127.0.0.1:8080 only, so nothing reaches it except through the login proxy;
  • oauth-proxy (OpenShift oauth-proxy) logs the person in through the cluster OAuth server with the instance ServiceAccount as OAuth client and passes the user's email in X-Forwarded-Email, which Open WebUI trusts for its own login (WEBUI_AUTH_TRUSTED_EMAIL_HEADER); the proxy replaces any such header a client sends;
  • token-proxy on 127.0.0.1:8099 adds the projected ServiceAccount token to every model call to gateway.upstream. Open WebUI points at http://127.0.0.1:8099/v1 with a placeholder key.

Choices:

  • Signup is off and the first user is the admin: the owner, the only email the proxy admits.
  • Chats, uploads, settings (SQLite) and the embedding model cache live on one volume. The Deployment uses strategy: Recreate, so the old pod stops before the new one starts and the volume can be ReadWriteOnce.
  • Ollama, telemetry and the version check are off.
  • With openwebui.persistentConfig (default true), settings the owner changes in the admin panel survive restarts and win over the values of this chart after the first start.

Install

helm repo add grncloud https://apps.openshift.eu
helm install sam grncloud/openwebui \
  --set person.email=sam@example.com \
  --set 'oauth.allowedGroups={team-admins}' \
  --set route.host=chat-sam.apps.example.com \
  --set gateway.upstream=https://api.example.com

Objects are named <person.name>-openwebui. Read the address:

oc get route sam-openwebui -o jsonpath='https://{.spec.host}{"\n"}'
  • person.name (default: the release name): Name prefix of the objects.
  • person.email (default: empty): OpenShift user name (an email) of the owner.
  • oauth.ownerEmail (default: person.email): The only user admitted. Empty: oauth.allowedGroups; both empty: everyone who may edit the project.
  • oauth.allowedGroups (default: empty): OpenShift groups admitted. Only their members log in: the chart grants them the verb login on services/proxy of the Service, which admin and edit do not hold, and the login proxy checks that permission. With an owner, the owner must also be in one of them.
  • oauth.loginClusterRole (default: empty): ClusterRole holding the verb login on services/proxy; oauth.allowedGroups are bound to it instead of to the chart's own Role. Creating a Role or binding that grants login needs that permission, or bind on the ClusterRole: an installer without it (a project admin, the project's Argo CD) needs this value.
  • route.host (default: empty): Hostname. Empty: OpenShift assigns one. Set it at install; a tenant cannot change the hostname of an existing Route. Also sets WEBUI_URL.
  • route.labels, route.timeout (default: empty, 3600s), route.annotations (default: cert-manager issuer, used when route.host is set).
  • gateway.upstream (default: empty): OpenAI-compatible gateway; Open WebUI calls <upstream>/v1. Required for models.
  • gateway.audience (default: the host of gateway.upstream): Audience of the ServiceAccount token, mounted at /var/run/secrets/api-token/token.
  • tokenProxy.agentToken.tokenUrl (default: empty): Token endpoint of an OpenID Connect realm. Calls under tokenProxy.agentToken.paths (default /mcp) then carry the instance's own token from a client_credentials grant, authenticated with a ServiceAccount token for tokenProxy.agentToken.audience (federated client authentication, no stored secret); model calls keep the ServiceAccount token.
  • serviceAccount.labels (default: empty): Labels on the instance's ServiceAccount, for example the one a platform uses to register it as a client of that realm.
  • openwebui.image (default: ghcr.io/open-webui/open-webui:v0.12.3), openwebui.title (default: empty), openwebui.persistentConfig (default: true).
  • openwebui.env (default: empty): Extra Open WebUI environment variables, name to value; they override the chart's.
  • openwebui.resources (default: 100m CPU and 2Gi requested, 4 CPU and 16Gi limit).
  • secrets.cookieSecret, secrets.secretKey (default: empty): Login cookie key and Open WebUI session key, generated once and kept on upgrade.
  • secrets.type (default: kubernetes): externalSecret reads both from a secret store.
  • storage.size, storage.accessMode, storage.className (default: 10Gi, ReadWriteOnce, the default class): The data volume. It is kept when the release is removed.
  • oauthProxy.image (default: openshift/oauth-proxy:v4.4 from the cluster registry): OpenShift keeps that image stream tag current.
  • networkPolicy.enabled (default: true): Admits the login proxy from the router only.

Delivery instructions

  • People log in through the cluster's OAuth server with their OpenShift account; no login client is needed. The owner's OpenShift user name must be an email address (oc whoami after a console login) and equal oauth.ownerEmail.
  • The gateway in gateway.upstream must accept ServiceAccount tokens of your project with the audience gateway.audience and answer the OpenAI API under /v1.
  • The first start downloads the embedding model for document search (about 100 MB) from Hugging Face; the pod needs outbound HTTPS. Later starts read it from the volume.
  • Open WebUI keeps SQLite on the volume: a block storage class suits it best. ReadWriteMany works too.
  • With secrets.type=externalSecret, set secrets.externalSecret.storeName and create one vault item per secret, named <person.name>-openwebui-<cookie-secret, secret-key> or as set in secrets.externalSecret.items, with the value in the password field. The cookie secret item must hold 16, 24 or 32 characters.
  • Sign out in Open WebUI redirects to the login proxy's /oauth/sign_out, which clears the proxy cookie.