openwebui changelog¶
0.3.2¶
Released 2026-10-25.
Changes¶
Room for an agent at work¶
The openwebui container now requests 100m CPU and 2Gi and is limited to 4 CPU and 16Gi, so a busy agent is neither killed for memory nor throttled hard. The sizes follow measured usage of the agents on the platform with generous headroom. The proxy sidecars may use 256Mi instead of 128Mi.
0.3.1¶
Released 2026-10-25.
Changes¶
Token proxy: agent identity through the tenant realm¶
The token proxy copy follows images/agent-identity/token-proxy.py. With AGENT_TOKEN_VIA_URL set, the agent first gets a token from its tenant's own realm with its ServiceAccount token, and that token is the client assertion for the shared realm. Without the variable nothing changes.
0.3.0¶
Released 2026-10-25.
Changes¶
Apps of a team¶
team and tenant put every object of the chart into <tenant>-<team>, the
namespace of the tenant's team, so an app ordered for a team runs next to the
team's agents and MCP servers. Without team the chart renders into the release
namespace as before.
0.2.4¶
Released 2026-10-25.
Changes¶
The agent's own token for MCP servers¶
The token proxy can carry the instance's own OpenID Connect token on MCP calls. With tokenProxy.agentToken.tokenUrl set, calls under tokenProxy.agentToken.paths (default /mcp) get a token from a client_credentials grant at that endpoint, authenticated with a short-lived ServiceAccount token for tokenProxy.agentToken.audience (federated client authentication). No secret is stored; the token is kept until shortly before it expires. Model calls keep the ServiceAccount token. serviceAccount.labels puts labels on the ServiceAccount, for example the one a platform uses to register it as a client of the realm.
Upgrade¶
Nothing changes until tokenProxy.agentToken.tokenUrl is set. The pod restarts once, because the token proxy script changed.
0.2.3¶
Released 2026-10-24.
Changes¶
Logins without an owner¶
Without an owner the chart passed an empty email domain, which oauth-proxy reads as a domain no address matches, so a group or project-editor instance let nobody in. It now passes --email-domain=* and the SubjectAccessReview decides who logs in. Owner instances render the same object.
0.2.2¶
Released 2026-10-22.
Changes¶
Bind login groups to a ClusterRole¶
Kubernetes refuses a Role that grants permissions the creator does not
hold. A project admin, and the project's Argo CD with admin, do not hold
the verb login, so the group lockdown of 0.1.2, 0.3.5 and 0.2.1 failed
to sync for them ("attempting to grant RBAC permissions not currently
held"). oauth.loginClusterRole names a ClusterRole holding that verb;
allowedGroups are bound to it in a RoleBinding
0.2.1¶
Released 2026-10-22.
Changes¶
openhands 0.1.2 (Agent Canvas 1.30.0), owner or group login lockdown (#34)¶
Agent Canvas 1.30.0 binds the frontend through STATIC_SERVER_BIND_HOST instead of a literal --host ::, so the loopback patch rewrites both assignments (the build still asserts two hits). The volume claim template drops the version label: Kubernetes refuses any change there, so every appVersion bump failed the StatefulSet update. A cookie secret that is not 16, 24 or 32 characters long is hashed to 32, as in opencode-agent and openwebui, so a 48-character generated value works.
opencode-agent 0.3.5 and openwebui 0.2.1: with neither oauth.ownerEmail nor person.email set, the login proxy drops the emails file and admits everyone who may get services/proxy on the UI Service, which admin and edit grant. A team instance from a managed Template needs no e-mail. Open WebUI then allows sign-up with role user; the first user is admin. With an owner set the render is unchanged.
Every chart now offers two lockdowns. oauth.ownerEmail admits that one user (emails file). oauth.allowedGroups admits only members of those groups: the login Role grants the verb login on services/proxy of the UI Service and the login proxy checks that verb. The previous check, get on services/proxy, is also held by admin and edit, so any project editor passed a group lockdown. With neither set, project editors log in. openhands gains oauth.ownerEmail.
Verified on berry-ai with the authorization.openshift.io SAR the proxy sends: a grncloud-engineering member is allowed login, a grncloud-admins project admin and an outsider are refused, the same admin is allowed get.
The group lockdown checks the verb login, which only the login Role grants; the tests asserted the previous verb get.
0.2.0¶
Released 2026-10-21.
Changes¶
openwebui 0.2.0 with MCP tools, terminal and Jupyter (#29)¶
mcp.enabled offers the gateway's MCP endpoints (the namespace's team endpoint and public) as tool servers to every user, through the token proxy that adds the instance's ServiceAccount token. workbench runs Open Terminal and a Jupyter server as sidecars on 127.0.0.1 from an image that holds the CLIs, with HOME on the data volume, as the terminal and the code execution engine.
Open WebUI reads its terminal connection once at startup and found the terminal sidecar not yet listening. The workbench containers now run as native sidecars (init containers with restartPolicy Always), which are started and ready before the main containers.
0.1.1¶
Released 2026-10-21.
Changes¶
opencode-agent 0.3.3 sends no body on 204 and 304 (#26)¶
The UI and token proxies framed every response without a length as chunked, including 204 and 304, and wrote the closing chunk after them. Those responses have no body, so oauth-proxy read the stray chunk as the start of the next response and failed that request: the web UI showed no providers. Responses without a body now go out without chunked framing.
openwebui carries the same token proxy as opencode-agent and CI requires the copies to match. A regression test covers 204 and 304 on a reused connection.
0.1.0¶
Released 2026-10-20.
Changes¶
Add chart openwebui (#11)¶
One personal Open WebUI per release behind the OpenShift oauth-proxy, trusting the proxy's email header, with models through the same ServiceAccount token proxy as opencode-agent.