feat(helm): gate OpenShift UI Route behind ui.route.enabled

[davidkarlsen]

Problem

The OpenShift Route for the kagent UI (helm/kagent/templates/openshift-route.yaml) renders unconditionally whenever the route.openshift.io/v1 API is present — the only guard is the CRD-existence check. There is no value to turn it off.

As raised in #2028, this means that on OpenShift the UI is effectively always exposed via an edge-terminated Route straight to kagent-ui:8080, with no auth in front. Users who want to front the UI with the bundled oauth2-proxy subchart, a custom Route, or their own ingress have no supported way to stop the chart from also publishing this unauthenticated Route.

Fix

• Add a ui.route.enabled value (default true to preserve current behavior — existing OpenShift users must not silently lose the Route on upgrade).

• AND it with the existing CRD-presence check, so the Route stays a no-op off-OpenShift and can now be disabled on OpenShift:

  {{- if and (.Capabilities.APIVersions.Has "route.openshift.io/v1") .Values.ui.route.enabled }}
  

No other behavior changes.

Verification (helm template)

Scenario	kind: Route rendered
--api-versions route.openshift.io/v1 (default)	✅ present
--api-versions route.openshift.io/v1 --set ui.route.enabled=false	❌ absent
no --api-versions (CRD guard)	❌ absent

Fixes #2028

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a Helm value flag to gate creation of an OpenShift Route for the UI, and wires that flag into the OpenShift Route template so it only renders when enabled and the API is available.

Changes:

• Introduces ui.route.enabled in chart values (default true) with documentation.
• Updates the OpenShift Route template to require both the OpenShift Route API and ui.route.enabled.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
helm/kagent/values.yaml	Adds ui.route.enabled configuration and documentation for gating the UI OpenShift Route.
helm/kagent/templates/openshift-route.yaml	Gates rendering of the Route resource on both API availability and the new values flag.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mesutoezdil]

1 gap: there is no openshift-route_test.yaml in helm/kagent/tests/. A unit test covering the ui.route.enabled=false case (and ideally the enabled + API present case) would make the guard verifiable without a live cluster. The other files in that directory show the pattern.

[davidkarlsen]

1 gap: there is no openshift-route_test.yaml in helm/kagent/tests/. A unit test covering the ui.route.enabled=false case (and ideally the enabled + API present case) would make the guard verifiable without a live cluster. The other files in that directory show the pattern.

thanks for the review - didn't realize there were tests there - added now!

[EItanya]

Hey there @davidkarlsen, you will need to sign your commits to pass DCO, you can check the job for more info

[davidkarlsen]

Hey there @davidkarlsen, you will need to sign your commits to pass DCO, you can check the job for more info

fixed