templates/nebariapp.yaml drops several AuthConfig fields from helm values

[oren-openteams]

Summary

The chart's templates/nebariapp.yaml auth: block passes through some but not all of the operator's AuthConfig fields. Helm values set under nebariapp.auth.* for the missing fields are silently dropped before reaching the NebariApp CR.

The current template renders:

• enabled, provider, provisionClient, redirectURI, scopes
• enforceAtGateway, forwardAccessToken (via hasKey checks — good)
• tokenExchange (via toYaml — good)

Missing relative to the operator's AuthConfig (in api/v1/nebariapp_types.go):

• denyRedirect
• clientSecretRef
• groups
• issuerURL
• spaClient
• deviceFlowClient
• keycloakConfig

This is the best-of-three chart coverage but still leaks the long-tail OIDC fields (group gating, generic-OIDC providers, public SPA clients, device flow, fine-grained Keycloak config) — none of which can be configured from helm values today.

Proposed fix

Same pattern recommended in nebari-nebi-pack#20 — replace the hand-curated subset with a toYaml passthrough, matching the pattern already used for routing: higher in the same template:

{{- with .Values.nebariapp.auth }}
auth:
  {{- toYaml . | nindent 4 }}
{{- end }}

Move the chart-side defaults (enabled: true, provider: keycloak, provisionClient: true, redirectURI: /oauth2/callback) into values.yaml so they still apply.

This eliminates the drift risk: new fields the operator adds to AuthConfig are immediately deployer-controllable without chart updates.

Definition of Done

• templates/nebariapp.yaml renders all nebariapp.auth.* helm values without dropping fields
• Defaults (enabled: true, provider: keycloak, provisionClient: true, redirectURI: /oauth2/callback) preserved via values.yaml
• Helm test asserts each previously-dropped field surfaces on the rendered NebariApp.spec.auth

Related

• nebari-nebi-pack#20 — same pattern, worse coverage gap