fix(helm): add missing azure_key_config fields to schema

[axelray-dev]

Summary

The Helm chart's values.schema.json is missing four fields in the azure_key_config object that exist in the Go AzureKeyConfig struct. This causes Helm schema validation to reject valid Azure configurations that include client_id, client_secret, tenant_id, or scopes.

Changes

Added the following fields to azure_key_config in helm-charts/bifrost/values.schema.json (both $defs.providerKey and $defs.virtualKeyProviderConfig paths):

• client_id (string) - Azure client ID for authentication
• client_secret (string) - Azure client secret for authentication
• tenant_id (string) - Azure tenant ID for authentication
• scopes (array of strings) - Azure scopes for authentication

These match the Go struct in core/schemas/account.go:

type AzureKeyConfig struct {
    Endpoint     EnvVar   `json:"endpoint"`
    ClientID     *EnvVar  `json:"client_id,omitempty"`
    ClientSecret *EnvVar  `json:"client_secret,omitempty"`
    TenantID     *EnvVar  `json:"tenant_id,omitempty"`
    Scopes       []string `json:"scopes,omitempty"`
}

How to test

1. Validate the JSON schema is well-formed:

   python3 -c "import json; json.load(open('helm-charts/bifrost/values.schema.json'))"

2. Verify the new fields appear in both azure_key_config locations:

   python3 -c "
   import json
   data = json.load(open('helm-charts/bifrost/values.schema.json'))
   akc1 = data['\$defs']['providerKey']['properties']['azure_key_config']['properties']
   akc2 = data['\$defs']['virtualKeyProviderConfig']['properties']['keys']['items']['properties']['azure_key_config']['properties']
   for f in ['client_id', 'client_secret', 'tenant_id', 'scopes']:
       assert f in akc1, f'Missing {f} in providerKey'
       assert f in akc2, f'Missing {f} in virtualKeyProviderConfig'
   print('All fields present in both locations')
   "

3. Test Helm chart rendering with an azure_key_config that includes the new fields:

   helm template bifrost helm-charts/bifrost --set 'azure.keys[0].azure_key_config.client_id=test'

Type of change

• Bug fix

Affected areas

• Docs (Helm chart schema)

Breaking changes

• No

Related issues

Fixes #3990

Summary by CodeRabbit

• Chores
  • Extended Helm chart configuration schema to support Azure OAuth credentials (client_id, client_secret, tenant_id, scopes) for provider-level and per-key configurations. Validation now enforces that endpoint stays required and that the three credential fields must be supplied together if any is provided, ensuring consistent Azure auth validation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e5f4f7c6-23f1-49da-b74e-8532f17b8826

📥 Commits

Reviewing files that changed from the base of the PR and between b5accd6 and 840080d.

📒 Files selected for processing (1)

• helm-charts/bifrost/values.schema.json

---

📝 Walkthrough

Walkthrough

Schema additions: client_id, client_secret, tenant_id, and scopes were added to both providerKey.azure_key_config and virtualKeyProviderConfig.keys[].azure_key_config, plus dependentRequired rules requiring the three credential fields to be present together when any is provided.

Changes

Azure Provider Key Configuration

Layer / File(s)	Summary
Azure OAuth credential fields and validation helm-charts/bifrost/values.schema.json	Adds client_id, client_secret, tenant_id, and scopes to both providerKey.azure_key_config and virtualKeyProviderConfig.keys[].azure_key_config, and adds dependentRequired rules requiring the three credential fields together.

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested reviewers:

• akshaydeo
• danpiths

🐰 I hopped through schema lines, nibbling missing keys,
client_id and secret tucked in with ease,
tenant_id joins, scopes sing in a row,
Two azure spots fixed — now validation will go! 🥕

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding missing Azure key configuration fields to the Helm schema.
Description check	✅ Passed	The description covers the summary, changes made, testing steps, type of change, affected areas, and related issue. All major sections from the template are adequately addressed.
Linked Issues check	✅ Passed	The PR fully addresses issue #3990 by adding all four missing fields (client_id, client_secret, tenant_id, scopes) to both azure_key_config locations in the schema, with additional dependentRequired constraints.
Out of Scope Changes check	✅ Passed	All changes are focused on schema updates directly related to issue #3990. No unrelated modifications or scope creep detected in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Confidence Score: 5/5

Schema-only change that strictly expands what the Helm validator accepts; no runtime logic is touched.

The new fields and their types match the Go struct and transports/config.schema.json exactly. The dependentRequired co-occurrence rules are correctly applied in both schema locations and the previously missing required: ["endpoint"] in virtualKeyProviderConfig is now also corrected. There are no logic changes and no regressions possible from adding previously-absent-but-valid fields.

No files require special attention.

Important Files Changed

Filename	Overview
helm-charts/bifrost/values.schema.json	Adds missing client_id, client_secret, tenant_id, and scopes fields to azure_key_config in both $defs.providerKey and $defs.virtualKeyProviderConfig; also adds dependentRequired co-occurrence constraints in both locations and fixes the missing required: ["endpoint"] in the virtualKeyProviderConfig path.

_{Reviews (2): Last reviewed commit: "fix(helm): add missing azure_key_config ..." | Re-trigger Greptile}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

helm-charts/bifrost/values.schema.json (1)

3517-3556: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Keep the Helm Azure schema aligned with the runtime contract.

These additions expose the missing fields, but the Helm schema still diverges from transports/config.schema.json:2448-2490: client_id, client_secret, and tenant_id are supposed to be mutually dependent, and the virtual-key keys[].azure_key_config block should also require endpoint. As written, Helm will still accept partial or endpoint-less Azure OAuth configs that the runtime schema rejects.

Suggested fix

         "azure_key_config": {
           "type": "object",
           "properties": {
             "endpoint": {
               "type": "string",
               "description": "Azure endpoint (can use env. prefix)"
             },
             "client_id": {
               "type": "string",
               "description": "Azure client ID for authentication (can use env. prefix)"
             },
             "client_secret": {
               "type": "string",
               "description": "Azure client secret for authentication (can use env. prefix)"
             },
             "tenant_id": {
               "type": "string",
               "description": "Azure tenant ID for authentication (can use env. prefix)"
             },
             "scopes": {
               "type": "array",
               "items": {
                 "type": "string"
               },
               "description": "Azure scopes for authentication"
             },
             "deployments": {
               "type": "object",
               "additionalProperties": {
                 "type": "string"
               },
               "description": "Model to deployment mappings"
             },
             "api_version": {
               "type": "string",
               "description": "Azure API version"
             }
           },
           "required": ["endpoint"],
+          "dependentRequired": {
+            "client_id": ["client_secret", "tenant_id"],
+            "client_secret": ["client_id", "tenant_id"],
+            "tenant_id": ["client_id", "client_secret"]
+          },
           "additionalProperties": false
         },

               "azure_key_config": {
                 "type": "object",
                 "properties": {
                   "endpoint": {
                     "type": "string",
                     "description": "Azure endpoint (can use env. prefix)"
                   },
                   "client_id": {
                     "type": "string",
                     "description": "Azure client ID for authentication (can use env. prefix)"
                   },
                   "client_secret": {
                     "type": "string",
                     "description": "Azure client secret for authentication (can use env. prefix)"
                   },
                   "tenant_id": {
                     "type": "string",
                     "description": "Azure tenant ID for authentication (can use env. prefix)"
                   },
                   "scopes": {
                     "type": "array",
                     "items": {
                       "type": "string"
                     },
                     "description": "Azure scopes for authentication"
                   },
                   "deployments": {
                     "type": "object",
                     "additionalProperties": {
                       "type": "string"
                     },
                     "description": "Model to deployment mappings"
                   },
                   "api_version": {
                     "type": "string",
                     "description": "Azure API version"
                   }
                 },
+                "required": ["endpoint"],
+                "dependentRequired": {
+                  "client_id": ["client_secret", "tenant_id"],
+                  "client_secret": ["client_id", "tenant_id"],
+                  "tenant_id": ["client_id", "client_secret"]
+                },
                 "additionalProperties": false
               },

Also applies to: 4263-4301

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helm-charts/bifrost/values.schema.json` around lines 3517 - 3556, Update the
azure_key_config schema to match the runtime contract by making client_id,
client_secret, and tenant_id mutually dependent and ensuring endpoint is
required when azure_key_config is used under keys[].azure_key_config;
specifically add a dependentRequired (or equivalent allOf/if-then) constraint on
"client_id" to require ["client_secret","tenant_id"] (and symmetric checks or a
single dependentRequired on each key) and enforce "required":["endpoint"] for
the azure_key_config object used in keys entries so Helm rejects partial or
endpoint-less Azure OAuth configs (refer to azure_key_config, client_id,
client_secret, tenant_id, and keys[].azure_key_config).

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@helm-charts/bifrost/values.schema.json`:
- Around line 3517-3556: Update the azure_key_config schema to match the runtime
contract by making client_id, client_secret, and tenant_id mutually dependent
and ensuring endpoint is required when azure_key_config is used under
keys[].azure_key_config; specifically add a dependentRequired (or equivalent
allOf/if-then) constraint on "client_id" to require
["client_secret","tenant_id"] (and symmetric checks or a single
dependentRequired on each key) and enforce "required":["endpoint"] for the
azure_key_config object used in keys entries so Helm rejects partial or
endpoint-less Azure OAuth configs (refer to azure_key_config, client_id,
client_secret, tenant_id, and keys[].azure_key_config).

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e3a859f6-ef5b-4e41-8678-7b43d6bfd5b7

📥 Commits

Reviewing files that changed from the base of the PR and between 8c60820 and b5accd6.

📒 Files selected for processing (1)

• helm-charts/bifrost/values.schema.json

[akshaydeo]

@axelray-dev ❤️ for the PR - could you check the comments and resolve 🙇

[axelray-dev]

@akshaydeo Thanks for the nudge. I have resolved both review comments:

1. Added dependentRequired constraints to both azure_key_config locations (providerKey and virtualKeyProviderConfig), ensuring client_id, client_secret, and tenant_id are mutually required when any one is provided. This matches the constraint in transports/config.schema.json.

2. Added "required": ["endpoint"] to the virtual-key azure_key_config block, which was missing compared to the providerKey location.

Both changes align the Helm chart schema with the runtime contract so partial service-principal configs are caught at schema-validation time rather than silently falling through to DefaultAzureCredential.