feat: add skillsRegistry, allowDirectKeys, mcpExternalClientUrl, blacklisted_models, allow_private_network, and deployment strategy to Bifrost Helm chart

[BearTS]

Summary

Extends the Bifrost Helm chart with several new configuration surface areas: a declarative Skills Registry, two new client-level options (allowDirectKeys and mcpExternalClientUrl), a blacklisted_models field for provider configs, allow_private_network support in network configs, and a configurable Deployment update strategy.

Changes

• Added strategy field to values.yaml and deployment.yaml so operators can override the Kubernetes Deployment rollout strategy (e.g. surge-only rollouts for HA gateway deployments).
• Added bifrost.client.allowDirectKeys to permit callers to bypass the registered key pool via x-bf-direct-key + Authorization header, mapping to client.allow_direct_keys.
• Added bifrost.client.mcpExternalClientUrl to set the public base URL Bifrost uses as redirect_uri when acting as an OAuth client to upstream MCP servers, mapping to client.mcp_external_client_url.
• Added allow_private_network to provider network_config handling in _helpers.tpl, using hasKey to allow explicit false values to be set.
• Added blacklisted_models to the provider config schema, allowing specific models to be blocked even when matched by allowed_models (use ["*"] to block all).
• Added bifrost.skillsRegistry as a declarative Skills Repository block rendered verbatim as skills_registry in config.json, reconciled at startup when enabled. Supports skill definitions with name, description, version, markdown body, optional metadata, and file attachments with text, url, or dataurl source types.
• Updated values.schema.json with full JSON Schema definitions and descriptions for all new fields.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

# Render the Helm chart and verify new fields appear in the generated config
helm template bifrost ./helm-charts/bifrost \
  --set bifrost.client.allowDirectKeys=true \
  --set bifrost.client.mcpExternalClientUrl="https://example.com" \
  --set bifrost.skillsRegistry.enabled=true \
  --set strategy.type=RollingUpdate

# Validate the chart against the schema
helm lint ./helm-charts/bifrost

# Verify allow_private_network renders correctly for a provider network_config
helm template bifrost ./helm-charts/bifrost -f <values-with-allow_private_network.yaml>

New configuration fields:

Field	Description
strategy	Deployment update strategy rendered verbatim into spec.strategy
bifrost.client.allowDirectKeys	Allows bypassing the key pool via x-bf-direct-key header
bifrost.client.mcpExternalClientUrl	Public base URL used as redirect_uri for MCP OAuth flows
bifrost.skillsRegistry	Declarative skills reconciled at startup
network_config.allow_private_network	Permits connections to private network addresses for a provider
blacklisted_models	Models blocked for a provider config even if matched by allowed_models

Breaking changes

• Yes
• No

Related issues

Security considerations

allowDirectKeys permits callers to supply raw provider keys directly via the Authorization header, bypassing the managed key pool. This should only be enabled in trusted environments where callers are already authenticated and authorized, as it exposes provider credentials to the request path.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

📝 Walkthrough

Walkthrough

The Bifrost Helm chart is extended with four additive changes: a configurable Kubernetes Deployment strategy block, two new bifrost.client fields (allowDirectKeys, mcpExternalClientUrl), allow_private_network for per-provider network_config, blacklisted_models for virtualKeyProviderConfig, and a new top-level skillsRegistry configuration block with per-skill file source validation.

Changes

Bifrost Helm Chart Config Extensions

Layer / File(s)	Summary
Deployment rolling update strategy helm-charts/bifrost/values.schema.json, helm-charts/bifrost/values.yaml, helm-charts/bifrost/templates/deployment.yaml	Adds a strategy object to the schema, a commented example in values.yaml, and conditional spec.strategy rendering in the Deployment template.
Client config fields, provider network_config, and virtualKey blacklisted_models helm-charts/bifrost/values.schema.json, helm-charts/bifrost/values.yaml, helm-charts/bifrost/templates/_helpers.tpl	Adds allowDirectKeys and mcpExternalClientUrl to bifrost.client, conditionally emits allow_private_network in provider network_config, and adds blacklisted_models to virtualKeyProviderConfig schema and example values.
Declarative skills registry helm-charts/bifrost/values.schema.json, helm-charts/bifrost/values.yaml, helm-charts/bifrost/templates/_helpers.tpl	Introduces a skillsRegistry schema with enabled, a skills array using oneOf for url/text/dataurl file sources, a conditional skills_registry block emitted in the config template, and commented example values.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• maximhq/bifrost#4140: Modifies _helpers.tpl provider network_config rendering around the same allow_private_network field that this PR also touches.

Suggested reviewers

• danpiths
• akshaydeo

Poem

🐇 Hop hop, new fields appear today,
Skills registry blooms in config's array,
Direct keys allowed, MCP URLs too,
Blacklisted models bid models adieu,
Strategy set, the rolling proceeds—
The rabbit charts forward wherever it leads! 🎉

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The linked issue #123 focuses on implementing File APIs for providers, but the PR changes are Helm chart configurations that don't directly implement file upload functionality.	Review the linked issue connection; if this PR is preparatory infrastructure for #123, add explicit notes. If unrelated, remove the link and create appropriate issue references for these Helm changes.
Description check	⚠️ Warning	Pull request description is entirely empty with no substantive content—only an unfilled template placeholder, providing zero explanation of changes, purpose, or testing.	Fill in all required sections: provide a clear summary of the Helm updates, explain the purpose and problem being solved, detail the specific changes made, check appropriate type/affected areas, describe testing procedures, and address breaking changes and security considerations.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The PR title accurately summarizes all the major features added to the Bifrost Helm chart configuration.
Out of Scope Changes check	✅ Passed	All changes are Helm chart configuration additions (schema, templates, values) that extend deployment options and provider configurations, with no unrelated modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-17-feat_helm_updates

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[BearTS]

• chore: bump Bifrost Helm chart to 2.1.24 with private network fix, env label, Datadog host/port split, passwordCommand, async log tuning, deployment strategy, and skills registry #4474
• feat: add skillsRegistry, allowDirectKeys, mcpExternalClientUrl, blacklisted_models, allow_private_network, and deployment strategy to Bifrost Helm chart #4473 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@helm-charts/bifrost/values.schema.json`:
- Around line 3086-3094: The url and dataurl fields in the skillsRegistry file
sources schema are currently unconstrained string types, allowing malformed
inputs to pass validation and fail later during reconciliation. Add format
constraints to these fields (url and dataurl should use "format": "uri" to
validate they are proper URIs) wherever they appear in the skillsRegistry
configuration schema to catch invalid inputs at validation time rather than
runtime.
- Around line 542-545: The mcpExternalClientUrl field in the schema currently
accepts any string without validating that it conforms to URI format. Since this
field is used as a public base URL for OAuth redirect construction, add URI
format validation to the field definition. Add a "format" property set to "uri"
to the mcpExternalClientUrl object definition to ensure only valid URIs are
accepted and fail fast on invalid configuration values.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a1e1992a-1df3-4fca-a5ae-125b7ff422c5

📥 Commits

Reviewing files that changed from the base of the PR and between 5df113e and 4444338.

📒 Files selected for processing (4)

• helm-charts/bifrost/templates/_helpers.tpl
• helm-charts/bifrost/templates/deployment.yaml
• helm-charts/bifrost/values.schema.json
• helm-charts/bifrost/values.yaml

[akshaydeo]

Merge activity

• Jun 16, 7:17 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 16, 7:17 PM UTC: @akshaydeo merged this pull request with Graphite.

[greptile-apps]

Confidence Score: 3/5

The Helm chart update needs attention before merge because access-profile values cannot express provider model deny-lists through the strict schema.

The changes are scoped to Helm chart templates and schema, but the schema omission blocks a newly supported configuration path for Helm-managed access profiles.

helm-charts/bifrost/values.schema.json

T-Rex Logs

What T-Rex did

• T-Rex verification was attempted but could not be completed; the session evidence only shows file reads from helm-charts/bifrost/values.yaml and no runtime validation output.
• Validated the client-strategy-network Helm render by examining the head render, which produced a successful render with exit code 0 and rendered ConfigMap/Deployment sections containing all four claimed fields.
• Validated the skills_registry handling in the head render and confirmed the resulting config.json includes a top-level skills_registry with the enabled flag, skill fields, metadata, extra frontmatter, and all three file forms.
• Validated the virtual key with blacklisted_models; the head render succeeded and config.json preserves blacklisted_models in the virtual-key provider config.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. helm-charts/bifrost/values.schema.json, line 3205-3210 (link)

   Allow access profile blacklists

   The PR adds blacklisted_models for virtual-key provider configs, but access profile provider configs use this separate strict schema and still only allow allowed_models. Because this object has additionalProperties: false, a Helm values file that seeds an access profile with provider_configs[].blacklisted_models is rejected even though the runtime virtual-key provider config model supports that field. This prevents Helm-managed access profiles from expressing model deny-lists.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "feat: helm updates" | Re-trigger Greptile}