helm: bump bundled oauth2-proxy subchart (7.0.0 → 10.x) — image tag override is mangled

[elihai-risk]

The kagent chart bundles oauth2-proxy chart 7.0.0 (appVersion 7.6.0). That version's deployment template hardcodes a v prefix on the image tag:

image: "{{ .Values.image.repository }}:v{{ include "oauth2-proxy.version" . }}"

so any custom image.tag that doesn't follow the vX.Y.Z convention gets mangled — e.g. a private-registry mirror tag my-repo/kagent:oauth2-proxy-v7.6.0 renders as :voauth2-proxy-v7.6.0 (ImagePullBackOff). Many orgs must mirror images into a private registry (admission policies forbid quay.io), so tag overrides are common.

Upstream oauth2-proxy/manifests already fixed this — current chart (10.7.0) renders the tag via the version helper without the hardcoded prefix:

image: "{{ tpl .Values.image.registry $ | default ... }}/{{ .Values.image.repository }}:{{ include "oauth2-proxy.version" . }}"

Bumping the bundled subchart to 10.x would fix this and pick up ~3 years of fixes. Happy to open a PR if maintainers agree on the target version / values migration.

Context: we hit this deploying kagent 0.9.11 on EKS with ECR-mirrored images and had to patch the vendored subchart. Related PRs from the same deployment: #2237 (pod labels), #2238 (UI Ingress).

🤖 Generated with Claude Code

[peterj]

I am fine with bumping the version to 10.x assuming we don't break the functionality. Would you like to create a PR for this?

[elihai-risk]

Opened #2254 with the bump (~7.0.0 → ~10.7.0, app v7.6.0 → v7.15.3).

Compatibility of every key the kagent chart sets was verified by render — config.existingSecret keys unchanged (now gated on config.requiredSecretKeys, defaulting to all three), extraArgs/extraEnv/extraVolumes unchanged, cookie sessions unchanged (the bitnami redis sub-chart became redis-ha, disabled by default), and service.portNumber: 4180 still pinned by the kagent values (upstream default moved to 80).

Confirmed the motivating scenario now renders verbatim: image.tag=oauth2-proxy-v7.6.0 → my-reg.example.com/mirrors/kagent:oauth2-proxy-v7.6.0 (no more v mangling).