Helm charts for the W'xOps identity stack: sign in to Kubernetes with Pinniped, and give the W'xOps ecosystem OIDC sign-in against your source control through Dex.
The current version of each chart, with what it does and where its documentation and changes are.
| Chart | What it does | Version | App version | Released | Docs |
|---|---|---|---|---|---|
pinniped |
Kubernetes authentication through the Pinniped Supervisor and Concierge, with Traefik, NGINX, Gateway API or LoadBalancer exposure and optional cert-manager TLS | 0.1.1 | v0.46.0 | 2026-10-16 | README · Changelog |
dexidp |
A thin wrapper around the upstream Dex chart. External Secrets Operator builds Dex's config.yaml from a secret backend such as OpenBao, so connectors and clients change without a chart change |
0.1.1 | v2.45.1 | 2026-10-16 | README · Changelog |
wxops-portal |
The W'xOps Portal, an internal developer portal for Kubernetes platform teams. Secrets come from External Secrets Operator, and it is exposed through a Traefik IngressRoute or any Ingress controller | 0.1.1 | v0.5.2 | 2026-10-19 | README · Changelog |
Dex can be the identity provider behind Pinniped. See "Using Dex with Pinniped" in the dexidp README.
Pin a chart to the version in the table with helm install <release> wxops/<chart> --version <Version>.
helm repo add wxops https://charts.wxops.cloud
helm repo update
helm search repo wxopsInstall a chart with its README as the guide. dexidp needs a secret store name to render, and pinniped needs an issuer or a hostname once you turn on a feature that uses one. A missing value fails the install with a message that names it, not with a half-working release.
helm install pinniped wxops/pinniped --dry-run --debug -f my-values.yaml # check first
helm install dex wxops/dexidp -n idp --create-namespace \
--set externalSecretDefaults.secretStoreRef.name=dex-openbaoEvery pull request runs lint-test.yaml, and a chart is only released from main after it passes:
- Lint:
helm lintand YAML style through chart-testing, plus a version bump for any chart that has already been released. - Required parameters: unit tests assert that each required value fails the render with a clear message. They live in
<chart>/tests/. - Render and schema: each chart is rendered with its
values-test.yamland the manifests are validated with kubeconform against the Kubernetes and CRD schemas. - Docs: the chart READMEs are regenerated with helm-docs and must match.
What this does not cover: the charts are rendered and validated, not installed on a cluster in CI. The dexidp README lists what has not been verified against a real External Secrets Operator and OpenBao. Test in a non-production cluster first.
See CONTRIBUTING.md for how to run the checks locally and what a pull request that changes a required parameter must include.
Apache License 2.0, see LICENSE.