Skip to main content

Release 0.5.60 — Auto-Create Team Sync Fix

Sri Aradhyula
Sri Aradhyula

Released: 2026-07-23 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.60 Previous release: 0.5.59

Highlights​

0.5.60 is a focused fix for deployments that enable login-time team auto-creation: OIDC group membership now syncs into OpenFGA team tuples even when no explicit group-sync rules are configured, restoring team-scoped resource sharing for non-admin users.

Bug Fixes​

  • rbac: when IDENTITY_SYNC_LOGIN_AUTO_CREATE_TEAMS is enabled but no identity_group_sync rules are configured, login now synthesizes a passthrough rule mapping each OIDC group to a same-named team instead of silently writing zero OpenFGA membership tuples. This was breaking team-scoped resource sharing (for example, the team dropdown in secret sharing) for every non-admin user on affected deployments. Behavior is unchanged if you already configure identity_group_sync rules, or if auto-create is off. (#2282)

Breaking Changes​

No breaking changes. Drop-in upgrade from 0.5.59.

Known Issues​

None known at this time.

Upgrade Guide: 0.5.59 → 0.5.60​

Overview​

Drop-in upgrade — no values.yaml edits required.

Helm Values Changes​

No Helm values changes between 0.5.59 and 0.5.60. Drop-in upgrade.

Upgrade Runbook​

1. Update chart version​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.60 \
  -f your-values.yaml

2. Verify​

kubectl get pods -n <namespace>

If you run with IDENTITY_SYNC_LOGIN_AUTO_CREATE_TEAMS=true and no identity_group_sync rules, expect newly logged-in users to start getting team-membership tuples written on next login — this is the intended fix, not a regression.

Personal Impact Analysis​

No values.yaml changes required.

Full Values Diff​

No diff — values.yaml is identical between 0.5.59 and 0.5.60.