From 0ca6020865dd165bbd1a053112eb475c97967882 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 14:46:53 +0200
Subject: [PATCH 01/18] refactor(helm): scope resource names by release name

---
 templates/envoy/backend-security-policy.yaml | 4 ++--
 templates/envoy/backend-traffic-policy.yaml  | 2 +-
 templates/envoy/backend.yaml                 | 2 +-
 templates/envoy/client-traffic-policy.yaml   | 2 +-
 templates/envoy/openwebui-httproute.yaml     | 2 +-
 templates/envoy/security-policy.yaml         | 2 +-
 templates/init_job/init_job.yaml             | 8 ++++----
 templates/init_job/init_secret.yaml          | 2 +-
 templates/models/knative-serving.yaml        | 6 +++---
 templates/models/model_secret.yaml           | 2 +-
 templates/models/network_policy.yaml         | 3 ++-
 templates/openwebui/deployment.yaml          | 6 ++++--
 templates/openwebui/oauth_secret.yaml        | 2 +-
 templates/openwebui/service.yaml             | 3 ++-
 templates/postgres_secret.yaml               | 2 +-
 15 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/templates/envoy/backend-security-policy.yaml b/templates/envoy/backend-security-policy.yaml
index 66cc6a7..c8511c8 100644
--- a/templates/envoy/backend-security-policy.yaml
+++ b/templates/envoy/backend-security-policy.yaml
@@ -5,7 +5,7 @@
 apiVersion: aigateway.envoyproxy.io/v1alpha1
 kind: BackendSecurityPolicy
 metadata:
-  name: backend-security-{{ $name }}
+  name: {{ $.Release.Name }}-backend-security-{{ $name }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
@@ -19,7 +19,7 @@ spec:
       name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
   apiKey:
     secretRef:
-      name: vllm-secret-{{ $name }}
+      name: {{ $.Release.Name }}-model-{{ $name }}
     {{- end }}
   {{- end }}
 {{- end }}
diff --git a/templates/envoy/backend-traffic-policy.yaml b/templates/envoy/backend-traffic-policy.yaml
index abff37b..e392187 100644
--- a/templates/envoy/backend-traffic-policy.yaml
+++ b/templates/envoy/backend-traffic-policy.yaml
@@ -8,7 +8,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: BackendTrafficPolicy
 metadata:
-  name: model-rate-limit-policy
+  name: {{ .Release.Name }}-model-rate-limit-policy
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:
diff --git a/templates/envoy/backend.yaml b/templates/envoy/backend.yaml
index d5ad709..4126d93 100644
--- a/templates/envoy/backend.yaml
+++ b/templates/envoy/backend.yaml
@@ -14,7 +14,7 @@ spec:
   endpoints:
       {{- if $model.internal }}
     - fqdn:
-        hostname: model-{{ $name }}.{{ $.Release.Namespace }}.svc.cluster.local
+        hostname: {{ $.Release.Name }}-model-{{ $name }}.{{ $.Release.Namespace }}.svc.cluster.local
         port: 80
       {{- else if $model.apiUrl }}
     - fqdn:
diff --git a/templates/envoy/client-traffic-policy.yaml b/templates/envoy/client-traffic-policy.yaml
index 3493948..441fc96 100644
--- a/templates/envoy/client-traffic-policy.yaml
+++ b/templates/envoy/client-traffic-policy.yaml
@@ -4,7 +4,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: ClientTrafficPolicy
 metadata:
-  name: client-buffer-limit
+  name: {{ .Release.Name }}-client-buffer-limit
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:
diff --git a/templates/envoy/openwebui-httproute.yaml b/templates/envoy/openwebui-httproute.yaml
index 09917a8..60a245c 100644
--- a/templates/envoy/openwebui-httproute.yaml
+++ b/templates/envoy/openwebui-httproute.yaml
@@ -12,7 +12,7 @@ spec:
       group: gateway.networking.k8s.io
   rules:
   - backendRefs:
-      - name: openwebui
+      - name: {{ .Release.Name }}-openwebui
         namespace: {{ .Release.Namespace }}
         port: 8080
   
diff --git a/templates/envoy/security-policy.yaml b/templates/envoy/security-policy.yaml
index 93030c6..39f9f79 100644
--- a/templates/envoy/security-policy.yaml
+++ b/templates/envoy/security-policy.yaml
@@ -2,7 +2,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: SecurityPolicy
 metadata:
-  name: authentik-jwks
+  name: {{ .Release.Name }}-authentik-jwks
   namespace: {{ .Release.Namespace }}
 spec:
   targetRef:
diff --git a/templates/init_job/init_job.yaml b/templates/init_job/init_job.yaml
index 50d2186..078462e 100644
--- a/templates/init_job/init_job.yaml
+++ b/templates/init_job/init_job.yaml
@@ -21,7 +21,7 @@ spec:
       initContainers:
         - name: check-openwebui
           image: alpine/curl:latest
-          command: ["sh", "-c", "until curl -f 'http://openwebui.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
+          command: ["sh", "-c", "until curl -f 'http://{{ .Release.Name }}-openwebui.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
       containers:
         - name: init-deployment
           image: {{ .Values.initJob.image.repository | default "ghcr.io/swissdatasciencecenter/llm-serving/init" }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
@@ -31,7 +31,7 @@ spec:
             - name: INIT_OPEN_WEBUI__ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: init-secret
+                  name: {{ .Release.Name }}-init
                   key: OPENWEBUI_ADMIN_PASSWORD
             - name: CONFIG_PATH
               value: /svc/config.toml
@@ -43,7 +43,7 @@ spec:
               cpu: 1
               memory: 2Gi
           volumeMounts:
-            - name: init-secret
+            - name: {{ .Release.Name }}-init
               mountPath: /svc/config.toml
               subPath: config.toml
 {{- with .Values.global.imagePullSecrets }}
@@ -51,6 +51,6 @@ spec:
         {{- toYaml . | nindent 8 }}
 {{- end }}
       volumes:
-        - name: init-secret
+        - name: {{ .Release.Name }}-init
           secret:
             secretName: init-secret
diff --git a/templates/init_job/init_secret.yaml b/templates/init_job/init_secret.yaml
index 9cb89b6..dcb83a5 100644
--- a/templates/init_job/init_secret.yaml
+++ b/templates/init_job/init_secret.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: init-secret
+  name: {{ .Release.Name }}-init
 type: Opaque
 stringData:
   config.toml: |
diff --git a/templates/models/knative-serving.yaml b/templates/models/knative-serving.yaml
index a6423d1..711f3ca 100644
--- a/templates/models/knative-serving.yaml
+++ b/templates/models/knative-serving.yaml
@@ -14,7 +14,7 @@ metadata:
     networking.knative.dev/visibility: cluster-local
     release: {{ $.Release.Name }}
     heritage: {{ $.Release.Service }}
-  name: model-{{ $name }}
+  name: {{ $.Release.Name }}-model-{{ $name }}
 spec:
   template:
     metadata:
@@ -117,7 +117,7 @@ metadata:
     networking.knative.dev/visibility: cluster-local
     release: {{ $.Release.Name }}
     heritage: {{ $.Release.Service }}
-  name: model-{{ $name }}
+  name: {{ $.Release.Name }}-model-{{ $name }}
 spec:
   template:
     metadata:
@@ -175,7 +175,7 @@ spec:
             - name: VLLM_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: vllm-secret-{{ $name }}
+                  name: {{ $.Release.Name }}-model-{{ $name }}
                   key: apiKey
     {{- if or $persistence.enabled $cacheDir }}
             - name: VLLM_CACHE_ROOT
diff --git a/templates/models/model_secret.yaml b/templates/models/model_secret.yaml
index fa04c5f..a5cf034 100644
--- a/templates/models/model_secret.yaml
+++ b/templates/models/model_secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "vllm-secret-{{ $name }}"
+  name: "{{ $.Release.Name }}-model-{{ $name }}"
   namespace: {{ $.Release.Namespace }}
 type: Opaque
 data:
diff --git a/templates/models/network_policy.yaml b/templates/models/network_policy.yaml
index 52e5d92..7f00d07 100644
--- a/templates/models/network_policy.yaml
+++ b/templates/models/network_policy.yaml
@@ -4,11 +4,12 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: model-{{ $name }}
+  name: {{ $.Release.Name }}-model-{{ $name }}
 spec:
   podSelector:
     matchLabels:
       app: model-{{ $name }}
+      release: {{ $.Release.Name }}
   policyTypes:
     - Ingress
   ingress:
diff --git a/templates/openwebui/deployment.yaml b/templates/openwebui/deployment.yaml
index c6cf51e..02db084 100644
--- a/templates/openwebui/deployment.yaml
+++ b/templates/openwebui/deployment.yaml
@@ -12,10 +12,12 @@ spec:
   selector:
     matchLabels:
       app: openwebui
+      release: {{ .Release.Name }}
   template:
     metadata:
       labels:
         app: openwebui
+        release: {{ .Release.Name }}
     spec:
       containers:
         - name: user-container
@@ -35,7 +37,7 @@ spec:
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: postgres-secret
+                  name: {{ .Release.Name }}-postgres
                   key: OPENWEBUI_DATABASE_URL
             - name: ENABLE_OAUTH_SIGNUP
               value: "true"
@@ -46,7 +48,7 @@ spec:
             - name: OAUTH_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: openwebui-oauth
+                  name: {{ .Release.Name }}-openwebui-oauth
                   key: OAUTH_CLIENT_SECRET
             - name: OAUTH_ADMIN_ROLES
               value: gateway admins
diff --git a/templates/openwebui/oauth_secret.yaml b/templates/openwebui/oauth_secret.yaml
index 6faa18f..46f1fab 100644
--- a/templates/openwebui/oauth_secret.yaml
+++ b/templates/openwebui/oauth_secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "openwebui-oauth"
+  name: "{{ .Release.Name }}-openwebui-oauth"
 type: Opaque
 stringData:
   OAUTH_CLIENT_SECRET: {{ .Values.authentik.oauthApp.clientSecret | required ".Values.authentik.oauthApp.clientSecret is required" }}
diff --git a/templates/openwebui/service.yaml b/templates/openwebui/service.yaml
index 738e89b..570917d 100644
--- a/templates/openwebui/service.yaml
+++ b/templates/openwebui/service.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: openwebui
+  name: {{ .Release.Name }}-openwebui
   labels:
     app: openwebui
     release: {{ .Release.Name }}
@@ -9,6 +9,7 @@ metadata:
 spec:
   selector:
     app: openwebui
+    release: {{ .Release.Name }}
   ports:
     - protocol: TCP
       port: 8080
diff --git a/templates/postgres_secret.yaml b/templates/postgres_secret.yaml
index 2c0ad21..70a5d72 100644
--- a/templates/postgres_secret.yaml
+++ b/templates/postgres_secret.yaml
@@ -6,7 +6,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "postgres-secret"
+  name: "{{ .Release.Name }}-postgres"
 type: Opaque
   {{- $pg := .Values.openwebui.postgres }}
   {{- /* One value fills both db and role. */}}

From 9a5535ef99524118119d49e8893fd512ef36c40c Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 15:08:01 +0200
Subject: [PATCH 02/18] fix(init): scope openwebui name in init config

---
 templates/init_job/init_secret.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/init_job/init_secret.yaml b/templates/init_job/init_secret.yaml
index dcb83a5..04bf2a7 100644
--- a/templates/init_job/init_secret.yaml
+++ b/templates/init_job/init_secret.yaml
@@ -6,7 +6,7 @@ type: Opaque
 stringData:
   config.toml: |
     [open_webui]
-    host = "openwebui.{{ $.Release.Namespace }}.svc.cluster.local:8080"
+    host = "{{ .Release.Name }}-openwebui.{{ $.Release.Namespace }}.svc.cluster.local:8080"
     admin_user = "{{ .Values.openwebui.admin.user | required ".Values.openwebui.admin.user is required" }}"
     admin_email = "{{ .Values.openwebui.admin.email | required ".Values.openwebui.admin.email is required"}}"
     model_ids = [{{ range $name, $model := .Values.models }}"{{ $model.fullName }}",{{ end }}]

From 5e8de17f368fd306f78228a396e85dbf6716e068 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 15:58:42 +0200
Subject: [PATCH 03/18] feat(helm): helpers fail on long release name

---
 templates/_helpers.tpl | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index cf185ec..e62c393 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -1,19 +1,25 @@
-{{- define "sanitizeEnvVarName" -}}
-{{ regexReplaceAll "[^A-Z0-9]+" (upper .) "_" }}
-{{- end -}}
-
 {{/*
 Envoy Gateway full name
 */}}
 {{- define "envoy.fullname" -}}
-  {{- printf "%s-envoy" .Release.Name | trunc 63 | trimSuffix "-" -}}
+  {{- printf "%s-envoy" .Release.Name -}}
 {{- end -}}
 
 {{/*
-Backend name for a specific model
+Base name for every resource of one model. Fails when too long.
+
+The cap is the 63-character DNS label limit minus the revision suffix Knative
+appends to derive names from the Service.
+
+Usage: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
 */}}
-{{- define "envoy.backendName" -}}
-  {{- printf "%s-%s" (include "envoy.fullname" .) .modelName | trunc 63 | trimSuffix "-" -}}
+{{- define "model.fullname" -}}
+  {{- $full := printf "%s-model-%s" .Release.Name .modelName -}}
+  {{- $cap := sub 63 (len "-00001") -}}
+  {{- if gt (len $full) (int $cap) -}}
+    {{- fail (printf "model resource name %q exceeds the %d characters available: shorten the release name or the model key" $full $cap) -}}
+  {{- end -}}
+  {{- $full -}}
 {{- end -}}
 
 {{/*

From 8db396339b26424a749550096bb99b2e76be04bf Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 15:59:16 +0200
Subject: [PATCH 04/18] fix(helm): populate model values for linting

---
 tools/helm/lint-values.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tools/helm/lint-values.yaml b/tools/helm/lint-values.yaml
index 1276334..89f29f5 100644
--- a/tools/helm/lint-values.yaml
+++ b/tools/helm/lint-values.yaml
@@ -15,3 +15,13 @@ openwebui:
     password: dummy
 initJob:
   image: {}
+# One model so `helm template` actually renders templates/models and the per-model
+# envoy objects; without it every `range .Values.models` iterates zero times.
+models:
+  lint:
+    fullName: org/lint-model
+    internal: true
+    apiKey: dummy
+    resources:
+      requests: { cpu: 1, memory: 1G }
+      limits: { cpu: 2, memory: 2G }

From 4b5ef0b130878c0b7643d01c2d46526cb36893b7 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 16:05:07 +0200
Subject: [PATCH 05/18] refactor(helm): use fullname helper in model templates

---
 templates/models/knative-serving.yaml | 11 ++++++-----
 templates/models/model_secret.yaml    |  2 +-
 templates/models/network_policy.yaml  |  2 +-
 templates/models/pvc.yaml             |  5 ++---
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/templates/models/knative-serving.yaml b/templates/models/knative-serving.yaml
index 711f3ca..790306e 100644
--- a/templates/models/knative-serving.yaml
+++ b/templates/models/knative-serving.yaml
@@ -3,6 +3,7 @@
   {{- $persistence := $model.persistence | default dict }}
   {{- $image := $model.image | default dict }}
   {{- $cacheDir := $model.cacheDir | default dict }}
+  {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
   {{- if $model.dummy }}
 ---
 apiVersion: serving.knative.dev/v1
@@ -14,7 +15,7 @@ metadata:
     networking.knative.dev/visibility: cluster-local
     release: {{ $.Release.Name }}
     heritage: {{ $.Release.Service }}
-  name: {{ $.Release.Name }}-model-{{ $name }}
+  name: {{ $fullname }}
 spec:
   template:
     metadata:
@@ -101,7 +102,7 @@ spec:
       volumes:
         - name: pvc-cache
           persistentVolumeClaim:
-            claimName: {{ if $persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
+            claimName: {{ if $persistence.enabled }}{{ $fullname }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
     {{- end }}
   traffic:
     - latestRevision: true
@@ -117,7 +118,7 @@ metadata:
     networking.knative.dev/visibility: cluster-local
     release: {{ $.Release.Name }}
     heritage: {{ $.Release.Service }}
-  name: {{ $.Release.Name }}-model-{{ $name }}
+  name: {{ $fullname }}
 spec:
   template:
     metadata:
@@ -175,7 +176,7 @@ spec:
             - name: VLLM_API_KEY
               valueFrom:
                 secretKeyRef:
-                  name: {{ $.Release.Name }}-model-{{ $name }}
+                  name: {{ $fullname }}
                   key: apiKey
     {{- if or $persistence.enabled $cacheDir }}
             - name: VLLM_CACHE_ROOT
@@ -246,7 +247,7 @@ spec:
       volumes:
         - name: pvc-cache
           persistentVolumeClaim:
-            claimName: {{ if $persistence.enabled }}{{ $.Release.Name }}-model-{{ $name }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
+            claimName: {{ if $persistence.enabled }}{{ $fullname }}-cache{{ else }}{{ $cacheDir.claimName }}{{ end }}
     {{- end }}
       timeoutSeconds: 600
       responseStartTimeoutSeconds: 600
diff --git a/templates/models/model_secret.yaml b/templates/models/model_secret.yaml
index a5cf034..d6e1743 100644
--- a/templates/models/model_secret.yaml
+++ b/templates/models/model_secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ $.Release.Name }}-model-{{ $name }}"
+  name: "{{ include "model.fullname" (merge (dict "modelName" $name) $) }}"
   namespace: {{ $.Release.Namespace }}
 type: Opaque
 data:
diff --git a/templates/models/network_policy.yaml b/templates/models/network_policy.yaml
index 7f00d07..0c0c577 100644
--- a/templates/models/network_policy.yaml
+++ b/templates/models/network_policy.yaml
@@ -4,7 +4,7 @@
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
-  name: {{ $.Release.Name }}-model-{{ $name }}
+  name: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
 spec:
   podSelector:
     matchLabels:
diff --git a/templates/models/pvc.yaml b/templates/models/pvc.yaml
index 92ce4e8..592b611 100644
--- a/templates/models/pvc.yaml
+++ b/templates/models/pvc.yaml
@@ -1,13 +1,12 @@
 {{- range $name, $model := .Values.models }}
-  {{- /* These sub-maps are optional in values.yaml; default them so a missing
-  key renders empty instead of failing with a nil pointer. */}}
+  {{- /* default optional sub-maps so a missing key does not fail. */}}
   {{- $persistence := $model.persistence | default dict }}
   {{- if and $model.internal $persistence.enabled }}
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ $.Release.Name }}-model-{{ $name }}-cache
+  name: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}-cache
   labels:
     app: model-{{ $name }}
     release: {{ $.Release.Name }}

From 1b8db8fb3862688ff0d42d8b28c13b764097bbdc Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 16:06:11 +0200
Subject: [PATCH 06/18] refactor(envoy): use model fullName instead of
 dedicated envoy.backendName

---
 templates/envoy/ai-gateway-route.yaml        | 2 +-
 templates/envoy/ai-service-backend.yaml      | 5 +++--
 templates/envoy/backend-security-policy.yaml | 8 ++++----
 templates/envoy/backend.yaml                 | 5 +++--
 4 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/templates/envoy/ai-gateway-route.yaml b/templates/envoy/ai-gateway-route.yaml
index 208123c..c0c67d1 100644
--- a/templates/envoy/ai-gateway-route.yaml
+++ b/templates/envoy/ai-gateway-route.yaml
@@ -28,7 +28,7 @@ spec:
               name: x-ai-eg-model
               value: {{ $model.fullName }}
       backendRefs:
-        - name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+        - name: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- end }}
   {{- end }}
 {{- end }}
diff --git a/templates/envoy/ai-service-backend.yaml b/templates/envoy/ai-service-backend.yaml
index 5146e78..0c2d866 100644
--- a/templates/envoy/ai-service-backend.yaml
+++ b/templates/envoy/ai-service-backend.yaml
@@ -1,11 +1,12 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: aigateway.envoyproxy.io/v1alpha1
 kind: AIServiceBackend
 metadata:
-  name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+  name: {{ $fullname }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
@@ -15,7 +16,7 @@ spec:
     name: OpenAI
     version: "v1"
   backendRef:
-    name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+    name: {{ $fullname }}
     kind: Backend
     group: gateway.envoyproxy.io
     {{- end }}
diff --git a/templates/envoy/backend-security-policy.yaml b/templates/envoy/backend-security-policy.yaml
index c8511c8..2c4933f 100644
--- a/templates/envoy/backend-security-policy.yaml
+++ b/templates/envoy/backend-security-policy.yaml
@@ -1,25 +1,25 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: aigateway.envoyproxy.io/v1alpha1
 kind: BackendSecurityPolicy
 metadata:
-  name: {{ $.Release.Name }}-backend-security-{{ $name }}
+  name: {{ $fullname }}-security
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
     release: {{ $.Release.Name }}
-    test: test
 spec:
   type: APIKey
   targetRefs:
     - group: aigateway.envoyproxy.io
       kind: AIServiceBackend
-      name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+      name: {{ $fullname }}
   apiKey:
     secretRef:
-      name: {{ $.Release.Name }}-model-{{ $name }}
+      name: {{ $fullname }}
     {{- end }}
   {{- end }}
 {{- end }}
diff --git a/templates/envoy/backend.yaml b/templates/envoy/backend.yaml
index 4126d93..6e63568 100644
--- a/templates/envoy/backend.yaml
+++ b/templates/envoy/backend.yaml
@@ -1,11 +1,12 @@
 {{- if .Values.envoy.enabled }}
   {{- range $name, $model := .Values.models }}
+    {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
     {{- if or $model.internal (and (not $model.internal) $model.apiUrl) }}
 ---
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: Backend
 metadata:
-  name: {{ include "envoy.backendName" (merge (dict "modelName" $name) $) }}
+  name: {{ $fullname }}
   namespace: {{ $.Release.Namespace }}
   labels:
     app: model-{{ $name }}
@@ -14,7 +15,7 @@ spec:
   endpoints:
       {{- if $model.internal }}
     - fqdn:
-        hostname: {{ $.Release.Name }}-model-{{ $name }}.{{ $.Release.Namespace }}.svc.cluster.local
+        hostname: {{ $fullname }}.{{ $.Release.Namespace }}.svc.cluster.local
         port: 80
       {{- else if $model.apiUrl }}
     - fqdn:

From 38b17da78ffd352584684743728b8fb462771791 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 16:11:27 +0200
Subject: [PATCH 07/18] fix: add default mountpath for existing claims

---
 templates/models/knative-serving.yaml |  4 ++--
 tools/helm/lint-values.yaml           | 11 +++++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/templates/models/knative-serving.yaml b/templates/models/knative-serving.yaml
index 790306e..c519f3b 100644
--- a/templates/models/knative-serving.yaml
+++ b/templates/models/knative-serving.yaml
@@ -74,7 +74,7 @@ spec:
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache/
     {{- else if (and $cacheDir $cacheDir.claimName) }}
-          - mountPath: {{ $cacheDir.path }}
+          - mountPath: {{ $cacheDir.path | default "/myhome" }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache
     {{- end }}
@@ -225,7 +225,7 @@ spec:
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache/
     {{- else if (and $cacheDir $cacheDir.claimName) }}
-          - mountPath: {{ $cacheDir.path }}
+          - mountPath: {{ $cacheDir.path | default "/myhome" }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache
     {{- end }}
diff --git a/tools/helm/lint-values.yaml b/tools/helm/lint-values.yaml
index 89f29f5..a6e5dcd 100644
--- a/tools/helm/lint-values.yaml
+++ b/tools/helm/lint-values.yaml
@@ -15,8 +15,6 @@ openwebui:
     password: dummy
 initJob:
   image: {}
-# One model so `helm template` actually renders templates/models and the per-model
-# envoy objects; without it every `range .Values.models` iterates zero times.
 models:
   lint:
     fullName: org/lint-model
@@ -25,3 +23,12 @@ models:
     resources:
       requests: { cpu: 1, memory: 1G }
       limits: { cpu: 2, memory: 2G }
+  # exercises the external-claim branch (persistence off, no cacheDir.path)
+  lint-byoc:
+    fullName: org/lint-byoc
+    internal: true
+    apiKey: dummy
+    cacheDir: { claimName: pvc-example-home }
+    resources:
+      requests: { cpu: 1, memory: 1G }
+      limits: { cpu: 2, memory: 2G }

From 1441d28f2a845e2ec0e0e7ef82de82134dd08183 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 21:55:51 +0200
Subject: [PATCH 08/18] refactor: simplify helpers + add telemetry helper

---
 templates/_helpers.tpl | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index e62c393..fb811d6 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -1,25 +1,31 @@
 {{/*
-Envoy Gateway full name
+Envoy Gateway full name.
 */}}
 {{- define "envoy.fullname" -}}
   {{- printf "%s-envoy" .Release.Name -}}
 {{- end -}}
 
 {{/*
-Base name for every resource of one model. Fails when too long.
+OpenWebUI full name.
+*/}}
+{{- define "openwebui.fullname" -}}
+  {{- printf "%s-openwebui" .Release.Name -}}
+{{- end -}}
+
+{{/*
+Telemetry bridge full name
+*/}}
+{{- define "telemetry.fullname" -}}
+  {{- printf "%s-otlp-openmeter-bridge" .Release.Name -}}
+{{- end -}}
 
-The cap is the 63-character DNS label limit minus the revision suffix Knative
-appends to derive names from the Service.
+{{/*
+Base name for every resource of one model.
 
 Usage: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
 */}}
 {{- define "model.fullname" -}}
-  {{- $full := printf "%s-model-%s" .Release.Name .modelName -}}
-  {{- $cap := sub 63 (len "-00001") -}}
-  {{- if gt (len $full) (int $cap) -}}
-    {{- fail (printf "model resource name %q exceeds the %d characters available: shorten the release name or the model key" $full $cap) -}}
-  {{- end -}}
-  {{- $full -}}
+  {{- printf "%s-model-%s" .Release.Name .modelName -}}
 {{- end -}}
 
 {{/*

From b6fd2822ea4186720fc921767c65c04b69f34454 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:06:31 +0200
Subject: [PATCH 09/18] fix(authentik): gate blueprint secret template

---
 templates/authentik-blueprints-secret.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/templates/authentik-blueprints-secret.yaml b/templates/authentik-blueprints-secret.yaml
index 91538e9..da0d0ba 100644
--- a/templates/authentik-blueprints-secret.yaml
+++ b/templates/authentik-blueprints-secret.yaml
@@ -1,7 +1,8 @@
+{{- if and .Values.authentik.enabled .Values.authentik.blueprints.secrets }}
 apiVersion: v1
 kind: Secret
 metadata:
-  name: authentik-blueprints
+  name: {{ .Values.authentik.blueprints.secrets | first }}
 type: Opaque
 stringData:
   authentik-config.yaml: |
@@ -112,3 +113,4 @@ stringData:
           domain: authentik-default
         attrs:
           flow_device_code: !Find [authentik_flows.flow, [slug, default-source-pre-authentication]]
+{{- end }}

From 8d9e65674a13059487499d14683b101581b075db Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:06:52 +0200
Subject: [PATCH 10/18] refactor(envoy): use fullname helper

---
 templates/envoy/authentik-httproute.yaml        |  2 ++
 templates/envoy/envoy-proxy.yaml                |  2 +-
 templates/envoy/openwebui-httproute.yaml        |  4 +++-
 templates/init_job/init_job.yaml                |  8 +++++---
 templates/init_job/init_secret.yaml             |  4 +++-
 templates/openwebui/deployment.yaml             |  6 +++---
 templates/openwebui/oauth_secret.yaml           |  2 +-
 templates/openwebui/pvc.yaml                    |  2 +-
 templates/openwebui/service.yaml                |  4 +++-
 templates/otlp-openmeter-bridge/configmap.yaml  |  2 +-
 templates/otlp-openmeter-bridge/deployment.yaml | 13 +++++++------
 templates/otlp-openmeter-bridge/secret.yaml     |  2 +-
 templates/otlp-openmeter-bridge/service.yaml    |  3 ++-
 tools/helm/lint-values.yaml                     |  7 +++++--
 14 files changed, 38 insertions(+), 23 deletions(-)

diff --git a/templates/envoy/authentik-httproute.yaml b/templates/envoy/authentik-httproute.yaml
index 2cd314f..d142642 100644
--- a/templates/envoy/authentik-httproute.yaml
+++ b/templates/envoy/authentik-httproute.yaml
@@ -1,3 +1,4 @@
+{{- if and .Values.envoy.enabled .Values.authentik.enabled }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -16,3 +17,4 @@ spec:
         namespace: {{ .Release.Namespace }}
         port: 80
   
+{{- end }}
diff --git a/templates/envoy/envoy-proxy.yaml b/templates/envoy/envoy-proxy.yaml
index eef8842..683265f 100644
--- a/templates/envoy/envoy-proxy.yaml
+++ b/templates/envoy/envoy-proxy.yaml
@@ -52,7 +52,7 @@ spec:
             - type: OpenTelemetry
               openTelemetry:
                 port: 4317
-                host: "otlp-openmeter-bridge.{{ .Release.Namespace }}.svc.cluster.local"
+                host: "{{ include "telemetry.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local"
   {{- end }}
   {{- if or .Values.envoy.resources .Values.envoy.service }}
   provider:
diff --git a/templates/envoy/openwebui-httproute.yaml b/templates/envoy/openwebui-httproute.yaml
index 60a245c..942353e 100644
--- a/templates/envoy/openwebui-httproute.yaml
+++ b/templates/envoy/openwebui-httproute.yaml
@@ -1,3 +1,4 @@
+{{- if and .Values.envoy.enabled .Values.openwebui.enabled }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -12,7 +13,8 @@ spec:
       group: gateway.networking.k8s.io
   rules:
   - backendRefs:
-      - name: {{ .Release.Name }}-openwebui
+      - name: {{ include "openwebui.fullname" . }}
         namespace: {{ .Release.Namespace }}
         port: 8080
   
+{{- end }}
diff --git a/templates/init_job/init_job.yaml b/templates/init_job/init_job.yaml
index 078462e..a9c3813 100644
--- a/templates/init_job/init_job.yaml
+++ b/templates/init_job/init_job.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -21,7 +22,7 @@ spec:
       initContainers:
         - name: check-openwebui
           image: alpine/curl:latest
-          command: ["sh", "-c", "until curl -f 'http://{{ .Release.Name }}-openwebui.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
+          command: ["sh", "-c", "until curl -f 'http://{{ include "openwebui.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
       containers:
         - name: init-deployment
           image: {{ .Values.initJob.image.repository | default "ghcr.io/swissdatasciencecenter/llm-serving/init" }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
@@ -46,11 +47,12 @@ spec:
             - name: {{ .Release.Name }}-init
               mountPath: /svc/config.toml
               subPath: config.toml
-{{- with .Values.global.imagePullSecrets }}
+  {{- with .Values.global.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
-{{- end }}
+  {{- end }}
       volumes:
         - name: {{ .Release.Name }}-init
           secret:
             secretName: init-secret
+{{- end }}
diff --git a/templates/init_job/init_secret.yaml b/templates/init_job/init_secret.yaml
index 04bf2a7..659b07d 100644
--- a/templates/init_job/init_secret.yaml
+++ b/templates/init_job/init_secret.yaml
@@ -1,3 +1,4 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -6,8 +7,9 @@ type: Opaque
 stringData:
   config.toml: |
     [open_webui]
-    host = "{{ .Release.Name }}-openwebui.{{ $.Release.Namespace }}.svc.cluster.local:8080"
+    host = "{{ include "openwebui.fullname" . }}.{{ $.Release.Namespace }}.svc.cluster.local:8080"
     admin_user = "{{ .Values.openwebui.admin.user | required ".Values.openwebui.admin.user is required" }}"
     admin_email = "{{ .Values.openwebui.admin.email | required ".Values.openwebui.admin.email is required"}}"
     model_ids = [{{ range $name, $model := .Values.models }}"{{ $model.fullName }}",{{ end }}]
   OPENWEBUI_ADMIN_PASSWORD: {{ .Values.openwebui.admin.password | required ".Values.openwebui.admin.password" | quote }}
+{{- end }}
diff --git a/templates/openwebui/deployment.yaml b/templates/openwebui/deployment.yaml
index 02db084..b0d8095 100644
--- a/templates/openwebui/deployment.yaml
+++ b/templates/openwebui/deployment.yaml
@@ -2,7 +2,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ .Release.Name }}-openwebui
+  name: {{ include "openwebui.fullname" . }}
   labels:
     app: openwebui
     release: {{ .Release.Name }}
@@ -48,7 +48,7 @@ spec:
             - name: OAUTH_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-openwebui-oauth
+                  name: {{ include "openwebui.fullname" . }}-oauth
                   key: OAUTH_CLIENT_SECRET
             - name: OAUTH_ADMIN_ROLES
               value: gateway admins
@@ -118,7 +118,7 @@ spec:
   {{- if .Values.openwebui.persistence.enabled }}
         - name: data
           persistentVolumeClaim:
-            claimName: {{ .Release.Name }}-openwebui-data
+            claimName: {{ include "openwebui.fullname" . }}-data
   {{- else if .Values.openwebui.dataClaimName }}
         - name: data
           persistentVolumeClaim:
diff --git a/templates/openwebui/oauth_secret.yaml b/templates/openwebui/oauth_secret.yaml
index 46f1fab..fbb0d2d 100644
--- a/templates/openwebui/oauth_secret.yaml
+++ b/templates/openwebui/oauth_secret.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ .Release.Name }}-openwebui-oauth"
+  name: "{{ include "openwebui.fullname" . }}-oauth"
 type: Opaque
 stringData:
   OAUTH_CLIENT_SECRET: {{ .Values.authentik.oauthApp.clientSecret | required ".Values.authentik.oauthApp.clientSecret is required" }}
diff --git a/templates/openwebui/pvc.yaml b/templates/openwebui/pvc.yaml
index 114f0c0..d1a6dc3 100644
--- a/templates/openwebui/pvc.yaml
+++ b/templates/openwebui/pvc.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: {{ .Release.Name }}-openwebui-data
+  name: {{ include "openwebui.fullname" . }}-data
   labels:
     app: openwebui
     release: {{ .Release.Name }}
diff --git a/templates/openwebui/service.yaml b/templates/openwebui/service.yaml
index 570917d..c9e915f 100644
--- a/templates/openwebui/service.yaml
+++ b/templates/openwebui/service.yaml
@@ -1,7 +1,8 @@
+{{- if .Values.openwebui.enabled }}
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ .Release.Name }}-openwebui
+  name: {{ include "openwebui.fullname" . }}
   labels:
     app: openwebui
     release: {{ .Release.Name }}
@@ -16,3 +17,4 @@ spec:
       targetPort: 8080
       name: http
   type: ClusterIP
+{{- end }}
diff --git a/templates/otlp-openmeter-bridge/configmap.yaml b/templates/otlp-openmeter-bridge/configmap.yaml
index b1a6276..62902a3 100644
--- a/templates/otlp-openmeter-bridge/configmap.yaml
+++ b/templates/otlp-openmeter-bridge/configmap.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: otlp-openmeter-bridge-config
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
diff --git a/templates/otlp-openmeter-bridge/deployment.yaml b/templates/otlp-openmeter-bridge/deployment.yaml
index 0511920..c999984 100644
--- a/templates/otlp-openmeter-bridge/deployment.yaml
+++ b/templates/otlp-openmeter-bridge/deployment.yaml
@@ -2,16 +2,17 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: otlp-openmeter-bridge
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     app: otlp-openmeter-bridge
     release: {{ .Release.Name }}
 spec:
-  replicas: {{ .Values.envoy.telemetry.replicas | default 1 }}
+  replicas: {{ .Values.envoy.telemetry.replicas }}
   selector:
     matchLabels:
       app: otlp-openmeter-bridge
+      release: {{ .Release.Name }}
   template:
     metadata:
       labels:
@@ -24,8 +25,8 @@ spec:
   {{- end }}
       containers:
         - name: bridge
-          image: {{ .Values.envoy.telemetry.image.repository | default "ghcr.io/swissdatasciencecenter/llm-serving/otlp-openmeter-bridge" }}:{{ .Values.envoy.telemetry.image.tag | default .Chart.AppVersion }}
-          imagePullPolicy: {{ .Values.envoy.telemetry.image.pullPolicy | default "IfNotPresent" }}
+          image: {{ .Values.envoy.telemetry.image.repository }}:{{ .Values.envoy.telemetry.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: {{ .Values.envoy.telemetry.image.pullPolicy }}
           ports:
             - containerPort: 4317
               name: grpc
@@ -33,7 +34,7 @@ spec:
             - name: REMOTE_API_URL
               valueFrom:
                 configMapKeyRef:
-                  name: otlp-openmeter-bridge-config
+                  name: {{ include "telemetry.fullname" . }}
                   key: remote-api-url
             - name: GRPC_LISTEN_ADDR
               value: ":4317"
@@ -42,7 +43,7 @@ spec:
             - name: BEARER_TOKEN
               valueFrom:
                 secretKeyRef:
-                  name: otlp-openmeter-bridge-secret
+                  name: {{ include "telemetry.fullname" . }}
                   key: bearer-token
           resources:
             {{- toYaml .Values.envoy.telemetry.resources | nindent 12 }}
diff --git a/templates/otlp-openmeter-bridge/secret.yaml b/templates/otlp-openmeter-bridge/secret.yaml
index dad6770..e2a7a8b 100644
--- a/templates/otlp-openmeter-bridge/secret.yaml
+++ b/templates/otlp-openmeter-bridge/secret.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: otlp-openmeter-bridge-secret
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     release: {{ .Release.Name }}
diff --git a/templates/otlp-openmeter-bridge/service.yaml b/templates/otlp-openmeter-bridge/service.yaml
index 2d48187..015c607 100644
--- a/templates/otlp-openmeter-bridge/service.yaml
+++ b/templates/otlp-openmeter-bridge/service.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: otlp-openmeter-bridge
+  name: {{ include "telemetry.fullname" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     app: otlp-openmeter-bridge
@@ -10,6 +10,7 @@ metadata:
 spec:
   selector:
     app: otlp-openmeter-bridge
+    release: {{ .Release.Name }}
   ports:
     - protocol: TCP
       port: 4317
diff --git a/tools/helm/lint-values.yaml b/tools/helm/lint-values.yaml
index a6e5dcd..92fe23f 100644
--- a/tools/helm/lint-values.yaml
+++ b/tools/helm/lint-values.yaml
@@ -1,3 +1,8 @@
+envoy:
+  telemetry:
+    enabled: true
+    openmeterUrl: https://openmeter.example.invalid
+    bearerToken: dummy
 # Dummy values so `helm template` (just lint) can render required fields.
 authentik:
   authentik:
@@ -13,8 +18,6 @@ openwebui:
   postgres:
     host: pg.example.invalid
     password: dummy
-initJob:
-  image: {}
 models:
   lint:
     fullName: org/lint-model

From 5d3928b47e8b1b124cb8b48175b56ce7d7f5c1e0 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:33:45 +0200
Subject: [PATCH 11/18] refactor(knative): variable for cachePath

---
 templates/models/knative-serving.yaml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/templates/models/knative-serving.yaml b/templates/models/knative-serving.yaml
index c519f3b..a62356f 100644
--- a/templates/models/knative-serving.yaml
+++ b/templates/models/knative-serving.yaml
@@ -4,6 +4,7 @@
   {{- $image := $model.image | default dict }}
   {{- $cacheDir := $model.cacheDir | default dict }}
   {{- $fullname := include "model.fullname" (merge (dict "modelName" $name) $) }}
+  {{- $cachePath := $cacheDir.path | default "/myhome" }}
   {{- if $model.dummy }}
 ---
 apiVersion: serving.knative.dev/v1
@@ -70,11 +71,11 @@ spec:
     {{- end }}
           volumeMounts:
     {{- if $persistence.enabled }}
-          - mountPath: {{ $cacheDir.path | default "/myhome" }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache/
     {{- else if (and $cacheDir $cacheDir.claimName) }}
-          - mountPath: {{ $cacheDir.path | default "/myhome" }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache
     {{- end }}
@@ -180,7 +181,7 @@ spec:
                   key: apiKey
     {{- if or $persistence.enabled $cacheDir }}
             - name: VLLM_CACHE_ROOT
-              value: {{ $cacheDir.path | default "/myhome" }}
+              value: {{ $cachePath }}
     {{- end }}
           startupProbe:
             httpGet:
@@ -218,14 +219,14 @@ spec:
           ports:
             - containerPort: 8000
               protocol: TCP
-          workingDir: {{ $cacheDir.path | default "/myhome" }}
+          workingDir: {{ $cachePath }}
           volumeMounts:
     {{- if $persistence.enabled }}
-          - mountPath: {{ $cacheDir.path | default "/myhome" }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache/
     {{- else if (and $cacheDir $cacheDir.claimName) }}
-          - mountPath: {{ $cacheDir.path | default "/myhome" }}
+          - mountPath: {{ $cachePath }}
             name: pvc-cache
             subPath: {{ $.Values.environment | default "." }}/model_cache
     {{- end }}

From ecc5880c5c3578549ff34d01de11cc24538706c6 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:34:07 +0200
Subject: [PATCH 12/18] refactor(init): fullname helper

---
 templates/_helpers.tpl              |  4 ++++
 templates/init_job/init_job.yaml    | 16 ++++++++--------
 templates/init_job/init_secret.yaml |  2 +-
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index fb811d6..5dc3829 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -24,6 +24,10 @@ Base name for every resource of one model.
 
 Usage: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
 */}}
+{{- define "initjob.fullname" -}}
+  {{- printf "%s-init" .Release.Name -}}
+{{- end -}}
+
 {{- define "model.fullname" -}}
   {{- printf "%s-model-%s" .Release.Name .modelName -}}
 {{- end -}}
diff --git a/templates/init_job/init_job.yaml b/templates/init_job/init_job.yaml
index a9c3813..bde16f5 100644
--- a/templates/init_job/init_job.yaml
+++ b/templates/init_job/init_job.yaml
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: "{{ .Release.Name }}-init-deployment"
+  name: "{{ include "initjob.fullname" . }}-deployment"
   labels:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
@@ -13,7 +13,7 @@ spec:
   backoffLimit: 6
   template:
     metadata:
-      name: "{{.Release.Name}}-init-deployment"
+      name: "{{ include "initjob.fullname" . }}-deployment"
       labels:
         heritage: {{ .Release.Service }}
         release: {{ .Release.Name }}
@@ -25,14 +25,14 @@ spec:
           command: ["sh", "-c", "until curl -f 'http://{{ include "openwebui.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
       containers:
         - name: init-deployment
-          image: {{ .Values.initJob.image.repository | default "ghcr.io/swissdatasciencecenter/llm-serving/init" }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
-          imagePullPolicy: {{ .Values.initJob.image.pullPolicy | default "IfNotPresent" }}
+          image: {{ .Values.initJob.image.repository }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
+          imagePullPolicy: {{ .Values.initJob.image.pullPolicy }}
           args: ["init"]
           env:
             - name: INIT_OPEN_WEBUI__ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-init
+                  name: {{ include "initjob.fullname" . }}
                   key: OPENWEBUI_ADMIN_PASSWORD
             - name: CONFIG_PATH
               value: /svc/config.toml
@@ -44,7 +44,7 @@ spec:
               cpu: 1
               memory: 2Gi
           volumeMounts:
-            - name: {{ .Release.Name }}-init
+            - name: config
               mountPath: /svc/config.toml
               subPath: config.toml
   {{- with .Values.global.imagePullSecrets }}
@@ -52,7 +52,7 @@ spec:
         {{- toYaml . | nindent 8 }}
   {{- end }}
       volumes:
-        - name: {{ .Release.Name }}-init
+        - name: config
           secret:
-            secretName: init-secret
+            secretName: {{ include "initjob.fullname" . }}
 {{- end }}
diff --git a/templates/init_job/init_secret.yaml b/templates/init_job/init_secret.yaml
index 659b07d..ebfc551 100644
--- a/templates/init_job/init_secret.yaml
+++ b/templates/init_job/init_secret.yaml
@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: {{ .Release.Name }}-init
+  name: {{ include "initjob.fullname" . }}
 type: Opaque
 stringData:
   config.toml: |

From daa9aa81d052c81a81eb136065ecb67ae21cc947 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:35:57 +0200
Subject: [PATCH 13/18] fix(envoy): gate httproutes

---
 templates/envoy/gateway.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/templates/envoy/gateway.yaml b/templates/envoy/gateway.yaml
index 8115b5c..ed598c3 100644
--- a/templates/envoy/gateway.yaml
+++ b/templates/envoy/gateway.yaml
@@ -16,6 +16,7 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ include "envoy.fullname" . }}-wildcard-https
+  {{- if .Values.openwebui.enabled }}
     - name: https-openwebui
       protocol: HTTPS
       port: 443
@@ -25,6 +26,8 @@ spec:
         certificateRefs:
           - kind: Secret
             name: {{ include "envoy.fullname" . }}-wildcard-https
+  {{- end }}
+  {{- if .Values.authentik.enabled }}
     - name: https-authentik
       protocol: HTTPS
       port: 443
@@ -39,4 +42,5 @@ spec:
       group: gateway.envoyproxy.io
       kind: EnvoyProxy
       name: {{ include "envoy.fullname" . }}
+  {{- end }}
 {{- end }}

From 036d6385237c25616a794917b1f5a2f79461800c Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:38:15 +0200
Subject: [PATCH 14/18] chore: deduplicate debug values

---
 tools/helm/lint-values.yaml | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/tools/helm/lint-values.yaml b/tools/helm/lint-values.yaml
index 92fe23f..6f3f8ed 100644
--- a/tools/helm/lint-values.yaml
+++ b/tools/helm/lint-values.yaml
@@ -1,9 +1,6 @@
 envoy:
   telemetry:
     enabled: true
-    openmeterUrl: https://openmeter.example.invalid
-    bearerToken: dummy
-# Dummy values so `helm template` (just lint) can render required fields.
 authentik:
   authentik:
     postgresql:
@@ -19,19 +16,16 @@ openwebui:
     host: pg.example.invalid
     password: dummy
 models:
-  lint:
+  lint: &model
     fullName: org/lint-model
     internal: true
     apiKey: dummy
+    persistence: { enabled: true } # renders models/pvc.yaml and the chart-owned claim
     resources:
       requests: { cpu: 1, memory: 1G }
       limits: { cpu: 2, memory: 2G }
   # exercises the external-claim branch (persistence off, no cacheDir.path)
   lint-byoc:
-    fullName: org/lint-byoc
-    internal: true
-    apiKey: dummy
+    <<: *model
+    persistence: { enabled: false }
     cacheDir: { claimName: pvc-example-home }
-    resources:
-      requests: { cpu: 1, memory: 1G }
-      limits: { cpu: 2, memory: 2G }

From 2826b95bf49d1e14759bf3c53bab3d1a2a1ce7b9 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:43:54 +0200
Subject: [PATCH 15/18] fix(just): pass args before chart in helm template

---
 tools/just/helm.just | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/just/helm.just b/tools/just/helm.just
index 0aed117..88a56bf 100644
--- a/tools/just/helm.just
+++ b/tools/just/helm.just
@@ -31,7 +31,7 @@ template *args: fetch-deps
     #!/usr/bin/env bash
     set -eu
     cd "{{root_dir}}"
-    helm template . "$@"
+    helm template "$@" .
 
 # Package the chart for a release tag (e.g. v0.3.0) and push it to GHCR as an OCI artifact.
 publish tag: fetch-deps

From 75fb12b2d0938bb63436b44a764b46608f460314 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 22:54:58 +0200
Subject: [PATCH 16/18] fix: add missing fullname calls

---
 templates/_helpers.tpl                      | 9 ++++++---
 templates/envoy/backend-traffic-policy.yaml | 2 +-
 templates/envoy/client-traffic-policy.yaml  | 2 +-
 templates/envoy/security-policy.yaml        | 2 +-
 templates/init_job/init_job.yaml            | 6 +++---
 templates/openwebui/deployment.yaml         | 2 +-
 templates/postgres_secret.yaml              | 2 +-
 7 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index 5dc3829..13986e8 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -20,14 +20,17 @@ Telemetry bridge full name
 {{- end -}}
 
 {{/*
-Base name for every resource of one model.
-
-Usage: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
+Init job full name.
 */}}
 {{- define "initjob.fullname" -}}
   {{- printf "%s-init" .Release.Name -}}
 {{- end -}}
 
+{{/*
+Base name for every resource of one model.
+
+Usage: {{ include "model.fullname" (merge (dict "modelName" $name) $) }}
+*/}}
 {{- define "model.fullname" -}}
   {{- printf "%s-model-%s" .Release.Name .modelName -}}
 {{- end -}}
diff --git a/templates/envoy/backend-traffic-policy.yaml b/templates/envoy/backend-traffic-policy.yaml
index e392187..095382f 100644
--- a/templates/envoy/backend-traffic-policy.yaml
+++ b/templates/envoy/backend-traffic-policy.yaml
@@ -8,7 +8,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: BackendTrafficPolicy
 metadata:
-  name: {{ .Release.Name }}-model-rate-limit-policy
+  name: {{ include "envoy.fullname" . }}-model-rate-limit
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:
diff --git a/templates/envoy/client-traffic-policy.yaml b/templates/envoy/client-traffic-policy.yaml
index 441fc96..0890ab0 100644
--- a/templates/envoy/client-traffic-policy.yaml
+++ b/templates/envoy/client-traffic-policy.yaml
@@ -4,7 +4,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: ClientTrafficPolicy
 metadata:
-  name: {{ .Release.Name }}-client-buffer-limit
+  name: {{ include "envoy.fullname" . }}-client-buffer-limit
   namespace: {{ .Release.Namespace }}
 spec:
   targetRefs:
diff --git a/templates/envoy/security-policy.yaml b/templates/envoy/security-policy.yaml
index 39f9f79..d535e75 100644
--- a/templates/envoy/security-policy.yaml
+++ b/templates/envoy/security-policy.yaml
@@ -2,7 +2,7 @@
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: SecurityPolicy
 metadata:
-  name: {{ .Release.Name }}-authentik-jwks
+  name: {{ include "envoy.fullname" . }}-authentik-jwks
   namespace: {{ .Release.Namespace }}
 spec:
   targetRef:
diff --git a/templates/init_job/init_job.yaml b/templates/init_job/init_job.yaml
index bde16f5..ff0e9a3 100644
--- a/templates/init_job/init_job.yaml
+++ b/templates/init_job/init_job.yaml
@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: "{{ include "initjob.fullname" . }}-deployment"
+  name: "{{ include "initjob.fullname" . }}"
   labels:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
@@ -13,7 +13,7 @@ spec:
   backoffLimit: 6
   template:
     metadata:
-      name: "{{ include "initjob.fullname" . }}-deployment"
+      name: "{{ include "initjob.fullname" . }}"
       labels:
         heritage: {{ .Release.Service }}
         release: {{ .Release.Name }}
@@ -24,7 +24,7 @@ spec:
           image: alpine/curl:latest
           command: ["sh", "-c", "until curl -f 'http://{{ include "openwebui.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:8080/health'; do echo waiting for openwebui; sleep 2; done"]
       containers:
-        - name: init-deployment
+        - name: init
           image: {{ .Values.initJob.image.repository }}:{{ .Values.initJob.image.tag | default .Chart.AppVersion }}
           imagePullPolicy: {{ .Values.initJob.image.pullPolicy }}
           args: ["init"]
diff --git a/templates/openwebui/deployment.yaml b/templates/openwebui/deployment.yaml
index b0d8095..a2fc638 100644
--- a/templates/openwebui/deployment.yaml
+++ b/templates/openwebui/deployment.yaml
@@ -37,7 +37,7 @@ spec:
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-                  name: {{ .Release.Name }}-postgres
+                  name: {{ include "openwebui.fullname" . }}-postgres
                   key: OPENWEBUI_DATABASE_URL
             - name: ENABLE_OAUTH_SIGNUP
               value: "true"
diff --git a/templates/postgres_secret.yaml b/templates/postgres_secret.yaml
index 70a5d72..b42e349 100644
--- a/templates/postgres_secret.yaml
+++ b/templates/postgres_secret.yaml
@@ -6,7 +6,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: "{{ .Release.Name }}-postgres"
+  name: "{{ include "openwebui.fullname" . }}-postgres"
 type: Opaque
   {{- $pg := .Values.openwebui.postgres }}
   {{- /* One value fills both db and role. */}}

From f3c9c0ee3cee767311846f2255ac306d8c89c6a8 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Fri, 7 Aug 2026 23:51:07 +0200
Subject: [PATCH 17/18] doc: note on authentik blueprints scoping

---
 values.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/values.yaml b/values.yaml
index f7acc61..2a464dd 100644
--- a/values.yaml
+++ b/values.yaml
@@ -94,6 +94,7 @@ authentik:
     bootstrapPassword:
     bootstrapToken:
   blueprints:
+    # Override when two releases share a namespace.
     secrets:
       - authentik-blueprints
   server:

From e9c9879c03485a7c6a80269a746cb2ffba529ac3 Mon Sep 17 00:00:00 2001
From: cmdoret <cyril.mattheydoret@gmail.com>
Date: Sat, 8 Aug 2026 00:09:26 +0200
Subject: [PATCH 18/18] refactor(telemetry): shorter prefix for resource names

---
 templates/_helpers.tpl | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl
index 13986e8..e2cd203 100644
--- a/templates/_helpers.tpl
+++ b/templates/_helpers.tpl
@@ -13,13 +13,15 @@ OpenWebUI full name.
 {{- end -}}
 
 {{/*
-Telemetry bridge full name
+
+Telemetry full name.
 */}}
 {{- define "telemetry.fullname" -}}
-  {{- printf "%s-otlp-openmeter-bridge" .Release.Name -}}
+  {{- printf "%s-telemetry" .Release.Name -}}
 {{- end -}}
 
 {{/*
+
 Init job full name.
 */}}
 {{- define "initjob.fullname" -}}