From d954ba92f67f46eb8fa7aaa4d713ebf34eaecb5f Mon Sep 17 00:00:00 2001
From: Matthias Erll <merll@akamai.com>
Date: Mon, 5 Oct 2026 10:00:14 +0200
Subject: [PATCH 1/2] chore: remove kubeflow-pipelines

---
 src/openapi/app.yaml      |  1 -
 src/openapi/settings.yaml |  4 ----
 src/otomi-stack.ts        |  1 -
 src/validators.ts         |  1 -
 test/apps.yaml            | 11 -----------
 test/core.yaml            |  4 ----
 6 files changed, 22 deletions(-)

diff --git a/src/openapi/app.yaml b/src/openapi/app.yaml
index be31e3d5c..d80b0b7c2 100644
--- a/src/openapi/app.yaml
+++ b/src/openapi/app.yaml
@@ -17,7 +17,6 @@ AppList:
     - keycloak
     - knative
     - kserve
-    - kubeflow-pipelines
     - kyverno
     - loki
     - otel
diff --git a/src/openapi/settings.yaml b/src/openapi/settings.yaml
index 99ccff0ab..1500061c0 100644
--- a/src/openapi/settings.yaml
+++ b/src/openapi/settings.yaml
@@ -125,10 +125,6 @@ Settings:
                           type: string
                           $ref: 'definitions.yaml#/wordCharacterPattern'
                           default: gitea
-                        kubeflow-pipelines:
-                          type: string
-                          $ref: 'definitions.yaml#/wordCharacterPattern'
-                          default: kubeflow-pipelines
                   required:
                     - region
                     - accessKeyId
diff --git a/src/otomi-stack.ts b/src/otomi-stack.ts
index 481f61809..491d3448e 100644
--- a/src/otomi-stack.ts
+++ b/src/otomi-stack.ts
@@ -448,7 +448,6 @@ export default class OtomiStack {
         harbor: `lke${lkeClusterId}-harbor`,
         loki: `lke${lkeClusterId}-loki`,
         gitea: `lke${lkeClusterId}-gitea`,
-        'kubeflow-pipelines': `lke${lkeClusterId}-kubeflow-pipelines`,
       }
       const objectStorageClient = new ObjectStorageClient(data.apiToken)
       // Create object storage buckets
diff --git a/src/validators.ts b/src/validators.ts
index 65bf8a27d..81f731a2e 100644
--- a/src/validators.ts
+++ b/src/validators.ts
@@ -103,7 +103,6 @@ export const OBJ_STORAGE_APPS = json({
   default: [
     { appId: 'harbor', required: false },
     { appId: 'loki', required: false },
-    { appId: 'kubeflow-pipelines', required: true },
   ],
 })
 export const ROOT_KEYCLOAK_USER = str({
diff --git a/test/apps.yaml b/test/apps.yaml
index 27471f246..2a5b869ad 100644
--- a/test/apps.yaml
+++ b/test/apps.yaml
@@ -137,17 +137,6 @@ appsInfo:
       - https://kyverno.io/docs/kyverno-policies/
     license: Apache 2.0
     about: Kyverno is a policy engine designed for Kubernetes. It can validate, mutate, and generate configurations using admission controls and background scans. Kyverno policies are Kubernetes resources and do not require learning a new language.
-  kubeflow-pipelines:
-    title: Kubeflow-Pipelines
-    appVersion: 2.4.0
-    repo: https://github.com/kubeflow/pipelines
-    maintainers: Kubeflow
-    relatedLinks:
-      - https://www.kubeflow.org/docs/components/pipelines/overview/
-      - https://kubeflow.org
-    license: Apache 2.0
-    about: Kubeflow pipelines are reusable end-to-end ML workflows built using the Kubeflow Pipelines SDK.
-    isAlpha: true
   tekton:
     title: Tekton Pipelines
     appVersion: 1.3.1
diff --git a/test/core.yaml b/test/core.yaml
index 478b3abea..cca0bf017 100644
--- a/test/core.yaml
+++ b/test/core.yaml
@@ -44,10 +44,6 @@ k8s:
       app: knative
       disablePolicyChecks: true
       disableIstioInjection: true
-    - name: kfp
-      app: kubeflow-pipelines
-      disablePolicyChecks: true
-      disableIstioInjection: true
     - name: kyverno
       app: kyverno
       disableIstioInjection: true

From 70edff02c28a06a1b79e588db356093897074bee Mon Sep 17 00:00:00 2001
From: Matthias Erll <merll@akamai.com>
Date: Mon, 5 Oct 2026 11:04:52 +0200
Subject: [PATCH 2/2] chore: sync core.yaml

---
 test/core.yaml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/test/core.yaml b/test/core.yaml
index cca0bf017..dc58e598d 100644
--- a/test/core.yaml
+++ b/test/core.yaml
@@ -29,6 +29,8 @@ k8s:
       app: grafana
     - name: istio-system
       disableIstioInjection: true
+    - name: dex
+      app: dex
     - name: keycloak
     - name: apl-keycloak-operator
       disableIstioInjection: true
@@ -97,6 +99,7 @@ adminApps:
     tags: [cicd, gitops]
     isShared: true
     ownHost: true
+    oidcCallbackPath: /auth/callback
   - name: cert-manager
     tags: [ingress, security, tls]
   - name: cnpg
@@ -107,20 +110,25 @@ adminApps:
     ownHost: true
   - name: external-dns
     tags: [ingress, security, tls]
+  - name: external-secrets
+    tags: [secrets, security]
   - name: gitea
     tags: [git]
     isShared: true
     ownHost: true
     path: /user/oauth2/otomi-idp
+    oidcCallbackPath: /user/oauth2/otomi-idp/callback
   - name: grafana
     tags: [tracing, telemetry, observability]
     deps: [prometheus]
     path: /dashboards
     ownHost: true
+    oidcCallbackPath: /login/generic_oauth
   - name: harbor
     tags: [security]
     isShared: true
     ownHost: true
+    oidcCallbackPath: /c/oidc/callback
   - name: hello
     hide: true
     tags: [demo]
@@ -133,10 +141,6 @@ adminApps:
   - name: knative
     tags: [serverless, functions]
     deps: [istio]
-  - name: kubeflow-pipelines
-    tags: [ai, ml]
-    ownHost: true
-    isShared: true
   - name: kserve
     tags: [ai]
   - name: tekton
@@ -161,7 +165,6 @@ adminApps:
     ownHost: true
   - name: sealed-secrets
     tags: [secrets, security, observability]
-    ownHost: true
   - name: otel
     tags: [logging, tracing]
   - name: trivy
@@ -179,6 +182,7 @@ teamApps:
   - name: grafana
     ownHost: true
     path: /dashboards
+    oidcCallbackPath: /login/generic_oauth
   - name: loki
     useHost: grafana
     path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A","expr":"","queryType":"range","datasource":%7B"type":"loki","uid":"loki"%7D%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D