tidepool-org · darinkrauss · Dec 30, 2025 · Jan 12, 2026 · Jan 14, 2026 · Jan 22, 2026
diff --git a/charts/tidepool/charts/abbott/README.md b/charts/tidepool/charts/abbott/README.md
@@ -14,6 +14,7 @@ A Helm chart for Kubernetes
 | configmap.redirectURL | string | `""` | OAuth2 redirect URL |
 | configmap.tokenURL | string | `""` | OAuth2 token URL |
 | configmap.authorizeURL | string | `""` | OAuth2 authorization URL |
+| configmap.revokeURL | string | `""` | OAuth2 revoke URL |
 | configmap.jwksURL | string | `""` | JWKS URL |
 | configmap.clientURL | string | `""` | client URL |
 | configmap.scopes | string | `""` | OAuth2 scopes |

diff --git a/charts/tidepool/charts/abbott/templates/0-configmap.yaml b/charts/tidepool/charts/abbott/templates/0-configmap.yaml
@@ -14,6 +14,7 @@ data:
 {{ end }}
   TokenURL: {{ .Values.configmap.tokenURL | default "" }}
   AuthorizeURL: {{ .Values.configmap.authorizeURL | default "" }}
+  RevokeURL: {{ .Values.configmap.revokeURL | default "" }}
   JWKSURL: {{ .Values.configmap.jwksURL | default "" }}
   ClientURL: {{ .Values.configmap.clientURL | default "" }}
   Scopes: {{ .Values.configmap.scopes | default "" }}

diff --git a/charts/tidepool/charts/abbott/values.yaml b/charts/tidepool/charts/abbott/values.yaml
@@ -3,6 +3,7 @@ configmap:
   redirectURL: ""
   tokenURL: ""
   authorizeURL: ""
+  revokeURL: ""
   jwksURL: ""
   clientURL: ""
   scopes: ""

diff --git a/charts/tidepool/charts/auth/templates/1-deployment.yaml b/charts/tidepool/charts/auth/templates/1-deployment.yaml
@@ -8,8 +8,8 @@ metadata:
   name: auth
   namespace: {{.Release.Namespace}}
   annotations:
-    secret.reloader.stakater.com/reload: "server,{{ .Values.mongo.secretName }},abbott,dexcom,twiist,auth"
-    configmap.reloader.stakater.com/reload: "abbott,dexcom,twiist"
+    secret.reloader.stakater.com/reload: "server,{{ .Values.mongo.secretName }},abbott,dexcom,oura,twiist,auth"
+    configmap.reloader.stakater.com/reload: "abbott,dexcom,oura,twiist"
 {{ if .Values.deployment.annotations }}
     {{- .Values.deployment.annotations | toYaml | nindent 4 }}
 {{- end }}
@@ -75,6 +75,12 @@ spec:
               name: abbott
               key: TokenURL
               optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_ABBOTT_REVOKE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: abbott
+              key: RevokeURL
+              optional: true
         - name: TIDEPOOL_SERVICE_PROVIDER_ABBOTT_JWKS_URL
           valueFrom:
             configMapKeyRef:
@@ -125,6 +131,12 @@ spec:
               name: dexcom
               key: TokenURL
               optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_DEXCOM_REVOKE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: dexcom
+              key: RevokeURL
+              optional: true
         - name: TIDEPOOL_SERVICE_PROVIDER_DEXCOM_CLIENT_ID
           valueFrom:
             secretKeyRef:
@@ -143,6 +155,78 @@ spec:
               name: dexcom
               key: StateSalt
               optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: ClientId
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: ClientSecret
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_ACCEPT_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: AcceptURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_AUTHORIZE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: AuthorizeURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_REDIRECT_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: RedirectURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_TOKEN_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: TokenURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_REVOKE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: RevokeURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_SCOPES
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: Scopes
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_STATE_SALT
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: StateSalt
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_CLIENT_ADDRESS
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: ClientURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_PARTNER_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: PartnerURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_PARTNER_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: PartnerSecret
+              optional: true
         - name: TIDEPOOL_SERVICE_PROVIDER_TWIIST_AUTHORIZE_URL
           valueFrom:
             configMapKeyRef:
@@ -161,6 +245,12 @@ spec:
               name: twiist
               key: TokenURL
               optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_TWIIST_REVOKE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: twiist
+              key: RevokeURL
+              optional: true
         - name: TIDEPOOL_SERVICE_PROVIDER_TWIIST_JWKS_URL
           valueFrom:
             configMapKeyRef:

diff --git a/charts/tidepool/charts/data/templates/1-deployment.yaml b/charts/tidepool/charts/data/templates/1-deployment.yaml
@@ -8,8 +8,8 @@ metadata:
   name: data
   namespace: {{.Release.Namespace}}
   annotations:
-    secret.reloader.stakater.com/reload: "server,{{ .Values.mongo.secretName }},abbott,data"
-    configmap.reloader.stakater.com/reload: "abbott"
+    secret.reloader.stakater.com/reload: "server,{{ .Values.mongo.secretName }},abbott,oura,twiist,data"
+    configmap.reloader.stakater.com/reload: "abbott,oura,twiist"
 {{ if .Values.deployment.annotations }}
     {{- .Values.deployment.annotations | toYaml | nindent 4 }}
 {{- end }}
@@ -76,6 +76,12 @@ spec:
               name: abbott
               key: TokenURL
               optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_ABBOTT_REVOKE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: abbott
+              key: RevokeURL
+              optional: true
         - name: TIDEPOOL_SERVICE_PROVIDER_ABBOTT_JWKS_URL
           valueFrom:
             configMapKeyRef:
@@ -126,6 +132,78 @@ spec:
               name: abbott
               key: PartnerURL
               optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: ClientId
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: ClientSecret
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_ACCEPT_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: AcceptURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_AUTHORIZE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: AuthorizeURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_REDIRECT_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: RedirectURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_TOKEN_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: TokenURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_REVOKE_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: RevokeURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_SCOPES
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: Scopes
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_STATE_SALT
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: StateSalt
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_CLIENT_ADDRESS
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: ClientURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_PARTNER_URL
+          valueFrom:
+            configMapKeyRef:
+              name: oura
+              key: PartnerURL
+              optional: true
+        - name: TIDEPOOL_SERVICE_PROVIDER_OURA_PARTNER_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: oura
+              key: PartnerSecret
+              optional: true
         - name: TIDEPOOL_TWIIST_SERVICE_ACCOUNT_IDS
           valueFrom:
             configMapKeyRef:

diff --git a/charts/tidepool/charts/dexcom/README.md b/charts/tidepool/charts/dexcom/README.md
@@ -12,6 +12,7 @@ A Helm chart for Kubernetes
 |-----|------|---------|-------------|
 | configmap.enabled | bool | `true` | whether to generate a configmap |
 | configmap.redirectURL | string | `""` |  |
+| configmap.revokeURL | string | `""` | OAuth2 revoke URL |
 | secret.data_.ClientId | string | `""` | plaintext Dexcom Oauth2 client id |
 | secret.data_.ClientSecret | string | `""` | plaintext Dexcom Oauth2 client secret |
 | secret.data_.StateSalt | string | `""` | plaintext Dexcom Oauth2 state salt |

diff --git a/charts/tidepool/charts/dexcom/templates/0-configmap.yaml b/charts/tidepool/charts/dexcom/templates/0-configmap.yaml
@@ -14,6 +14,7 @@ data:
 {{ end }}
   TokenURL: {{ .Values.configmap.tokenURL | default "https://api.dexcom.com/v1/oauth2/token" }}
   AuthorizeURL: {{ .Values.configmap.authorizeURL | default "https://api.dexcom.com/v1/oauth2/login?prompt=login" }}
+  RevokeURL: {{ .Values.configmap.revokeURL | default "" }}
   ClientURL: {{ .Values.configmap.clientURL | default "https://api.dexcom.com" }}
   Scopes: {{ .Values.configmap.scopes | default "offline_access" }}
 {{ end }}
diff --git a/charts/tidepool/charts/dexcom/values.yaml b/charts/tidepool/charts/dexcom/values.yaml
@@ -12,5 +12,6 @@ configmap:
   # -- whether to generate a configmap
   enabled: true
   redirectURL: ""
+  revokeURL: ""
   clientURL: "https://api.dexcom.com"
 
diff --git a/charts/tidepool/charts/kafka/README.md b/charts/tidepool/charts/kafka/README.md
@@ -19,6 +19,7 @@ A Helm chart for Kubernetes
 | configmap.UserEventsTopic | string | `"user-events"` | name for the user events topic |
 | configmap.Version | string | `"2.4.0"` | required version of Kafka server |
 | configmap.enabled | bool | `true` | whether to generate a configmap  |
+| connect.image | string | `""` | image (registry, name, tag) to use for Kakfa connect |
 
 ----------------------------------------------
 Autogenerated from chart metadata using [helm-docs v1.3.0](https://github.com/norwoodj/helm-docs/releases/v1.3.0)
diff --git a/charts/tidepool/charts/kafka/templates/1-kafka-connect-mongo-cluster.yaml b/charts/tidepool/charts/kafka/templates/1-kafka-connect-mongo-cluster.yaml
@@ -50,7 +50,7 @@ spec:
         secret:
           secretName: {{ .Values.keycloak.secretName }}
 {{- end }}
-  image: tidepool/connect-debezium:0.48.0-kafka-4.1.0-mongo-1.14.1-pg-1.9.6
+  image: {{ .Values.connect.image | quote }}
   replicas: {{ .Values.global.kafka.connect.replicas | int }}
 {{ if .Values.global.kafka.connect.tlsEnabled }}
   tls:

diff --git a/charts/tidepool/charts/kafka/values.yaml b/charts/tidepool/charts/kafka/values.yaml
@@ -41,6 +41,8 @@ configmap:
   Username: "admin"
   # -- required version of Kafka server
   Version: "2.5.0"
+connect:
+  image: "tidepool/connect-debezium:0.48.0-kafka-4.1.0-mongo-1.14.1-pg-1.9.6" 
 mongo:
   secretName: "mongo"
 keycloak:

diff --git a/charts/tidepool/charts/oura/.helmignore b/charts/tidepool/charts/oura/.helmignore
@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/tidepool/charts/oura/Chart.yaml b/charts/tidepool/charts/oura/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v1
+appVersion: "1.0"
+description: A Helm chart for Kubernetes
+name: oura
+version: 0.1.0
+home: https://github.com/tidepool-org/development/charts
diff --git a/charts/tidepool/charts/oura/README.md b/charts/tidepool/charts/oura/README.md
@@ -0,0 +1,29 @@
+# oura
+
+![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![AppVersion: 1.0](https://img.shields.io/badge/AppVersion-1.0-informational?style=flat-square)
+
+A Helm chart for Kubernetes
+
+**Homepage:** <https://github.com/tidepool-org/development/charts>
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| configmap.enabled | bool | `false` | whether to generate a configmap |
+| configmap.acceptURL | string | `""` | OAuth2 accept URL |
+| configmap.authorizeURL | string | `""` | OAuth2 authorization URL |
+| configmap.redirectURL | string | `""` | OAuth2 redirect URL |
+| configmap.tokenURL | string | `""` | OAuth2 token URL |
+| configmap.revokeURL | string | `""` | OAuth2 revoke URL |
+| configmap.scopes | string | `""` | OAuth2 scopes |
+| configmap.clientURL | string | `""` | client URL |
+| configmap.partnerURL | string | `""` | partner URL |
+| secret.enabled | bool | `false` | whether to create a secret |
+| secret.data_.clientId | string | `""` | plaintext OAuth2 client id |
+| secret.data_.clientSecret | string | `""` | plaintext OAuth2 client secret |
+| secret.data_.stateSalt | string | `""` | plaintext OAuth2 state salt |
+| secret.data_.partnerSecret | string | `""` | plaintext partner secret |
+
+----------------------------------------------
+Autogenerated from chart metadata using [helm-docs v1.3.0](https://github.com/norwoodj/helm-docs/releases/v1.3.0)
diff --git a/charts/tidepool/charts/oura/templates/0-configmap.yaml b/charts/tidepool/charts/oura/templates/0-configmap.yaml
@@ -0,0 +1,22 @@
+{{ if .Values.configmap.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: oura
+  namespace: {{ .Release.Namespace }}
+  labels:
+{{ include "charts.labels.standard" . }}
+data:
+  AcceptURL: {{ .Values.configmap.acceptURL | default "" }}
+  AuthorizeURL: {{ .Values.configmap.authorizeURL | default "" }}
+{{ if .Values.configmap.redirectURL }}
+  RedirectURL: {{ .Values.configmap.redirectURL }}
+{{ else }}
+  RedirectURL: "{{include "charts.host.api" .}}/v1/oauth/oura/redirect"
+{{ end }}
+  TokenURL: {{ .Values.configmap.tokenURL | default "" }}
+  RevokeURL: {{ .Values.configmap.revokeURL | default "" }}
+  Scopes: {{ .Values.configmap.scopes | default "" }}
+  ClientURL: {{ .Values.configmap.clientURL | default "" }}
+  PartnerURL: {{ .Values.configmap.partnerURL | default "" }}
+{{ end }}