[jbouder]

What and why

Renames the authz sidecar to proxy everywhere current. Since #168 the gateway (nebari-operator v0.2.0 SecurityPolicy) enforces sign-in and access.groups; the sidecar authorizes nothing. It only proxies requests and records activity for scale to zero, and gives image Apps the single front port 8080. The name authz made readers think the pod checks access. Doing it now, before 0.2.0 (which already carries the image rename from #169) and before the Quay repositories in #85 exist.

Ports (8080 front, 8081 app, 8082 health/activity) and behaviour are unchanged.

Renames

• Component: apps-authz -> apps-proxy ("the proxy sidecar"); binary /apps-proxy.
• Directory and module: authz/ -> proxy/ (git mv), module github.com/nebari-dev/nebari-apps-pack/proxy.
• Image: matrix entry authz -> proxy in images.yaml, so ghcr.io/nebari-dev/apps-pack/proxy and quay.io/nebari/apps-pack-proxy; release.yaml tag path proxy.image.tag; Dependabot directories; CI job authz / "Authz sidecar" -> proxy / "Proxy sidecar", plus the toolchain/Dockerfile checks.
• Chart: authz.* -> proxy.* (values.yaml, values.schema.json, _helpers.tpl nebari-apps.proxyImage, operator args); README regenerated with helm-docs.
• Operator: flags --authz-image, --authz-image-pull-policy, --authz-resources -> --proxy-* (env PROXY_IMAGE, PROXY_IMAGE_PULL_POLICY, PROXY_RESOURCES); container authz -> proxy, port name authz-health -> proxy-health; authz.go/authz_test.go -> proxy.go/proxy_test.go; AuthzImage, DefaultAuthzResources, checkAuthz, addAuthzSidecar etc. -> Proxy*.
• Sidecar env: AUTHZ_LISTEN, AUTHZ_HEALTH_LISTEN, AUTHZ_UPSTREAM -> PROXY_*. AUTHZ_PASSTHROUGH was no longer read and is dropped from comments/tests rather than renamed.
• dev/Makefile: PROXY_IMG := apps-proxy:dev, proxy-image target, --set proxy.image.*.
• CRD/type comments (regenerated CRD and ui/src/lib/crd.gen.ts), API/MCP comments and messages, docs, AGENTS.md, README.md, CONTRIBUTING.md, skill, examples.

What stays, and why

• The mixed-version guard. The sidecar still refuses to start when AUTHZ_GROUPS, AUTHZ_ISSUERS, AUTHZ_JWKS_URL or AUTHZ_CLIENT_ID is set, under those literal old names (with a comment saying why): an older operator that still passes group settings must never run a restricted App open. The error message is unchanged ("AUTHZ_GROUPS is set, but this sidecar no longer checks tokens or groups ...").
• New: the old names of its own settings fail closed too. An operator from before this rename passes AUTHZ_LISTEN/AUTHZ_HEALTH_LISTEN/AUTHZ_UPSTREAM. The proxy would already fail on the missing PROXY_UPSTREAM; it now also says explicitly "AUTHZ_UPSTREAM is set, but this sidecar (apps-proxy, formerly apps-authz) reads PROXY_UPSTREAM: upgrade the apps-operator to match this image". Tested with an exact old-operator environment. The reverse (new operator, old authz image) fails on "AUTHZ_UPSTREAM is required".
• Historical text: CHANGELOG.md and the past "Version notes" in upgrading.md keep their authz wording, except two spots a reader would follow today (the shorter-image-names note now points at proxy, and the 0.1.0 -> 0.2.0 note names proxy.image).
• api/tests/test_authz.py (API route authorization, unrelated) and "authn/authz filter" in operator/cmd/main_test.go (controller-runtime metrics auth) are not about the sidecar.

Docs

New "Upgrading to the proxy sidecar" section at the top of the version notes (renamed image and authz.* -> proxy.* keys, the schema rejects the old key, pods with the sidecar roll once, kubectl logs -c authz -> -c proxy, upgrade chart and images together). The troubleshooting item now covers both mismatch directions.

Checks run

• proxy/: go build, go vet, go test ./... -race, go mod tidy -diff, golangci-lint run: pass.
• operator/: go build, go vet, go test ./... -race, golangci-lint run: pass; envtest suite (k8s 1.37.0): pass. controller-gen v0.21.0 + gen_crd_types.py: no drift beyond the comment changes.
• api/, mcp/: pytest (316 / 71 passed), ruff check, ruff format --check, mypy: pass.
• ui/: npm run check:ci, npm test (288 passed): pass.
• docs/: bun test test, bun run build: pass.
• Chart: helm lint pass; helm-docs (pinned digest from ci.yaml) regenerated README; helm template with examples/nebari-values.yaml renders --proxy-image=ghcr.io/nebari-dev/apps-pack/proxy:0.1.0 etc. and no authz; --set authz.image.tag=x is rejected by the schema.
• check_doc_paths.py, check_versions.py, actionlint 1.7.12: pass.

Not tested on a cluster.

Notes

• Issue Build Images fails on main: Quay returns 401 for the apps-pack-* repositories #85's Quay list should say apps-pack-proxy instead of apps-pack-authz (not edited here).
• If branch protection requires the "Authz sidecar" status check by name, it needs updating to "Proxy sidecar".

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ap1Tqx1QLHRGVVSXdxeduM

[github-actions]

📄 Docs preview for refactor/proxy-sidecar:
https://refactor-proxy-sidecar.apps-pack.pages.dev