From 9fcd6699d719e2014ab1ab18ca86a728d60a1f5b Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Fri, 28 Aug 2026 13:27:42 +0200
Subject: [PATCH 01/14] depend in nebari app library chart

---
 chart/templates/NOTES.txt      |  15 -----
 chart/templates/nebariapp.yaml | 111 ++++++---------------------------
 chart/values.yaml              |  43 +++++++------
 3 files changed, 41 insertions(+), 128 deletions(-)

diff --git a/chart/templates/NOTES.txt b/chart/templates/NOTES.txt
index 4794381..5f6a5e3 100644
--- a/chart/templates/NOTES.txt
+++ b/chart/templates/NOTES.txt
@@ -3,27 +3,12 @@
 The RayService controller manages the Ray cluster and Serve proxy.
 Serve is pre-initialized with host 0.0.0.0 on port 8000.
 
-{{- if .Values.nebariapp.enabled }}
-
-NebariApp is ENABLED. The nebari-operator will configure:
-  {{- if ne (toString (dig "serve" "enabled" true .Values.nebariapp)) "false" }}
-  - HTTPRoute for Ray Serve: {{ .Values.nebariapp.hostname }}
-  {{- end }}
-  {{- if .Values.nebariapp.dashboard.enabled }}
-  - HTTPRoute for Ray Dashboard: {{ .Values.nebariapp.dashboard.hostname }}
-  {{- end }}
-  {{- if .Values.nebariapp.auth.enabled }}
-  - OIDC authentication via {{ .Values.nebariapp.auth.provider }}
-  {{- end }}
-
-{{- else }}
 
 To access locally:
 
   kubectl port-forward svc/{{ include "nebari-rayserve.serve-service-name" . }} 8000:8000 -n {{ .Release.Namespace }}
   kubectl port-forward svc/{{ include "nebari-rayserve.head-service-name" . }} 8265:8265 -n {{ .Release.Namespace }}
 
-{{- end }}
 
 === Deploying Models ===
 
diff --git a/chart/templates/nebariapp.yaml b/chart/templates/nebariapp.yaml
index 59285d3..cfb8f16 100644
--- a/chart/templates/nebariapp.yaml
+++ b/chart/templates/nebariapp.yaml
@@ -1,96 +1,25 @@
-{{- if and .Values.nebariapp.enabled (ne (toString (dig "serve" "enabled" true .Values.nebariapp)) "false") }}
-{{- if .Values.nebariapp.hostname }}
+{{- if .Values.nebariapp.serve.enabled -}}
 # NebariApp for Ray Serve endpoint
-apiVersion: reconcilers.nebari.dev/v1
-kind: NebariApp
-metadata:
-  name: {{ include "nebari-rayserve.fullname" . }}
-  labels:
-    {{- include "nebari-rayserve.labels" . | nindent 4 }}
-spec:
-  hostname: {{ .Values.nebariapp.hostname }}
-  service:
-    name: {{ .Values.nebariapp.service.name | default (include "nebari-rayserve.serve-service-name" .) }}
-    port: {{ .Values.nebariapp.service.servePort }}
-  routing:
-    routes:
-      - pathPrefix: /
-        pathType: PathPrefix
-  {{- if .Values.nebariapp.auth.enabled }}
-  auth:
-    enabled: true
-    provider: {{ .Values.nebariapp.auth.provider }}
-    provisionClient: {{ .Values.nebariapp.auth.provisionClient }}
-    redirectURI: {{ .Values.nebariapp.auth.redirectURI }}
-    scopes:
-      {{- toYaml .Values.nebariapp.auth.scopes | nindent 6 }}
-
-  {{- end }}
-  gateway: {{ .Values.nebariapp.gateway }}
-{{- end }}
+{{ include "nebari-app.nebariApp" (dict
+    "metadata" (dict
+      "name"      (include "nebari-rayserve.fullname" .)
+      "namespace" .Release.Namespace
+      "labels"    (include "nebari-rayserve.labels" . | fromYaml)
+    )
+    "spec"   (omit .Values.nebariapp.serve "enabled")
+    "tplCtx" .
+) -}}
 {{- end }}
 ---
-{{- if and .Values.nebariapp.enabled .Values.nebariapp.dashboard.enabled }}
+{{- if .Values.nebariapp.dashboard.enabled -}}
 # NebariApp for Ray Dashboard
-apiVersion: reconcilers.nebari.dev/v1
-kind: NebariApp
-metadata:
-  name: {{ include "nebari-rayserve.fullname" . }}-dashboard
-  labels:
-    {{- include "nebari-rayserve.labels" . | nindent 4 }}
-spec:
-  hostname: {{ required "nebariapp.dashboard.hostname is required when dashboard is enabled" .Values.nebariapp.dashboard.hostname }}
-  service:
-    name: {{ .Values.nebariapp.service.name | default (include "nebari-rayserve.head-service-name" .) }}
-    port: {{ .Values.nebariapp.service.dashboardPort }}
-  routing:
-    routes:
-      - pathPrefix: /
-        pathType: PathPrefix
-  {{- if .Values.nebariapp.auth.enabled }}
-  auth:
-    enabled: true
-    provider: {{ .Values.nebariapp.auth.provider }}
-    provisionClient: {{ .Values.nebariapp.auth.provisionClient }}
-    redirectURI: {{ .Values.nebariapp.auth.redirectURI }}
-    scopes:
-      {{- toYaml .Values.nebariapp.auth.scopes | nindent 6 }}
-
-  {{- end }}
-  {{- with .Values.nebariapp.dashboard.landingPage }}
-  landingPage:
-    enabled: {{ .enabled | default false }}
-    {{- with .displayName }}
-    displayName: {{ . | quote }}
-    {{- end }}
-    {{- with .description }}
-    description: {{ . | quote }}
-    {{- end }}
-    {{- with .icon }}
-    icon: {{ . | quote }}
-    {{- end }}
-    {{- with .category }}
-    category: {{ . | quote }}
-    {{- end }}
-    {{- if kindIs "float64" .priority }}
-    priority: {{ .priority }}
-    {{- end }}
-    {{- with .externalUrl }}
-    externalUrl: {{ . | quote }}
-    {{- end }}
-    {{- with .healthCheck }}
-    healthCheck:
-      enabled: {{ .enabled | default false }}
-      {{- with .path }}
-      path: {{ . | quote }}
-      {{- end }}
-      {{- if .intervalSeconds }}
-      intervalSeconds: {{ .intervalSeconds }}
-      {{- end }}
-      {{- if .timeoutSeconds }}
-      timeoutSeconds: {{ .timeoutSeconds }}
-      {{- end }}
-    {{- end }}
-  {{- end }}
-  gateway: {{ .Values.nebariapp.gateway }}
+{{ include "nebari-app.nebariApp" (dict
+    "metadata" (dict
+      "name"      (printf "%s-dashboard" (include "nebari-rayserve.fullname" .))
+      "namespace" .Release.Namespace
+      "labels"    (include "nebari-rayserve.labels" . | fromYaml)
+    )
+    "spec"   (omit .Values.nebariapp.dashboard "enabled")
+    "tplCtx" .
+) -}}
 {{- end }}
diff --git a/chart/values.yaml b/chart/values.yaml
index b25c4d7..53ab21e 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -1,16 +1,25 @@
 # =============================================================================
 # Nebari Integration
 # =============================================================================
-# Creates a NebariApp CRD that configures routing, TLS, and auth via nebari-operator.
-# Set enabled: true when deploying on a Nebari cluster.
+# Creates NebariApp CRs that configure routing, TLS, and auth via nebari-operator.
 nebariapp:
-  enabled: false
-  # hostname: rayserve.nebari.example.com  # Required when serve.enabled is true
   serve:
-    enabled: false  # Set to true and provide nebariapp.hostname to expose the serve endpoint externally
+    enabled: false
+    hostname: '{{ fail "nebariapps.serve.hostname is required if nebariapps.serve.enabled is true" }}'
+    service:
+      name: '{{ include "nebari-rayserve.serve-service-name" . | toJson }}'
+      port: 8000
+    gateway: public
+    routing:
+      routes:
+        - pathPrefix: /
+          pathType: PathPrefix
   dashboard:
-    enabled: true
-    # hostname: ray-dashboard.nebari.example.com  # Separate hostname for dashboard
+    enabled: false
+    hostname: '{{ fail "nebariapps.dashboard.hostname is required if nebariapps.dashboard.enabled is true" }}'
+    service:
+      name: '{{ include "nebari-rayserve.head-service-name" . | toJson }}'
+      port: 8265
     landingPage:
       enabled: false
       displayName: "Ray Dashboard"
@@ -23,21 +32,11 @@ nebariapp:
         path: /api/component_activities
         intervalSeconds: 30
         timeoutSeconds: 5
-  service:
-    name: ""   # Defaults to <release>-<chart>-serve-svc (serve) or -head-svc (dashboard)
-    servePort: 8000
-    dashboardPort: 8265
-  auth:
-    enabled: false
-    provider: keycloak
-    provisionClient: true
-    redirectURI: /oauth2/callback
-    scopes:
-      - openid
-      - profile
-      - email
-
-  gateway: public
+    gateway: public
+    routing:
+      routes:
+        - pathPrefix: /
+          pathType: PathPrefix
 
 # =============================================================================
 # KubeRay Operator

From 9768151bf9fc48ed2c3a085c68deec43ded5820d Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Fri, 28 Aug 2026 17:43:58 +0200
Subject: [PATCH 02/14] fix CI

---
 .github/workflows/lint.yaml | 16 ++--------------
 .github/workflows/test.yaml |  3 ++-
 .gitignore                  |  1 -
 chart/Chart.lock            |  9 +++++++++
 chart/Chart.yaml            |  3 +++
 5 files changed, 16 insertions(+), 16 deletions(-)
 create mode 100644 chart/Chart.lock

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 4ba8f14..801e7a3 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -21,22 +21,10 @@ jobs:
       - name: Lint chart
         run: helm lint chart/
 
-      - name: Template chart (NebariApp disabled)
-        run: helm template test chart/ --set nebariapp.enabled=false
-
       - name: Template chart (NebariApp enabled)
         run: |
           helm template test chart/ \
-            --set nebariapp.enabled=true \
-            --set nebariapp.hostname=test.example.com \
+            --set nebariapp.serve.enabled=true \
+            --set nebariapp.serve.hostname=test.example.com \
             --set nebariapp.dashboard.enabled=true \
             --set nebariapp.dashboard.hostname=dashboard.example.com
-
-      - name: Template chart (NebariApp + auth enabled)
-        run: |
-          helm template test chart/ \
-            --set nebariapp.enabled=true \
-            --set nebariapp.hostname=test.example.com \
-            --set nebariapp.dashboard.enabled=true \
-            --set nebariapp.dashboard.hostname=dashboard.example.com \
-            --set nebariapp.auth.enabled=true
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 640019a..c476a09 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -33,7 +33,8 @@ jobs:
         run: |
           helm install rayserve chart/ \
             --set kuberay-operator.enabled=false \
-            --set nebariapp.enabled=false \
+            --set nebariapp.serve.enabled=false \
+            --set nebariapp.dashboard.enabled=false \
             --set head.resources.requests.cpu=500m \
             --set head.resources.requests.memory=512Mi \
             --set head.resources.limits.cpu=1 \
diff --git a/.gitignore b/.gitignore
index 71dcf0d..27aee61 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,5 @@
 # Helm
 chart/charts/
-chart/Chart.lock
 
 # Dev environment
 dev/.cache/
diff --git a/chart/Chart.lock b/chart/Chart.lock
new file mode 100644
index 0000000..55fd8cd
--- /dev/null
+++ b/chart/Chart.lock
@@ -0,0 +1,9 @@
+dependencies:
+- name: nebari-app
+  repository: oci://quay.io/reiemp/charts
+  version: 0.1.2
+- name: kuberay-operator
+  repository: https://ray-project.github.io/kuberay-helm/
+  version: 1.3.0
+digest: sha256:9e9345b359fb1be3ec07a39e1fbe3ce0b600309715741d318087170486ba8cde
+generated: "2026-08-28T17:43:29.042013605+02:00"
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index ba07c8b..8092251 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -5,6 +5,9 @@ type: application
 version: 0.4.1
 appVersion: "2.43.0"
 dependencies:
+  - name: nebari-app
+    repository: oci://quay.io/reiemp/charts
+    version: "0.1.2"
   - name: kuberay-operator
     version: 1.3.0
     repository: https://ray-project.github.io/kuberay-helm/

From 915643e62a4da6f8b238e5fa07b568200fe20843 Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 3 Sep 2026 14:36:56 +0200
Subject: [PATCH 03/14] fix integration CI

---
 .github/workflows/test-integration.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index 331462f..d1a618f 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -119,7 +119,7 @@ jobs:
           helm install rayserve chart/ \
             --set kuberay-operator.enabled=false \
             --set nebariapp.enabled=true \
-            --set nebariapp.hostname=rayserve.nebari.local \
+            --set nebariapp.serve.hostname=rayserve.nebari.local \
             --set nebariapp.serve.enabled=true \
             --set nebariapp.dashboard.enabled=true \
             --set nebariapp.dashboard.hostname=ray-dashboard.nebari.local \

From e549df23f7e5ad6c9b51122d7af41b0ea9986f84 Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 3 Sep 2026 14:37:43 +0200
Subject: [PATCH 04/14] upgrade dev chart version

---
 chart/Chart.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index 8092251..185dec4 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -7,7 +7,7 @@ appVersion: "2.43.0"
 dependencies:
   - name: nebari-app
     repository: oci://quay.io/reiemp/charts
-    version: "0.1.2"
+    version: "0.1.3"
   - name: kuberay-operator
     version: 1.3.0
     repository: https://ray-project.github.io/kuberay-helm/

From 48b4d63334a95ad0f11a26dff87a008987eeb2b0 Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 3 Sep 2026 14:57:12 +0200
Subject: [PATCH 05/14] reinstate notes

---
 chart/templates/NOTES.txt | 27 +++++++++++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/chart/templates/NOTES.txt b/chart/templates/NOTES.txt
index 5f6a5e3..22a1884 100644
--- a/chart/templates/NOTES.txt
+++ b/chart/templates/NOTES.txt
@@ -3,12 +3,35 @@
 The RayService controller manages the Ray cluster and Serve proxy.
 Serve is pre-initialized with host 0.0.0.0 on port 8000.
 
+{{ $tplCtx := . }}
+{{- range $name, $component := dict 
+  "Ray Serve" (dict
+    "nebariapp"  .Values.nebariapp.serve
+    "serviceName" (include "nebari-rayserve.serve-service-name" .)
+    "servicePort" 8000
+    )
+  "Ray Dashboard" (dict
+    "nebariapp"  .Values.nebariapp.dashboard
+    "serviceName" (include "nebari-rayserve.head-service-name" .)
+    "servicePort" 8265
+) -}}
+{{- if $component.nebariapp.enabled }}
+{{- $nebariapp := include "nebari-app.deepTplJson" (dict "value" (omit $component.nebariapp "enabled") "ctx" $tplCtx) | fromJson }}
+
+NebariApp  for {{ $name }} is ENABLED. The nebari-operator will configure:
+  - HTTPRoute: {{ $nebariapp.hostname }}
+  {{- if (and $nebariapp.auth $nebariapp.auth.enabled) }}
+  - OIDC authentication via {{ $nebariapp.auth.provider | default "keycloak" }}
+  {{- end }}
+
+{{- else }}
 
 To access locally:
 
-  kubectl port-forward svc/{{ include "nebari-rayserve.serve-service-name" . }} 8000:8000 -n {{ .Release.Namespace }}
-  kubectl port-forward svc/{{ include "nebari-rayserve.head-service-name" . }} 8265:8265 -n {{ .Release.Namespace }}
+  kubectl port-forward svc/{{ $component.serviceName }} {{ $component.servicePort }}:{{ $component.servicePort }} -n {{ $tplCtx.Release.Namespace }}
 
+{{- end }}
+{{- end }}
 
 === Deploying Models ===
 

From 0deab2126326387bb62de8d2a775b5aae61ec116 Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 3 Sep 2026 15:35:14 +0200
Subject: [PATCH 06/14] remove gateway config

---
 chart/values.yaml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/chart/values.yaml b/chart/values.yaml
index 53ab21e..236f212 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -9,7 +9,6 @@ nebariapp:
     service:
       name: '{{ include "nebari-rayserve.serve-service-name" . | toJson }}'
       port: 8000
-    gateway: public
     routing:
       routes:
         - pathPrefix: /
@@ -32,7 +31,6 @@ nebariapp:
         path: /api/component_activities
         intervalSeconds: 30
         timeoutSeconds: 5
-    gateway: public
     routing:
       routes:
         - pathPrefix: /

From ce57836e922b63f9c28c2f72e88fc42933c3604f Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 3 Sep 2026 15:42:23 +0200
Subject: [PATCH 07/14] fix README

---
 README.md | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/README.md b/README.md
index 785a93f..2cd845a 100644
--- a/README.md
+++ b/README.md
@@ -70,17 +70,13 @@ spec:
       releaseName: rayserve
       values: |
         nebariapp:
-          enabled: true
           serve:
             enabled: false  # Keep serve endpoint internal-only
           dashboard:
             enabled: true
             hostname: ray-dashboard.example.com
-          auth:
-            enabled: true
-            provider: keycloak
-            provisionClient: true
-            redirectURI: /oauth2/callback
+            auth:
+              enabled: true
   destination:
     server: https://kubernetes.default.svc
     namespace: rayserve
@@ -195,14 +191,12 @@ Key values in `chart/values.yaml`:
 
 | Value | Default | Description |
 |-------|---------|-------------|
-| `nebariapp.enabled` | `false` | Create NebariApp resources for routing/TLS/auth |
 | `nebariapp.serve.enabled` | `false` | Expose the serve endpoint externally (set `false` to keep internal-only) |
-| `nebariapp.hostname` | - | Hostname for the Ray Serve endpoint (required when serve.enabled) |
-| `nebariapp.dashboard.enabled` | `true` | Create a separate NebariApp for the Ray Dashboard |
-| `nebariapp.dashboard.hostname` | - | Hostname for the Ray Dashboard (required when dashboard enabled) |
-| `nebariapp.auth.enabled` | `false` | Enable OIDC authentication via Keycloak |
-| `nebariapp.auth.redirectURI` | `/oauth2/callback` | OAuth callback path (Envoy Gateway rejects `/`) |
-| `nebariapp.gateway` | `public` | Gateway to use (`public` or `internal`) |
+| `nebariapp.serve.hostname` | - | Hostname for the Ray Serve endpoint (required when serve.enabled) |
+| `nebariapp.serve.auth.enabled` | `false` | Enable OIDC authentication for the Ray Serve endpoint via Keycloak |
+| `nebariapp.dashboard.enabled` | `false` | Create a separate NebariApp for the Ray Dashboard |
+| `nebariapp.dashboard.hostname` | - | Hostname for the Ray Dashboard (required when dashboard.enabled) |
+| `nebariapp.dashboard.auth.enabled` | `false` | Enable OIDC authentication for the Ray Dashboard endpoint via Keycloak |
 
 ### Ray Cluster
 

From e405db43e6e278c3caacab869772fc9563de6107 Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Mon, 7 Sep 2026 08:45:10 +0200
Subject: [PATCH 08/14] use official chart

---
 .github/workflows/test-integration.yaml | 6 +++---
 chart/Chart.lock                        | 8 ++++----
 chart/Chart.yaml                        | 4 ++--
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index d1a618f..5db63aa 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -178,12 +178,12 @@ jobs:
           # "generation is 2, but latest observed generation is 1".
           helm upgrade rayserve chart/ \
             --set kuberay-operator.enabled=false \
-            --set nebariapp.enabled=true \
-            --set nebariapp.hostname=rayserve.nebari.local \
             --set nebariapp.serve.enabled=true \
+            --set nebariapp.serve.hostname=rayserve.nebari.local \
+            --set nebariapp.serve.auth.enabled=true \
             --set nebariapp.dashboard.enabled=true \
             --set nebariapp.dashboard.hostname=ray-dashboard.nebari.local \
-            --set nebariapp.auth.enabled=true \
+            --set nebariapp.dashboard.auth.enabled=true \
             --set head.resources.requests.cpu=500m \
             --set head.resources.requests.memory=512Mi \
             --set head.resources.limits.cpu=1 \
diff --git a/chart/Chart.lock b/chart/Chart.lock
index 55fd8cd..8ff50e8 100644
--- a/chart/Chart.lock
+++ b/chart/Chart.lock
@@ -1,9 +1,9 @@
 dependencies:
 - name: nebari-app
-  repository: oci://quay.io/reiemp/charts
-  version: 0.1.2
+  repository: oci://quay.io/nebari/charts
+  version: 0.1.1
 - name: kuberay-operator
   repository: https://ray-project.github.io/kuberay-helm/
   version: 1.3.0
-digest: sha256:9e9345b359fb1be3ec07a39e1fbe3ce0b600309715741d318087170486ba8cde
-generated: "2026-08-28T17:43:29.042013605+02:00"
+digest: sha256:2b718f48309bcdad46da4d24aae42d6e321c2399dc07f91b9a94791082eb567b
+generated: "2026-09-07T08:44:08.940992973+02:00"
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index 185dec4..dd80b5a 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -6,8 +6,8 @@ version: 0.4.1
 appVersion: "2.43.0"
 dependencies:
   - name: nebari-app
-    repository: oci://quay.io/reiemp/charts
-    version: "0.1.3"
+    repository: oci://quay.io/nebari/charts
+    version: "0.1.1"
   - name: kuberay-operator
     version: 1.3.0
     repository: https://ray-project.github.io/kuberay-helm/

From c1cb74a8df21d50bbe05c0b0df0e5ddbffaf3fbe Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Mon, 7 Sep 2026 08:47:34 +0200
Subject: [PATCH 09/14] cleanup

---
 .github/workflows/test-integration.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index 5db63aa..7da09e7 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -118,9 +118,8 @@ jobs:
         run: |
           helm install rayserve chart/ \
             --set kuberay-operator.enabled=false \
-            --set nebariapp.enabled=true \
-            --set nebariapp.serve.hostname=rayserve.nebari.local \
             --set nebariapp.serve.enabled=true \
+            --set nebariapp.serve.hostname=rayserve.nebari.local \
             --set nebariapp.dashboard.enabled=true \
             --set nebariapp.dashboard.hostname=ray-dashboard.nebari.local \
             --set head.resources.requests.cpu=500m \

From defae7040ba54d4de4ec24a0d566eeb280b3847e Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 10 Sep 2026 09:37:30 +0200
Subject: [PATCH 10/14] address comments

---
 chart/Chart.lock               |  4 ++--
 chart/Chart.yaml               |  4 ++--
 chart/templates/NOTES.txt      |  2 +-
 chart/templates/nebariapp.yaml | 20 ++++++++++++++++++++
 chart/values.yaml              |  4 ++--
 5 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/chart/Chart.lock b/chart/Chart.lock
index 8ff50e8..15e1c50 100644
--- a/chart/Chart.lock
+++ b/chart/Chart.lock
@@ -5,5 +5,5 @@ dependencies:
 - name: kuberay-operator
   repository: https://ray-project.github.io/kuberay-helm/
   version: 1.3.0
-digest: sha256:2b718f48309bcdad46da4d24aae42d6e321c2399dc07f91b9a94791082eb567b
-generated: "2026-09-07T08:44:08.940992973+02:00"
+digest: sha256:09645189c12af2207c6ee2eb4283da5a5264128fc84f142c82242fa064519f92
+generated: "2026-09-10T09:36:11.521304057+02:00"
diff --git a/chart/Chart.yaml b/chart/Chart.yaml
index dd80b5a..18dc480 100644
--- a/chart/Chart.yaml
+++ b/chart/Chart.yaml
@@ -2,12 +2,12 @@ apiVersion: v2
 name: nebari-rayserve-pack
 description: A Nebari Software Pack for Ray Serve
 type: application
-version: 0.4.1
+version: 0.5.0
 appVersion: "2.43.0"
 dependencies:
   - name: nebari-app
     repository: oci://quay.io/nebari/charts
-    version: "0.1.1"
+    version: ">=0.1.1"
   - name: kuberay-operator
     version: 1.3.0
     repository: https://ray-project.github.io/kuberay-helm/
diff --git a/chart/templates/NOTES.txt b/chart/templates/NOTES.txt
index 22a1884..d57d804 100644
--- a/chart/templates/NOTES.txt
+++ b/chart/templates/NOTES.txt
@@ -18,7 +18,7 @@ Serve is pre-initialized with host 0.0.0.0 on port 8000.
 {{- if $component.nebariapp.enabled }}
 {{- $nebariapp := include "nebari-app.deepTplJson" (dict "value" (omit $component.nebariapp "enabled") "ctx" $tplCtx) | fromJson }}
 
-NebariApp  for {{ $name }} is ENABLED. The nebari-operator will configure:
+NebariApp for {{ $name }} is ENABLED. The nebari-operator will configure:
   - HTTPRoute: {{ $nebariapp.hostname }}
   {{- if (and $nebariapp.auth $nebariapp.auth.enabled) }}
   - OIDC authentication via {{ $nebariapp.auth.provider | default "keycloak" }}
diff --git a/chart/templates/nebariapp.yaml b/chart/templates/nebariapp.yaml
index cfb8f16..3fb4fc4 100644
--- a/chart/templates/nebariapp.yaml
+++ b/chart/templates/nebariapp.yaml
@@ -1,3 +1,23 @@
+{{- if hasKey .Values.nebariapp.enabled -}}
+{{- fail "nebariapp.enabled was removed in version 0.5.0. Set nebariapp.serve.enabled and nebariapp.dashboard.enabled instead." -}}
+{{- end -}}
+
+{{- if hasKey .Values.nebariapp.hostname -}}
+{{- fail "nebariapp.hostname was removed in version 0.5.0. Set nebariapp.serve.hostname instead." -}}
+{{- end -}}
+
+{{- if hasKey .Values.nebariapp.service -}}
+{{- fail "nebariapp.service was removed in version 0.5.0. Set nebariapp.serve.service.{name,port} and nebariapp.dashboard.service.{name,port} instead." -}}
+{{- end -}}
+
+{{- if hasKey .Values.nebariapp.auth -}}
+{{- fail "nebariapp.auth was removed in version 0.5.0. Set nebariapp.serve.auth and nebariapp.dashboard.auth instead." -}}
+{{- end -}}
+
+{{- if hasKey .Values.nebariapp.gateway -}}
+{{- fail "nebariapp.gateway was removed in version 0.5.0. Set nebariapp.serve.gateway and nebariapp.dashboard.gateway instead." -}}
+{{- end -}}
+
 {{- if .Values.nebariapp.serve.enabled -}}
 # NebariApp for Ray Serve endpoint
 {{ include "nebari-app.nebariApp" (dict
diff --git a/chart/values.yaml b/chart/values.yaml
index 236f212..47e0c2e 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -5,7 +5,7 @@
 nebariapp:
   serve:
     enabled: false
-    hostname: '{{ fail "nebariapps.serve.hostname is required if nebariapps.serve.enabled is true" }}'
+    hostname: '{{ fail "nebariapp.serve.hostname is required if nebariapps.serve.enabled is true" }}'
     service:
       name: '{{ include "nebari-rayserve.serve-service-name" . | toJson }}'
       port: 8000
@@ -15,7 +15,7 @@ nebariapp:
           pathType: PathPrefix
   dashboard:
     enabled: false
-    hostname: '{{ fail "nebariapps.dashboard.hostname is required if nebariapps.dashboard.enabled is true" }}'
+    hostname: '{{ fail "nebariapp.dashboard.hostname is required if nebariapps.dashboard.enabled is true" }}'
     service:
       name: '{{ include "nebari-rayserve.head-service-name" . | toJson }}'
       port: 8265

From a9397d3c9fab2042373613df53fbd11017db0a17 Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 10 Sep 2026 09:58:53 +0200
Subject: [PATCH 11/14] improve comment

---
 chart/values.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/chart/values.yaml b/chart/values.yaml
index 47e0c2e..a91aa27 100644
--- a/chart/values.yaml
+++ b/chart/values.yaml
@@ -1,7 +1,9 @@
 # =============================================================================
 # Nebari Integration
 # =============================================================================
-# Creates NebariApp CRs that configure routing, TLS, and auth via nebari-operator.
+# NebariApp CRs (https://github.com/nebari-dev/nebari-operator).
+# Rendered through the official nebari-app.nebariApp template 
+# (https://github.com/nebari-dev/nebari-operator/tree/main/charts/nebari-app) with templating enabled.
 nebariapp:
   serve:
     enabled: false

From e3be499114716b97a520405fb3d4e56eca541a4c Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 10 Sep 2026 10:01:23 +0200
Subject: [PATCH 12/14] fix guards

---
 chart/templates/nebariapp.yaml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/chart/templates/nebariapp.yaml b/chart/templates/nebariapp.yaml
index 3fb4fc4..62e62de 100644
--- a/chart/templates/nebariapp.yaml
+++ b/chart/templates/nebariapp.yaml
@@ -1,20 +1,20 @@
-{{- if hasKey .Values.nebariapp.enabled -}}
+{{- if hasKey .Values.nebariapp "enabled" -}}
 {{- fail "nebariapp.enabled was removed in version 0.5.0. Set nebariapp.serve.enabled and nebariapp.dashboard.enabled instead." -}}
 {{- end -}}
 
-{{- if hasKey .Values.nebariapp.hostname -}}
+{{- if hasKey .Values.nebariapp "hostname" -}}
 {{- fail "nebariapp.hostname was removed in version 0.5.0. Set nebariapp.serve.hostname instead." -}}
 {{- end -}}
 
-{{- if hasKey .Values.nebariapp.service -}}
+{{- if hasKey .Values.nebariapp "service" -}}
 {{- fail "nebariapp.service was removed in version 0.5.0. Set nebariapp.serve.service.{name,port} and nebariapp.dashboard.service.{name,port} instead." -}}
 {{- end -}}
 
-{{- if hasKey .Values.nebariapp.auth -}}
+{{- if hasKey .Values.nebariapp "auth" -}}
 {{- fail "nebariapp.auth was removed in version 0.5.0. Set nebariapp.serve.auth and nebariapp.dashboard.auth instead." -}}
 {{- end -}}
 
-{{- if hasKey .Values.nebariapp.gateway -}}
+{{- if hasKey .Values.nebariapp "gateway" -}}
 {{- fail "nebariapp.gateway was removed in version 0.5.0. Set nebariapp.serve.gateway and nebariapp.dashboard.gateway instead." -}}
 {{- end -}}
 

From dd5035058337bb90d4611ecdac36985e4b0a584a Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 10 Sep 2026 10:03:29 +0200
Subject: [PATCH 13/14] build instead of install helm deps in CI

---
 .github/workflows/lint.yaml             | 4 ++--
 .github/workflows/test-integration.yaml | 4 ++--
 .github/workflows/test.yaml             | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 801e7a3..8085f2a 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -15,8 +15,8 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v4
 
-      - name: Update chart dependencies
-        run: helm dependency update chart/
+      - name: Build chart dependencies
+        run: helm dependency build chart/
 
       - name: Lint chart
         run: helm lint chart/
diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index 7da09e7..39d172e 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -106,8 +106,8 @@ jobs:
       # ============================================================
       # Test: Ray Serve with NebariApp (no auth)
       # ============================================================
-      - name: Update chart dependencies
-        run: helm dependency update chart/
+      - name: Build chart dependencies
+        run: helm dependency build chart/
 
       - name: Install KubeRay operator (CRDs must exist before RayService)
         run: |
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index c476a09..4c829bb 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -21,8 +21,8 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v4
 
-      - name: Update chart dependencies
-        run: helm dependency update chart/
+      - name: Build chart dependencies
+        run: helm dependency build chart/
 
       - name: Install KubeRay operator (CRDs must exist before RayService)
         run: |

From 68576ac314ae7c0b1989c9f59a130d977f0cb943 Mon Sep 17 00:00:00 2001
From: Philip Meier <github.pmeier@posteo.de>
Date: Thu, 10 Sep 2026 10:06:03 +0200
Subject: [PATCH 14/14] Revert "build instead of install helm deps in CI"

This reverts commit dd5035058337bb90d4611ecdac36985e4b0a584a.
---
 .github/workflows/lint.yaml             | 4 ++--
 .github/workflows/test-integration.yaml | 4 ++--
 .github/workflows/test.yaml             | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 8085f2a..801e7a3 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -15,8 +15,8 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v4
 
-      - name: Build chart dependencies
-        run: helm dependency build chart/
+      - name: Update chart dependencies
+        run: helm dependency update chart/
 
       - name: Lint chart
         run: helm lint chart/
diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml
index 39d172e..7da09e7 100644
--- a/.github/workflows/test-integration.yaml
+++ b/.github/workflows/test-integration.yaml
@@ -106,8 +106,8 @@ jobs:
       # ============================================================
       # Test: Ray Serve with NebariApp (no auth)
       # ============================================================
-      - name: Build chart dependencies
-        run: helm dependency build chart/
+      - name: Update chart dependencies
+        run: helm dependency update chart/
 
       - name: Install KubeRay operator (CRDs must exist before RayService)
         run: |
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 4c829bb..c476a09 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -21,8 +21,8 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@v4
 
-      - name: Build chart dependencies
-        run: helm dependency build chart/
+      - name: Update chart dependencies
+        run: helm dependency update chart/
 
       - name: Install KubeRay operator (CRDs must exist before RayService)
         run: |