Drop `no_driver_configured_message` and `compiled_in_builtin_names` in
favor of an inline static error. The dynamic list of supported drivers
belonged in a discoverable channel (a future `openshell-gateway info`
subcommand, tracked separately) rather than in an error message the
operator can only reach by triggering a failure.
Adjust `configured_compute_driver_empty_points_at_extensions_when_no_builtins`
to assert only the socket_path escape hatch, which the single static
message still surfaces for the extension-only build shape.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Operators running packaged gateway binaries (Docker images, Helm
charts, Homebrew) can't act on "rebuild openshell-server with
--features driver-<name>" — that advice is aimed at contributors
editing the source tree. Replace with a shorter operator-oriented
phrase that says what's wrong without prescribing a fix outside the
operator's reach.
Update `configured_compute_driver_matches_compiled_features` to
assert the new phrase and the driver name rather than the Cargo flag.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Gate driver-specific fields on `ServerStartupConfig` and
`DriverStartupContext` (and the `GuestTlsPaths` type they reference)
with `#[cfg]` directly instead of double-negated
`#[cfg_attr(not(any(...)), allow(dead_code))]`. The direct form makes
the struct definition accurately reflect what exists per build and
removes the drift risk where a new driver reading one of these fields
would silently re-suppress the warning if the exclusion predicate went
stale.
Every construction site (`run_server`, `prepare_server_config`,
`test_context_with_endpoint_overrides`, `test_driver_startup`) is
updated to gate the matching field assignments with the same predicate,
so the gates cannot drift apart.
Split `apply_runtime_defaults` into a pure-side-effect `Result<()>`
plus a separate `resolved_local_tls` accessor so the call site no
longer needs a two-branch `#[cfg]` split around `let _ = ...` just
to keep the return value from being unused under
`--no-default-features`. The two are now clean concerns: one mutates
args, one reads TLS paths off disk. Callers invoke whichever they
need.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Replace the `#[cfg(not(all(feature = "driver-*")))]`-gated
`ConfiguredComputeDriver::Builtin(kind)` catch-all in the dispatch
match with a plain `_ => unreachable!(...)` guarded by
`#[allow(unreachable_patterns)]`. Adding or removing a driver feature
no longer requires updating this arm, and there is no feature list to
drift out of sync with the enum.
The arm remains genuinely unreachable at runtime: config validation in
`configured_compute_driver` rejects builtins whose feature was compiled
out before dispatch runs. The trade-off is that the panic message no
longer names the specific driver — acceptable because the actionable
error operators see is the validation-layer message, which does name
the driver and the Cargo feature that re-enables it.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Break the flat 12-step run list into seven hidden sibling tasks — one
positive control, four single-driver builds, one mixed docker+podman
build, and one zero-driver build (which also runs the extension-only
unit tests). The top-level task becomes a `depends` aggregator over
them.
Each sub-task runs the exact same cargo build + verify-drivers-compiled-
out.sh pair as before, so total work and CI wall clock are unchanged.
The split lets a developer re-run a single leg in isolation
(`mise run rust:verify:drivers-off:podman`) after a failure, and mise's
per-task log prefix makes a failing leg trivially identifiable in CI
output. The parent task keeps the same name so
`.github/workflows/branch-checks.yml` needs no change.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Cover both directions of the compile-time driver gate in one test: a
compiled-in driver must resolve to its Builtin variant; a compiled-out
driver must fail with a message naming the Cargo feature that re-enables
it. An exhaustive match on `ComputeDriverKind` inside the test makes a
new variant a compile error until it's given a feature gate. Derive
`Hash` on `ComputeDriverKind` so it can key the driver-features map.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
- README.md gains a "Choosing Which Compute Drivers Are Compiled In"
section covering the four driver features, the extension-only
build shape, and the startup-time compiled-out rejection.
- architecture/compute-runtimes.md gains a "Compile-Time Driver
Selection" section covering the four driver features, the
extension-only zero-driver build, the startup-time missing-driver
error, filtered auto-detection, and the always-available extension
driver path.
- docs/reference/gateway-config.mdx gains a matching reference
section under "Choosing Which Drivers Are Compiled In" with a
per-feature table, single-driver / mixed / extension-only build
examples, and the startup-time rejection contract.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Adds verify-drivers-compiled-out.sh, a mise task that exercises the
per-driver Cargo features, and a matching step in the branch-checks
workflow.
The script mirrors verify-telemetry-compiled-out.sh: a table of stable
driver-exclusive marker strings pulled from each driver crate, with
present/absent/only modes. The 'only' mode asserts presence for a
selected driver list AND absence for every other driver in one sweep,
so a single script invocation covers both directions per build.
The mise task exercises: default (all four drivers present), each
single-driver build, one mixed feature set (docker+podman), and a
zero-driver extension-only build that must link cleanly and must
contain none of the four driver markers. After the zero-driver build
the task also runs `cargo test -p openshell-server --lib
--no-default-features` so the #[cfg]-gated extension-only unit tests
actually execute in CI rather than being silently skipped by the
default-features test job.
The telemetry-off task uses a mixed --features driver-...,driver-...
gateway build so the telemetry-marker absence check still exercises a
representative in-tree-driver build path.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Move the availability check out of the build_compute_runtime match arm
into resolve_configured_compute_driver so it fires alongside the other
config-time driver validation. Configuring a driver that this gateway
was not built with now fails at startup with a message naming both the
driver and the Cargo flag that re-enables it.
Auto-detection (empty --drivers) filters through filtered_detect_driver:
if openshell-core's environment probe picks a driver that was compiled
out, we return None and let the caller produce the "no suitable driver"
error rather than silently starting a different backend. In an
extension-only build (zero built-ins compiled in) the message adapts to
point operators at the [openshell.drivers.<name>].socket_path path
instead of listing built-in names that don't exist in this binary;
otherwise it lists only the built-ins actually linked and mentions
that extension drivers are also valid.
Adds unit tests that exercise the compiled-out rejection path and the
extension-only empty-drivers message. The latter is #[cfg]-gated so it
only compiles when no driver features are on.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
Introduce driver-kubernetes, driver-docker, driver-podman, and driver-vm
cargo features on openshell-server, all enabled by default. Building with
--no-default-features and selecting a subset produces a gateway that only
carries the requested drivers.
The three container-driver crates flip to optional dependencies. The VM
driver runs out-of-process already, so driver-vm gates the in-server
launcher and match arm rather than a Cargo dep.
Feature gates cover:
- driver crate imports and re-exports in compute/mod.rs
- ComputeRuntime::new_docker / new_kubernetes / new_podman
- Docker's ShutdownCleanup / StartupResume trait impls
- the compute::vm module and VmComputeConfig re-export
- driver-specific *_config_from_context and apply_*_runtime_defaults
- the K8s ServiceAccount authenticator bootstrap in ServerState
- the auth::k8s_sa module and state field
- authenticator-chain construction in multiplex.rs
- SupervisorReadiness impl for SupervisorSessionRegistry
- driver-specific unit tests in cli.rs, lib.rs, driver_config.rs
A zero-driver build is a supported extension-only gateway shape: it
carries no in-tree driver code and speaks compute_driver.proto over
a Unix socket to an out-of-tree driver named in compute_drivers with
a matching [openshell.drivers.<name>].socket_path. The runtime gate
in resolve_configured_compute_driver (see the follow-up commit)
still rejects a built-in that was compiled out with the "rebuild
with --features driver-X" message, so silent misconfiguration is
impossible.
Default builds are byte-equivalent to before. Each of the four
single-driver builds compiles cleanly under -D warnings, as does the
docker + podman combo and the zero-driver extension-only build.
Signed-off-by: Dimitar Mirchev <28221091+dimityrmirchev@users.noreply.github.com>
* feat(policy): accept numeric UIDs in sandbox process identity validation
Allow run_as_user and run_as_group to be either the literal 'sandbox'
or a numeric UID/GID within [1000, 2_000_000_000]. This removes the
hard dependency on a baked-in 'sandbox' user in container images,
enabling compute drivers to inject resolved UIDs at sandbox creation.
Phase 1 of #1959.
Signed-off-by: Seth Jennings <sjenning@redhat.com>
* feat(supervisor): accept numeric UIDs for process identity dropping
Allow run_as_user and run_as_group to be numeric UIDs/GIDs, removing
the hard dependency on a baked-in 'sandbox' user in container images.
Changes:
- validate_sandbox_user(): accepts numeric UIDs without passwd lookup
(logs OCSF event); keeps passwd check for "sandbox" name; rejects
non-numeric non-sandbox strings that fail passwd lookup
- prepare_filesystem(): passes numeric UIDs/GIDs directly to chown()
instead of requiring a passwd entry
- drop_privileges(): resolves numeric UIDs/GIDs directly via UID::from_raw
/ Gid::from_raw; skips initgroups when target uid matches current euid;
uses guard conditions before setgid/setuid calls
- session_user_and_home(): falls back to ("{uid}", "/sandbox") for
numeric UIDs, avoiding a passwd lookup that will fail
Re-exports MIN_SANDBOX_UID and MAX_SANDBOX_UID from openshell-policy
so callers have consistent range constants.
Phase 2 of #1959.
Signed-off-by: Seth Jennings <sjenning@redhat.com>
* feat(driver-kubernetes): resolve sandbox UID/GID from config or OpenShift SCC annotations
Phase 3 of the numeric-UID plan: allow operators to specify explicit
sandbox_uid/sandbox_gid in Kubernetes driver config, auto-detect from
OpenShift SCC namespace annotations, and propagate resolved values to
supervisor container env vars and PVC init container securityContext.
Changes:
- Add sandbox_uid/sandbox_gid fields to KubernetesComputeConfig
- Add SANDBOX_UID/SANDBOX_GID env var constants to openshell-core
- Implement resolve_sandbox_identity() to fetch namespace annotations
and auto-detect OpenShift SCC UID ranges (sa.scc.uid-range)
- Pass resolved UID/GID through SandboxPodParams to pod spec builder
- Inject SANDBOX_UID/SANDBOX_GID env vars into supervisor container
- Update PVC init container securityContext with resolved UID/GID
instead of hard-coded root
- Add comprehensive unit tests for resolution logic and annotation
parsing (resolve_sandbox_uid, resolve_sandbox_gid, OpenShift SCC
annotation parsing)
Signed-off-by: Seth Jennings <sjenning@redhat.com>
* feat(driver-vm): add configurable sandbox UID/GID and update docs/examples
Phase 4 of the numeric-UID plan: replace hardcoded SANDBOX_UID (10001)
in VM rootfs preparation with configurable sandbox_uid/sandbox_gid fields.
Changes:
- Add sandbox_uid/sandbox_gid to VmDriverConfig with serde derives
- Pass resolved UID/GID through prepare_sandbox_rootfs_from_image_root
to ensure_sandbox_guest_user which writes /etc/passwd/group/gshadow
- Update BYOC Dockerfile: remove groupadd/useradd, document runtime UID
injection and the ability to skip baked-in sandbox user
- Update gateway-config.mdx: document sandbox_uid/sandbox_gid for both
Kubernetes (with OpenShift SCC autodetection) and VM drivers
- Update sandbox-compute-drivers.mdx: add Sandbox User Identity section
explaining numeric UID support across all compute drivers
- Update rootfs tests to use non-default UIDs, verify config passthrough
Signed-off-by: Seth Jennings <sjenning@redhat.com>
* code review changes
* fix(supervisor): harden tests for restricted CI container environments
Guard tests against CI-specific constraints: root without CAP_SETPCAP,
UIDs with no /etc/passwd entry, and restricted /proc access.
Signed-off-by: Seth Jennings <sjennings@nvidia.com>
Signed-off-by: Seth Jennings <sjenning@redhat.com>
---------
Signed-off-by: Seth Jennings <sjenning@redhat.com>
Signed-off-by: Seth Jennings <sjennings@nvidia.com>
* feat(docker,podman): add SELinux label support for bind mounts
The Docker Engine structured Mount API does not support SELinux
relabelling (:z / :Z). Move user-supplied bind mounts from the
structured `mounts` field to the legacy string-format `binds` field,
which does support these options.
Add a shared `SelinuxLabel` enum (shared/private) to openshell-core so
both Docker and Podman drivers accept an optional `selinux_label` field
on bind mount configs. For Docker, labels are appended to the bind
string; for Podman, they are pushed to the mount options vec.
Signed-off-by: Florian Bergmann <fbergman@redhat.com>
* fix(docker): reject missing bind source paths on legacy binds
Moving user bind mounts from the structured Mount API to the legacy
Binds field changed Docker's behavior for missing source directories:
the legacy path silently creates them as empty root-owned dirs instead
of erroring. Add an explicit Path::exists() check to preserve the
fail-fast behavior operators expect.
Signed-off-by: Florian Bergmann <fbergman@redhat.com>
---------
Signed-off-by: Florian Bergmann <fbergman@redhat.com>
The chart's optional Gateway API ingress only rendered a plaintext HTTP
listener, so the gateway could not be exposed over TLS. Add an HTTPS
listener option that terminates TLS at the Envoy Gateway and forwards
plaintext gRPC to the gateway pod.
- gateway.yaml renders an HTTPS listener with `tls.mode: Terminate` and
`certificateRefs` when `grpcRoute.gateway.listener.protocol=HTTPS`,
keeping the default HTTP listener unchanged. Guards fail the render when
`certificateRefs` is empty or `server.disableTls` is not true (the chart
does not render a BackendTLSPolicy for re-encryption).
- values.yaml adds `grpcRoute.gateway.listener.tls.certificateRefs`.
- ci/values-gateway-tls.yaml exercises the HTTPS branch in lint/render.
- docs/kubernetes/ingress.mdx documents HTTPS setup and clarifies that
Envoy Gateway only terminates TLS (no OIDC SecurityPolicy); client
identity uses OIDC bearer tokens, with the client-credentials grant for
headless agents.
- debug-openshell-cluster skill gains HTTPS-ingress troubleshooting rows.
- Regenerated the chart README values table.
Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
The field was added during the Kubernetes driver extraction refactor
(#817) as a pass-through mechanism, but was never wired up to a CLI
flag, Python SDK helper, or any documentation. The only reachable
user path was raw gRPC construction.
The Kubernetes driver now always injects the default workspace PVC,
removing the branching logic that checked for a user-supplied VCT.
Field number 9 is reserved in the proto to prevent reuse.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
The certgen hook and cert-manager Certificate template hardcoded
openshell.openshell.svc.cluster.local in server certificate SANs,
breaking deployments in any namespace other than openshell. Use
.Release.Namespace in the templates so the SANs match the actual
service FQDN regardless of the target namespace.
Closes#2060
Signed-off-by: Akram <akram.benaissi@gmail.com>
Reduce the Linux capability bounding set in the common privilege-drop path before executing sandbox workloads or connect shells and use capctl
Signed-off-by: Adrien Langou <alangou@nvidia.com>
Add policy schema, proto, provider profile, OPA, and L7 proxy support for
`protocol: json-rpc` and `protocol: mcp`. Generic JSON-RPC endpoints match
exact method names only, with `method: "*"` as the all-method sentinel;
wildcard/glob methods and params matchers are rejected.
Parse JSON-RPC request bodies and batches in the forward proxy, deny
response-shaped client frames, limit receive-stream GET allowance to MCP
endpoints, and redact params in decision logs. Preserve L7 rule params on the
proto load path so MCP `tools/call` tool filters behave like YAML-loaded
policies.
Add MCP conformance coverage, JSON-RPC L7 e2e coverage, and docs for the new
protocols and current matcher limitations.
Signed-off-by: Kris Hicks <khicks@nvidia.com>
Co-authored-by: ddurst <267424412+ddurst-nvidia@users.noreply.github.com>
The generated protobuf/gRPC modules under python/openshell/_proto/ are
gitignored. maturin honors .gitignore when collecting python-source files
from a git checkout, so native builds (Linux release CI, local
pip install .) dropped these modules and shipped an unimportable wheel.
The macOS wheel only included them by accident: it builds in a Docker
context whose COPY omits .git, so maturin had no gitignore to apply.
Pin the stubs back in with explicit, package-relative
[tool.maturin].include globs so inclusion no longer depends on whether
.git is present in the build context.
Add a wheel smoke check to the release-tag and release-dev workflows that
installs each Linux wheel in a clean python:3.12-slim image and imports
openshell.sandbox, and document the invariant in architecture/build.md.
Closes#1705
Signed-off-by: Max Dubrinsky <mdubrinsky@nvidia.com>
Add HTTP/2 keepalive on supervisor multiplex connections so half-dead
sessions cannot leave in-flight exec relays parked indefinitely. Configure
SSH keepalive on exec relay clients so long silent commands are not timed
out on stdout idle alone; wedged or orphaned relays fail after missed
keepalives instead.
After a command reports exit status, bound how long the gateway waits for
the trailing channel close. Return UNAVAILABLE when a relay closes before
reporting exit status rather than defaulting to exit code 1.
Signed-off-by: Gal Zaidman <gzaidman@nvidia.com>
* feat(kubernetes): support agent-sandbox v1beta1
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
* ci(kubernetes): test agent-sandbox api versions
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
* fix(kubernetes): retry agent-sandbox raw 404s
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
* fix(kubernetes): harden agent-sandbox api setup
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
* fix(kubernetes): cache agent-sandbox api version
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
* docs(kubernetes): document agent-sandbox upgrade behavior
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
* refactor(kubernetes): collapse agent-sandbox api selection
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
---------
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Closes#1982
Reject user-authored _provider_* network policy keys at gateway boundaries, strip provider-derived rules from sandbox sync, and document the round-trip workflow.
Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
* feat(server): support remote compute driver endpoints
Add named remote compute driver endpoint support to the gateway.
Remote drivers are selected by a non-reserved compute driver name and either a CLI/env socket endpoint or [openshell.drivers.<name>].socket_path. The VM driver now enters ComputeRuntime through the same acquired remote endpoint path, while Docker, Podman, and Kubernetes retain their in-process drivers.
Require --drivers/OPENSHELL_DRIVERS when pairing an ad-hoc socket endpoint so the socket does not imply a magic driver name, and keep reserved in-tree names unavailable for unmanaged socket endpoints.
Co-authored-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: st-gr <38470677+st-gr@users.noreply.github.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* test(server): cover remote compute driver UDS lifecycle
Signed-off-by: Evan Lezar <elezar@nvidia.com>
---------
Signed-off-by: st-gr <38470677+st-gr@users.noreply.github.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Co-authored-by: Evan Lezar <elezar@nvidia.com>
Remove the production-crate dev-settings feature so e2e tests build the same gateway, CLI, and supervisor binaries that we ship. Move settings coverage from dummy test-only keys to the production ocsf_json_enabled setting.
Signed-off-by: Simon Scatton <sscatton@nvidia.com>
* feat(gpu)!: add resource requirements
BREAKING CHANGE: SandboxSpec.gpu and DriverSandboxSpec.gpu were replaced with resource_requirements.gpu, changing protobuf field 9 from a bool to a message for both public and driver APIs.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* refactor(gpu): pass requirements through sandbox create
Pass the coupled GPU requirement object through the CLI sandbox_create boundary instead of splitting presence and count into separate arguments.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* refactor(gpu): pass requirements to timeout message
Pass ResourceRequirements into the provisioning timeout message helper so GPU hints are derived from the same nested request object used to create the sandbox.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* refactor(gpu): pass driver requirements through helpers
Thread Option<GpuResourceRequirements> through driver validation and rendering helpers instead of splitting GPU presence and count into separate arguments.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
* fix(gpu): validate exact device requests
Require exact driver GPU device lists to be tied to a GPU request, allow a single exact device to use the default countless request, and require explicit matching counts for multi-device lists.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
---------
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Dimitar Mirchev