mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
231 lines
8.0 KiB
YAML
231 lines
8.0 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Default values for OpenShell
|
|
|
|
replicaCount: 1
|
|
|
|
image:
|
|
repository: ghcr.io/nvidia/openshell/gateway
|
|
pullPolicy: IfNotPresent
|
|
tag: ""
|
|
|
|
# Supervisor image — provides the openshell-sandbox binary that is copied into
|
|
# sandbox pods via an init container. tag defaults to appVersion (same as the
|
|
# gateway image) so both stay in sync when the chart is released.
|
|
supervisor:
|
|
image:
|
|
repository: ghcr.io/nvidia/openshell/supervisor
|
|
pullPolicy: ""
|
|
tag: ""
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
name: ""
|
|
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
|
|
podSecurityContext:
|
|
fsGroup: 1000
|
|
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
service:
|
|
type: ClusterIP
|
|
port: 8080
|
|
healthPort: 8081
|
|
metricsPort: 9090
|
|
|
|
# Pod restart behavior and health probe tuning.
|
|
podLifecycle:
|
|
terminationGracePeriodSeconds: 5
|
|
|
|
probes:
|
|
startup:
|
|
periodSeconds: 2
|
|
timeoutSeconds: 1
|
|
failureThreshold: 30
|
|
liveness:
|
|
initialDelaySeconds: 2
|
|
periodSeconds: 5
|
|
timeoutSeconds: 1
|
|
failureThreshold: 3
|
|
readiness:
|
|
initialDelaySeconds: 1
|
|
periodSeconds: 2
|
|
timeoutSeconds: 1
|
|
failureThreshold: 3
|
|
|
|
resources: {}
|
|
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
# Server configuration
|
|
server:
|
|
logLevel: info
|
|
sandboxNamespace: openshell
|
|
dbUrl: "sqlite:/var/openshell/openshell.db"
|
|
sandboxImage: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
|
|
# Kubernetes imagePullPolicy for sandbox pods. Empty = Kubernetes default
|
|
# (Always for :latest, IfNotPresent otherwise). Set to "Always" for dev
|
|
# clusters so new images are picked up without manual eviction.
|
|
sandboxImagePullPolicy: ""
|
|
# gRPC endpoint for sandboxes to callback to OpenShell (must be reachable from pods)
|
|
grpcEndpoint: "https://openshell.openshell.svc.cluster.local:8080"
|
|
# Public host/port returned to CLI clients for SSH proxy CONNECT requests.
|
|
# For local clusters the default 127.0.0.1:8080 is correct; for remote
|
|
# clusters these should be set to the externally reachable host and port.
|
|
sshGatewayHost: ""
|
|
sshGatewayPort: 0
|
|
# TLS configuration for the server. The server always terminates mTLS
|
|
# directly and requires client certificates.
|
|
# Name of the Kubernetes Secret holding the NSSH1 HMAC handshake key.
|
|
# The secret must contain a `secret` key with the hex-encoded HMAC key.
|
|
# By default a pre-install/pre-upgrade hook creates it when missing (see sshHandshake).
|
|
sshHandshakeSecretName: "openshell-ssh-handshake"
|
|
# Host gateway IP for sandbox pod hostAliases. When set, sandbox pods get
|
|
# hostAliases entries mapping host.docker.internal and host.openshell.internal
|
|
# to this IP, allowing them to reach services running on the Docker host.
|
|
# Auto-detected by the cluster entrypoint script.
|
|
hostGatewayIP: ""
|
|
# Disable gateway authentication (mTLS client certificate requirement).
|
|
# Set to true when the gateway sits behind a reverse proxy (e.g.
|
|
# Cloudflare Tunnel) that terminates TLS.
|
|
disableGatewayAuth: false
|
|
# Disable TLS entirely — the server listens on plaintext HTTP.
|
|
# Set to true when a reverse proxy / tunnel terminates TLS at the edge.
|
|
disableTls: false
|
|
tls:
|
|
# K8s secret (type kubernetes.io/tls) with tls.crt and tls.key for the server
|
|
certSecretName: openshell-server-tls
|
|
# K8s secret with ca.crt for client certificate verification
|
|
clientCaSecretName: openshell-server-client-ca
|
|
# K8s secret mounted into sandbox pods for mTLS to the server
|
|
clientTlsSecretName: openshell-client-tls
|
|
# OIDC (OpenID Connect) configuration for JWT-based authentication.
|
|
# When issuer is set, the server validates Bearer tokens on gRPC requests.
|
|
oidc:
|
|
# OIDC issuer URL (e.g. https://keycloak.example.com/realms/openshell).
|
|
issuer: ""
|
|
# Expected audience claim for the API resource server.
|
|
# This should match the server's --oidc-audience, NOT the CLI client ID.
|
|
audience: "openshell-cli"
|
|
# JWKS key cache TTL in seconds.
|
|
jwksTtl: 3600
|
|
# Dot-separated path to the roles array in the JWT claims.
|
|
# Keycloak: "realm_access.roles", Entra ID: "roles", Okta: "groups".
|
|
rolesClaim: ""
|
|
# Role name for admin access. Leave empty (with userRole also empty) for
|
|
# authentication-only mode. Both must be set or both empty.
|
|
adminRole: ""
|
|
# Role name for standard user access.
|
|
userRole: ""
|
|
# Dot-separated path to the scopes array in the JWT claims.
|
|
scopesClaim: ""
|
|
|
|
# NetworkPolicy restricting SSH ingress on sandbox pods to the gateway only.
|
|
networkPolicy:
|
|
enabled: true
|
|
|
|
# NSSH1 SSH gateway handshake Secret (`server.sshHandshakeSecretName`).
|
|
# Helm hook creates it only when the Secret does not already exist (safe upgrades).
|
|
# Set sshHandshake.value from a gitignored values file for a stable dev secret.
|
|
sshHandshake:
|
|
hook:
|
|
enabled: true
|
|
# 64 hex chars (32 bytes), matching openshell-bootstrap. If empty, Helm generates
|
|
# a random value at install template time (two UUIDs, dashes stripped).
|
|
value: ""
|
|
|
|
# PKI bootstrap via a pre-install/pre-upgrade hook Job.
|
|
# Generates a self-signed CA, server TLS secret, and client TLS secret using
|
|
# openssl (ECDSA P-256) inside the cluster. Key material is written directly to
|
|
# K8s Secrets and never appears in Helm release history. Idempotent: existing
|
|
# secrets are left untouched on upgrade.
|
|
# Air-gapped environments should override pkiInitJob.image with an image that has
|
|
# openssl and curl pre-installed (the default alpine image fetches them at runtime).
|
|
pkiInitJob:
|
|
enabled: true
|
|
image:
|
|
repository: alpine
|
|
tag: "3"
|
|
pullPolicy: IfNotPresent
|
|
# Days until the CA certificate expires.
|
|
caValidityDays: 3650
|
|
# Days until server and client certificates expire.
|
|
certValidityDays: 3650
|
|
# DNS SANs for the server certificate.
|
|
serverDnsNames:
|
|
- openshell
|
|
- openshell.openshell.svc
|
|
- openshell.openshell.svc.cluster.local
|
|
- localhost
|
|
- host.docker.internal
|
|
# IP SANs for the server certificate.
|
|
serverIpAddresses:
|
|
- 127.0.0.1
|
|
|
|
# cert-manager Certificate/Issuer resources (requires cert-manager CRDs in-cluster).
|
|
# Uses namespaced Issuers only (no ClusterIssuer). Does not install cert-manager itself.
|
|
certManager:
|
|
enabled: false
|
|
# Secret created for the intermediate CA (Certificate with isCA: true).
|
|
caSecretName: openshell-ca-tls
|
|
# Mount gateway client CA from the server TLS secret's ca.crt (populated by
|
|
# cert-manager for certs issued by a CA Issuer). Avoids a separate
|
|
# openshell-server-client-ca Secret.
|
|
clientCaFromServerTlsSecret: true
|
|
certificateDuration: 8760h
|
|
certificateRenewBefore: 720h
|
|
serverDnsNames:
|
|
- openshell
|
|
- openshell.openshell.svc
|
|
- openshell.openshell.svc.cluster.local
|
|
- localhost
|
|
- host.docker.internal
|
|
serverIpAddresses:
|
|
- 127.0.0.1
|
|
|
|
# Kubernetes Gateway API — HTTPRoute and Gateway resources.
|
|
# Requires a Gateway API controller in the cluster. Install Envoy Gateway via
|
|
# the skaffold.yaml releases or independently:
|
|
# helm install eg oci://docker.io/envoyproxy/gateway-helm \
|
|
# --version v1.4.1 -n envoy-gateway-system --create-namespace
|
|
grpcRoute:
|
|
enabled: false
|
|
# Hostnames the GRPCRoute matches on. Leave empty to match all hosts.
|
|
hostnames: []
|
|
gateway:
|
|
# When true, a Gateway resource is created in the release namespace.
|
|
# Set to false and provide name/namespace to attach to a pre-existing Gateway.
|
|
create: false
|
|
# GatewayClass to reference. Envoy Gateway installs one named "eg".
|
|
className: "eg"
|
|
# Name of the Gateway resource. Defaults to the chart fullname.
|
|
name: ""
|
|
# Namespace of the Gateway referenced by the GRPCRoute parentRef.
|
|
# Defaults to the release namespace.
|
|
namespace: ""
|
|
# Listener settings (only used when gateway.create is true).
|
|
listener:
|
|
port: 80
|
|
protocol: HTTP
|
|
# "Same" restricts attached routes to the release namespace; "All" allows any namespace.
|
|
allowedRoutes: Same
|