mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-18 05:39:50 +08:00
Drew NewberryandPiotr Mlocek
83af7a245b
* feat(sandbox): inject host gateway hostAliases into sandbox pods Sandbox pods running in the k3s cluster cannot resolve host.docker.internal by default, preventing them from reaching services on the Docker host. Detect the host gateway IP (default route) in the cluster entrypoint, thread it through the Helm chart to the gateway server, and inject hostAliases entries (host.docker.internal, host.openshell.internal) into every sandbox pod spec. The injection is conditional -- when the IP is empty (non-Docker deployments), no hostAliases are added. --------- Co-authored-by: Piotr Mlocek <pmlocek@nvidia.com>
44 lines
1.6 KiB
YAML
44 lines
1.6 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# HelmChart CR for auto-deploying OpenShell via k3s Helm controller
|
|
# This manifest is placed in /var/lib/rancher/k3s/server/manifests/ and
|
|
# automatically installed when the k3s cluster starts.
|
|
#
|
|
# The chart tarball is served from the k3s static file server at:
|
|
# https://<k8s-api>/static/charts/openshell-0.1.0.tgz
|
|
#
|
|
# Component images are pulled at runtime from ghcr.io.
|
|
# Authentication is configured via /etc/rancher/k3s/registries.yaml
|
|
# (containerd-level) and a Kubernetes imagePullSecret (pod-level),
|
|
# both generated by the bootstrap process.
|
|
|
|
apiVersion: helm.cattle.io/v1
|
|
kind: HelmChart
|
|
metadata:
|
|
name: openshell
|
|
namespace: kube-system
|
|
spec:
|
|
chart: https://%{KUBERNETES_API}%/static/charts/openshell-0.1.0.tgz
|
|
targetNamespace: openshell
|
|
createNamespace: true
|
|
valuesContent: |-
|
|
chartChecksum: __CHART_CHECKSUM__
|
|
image:
|
|
repository: ghcr.io/nvidia/openshell/gateway
|
|
tag: latest
|
|
pullPolicy: Always
|
|
server:
|
|
sandboxImage: ghcr.io/nvidia/openshell-community/sandboxes/base:latest
|
|
sshGatewayHost: __SSH_GATEWAY_HOST__
|
|
sshGatewayPort: __SSH_GATEWAY_PORT__
|
|
sshHandshakeSecret: __SSH_HANDSHAKE_SECRET__
|
|
grpcEndpoint: "https://openshell.openshell.svc.cluster.local:8080"
|
|
hostGatewayIP: __HOST_GATEWAY_IP__
|
|
disableGatewayAuth: __DISABLE_GATEWAY_AUTH__
|
|
disableTls: __DISABLE_TLS__
|
|
tls:
|
|
certSecretName: openshell-server-tls
|
|
clientCaSecretName: openshell-server-client-ca
|
|
clientTlsSecretName: openshell-client-tls
|