mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-17 05:31:16 +08:00

Files

T

History

Eric Curtin b332ffdf7d refactor: deduplicate shared driver and provider constants (#1474 )

Move default_sandbox_image() and SUPERVISOR_IMAGE_BINARY_PATH into
openshell-core so all compute drivers share a single authoritative
definition. Eliminates four identical copies of default_sandbox_image()
and two identical copies of SUPERVISOR_IMAGE_BINARY_PATH.

Implement ProviderPlugin for ProviderDiscoverySpec to remove the
repeated three-method delegation boilerplate from eight simple
provider modules. Each now declares only a SPEC constant; the blanket
impl handles id(), discover_existing(), and credential_env_vars().

2026-05-20 09:24:57 -07:00

src

refactor: deduplicate shared driver and provider constants (#1474 )

2026-05-20 09:24:57 -07:00

Cargo.toml

feat(gateway): add TOML configuration file (RFC 0003) (#1317 )

2026-05-15 12:43:48 -07:00

README.md

docs(architecture): reset subsystem docs (#1184 )

2026-05-07 08:59:02 -07:00

README.md

openshell-driver-kubernetes

Kubernetes-backed compute driver for OpenShell cluster deployments.

The driver uses the Kubernetes API to create, delete, fetch, and watch sandbox custom resources in the configured namespace. It runs in-process with the gateway server.

Runtime Model

The gateway stores platform state and delegates sandbox workload creation to this driver. Kubernetes owns scheduling and pod lifecycle. The openshell-sandbox supervisor inside each workload owns agent isolation, credential injection, policy polling, logs, and the gateway relay.

Sandbox Resource

The driver works with the agents.x-k8s.io/v1alpha1 Sandbox custom resource. Driver events map Kubernetes object state and platform events into the shared compute-driver protobuf surface used by the gateway.

Kubernetes API calls use explicit timeouts so gRPC handlers do not block indefinitely when the API server is slow or unavailable.

Workspace Persistence

Sandbox pods use a PVC-backed /sandbox workspace. An init container seeds the PVC from the image's original /sandbox contents on first start and writes a sentinel so subsequent starts skip the copy.

This is a stopgap persistence model. It preserves user files across pod rescheduling but duplicates the base workspace and does not automatically apply image updates to existing PVCs. Future snapshotting should replace it.

Credentials, TLS, and Relay

The driver injects gateway callback configuration, sandbox identity, TLS client material, and the supervisor SSH socket path into the workload. Driver-owned values must override image-provided environment variables.

The gateway uses the supervisor relay for connect, exec, and file sync. Sandbox pods do not need direct external ingress for SSH.

GPU Support

When a sandbox requests GPU support, the driver checks node allocatable capacity for nvidia.com/gpu and requests one GPU resource in the workload spec. The sandbox image must provide the user-space libraries needed by the agent workload.