mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-18 05:39:50 +08:00
137 lines
4.4 KiB
YAML
137 lines
4.4 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Default values for OpenShell
|
|
|
|
replicaCount: 1
|
|
|
|
image:
|
|
repository: ghcr.io/nvidia/openshell/gateway
|
|
pullPolicy: Always
|
|
tag: "latest"
|
|
|
|
imagePullSecrets: []
|
|
nameOverride: ""
|
|
fullnameOverride: ""
|
|
|
|
serviceAccount:
|
|
create: true
|
|
annotations: {}
|
|
name: ""
|
|
|
|
# Whether to auto-mount the ServiceAccount token into the pod. Disabled
|
|
# in microVM gateway mode because the projected volume mount at
|
|
# /var/run/secrets/kubernetes.io/serviceaccount hits a containerd
|
|
# native-snapshotter + virtiofs incompatibility on sandbox re-creation.
|
|
automountServiceAccountToken: true
|
|
|
|
# When automountServiceAccountToken is false, the OpenShell gateway needs
|
|
# a kubeconfig to reach the API server. Point this to the directory
|
|
# containing the k3s kubeconfig (k3s.yaml). Only used when
|
|
# automountServiceAccountToken is false.
|
|
kubeconfig:
|
|
hostPath: ""
|
|
|
|
podAnnotations: {}
|
|
podLabels: {}
|
|
|
|
podSecurityContext:
|
|
fsGroup: 1000
|
|
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
|
|
service:
|
|
type: NodePort
|
|
port: 8080
|
|
nodePort: 30051
|
|
|
|
# Pod restart behavior and health probe tuning.
|
|
podLifecycle:
|
|
terminationGracePeriodSeconds: 5
|
|
|
|
probes:
|
|
liveness:
|
|
initialDelaySeconds: 2
|
|
periodSeconds: 5
|
|
timeoutSeconds: 1
|
|
failureThreshold: 3
|
|
readiness:
|
|
initialDelaySeconds: 1
|
|
periodSeconds: 2
|
|
timeoutSeconds: 1
|
|
failureThreshold: 3
|
|
|
|
resources: {}
|
|
|
|
# Persistent storage for the OpenShell database. When disabled, an
|
|
# emptyDir volume is used instead of a PVC. This is useful in microVM
|
|
# environments where overlayfs-on-virtiofs doesn't support PVC mounts
|
|
# reliably.
|
|
persistence:
|
|
enabled: true
|
|
|
|
# Run the pod directly on the host network. Useful in microVM
|
|
# environments where kube-proxy is unavailable (no iptables).
|
|
# When true, the pod binds to the VM's eth0 and NodePort is
|
|
# unnecessary — gvproxy forwards host ports to the pod directly.
|
|
hostNetwork: false
|
|
|
|
nodeSelector: {}
|
|
|
|
tolerations: []
|
|
|
|
affinity: {}
|
|
|
|
# Server configuration
|
|
server:
|
|
logLevel: info
|
|
sandboxNamespace: openshell
|
|
dbUrl: "sqlite:/var/openshell/openshell.db"
|
|
sandboxImage: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
|
|
# Kubernetes imagePullPolicy for sandbox pods. Empty = Kubernetes default
|
|
# (Always for :latest, IfNotPresent otherwise). Set to "Always" for dev
|
|
# clusters so new images are picked up without manual eviction.
|
|
sandboxImagePullPolicy: ""
|
|
# gRPC endpoint for sandboxes to callback to OpenShell (must be reachable from pods)
|
|
grpcEndpoint: "https://openshell.openshell.svc.cluster.local:8080"
|
|
# Public host/port returned to CLI clients for SSH proxy CONNECT requests.
|
|
# For local clusters the default 127.0.0.1:8080 is correct; for remote
|
|
# clusters these should be set to the externally reachable host and port.
|
|
sshGatewayHost: ""
|
|
sshGatewayPort: 0
|
|
# TLS configuration for the server. The server always terminates mTLS
|
|
# directly and requires client certificates.
|
|
# HMAC secret used for the NSSH1 handshake between gateway and sandbox SSH.
|
|
# Required — the server will refuse to start if empty. For cluster deployments
|
|
# this is auto-generated by the entrypoint script.
|
|
sshHandshakeSecret: ""
|
|
# Host gateway IP for sandbox pod hostAliases. When set, sandbox pods get
|
|
# hostAliases entries mapping host.docker.internal and host.openshell.internal
|
|
# to this IP, allowing them to reach services running on the Docker host.
|
|
# Auto-detected by the cluster entrypoint script.
|
|
hostGatewayIP: ""
|
|
# Disable gateway authentication (mTLS client certificate requirement).
|
|
# Set to true when the gateway sits behind a reverse proxy (e.g.
|
|
# Cloudflare Tunnel) that terminates TLS.
|
|
disableGatewayAuth: false
|
|
# Disable TLS entirely — the server listens on plaintext HTTP.
|
|
# Set to true when a reverse proxy / tunnel terminates TLS at the edge.
|
|
disableTls: false
|
|
tls:
|
|
# K8s secret (type kubernetes.io/tls) with tls.crt and tls.key for the server
|
|
certSecretName: openshell-server-tls
|
|
# K8s secret with ca.crt for client certificate verification
|
|
clientCaSecretName: openshell-server-client-ca
|
|
# K8s secret mounted into sandbox pods for mTLS to the server
|
|
clientTlsSecretName: openshell-client-tls
|
|
|
|
# NetworkPolicy restricting SSH ingress on sandbox pods to the gateway only.
|
|
networkPolicy:
|
|
enabled: true
|