OpenShell/deploy/helm/openshell/templates/statefulset.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ include "openshell.fullname" . }}
  labels:
    {{- include "openshell.labels" . | nindent 4 }}
spec:
  serviceName: {{ include "openshell.fullname" . }}
  replicas: {{ .Values.replicaCount }}
  selector:
    matchLabels:
      {{- include "openshell.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        # Roll the StatefulSet when the rendered gateway TOML changes — the
        # gateway only reads /etc/openshell/gateway.toml at startup, so
        # without this annotation a `helm upgrade` that only mutates the
        # ConfigMap would leave pods running with stale config.
        checksum/gateway-config: {{ include (print $.Template.BasePath "/gateway-config.yaml") . | sha256sum }}
        {{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
      labels:
        {{- include "openshell.labels" . | nindent 8 }}
        {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
    spec:
      terminationGracePeriodSeconds: {{ .Values.podLifecycle.terminationGracePeriodSeconds }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "openshell.serviceAccountName" . }}
      {{- if .Values.server.hostGatewayIP }}
      hostAliases:
        - ip: {{ .Values.server.hostGatewayIP | quote }}
          hostnames:
            - host.docker.internal
            - host.openshell.internal
      {{- end }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: {{ include "openshell.image" . | quote }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args:
            - --config
            - /etc/openshell/gateway.toml
            - --db-url
            - {{ .Values.server.dbUrl | quote }}
          env:
            # All gateway settings live in the ConfigMap-backed TOML file
            # mounted at /etc/openshell/gateway.toml. The only env var below
            # is a process-level setting consumed by libraries outside
            # gateway code (currently just SSL_CERT_FILE for OIDC issuer TLS).
            {{- if and .Values.server.oidc.issuer .Values.server.oidc.caConfigMapName }}
            # OIDC issuer custom-CA: rustls/reqwest read SSL_CERT_FILE for
            # outbound TLS verification. This is a process-level env var
            # consumed by the TLS stack itself, not by gateway code, so it
            # cannot be represented in the gateway TOML schema.
            - name: SSL_CERT_FILE
              value: /etc/openshell-tls/oidc-ca/ca.crt
            {{- end }}
          volumeMounts:
            - name: openshell-data
              mountPath: /var/openshell
            - name: gateway-config
              mountPath: /etc/openshell
              readOnly: true
            - name: sandbox-jwt
              mountPath: /etc/openshell-jwt
              readOnly: true
            {{- if not .Values.server.disableTls }}
            - name: tls-cert
              mountPath: /etc/openshell-tls/server
              readOnly: true
            {{- if or .Values.server.tls.clientCaSecretName .Values.pkiInitJob.enabled (and .Values.certManager.enabled .Values.certManager.clientCaFromServerTlsSecret) }}
            - name: tls-client-ca
              mountPath: /etc/openshell-tls/client-ca
              readOnly: true
            {{- end }}
            {{- end }}
            {{- if and .Values.server.oidc.issuer .Values.server.oidc.caConfigMapName }}
            - name: oidc-ca
              mountPath: /etc/openshell-tls/oidc-ca
              readOnly: true
            {{- end }}
          ports:
            - name: grpc
              containerPort: {{ .Values.service.port }}
              protocol: TCP
            - name: health
              containerPort: {{ .Values.service.healthPort }}
              protocol: TCP
            {{- if .Values.service.metricsPort }}
            - name: metrics
              containerPort: {{ .Values.service.metricsPort }}
              protocol: TCP
            {{- end }}
          startupProbe:
            httpGet:
              path: /healthz
              port: health
            periodSeconds: {{ .Values.probes.startup.periodSeconds }}
            timeoutSeconds: {{ .Values.probes.startup.timeoutSeconds }}
            failureThreshold: {{ .Values.probes.startup.failureThreshold }}
          livenessProbe:
            httpGet:
              path: /healthz
              port: health
            initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
            periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
            timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
            failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
          readinessProbe:
            httpGet:
              path: /readyz
              port: health
            initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
            periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
            timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
            failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      volumes:
        - name: gateway-config
          configMap:
            name: {{ include "openshell.fullname" . }}-config
        - name: sandbox-jwt
          secret:
            secretName: {{ .Values.server.sandboxJwt.signingSecretName | default (printf "%s-jwt-keys" (include "openshell.fullname" .)) }}
            defaultMode: 0400
        {{- if not .Values.server.disableTls }}
        - name: tls-cert
          secret:
            secretName: {{ .Values.server.tls.certSecretName }}
        {{- if or .Values.server.tls.clientCaSecretName .Values.pkiInitJob.enabled (and .Values.certManager.enabled .Values.certManager.clientCaFromServerTlsSecret) }}
        - name: tls-client-ca
          secret:
            {{- if or .Values.pkiInitJob.enabled (and .Values.certManager.enabled .Values.certManager.clientCaFromServerTlsSecret) }}
            secretName: {{ .Values.server.tls.certSecretName }}
            items:
              - key: ca.crt
                path: ca.crt
            {{- else }}
            secretName: {{ .Values.server.tls.clientCaSecretName }}
            {{- end }}
        {{- end }}
        {{- end }}
        {{- if and .Values.server.oidc.issuer .Values.server.oidc.caConfigMapName }}
        - name: oidc-ca
          configMap:
            name: {{ .Values.server.oidc.caConfigMapName }}
        {{- end }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
  volumeClaimTemplates:
    - metadata:
        name: openshell-data
      spec:
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi