mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-15 05:09:44 +08:00
Taylor MutchandSeth Jennings
8eacb4779f
* feat(kubernetes): add sidecar supervisor topology Add the Kubernetes sidecar supervisor topology, its Helm/Skaffold configuration, topology documentation, and sidecar e2e matrix coverage. Skip root-only sandbox identity rewriting when process enforcement is network-only so the low-permission sidecar process container can start successfully. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar process id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar process id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): avoid similar proxy id names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * docs(kubernetes): clarify sidecar topology limits Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): keep sidecar process leaf capless Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): refresh sidecar provider env snapshots Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * test(supervisor): align hot-swap identity regression Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): stage sidecar mtls files before proxy chown Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): simplify sidecar supervisor topology Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * chore(helm): reuse sidecar skaffold values Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid similar iptables helper names Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(e2e): harden kube gateway wrapper setup Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(supervisor): avoid nft batch rollback on OCP Run nftables setup as individual commands so optional conntrack and log expressions can fail without rolling back required table, chain, and reject rules. Signed-off-by: Seth Jennings <sjenning@redhat.com> Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): preserve process identity in sidecar topology Render sidecar pods with a shared process namespace, keep binary-aware network policy enabled, and move Kubernetes sidecar settings under the nested sidecar config table. Also apply unprivileged Landlock/seccomp setup in NetworkOnly supervisor mode so sidecar topology keeps sandbox child hardening without privileged process setup. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * refactor(kubernetes): replace sidecar snapshots with control socket Coordinate sidecar policy and provider bootstrap over a local Unix socket so the process leaf no longer reads policy/provider snapshot files. Report entrypoint startup through the control channel and keep gateway credentials confined to the network sidecar. Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * feat(kubernetes): support relaxed sidecar network identity Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): satisfy sidecar clippy lint Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * refactor(kubernetes): standardize topology naming Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(sandbox): satisfy linux clippy timeout import Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): support kata sidecar on ipv4 pods Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): satisfy linux clippy for sidecar fallback Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * chore(kubernetes): remove stale supervisor topology references Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): enable sidecar binary policy inspection Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): harden sidecar control boundary Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(kubernetes): couple sidecar supervisor lifecycles Signed-off-by: Taylor Mutch <taylormutch@gmail.com> --------- Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Signed-off-by: Seth Jennings <sjenning@redhat.com> Co-authored-by: Seth Jennings <sjenning@redhat.com>
135 lines
4.5 KiB
TOML
135 lines
4.5 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Helm chart tasks
|
|
|
|
["helm:docs"]
|
|
description = "Generate the openshell Helm chart README from Chart.yaml, values.yaml, and README.md.gotmpl"
|
|
run = "helm-docs --chart-search-root deploy/helm/openshell"
|
|
|
|
["helm:docs:check"]
|
|
description = "Verify the openshell Helm chart README is generated and up to date"
|
|
run = """
|
|
set -e
|
|
tmp="$(mktemp)"
|
|
trap 'rm -f "$tmp"' EXIT
|
|
|
|
helm-docs --chart-search-root deploy/helm/openshell --dry-run > "$tmp"
|
|
if ! diff -u deploy/helm/openshell/README.md "$tmp"; then
|
|
echo "Helm chart README is out of sync. Run: mise run helm:docs" >&2
|
|
exit 1
|
|
fi
|
|
"""
|
|
hide = true
|
|
|
|
["helm:lint"]
|
|
description = "Lint the openshell Helm chart (defaults + all CI configuration variants)"
|
|
run = """
|
|
set -e
|
|
helm dependency build deploy/helm/openshell
|
|
echo "--- helm lint: defaults ---"
|
|
echo "values files: deploy/helm/openshell/values.yaml"
|
|
helm lint deploy/helm/openshell
|
|
for f in deploy/helm/openshell/ci/values-*.yaml; do
|
|
variant=$(basename "$f" .yaml | sed 's/values-//')
|
|
echo "--- helm lint: $variant ---"
|
|
echo "values files: deploy/helm/openshell/values.yaml, $f"
|
|
helm lint deploy/helm/openshell -f "$f"
|
|
done
|
|
echo "All variants passed."
|
|
"""
|
|
|
|
["helm:test"]
|
|
description = "Run Helm chart unit tests"
|
|
run = """
|
|
set -e
|
|
if ! helm plugin list | grep -q unittest; then
|
|
helm plugin install https://github.com/helm-unittest/helm-unittest --verify=false
|
|
fi
|
|
helm dependency build deploy/helm/openshell
|
|
helm unittest deploy/helm/openshell
|
|
"""
|
|
|
|
["helm:skaffold:dev"]
|
|
description = "Run skaffold dev for deploy/helm/openshell (iterative deploy)"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold dev"
|
|
|
|
["helm:skaffold:dev:sidecar"]
|
|
description = "Run skaffold dev with the Kubernetes supervisor sidecar topology"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold dev -p sidecar"
|
|
|
|
["helm:skaffold:dev:sidecar-mtls"]
|
|
description = "Run skaffold dev with the Kubernetes supervisor sidecar topology and TLS/mTLS enabled"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold dev -p sidecar-mtls"
|
|
|
|
["helm:skaffold:run"]
|
|
description = "Run skaffold run for deploy/helm/openshell (one-shot deploy)"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold run"
|
|
|
|
["helm:skaffold:run:sidecar"]
|
|
description = "Run skaffold run with the Kubernetes supervisor sidecar topology"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold run -p sidecar"
|
|
|
|
["helm:skaffold:run:sidecar-mtls"]
|
|
description = "Run skaffold run with the Kubernetes supervisor sidecar topology and TLS/mTLS enabled"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold run -p sidecar-mtls"
|
|
|
|
["helm:skaffold:delete"]
|
|
description = "Run skaffold delete for deploy/helm/openshell"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold delete"
|
|
|
|
["helm:skaffold:delete:sidecar"]
|
|
description = "Run skaffold delete for the Kubernetes supervisor sidecar topology"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold delete -p sidecar"
|
|
|
|
["helm:skaffold:delete:sidecar-mtls"]
|
|
description = "Run skaffold delete for the Kubernetes supervisor sidecar topology with TLS/mTLS enabled"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold delete -p sidecar-mtls"
|
|
|
|
["helm:skaffold:diagnose"]
|
|
description = "Run skaffold diagnose for deploy/helm/openshell"
|
|
dir = "deploy/helm/openshell"
|
|
run = "skaffold diagnose"
|
|
hide = true
|
|
|
|
# Local k3s via k3d (Docker required). macOS gets k3d from mise; Linux users
|
|
# should install k3d explicitly or point workflows at an existing/kind cluster.
|
|
|
|
["helm:k3s:create"]
|
|
description = "Create a local k3s cluster with k3d and merge kubeconfig (macOS via mise; Linux requires explicit k3d install; use with helm:skaffold:dev)"
|
|
run = "tasks/scripts/helm-k3s-local.sh create"
|
|
|
|
["helm:k3s:delete"]
|
|
description = "Delete the local k3d cluster created by helm:k3s:create"
|
|
run = "tasks/scripts/helm-k3s-local.sh delete"
|
|
|
|
["helm:k3s:start"]
|
|
description = "Start the local k3d cluster (after helm:k3s:stop)"
|
|
run = "tasks/scripts/helm-k3s-local.sh start"
|
|
hide = true
|
|
|
|
["helm:k3s:stop"]
|
|
description = "Stop the local k3d cluster without deleting it"
|
|
run = "tasks/scripts/helm-k3s-local.sh stop"
|
|
hide = true
|
|
|
|
["helm:k3s:status"]
|
|
description = "List local k3d clusters"
|
|
run = "tasks/scripts/helm-k3s-local.sh status"
|
|
hide = true
|
|
|
|
# Install Envoy Gateway's GatewayClass into the cluster
|
|
|
|
["helm:gateway:apply"]
|
|
description = "Apply the Envoy GatewayClass manifest (run after helm:skaffold:run when gateway routing is enabled)"
|
|
run = "kubectl apply -f deploy/kube/manifests/envoy-gateway-openshell.yaml"
|