mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-17 05:31:16 +08:00
Gaizka MenendezandTaylor Mutch
fe3942f2da
* feat(helm): add generic gateway TOML serializer Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * docs(architecture): define Helm gateway configuration boundary Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * feat(helm): define default gateway configuration map Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * refactor(helm): render gateway config from values map Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * test(helm): cover generic gateway TOML rendering Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * feat(helm): protect gateway config secret boundary Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * docs(helm): classify legacy gateway configuration values Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * refactor(helm): derive dual-use resources from gateway config Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * test(helm): migrate gateway config scenarios Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * refactor(helm): derive credential resources from gateway config Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * refactor(helm): migrate gateway config overlays Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * refactor(helm): remove gateway configuration shadow values Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * refactor(helm): align runtime config with resources Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * docs(helm): add gateway config migration guide Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * test(helm): validate rendered gateway config Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * test(helm): cover config resource coherence Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(helm): make Kubernetes E2E deployable Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(e2e): pass host aliases through gateway config Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * docs(e2e): reference gateway config host alias Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(helm): enforce gateway resource ownership Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * test(e2e): cover chart host gateway input Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(helm): address gateway config review findings Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(helm): repair RFC 0012 migration integration Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(e2e): align Kubernetes parity with RFC 0012 Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(helm): complete gateway config migration Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * chore(helm): add SPDX header to TOML template * fix(helm): preserve legacy gateway configuration aliases Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(helm): complete legacy gateway config compatibility Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * feat(helm): support gateway config arrays of tables * fix(helm): preserve sandbox identity aliases * fix(helm): address gateway config review findings Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> * fix(helm): preserve gateway config migration settings Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * test(helm): validate extension arrays in CI values Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(helm): restore unconditional SPDX headers Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * fix(helm): restore route SPDX header placement Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * docs(helm): simplify configuration and migration examples Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * docs(helm): remove redundant flag explanations Signed-off-by: Taylor Mutch <taylormutch@gmail.com> * docs(helm): move chart configuration guidance to Kubernetes setup Signed-off-by: Taylor Mutch <taylormutch@gmail.com> --------- Signed-off-by: Gaizka Menendez Hernandez <gmenende@redhat.com> Signed-off-by: Taylor Mutch <taylormutch@gmail.com> Co-authored-by: Taylor Mutch <taylormutch@gmail.com>
56 lines
2.6 KiB
YAML
56 lines
2.6 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# OpenShift overlay for the Kubernetes e2e harness.
|
|
#
|
|
# Bundles the OpenShift-specific settings the harness needs: the Route/mTLS
|
|
# transport, and an image pull policy that avoids stale cached images.
|
|
#
|
|
# Route/mTLS transport: on OpenShift, `kubectl port-forward` stalls the SSH-relay
|
|
# `sandbox connect` path (round-trip-heavy SSH over SPDY), so the harness drives
|
|
# the gateway through a passthrough OpenShift Route with mTLS instead. This
|
|
# overlay turns TLS back on (values-skaffold.yaml disables it), enables the Route,
|
|
# and promotes the cert-verified caller to a dev principal.
|
|
#
|
|
# Image pull policy: force `Always` so runs against the `latest` upstream image
|
|
# actually use it, instead of a stale copy cached on the cluster nodes.
|
|
#
|
|
# Layered by e2e/with-kube-gateway.sh AFTER ci/values-skaffold.yaml and
|
|
# ci/values-openshift-scc.yaml when an OpenShift cluster is detected. The harness
|
|
# supplies `openshiftRoute.host` and `pkiInitJob.serverDnsNames[0]` via --set at
|
|
# install time (both are the cluster-derived Route hostname).
|
|
#
|
|
# Security: this is NOT an open gateway. `server.tls.clientCaSecretName` defaults
|
|
# to `openshell-server-client-ca` and there is no OIDC, so `require_client_auth`
|
|
# is true and mTLS is MANDATORY at the TLS handshake — a caller with only the
|
|
# Route URL and no client certificate is rejected before any RPC. The passthrough
|
|
# Route terminates TLS at the gateway pod, so this holds end-to-end.
|
|
# `allow_unauthenticated_users` only promotes the already cert-verified caller to a
|
|
# dev principal at the app layer (mtls_auth is unsupported with the Kubernetes
|
|
# driver). Both are required together; the client certificate is the access gate.
|
|
gateway:
|
|
image:
|
|
pullPolicy: Always
|
|
|
|
server:
|
|
disableTls: false
|
|
|
|
gatewayConfig:
|
|
openshell.gateway.auth:
|
|
allow_unauthenticated_users: true
|
|
openshell.drivers.kubernetes:
|
|
sandbox_runtime_image_pull_policy: always
|
|
supervisor_image_pull_policy: always
|
|
|
|
openshiftRoute:
|
|
enabled: true
|
|
# host is supplied via --set at install time (cluster-derived Route hostname).
|
|
# The default HAProxy Route timeout is 30s, which severs long-lived transfers
|
|
# (large sandbox upload/download, SSH-relay `sandbox connect`) mid-stream. Raise
|
|
# both the connection timeout and the passthrough tunnel timeout so these paths
|
|
# survive. Passthrough Routes proxy in TCP mode, so timeout-tunnel governs the
|
|
# established tunnel while timeout covers the pre-tunnel phase.
|
|
annotations:
|
|
haproxy.router.openshift.io/timeout: 300s
|
|
haproxy.router.openshift.io/timeout-tunnel: 300s
|