OpenShell

mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-14 04:59:28 +08:00

Files

T

History

Brandon Squizzato 99e83a535e feat(helm): scope ClusterRole/ClusterRoleBinding names by release namespace (#2939 )

* feat(helm): scope ClusterRole/ClusterRoleBinding names by release namespace

The chart creates cluster-scoped ClusterRole and ClusterRoleBinding
resources with a fixed name derived from the release name. When
multiple Helm releases coexist on the same cluster (multi-tenant),
only one release can own these resources due to Helm ownership
annotations -- the second install fails with a conflict.

Append .Release.Namespace to the ClusterRole and ClusterRoleBinding
names so each release gets its own cluster-scoped resources. The
duplication is harmless (the rules are identical and small) and
eliminates multi-tenant conflicts entirely without requiring external
RBAC management.

Signed-off-by: Brandon Squizzato <bsquizza@redhat.com>

* test(helm): add regression tests for namespace-scoped ClusterRole names

Assert the generated ClusterRole name, ClusterRoleBinding name, and
roleRef all include the release namespace suffix so multi-namespace
installations cannot silently regress to conflicting fixed names.

Signed-off-by: Brandon Squizzato <bsquizza@redhat.com>

---------

Signed-off-by: Brandon Squizzato <bsquizza@redhat.com>

2026-09-11 17:57:42 +00:00

_gateway-workload.tpl

refactor(config): normalize and enforce gateway schema v2 (#2814 )

2026-09-11 05:00:24 +00:00

_helpers.tpl

refactor(config): normalize and enforce gateway schema v2 (#2814 )

2026-09-11 05:00:24 +00:00

agent-sandbox-preflight.yaml

fix(helm): preflight Agent Sandbox APIs (#2867 )

2026-08-21 14:32:19 +00:00

cert-manager-pki.yaml

feat(k8s): add namespace-per-workspace support (RFC 0011 Phase 3) (#2656 )