mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-21 06:11:31 +08:00
Huabing (Robin) Zhao
abcd15d1f2
The chart's optional Gateway API ingress only rendered a plaintext HTTP listener, so the gateway could not be exposed over TLS. Add an HTTPS listener option that terminates TLS at the Envoy Gateway and forwards plaintext gRPC to the gateway pod. - gateway.yaml renders an HTTPS listener with `tls.mode: Terminate` and `certificateRefs` when `grpcRoute.gateway.listener.protocol=HTTPS`, keeping the default HTTP listener unchanged. Guards fail the render when `certificateRefs` is empty or `server.disableTls` is not true (the chart does not render a BackendTLSPolicy for re-encryption). - values.yaml adds `grpcRoute.gateway.listener.tls.certificateRefs`. - ci/values-gateway-tls.yaml exercises the HTTPS branch in lint/render. - docs/kubernetes/ingress.mdx documents HTTPS setup and clarifies that Envoy Gateway only terminates TLS (no OIDC SecurityPolicy); client identity uses OIDC bearer tokens, with the client-credentials grant for headless agents. - debug-openshell-cluster skill gains HTTPS-ingress troubleshooting rows. - Regenerated the chart README values table. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Gateway API overlay with TLS termination at the Envoy Gateway listener.
|
|
#
|
|
# Exercises the HTTPS listener branch of templates/gateway.yaml for
|
|
# `helm template`/lint coverage. Envoy Gateway terminates TLS using the
|
|
# referenced kubernetes.io/tls Secret and forwards plaintext to the gateway pod,
|
|
# so the gateway runs with TLS disabled and uses OIDC for client identity.
|
|
#
|
|
# The certificate Secret (openshell-ingress-tls) and the OIDC issuer below are
|
|
# placeholders for render coverage; a real deployment must provide a valid TLS
|
|
# Secret in the release namespace and a reachable OIDC issuer.
|
|
|
|
grpcRoute:
|
|
enabled: true
|
|
gateway:
|
|
create: true
|
|
className: "eg"
|
|
listener:
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
certificateRefs:
|
|
- name: openshell-ingress-tls
|
|
hostnames: []
|
|
|
|
server:
|
|
# Envoy terminates TLS at the edge; the gateway listens plaintext behind it.
|
|
disableTls: true
|
|
oidc:
|
|
issuer: "https://keycloak.example.com/realms/openshell"
|
|
audience: "openshell-cli"
|