OpenShell/deploy/helm/openshell/skaffold.yaml

# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

# Local dev: builds gateway, sandbox, and supervisor images via tasks/scripts/docker-build-image.sh,
# which first stages Rust binaries natively on the host (using cargo / cargo-zigbuild
# when cross-compiling) and then builds the image from the prebuilt binary. This
# mirrors CI and is faster than compiling inside Docker on every rebuild because
# the host's cargo target cache and sccache are reused across iterations.
#
# Run from repo root:
#   mise run helm:skaffold:dev
#   mise run helm:skaffold:run
#
# See https://skaffold.dev/docs/deployers/helm/ (setValueTemplates, IMAGE_* fields).
apiVersion: skaffold/v4beta14
kind: Config
metadata:
  name: openshell
build:
  local:
    push: false
  tagPolicy:
    gitCommit: {}
  artifacts:
    - image: openshell/gateway
      context: ../../..
      custom:
        buildCommand: |
          CONTAINER_ENGINE_TARGET=local-k8s-cluster \
          IMAGE_NAME="${IMAGE%:*}" \
          IMAGE_TAG="${IMAGE##*:}" \
          tasks/scripts/docker-build-image.sh gateway
        dependencies:
          paths:
            - Cargo.toml
            - Cargo.lock
            - crates/**
            - proto/**
            - deploy/docker/Dockerfile.gateway
            - tasks/scripts/docker-build-image.sh
            - tasks/scripts/stage-prebuilt-binaries.sh
    - image: openshell/supervisor
      context: ../../..
      custom:
        buildCommand: |
          CONTAINER_ENGINE_TARGET=local-k8s-cluster \
          IMAGE_NAME="${IMAGE%:*}" \
          IMAGE_TAG="${IMAGE##*:}" \
          tasks/scripts/docker-build-image.sh supervisor
        dependencies:
          paths:
            - Cargo.toml
            - Cargo.lock
            - crates/**
            - proto/**
            - deploy/docker/Dockerfile.supervisor
            - tasks/scripts/docker-build-image.sh
            - tasks/scripts/stage-prebuilt-binaries.sh
    - image: openshell/sandbox
      context: ../../..
      custom:
        buildCommand: |
          CONTAINER_ENGINE_TARGET=local-k8s-cluster \
          IMAGE_NAME="${IMAGE%:*}" \
          IMAGE_TAG="${IMAGE##*:}" \
          tasks/scripts/docker-build-image.sh sandbox
        dependencies:
          paths:
            - Cargo.toml
            - Cargo.lock
            - crates/**
            - proto/**
            - deploy/docker/Dockerfile.sandbox
            - tasks/scripts/docker-build-image.sh
            - tasks/scripts/stage-prebuilt-binaries.sh
deploy:
  helm:
    releases:
      # cert-manager — comment this in and add values-cert-manager.yaml below
      # when you want cert-manager to manage TLS while certgen handles JWT.
      # Requires cert-manager CRDs to be installed in the cluster first.
      #- name: cert-manager
      #  remoteChart: oci://quay.io/jetstack/charts/cert-manager
      #  version: v1.20.2
      #  namespace: cert-manager
      #  createNamespace: true
      #  setValues:
      #    crds.enabled: true
      # Envoy Gateway — Kubernetes Gateway API implementation.
      # Installs the Gateway API CRDs and the "eg" GatewayClass.
      # Required when grpcRoute.enabled is true in the openshell release.
      #- name: envoy-gateway
      #  remoteChart: oci://docker.io/envoyproxy/gateway-helm
      #  version: v1.7.2
      #  namespace: envoy-gateway-system
      #  createNamespace: true
      #  # wait ensures Gateway API CRDs are registered before the openshell
      #  # release attempts to create Gateway and HTTPRoute resources.
      #  wait: true
      # SPIRE — installs SPIRE Server, Agent, Controller Manager, CSI Driver,
      # and OIDC Discovery Provider using the SPIFFE hardened charts.
      # Uncomment both releases and ci/values-spire.yaml below to use
      # SPIFFE JWT-SVIDs for dynamic provider token grants.
      #- name: spire-crds
      #  repo: https://spiffe.github.io/helm-charts-hardened/
      #  remoteChart: spire-crds
      #  version: 0.5.0
      #  namespace: spire
      #  createNamespace: true
      #  wait: true
      #- name: spire
      #  repo: https://spiffe.github.io/helm-charts-hardened/
      #  remoteChart: spire
      #  version: 0.29.0
      #  namespace: spire
      #  createNamespace: true
      #  valuesFiles:
      #    - ci/values-spire-stack.yaml
      #  wait: true
      - name: openshell
        chartPath: .
        namespace: openshell
        createNamespace: true
        valuesFiles:
          - values.yaml
          - ci/values-skaffold.yaml
          # Add ci/values-cert-manager.yaml here (and uncomment the cert-manager
          # release above) to switch TLS generation to cert-manager.
          #- ci/values-cert-manager.yaml
          # To enable OIDC with a local Keycloak instance, run the one-time
          # setup task first, then uncomment the line below:
          #   mise run keycloak:k8s:setup
          #- ci/values-keycloak.yaml
          # To enable the Gateway API HTTPRoute (requires Envoy Gateway above):
          #- ci/values-gateway.yaml
          # To enable SPIFFE/SPIRE provider token grants (requires the
          # spire-crds and spire releases above):
          #- ci/values-spire.yaml
          # To test multi-replica external PostgreSQL behavior:
          #- ci/values-high-availability.yaml
        setValueTemplates:
          # Skaffold supplies complete image repositories. Clear the chart's
          # shared registry so these values are used verbatim.
          global.image.registry: ''
          gateway.image.repository: '{{.IMAGE_REPO_openshell_gateway}}'
          gateway.image.tag: '{{.IMAGE_TAG_openshell_gateway}}'
          supervisor.image.repository: '{{.IMAGE_REPO_openshell_supervisor}}'
          supervisor.image.tag: '{{.IMAGE_TAG_openshell_supervisor}}'
          sandboxRuntime.image.repository: '{{.IMAGE_REPO_openshell_sandbox}}'
          sandboxRuntime.image.tag: '{{.IMAGE_TAG_openshell_sandbox}}'
profiles:
  # Full HA test path: installs Envoy Gateway and layers both HA replicas and
  # Gateway API routing values onto the OpenShell release.
  - name: high-availability
    patches:
      - op: add
        path: /deploy/helm/releases/0
        value:
          name: envoy-gateway
          remoteChart: oci://docker.io/envoyproxy/gateway-helm
          version: v1.7.2
          namespace: envoy-gateway-system
          createNamespace: true
          wait: true
      - op: add
        path: /deploy/helm/releases/1/valuesFiles/-
        value: ci/values-high-availability.yaml
      - op: add
        path: /deploy/helm/releases/1/valuesFiles/-
        value: ci/values-gateway.yaml
  - name: credential-driver-kubernetes-secrets
    patches:
      - op: add
        path: /deploy/helm/releases/0/valuesFiles/-
        value: ci/values-credential-driver-kubernetes-secrets.yaml
  - name: credential-driver-vault
    patches:
      - op: add
        path: /deploy/helm/releases/0/valuesFiles/-
        value: ci/values-credential-driver-vault.yaml