mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-20 06:00:06 +08:00
Drew Newberry
84960e70a3
* fix(kubernetes): scope resource admission RBAC Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(helm): gate PVC admission reads Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
37 lines
1.4 KiB
Go Template
37 lines
1.4 KiB
Go Template
# OpenShell Workspace Helm Chart
|
|
|
|
<!--
|
|
This file is generated by helm-docs.
|
|
Edit README.md.gotmpl and values.yaml, then run `mise run helm:docs`.
|
|
-->
|
|
|
|
> **Experimental** - the shared-gateway, multi-namespace deployment path is
|
|
> under active design.
|
|
|
|
This chart installs the namespace-scoped ServiceAccount, RBAC, and NetworkPolicy
|
|
needed for OpenShell Kubernetes sandboxes. Install it once in every
|
|
platform-managed workspace namespace. It does not create a namespace or deploy
|
|
an OpenShell gateway.
|
|
|
|
Install the gateway chart with `workspaceResources.enabled=false`, then install
|
|
this chart with the gateway ServiceAccount identity. Configure the gateway's
|
|
Kubernetes driver in `operator` workspace mode when it serves more than one
|
|
pre-provisioned workspace namespace:
|
|
|
|
```shell
|
|
helm install openshell-workspace ./deploy/helm/openshell-workspace \
|
|
--namespace app-a \
|
|
--set gateway.serviceAccount.name=openshell \
|
|
--set gateway.serviceAccount.namespace=openshell
|
|
```
|
|
|
|
Keep `sandboxServiceAccount.name` aligned with the gateway chart's
|
|
`sandboxServiceAccount.name`. The defaults for both charts are
|
|
`openshell-sandbox`. If the gateway enables
|
|
`server.drivers.kubernetes.allowDriverConfig`, also set
|
|
`gateway.allowDriverConfig=true` in every workspace release so caller-selected
|
|
PVCs can be admitted.
|
|
|
|
{{ template "chart.valuesSection" . }}
|
|
{{ template "helm-docs.versionFooter" . }}
|