mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Mark CampbellandKris Hicks
679b190677
* feat(testing): normalize configurable test images Signed-off-by: Bobbins228 <mcampbel@redhat.com> Signed-off-by: Kris Hicks <khicks@nvidia.com> * feat(helm): add global image overrides Signed-off-by: Bobbins228 <mcampbel@redhat.com> * feat(helm): support image registry overrides Signed-off-by: Bobbins228 <mcampbel@redhat.com> Signed-off-by: Kris Hicks <khicks@nvidia.com> * refactor(helm): simplify image configuration Signed-off-by: Bobbins228 <mcampbel@redhat.com> * fix(e2e): avoid reloading reused kind sandbox image Signed-off-by: Bobbins228 <mcampbel@redhat.com> * fix(helm): default sandbox image to nvcr.io/nvidia/base/ubuntu:24.04 Signed-off-by: Kris Hicks <khicks@nvidia.com> --------- Signed-off-by: Bobbins228 <mcampbel@redhat.com> Signed-off-by: Kris Hicks <khicks@nvidia.com> Co-authored-by: Kris Hicks <khicks@nvidia.com>
55 lines
2.5 KiB
YAML
55 lines
2.5 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# OpenShift overlay for the Kubernetes e2e harness.
|
|
#
|
|
# Bundles the OpenShift-specific settings the harness needs: the Route/mTLS
|
|
# transport, and an image pull policy that avoids stale cached images.
|
|
#
|
|
# Route/mTLS transport: on OpenShift, `kubectl port-forward` stalls the SSH-relay
|
|
# `sandbox connect` path (round-trip-heavy SSH over SPDY), so the harness drives
|
|
# the gateway through a passthrough OpenShift Route with mTLS instead. This
|
|
# overlay turns TLS back on (values-skaffold.yaml disables it), enables the Route,
|
|
# and promotes the cert-verified caller to a dev principal.
|
|
#
|
|
# Image pull policy: force `Always` so runs against the `latest` upstream image
|
|
# actually use it, instead of a stale copy cached on the cluster nodes.
|
|
#
|
|
# Layered by e2e/with-kube-gateway.sh AFTER ci/values-skaffold.yaml and
|
|
# ci/values-openshift-scc.yaml when an OpenShift cluster is detected. The harness
|
|
# supplies `openshiftRoute.host` and `pkiInitJob.serverDnsNames[0]` via --set at
|
|
# install time (both are the cluster-derived Route hostname).
|
|
#
|
|
# Security: this is NOT an open gateway. `server.tls.clientCaSecretName` defaults
|
|
# to `openshell-server-client-ca` and there is no OIDC, so `require_client_auth`
|
|
# is true and mTLS is MANDATORY at the TLS handshake — a caller with only the
|
|
# Route URL and no client certificate is rejected before any RPC. The passthrough
|
|
# Route terminates TLS at the gateway pod, so this holds end-to-end.
|
|
# `allowUnauthenticatedUsers` only promotes the already cert-verified caller to a
|
|
# dev principal at the app layer (mtls_auth is unsupported with the Kubernetes
|
|
# driver). Both are required together; the client certificate is the access gate.
|
|
gateway:
|
|
image:
|
|
pullPolicy: Always
|
|
|
|
supervisor:
|
|
image:
|
|
pullPolicy: Always
|
|
|
|
server:
|
|
disableTls: false
|
|
auth:
|
|
allowUnauthenticatedUsers: true
|
|
|
|
openshiftRoute:
|
|
enabled: true
|
|
# host is supplied via --set at install time (cluster-derived Route hostname).
|
|
# The default HAProxy Route timeout is 30s, which severs long-lived transfers
|
|
# (large sandbox upload/download, SSH-relay `sandbox connect`) mid-stream. Raise
|
|
# both the connection timeout and the passthrough tunnel timeout so these paths
|
|
# survive. Passthrough Routes proxy in TCP mode, so timeout-tunnel governs the
|
|
# established tunnel while timeout covers the pre-tunnel phase.
|
|
annotations:
|
|
haproxy.router.openshift.io/timeout: 300s
|
|
haproxy.router.openshift.io/timeout-tunnel: 300s
|