mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-29 07:23:25 +08:00
Jesse Jaggars
26134dc735
* feat(gateway): add hashed service-routing hostnames for multi-gateway clusters
Closes #4840
Add an optional service_routing_gateway_name gateway setting (TOML, CLI,
env, Helm) that disambiguates exposed service URLs when multiple gateways
share a cluster, ingress, and wildcard certificate. When configured,
exposed-service hostnames become a deterministic 16-character lowercase
base32 SHA-256 label of (gateway name, workspace, sandbox, service) under
the same base domain, keeping every hostname exactly one label deep for
wildcard-certificate compatibility. Unset gateways preserve the existing
readable hostname format byte-for-byte, and configured gateways still
accept legacy hosts during migration.
Hashed hosts resolve through an in-memory route index hydrated from
persisted ServiceEndpoint records at startup, refreshed on miss for
multi-replica deployments, maintained across expose, delete, and sandbox
cleanup, and enforced for collisions before endpoint persistence.
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
* fix(lint): satisfy clippy doc lints on main-landed sandbox_runtime code
The shared-supervisor landing (9a85667d0) predates the last Branch
Checks run on main, so its doc-comment style was never gated. Split the
three overlong first doc paragraphs so workspace clippy -D warnings
passes; behavior is unchanged.
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
* refactor(gateway): address hashed-hostname review feedback
Three changes from PR review:
Identity model: replace service_routing_gateway_name with an explicit
service_hostname_format mode (readable, the default, or hashed). In
hashed mode the discriminator hashed into exposed-service hostnames is
the existing gateway installation name ([openshell.gateway].name,
operator- or platform-assigned, defaulting to the Helm release name),
so no second per-gateway name is introduced. The name must be a DNS
label and unique among gateways sharing the service base domain — an
operational contract held by the deploying platform, documented in the
configuration reference. gateway_jwt.gateway_id remains separate and
untouched; renaming the installation now changes every minted URL.
Request-path amplification: miss-triggered service route index
rebuilds are debounced to one attempt per five seconds. Unknown hash
labels reach the rebuild path before authentication, and without the
debounce each request carrying a random well-formed label triggered a
full all-workspaces endpoint scan. Startup hydration and explicit
rebuilds bypass the debounce.
OCSF regression: cross-origin rejections for hashed service hosts
emitted no security event because the logging path used the
readable-host parser only. The emitter now resolves hashed hosts
through the in-memory route index (never the miss-triggered rebuild
path) and still emits for unknown hash-shaped labels, attributed to
the raw label.
Also updates the debug-openshell-cluster skill for the new gateway
TOML fields, per the repository instructions for gateway config
changes.
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>
---------
Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>