mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-08 09:04:26 +08:00
grsandsjenning
37712756de
* feat(gateway): add storage-preserving sandbox image updates Add image-only UpdateSandbox with conditional versions, durable replay, fenced pending intent, and Kubernetes storage retention. Enable non-destructive image repair after completed timeout cleanup and exercise both Kubernetes controller API lanes. Closes #4623 Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> * feat(gateway): add storage-preserving sandbox image updates OpenClaw-Publication: b2036b09-b697-4d65-aba9-5c96a3198f9c Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> * fix(gateway): preserve image update patch-release compatibility Move image updates to a separate authenticated service and retain the baseline public sandbox status. Persist image intent and revisions independently with atomic baseline-known lifecycle fencing and explicit post-upgrade activation. Preserve concurrent provisioning clocks, fence replaced attempts and delayed callbacks, and verify private-state transactions plus both Kubernetes controller API lanes. Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> * fix(gateway): preserve optional driver compatibility and repair CI Move image updates to a separate optional compute-driver service, preserving the baseline generated trait and streaming associated type. Add source and TCP/UDS transport regressions, capability negotiation coverage, and a default-unsupported in-process extension. Keep Go compatibility tests outside generated output and update production reflection expectations for the separate sandbox update service. Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> * fix(gateway): preserve baseline factory and descriptor APIs Restore the original in-process driver trait object and existing instance enum. Register optional image updates through a default factory hook without requiring changes to existing drivers or factories, and require registration plus capability before mutation. Accept OpenShell-only descriptors while retaining strict validation of present update services. Cover baseline registration, missing-updater no-write behavior, descriptor validation, and both live Kubernetes retention lanes. Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> * chore(ci): use upstream Kubernetes E2E defaults Drop the task-level fallback superseded by main's runner defaults and explicit e2e-conformance-only selector. Preserve current upstream task definitions and recovery waiver unchanged. Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> * fix(gateway): integrate image updates with backend protocol Adapt non-launch image updates to the upstream remote admission API while retaining resource-policy verification before forwarding. Cover both negotiated extensions and preservation of backend pins and persisted launch identity. Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> * fix(gateway): remove sandbox image state on deletion Signed-off-by: Gordon Sim <gsim@redhat.com> * feat(gateway): expand UpdateSandbox configuration updates Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(sandbox): recover pending updates and address review feedback Signed-off-by: Gordon Sim <gsim@redhat.com> * perf(server): index pending sandbox updates for recovery Signed-off-by: Gordon Sim <gsim@redhat.com> * docs(sandbox): clarify stop behavior when updates are disabled Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(server): scope deletion bypass to the matching sandbox update Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(server): back off pending sandbox update recovery Signed-off-by: Gordon Sim <gsim@redhat.com> * ci: restore combined-chart Kubernetes e2e coverage Signed-off-by: Gordon Sim <gsim@redhat.com> * test(kubernetes): use uuid for update request IDs Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(kubernetes): reject oversized annotations before accepting sandbox updates Signed-off-by: Gordon Sim <gsim@redhat.com> * docs(skills): correct pending sandbox update recovery guidance Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(sandbox): preserve terminal results when stopping missing compute Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(server): bound sandbox update attempts to unblock recovery and deletion Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(server): remove unintended sandbox label count limit Signed-off-by: Gordon Sim <gsim@redhat.com> * fix(kubernetes): check known pod names during sandbox update preflight Signed-off-by: Gordon Sim <gsim@redhat.com> * docs: clarify sandbox update permissions and driver support Signed-off-by: Gordon Sim <gsim@redhat.com> --------- Signed-off-by: sjenning <493891+sjenning@users.noreply.github.com> Signed-off-by: Gordon Sim <gsim@redhat.com> Co-authored-by: sjenning <493891+sjenning@users.noreply.github.com>
OpenShell Workspace Helm Chart
Experimental - the shared-gateway, multi-namespace deployment path is under active design.
This chart installs the namespace-scoped ServiceAccount, RBAC, and NetworkPolicy needed for OpenShell Kubernetes sandboxes. Install it once in every platform-managed workspace namespace. It does not create a namespace or deploy an OpenShell gateway.
Install the gateway chart with workspaceResources.enabled=false, then install
this chart with the gateway ServiceAccount identity. Configure the gateway's
Kubernetes driver in operator workspace mode when it serves more than one
pre-provisioned workspace namespace:
helm install openshell-workspace ./deploy/helm/openshell-workspace \
--namespace app-a \
--set gateway.serviceAccount.name=openshell \
--set gateway.serviceAccount.namespace=openshell
Keep sandboxServiceAccount.name aligned with the gateway chart's
sandboxServiceAccount.name. The defaults for both charts are
openshell-sandbox. If the gateway enables
server.drivers.kubernetes.allowDriverConfig, also set
gateway.allowDriverConfig=true in every workspace release so caller-selected
PVCs can be admitted.
Values
| Key | Type | Default | Description |
|---|---|---|---|
| fullnameOverride | string | "" |
Override the full generated resource name. |
| gateway.allowDriverConfig | bool | false |
Grant PVC metadata reads required when the gateway enables caller driver config. Keep this aligned with server.drivers.kubernetes.allowDriverConfig in the gateway chart. |
| gateway.networkPolicy.podSelector | object | {"app.kubernetes.io/instance":"openshell","app.kubernetes.io/name":"openshell"} |
Labels selecting gateway pods allowed to reach sandbox SSH. |
| gateway.serviceAccount.name | string | "openshell" |
Name of the shared gateway ServiceAccount. |
| gateway.serviceAccount.namespace | string | "openshell" |
Namespace containing the shared gateway ServiceAccount. |
| nameOverride | string | "" |
Override the chart name used in generated resource names. |
| networkPolicy.enabled | bool | true |
Restrict sandbox SSH ingress to the shared gateway pods. |
| sandboxServiceAccount.annotations | object | {} |
Annotations added to the generated sandbox ServiceAccount. |
| sandboxServiceAccount.create | bool | true |
Create the ServiceAccount assigned to sandbox pods. |
| sandboxServiceAccount.name | string | "openshell-sandbox" |
Sandbox ServiceAccount name. |
Autogenerated from chart metadata using helm-docs v1.14.2