OpenShell

mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-16 05:20:22 +08:00

Files

T

Huabing (Robin) Zhao abcd15d1f2 feat(helm): add TLS termination for Envoy Gateway ingress (#2015 )

The chart's optional Gateway API ingress only rendered a plaintext HTTP
listener, so the gateway could not be exposed over TLS. Add an HTTPS
listener option that terminates TLS at the Envoy Gateway and forwards
plaintext gRPC to the gateway pod.

- gateway.yaml renders an HTTPS listener with `tls.mode: Terminate` and
  `certificateRefs` when `grpcRoute.gateway.listener.protocol=HTTPS`,
  keeping the default HTTP listener unchanged. Guards fail the render when
  `certificateRefs` is empty or `server.disableTls` is not true (the chart
  does not render a BackendTLSPolicy for re-encryption).
- values.yaml adds `grpcRoute.gateway.listener.tls.certificateRefs`.
- ci/values-gateway-tls.yaml exercises the HTTPS branch in lint/render.
- docs/kubernetes/ingress.mdx documents HTTPS setup and clarifies that
  Envoy Gateway only terminates TLS (no OIDC SecurityPolicy); client
  identity uses OIDC bearer tokens, with the client-credentials grant for
  headless agents.
- debug-openshell-cluster skill gains HTTPS-ingress troubleshooting rows.
- Regenerated the chart README values table.

Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>

2026-07-01 08:49:35 -07:00

deb

fix(gateway): align package TLS bootstrap path (#1601 )

2026-06-01 14:56:10 -05:00

docker

docs(container-gateway): fix Docker driver setup for containerized gateway (#1419 )

2026-06-03 09:41:41 -07:00

helm/openshell

feat(helm): add TLS termination for Envoy Gateway ingress (#2015 )

2026-07-01 08:49:35 -07:00

kube

chore(k8s): use upstream agent-sandbox manifest in CI/e2e (#1657 )