From a3826fddd436b1a8a1d00215c32643aea40ab279 Mon Sep 17 00:00:00 2001 From: Taylor Mutch Date: Thu, 7 May 2026 10:29:36 -0700 Subject: [PATCH 1/2] fix(helm): derive grpcEndpoint from chart context The chart hardcoded server.grpcEndpoint to https://openshell.openshell.svc.cluster.local:8080, which only matched the in-cluster Service DNS for the standard release name and namespace. A new helper now builds ://..svc.cluster.local: from chart context, picking the scheme from server.disableTls. An explicit server.grpcEndpoint override is passed through verbatim. --- deploy/helm/openshell/templates/_helpers.tpl | 16 ++++++++++++++++ deploy/helm/openshell/templates/statefulset.yaml | 2 +- deploy/helm/openshell/values.yaml | 8 ++++++-- deploy/kube/manifests/openshell-helmchart.yaml | 1 - examples/gateway-deploy-connect.md | 3 +-- 5 files changed, 24 insertions(+), 6 deletions(-) diff --git a/deploy/helm/openshell/templates/_helpers.tpl b/deploy/helm/openshell/templates/_helpers.tpl index 09159340d..93eff90a9 100644 --- a/deploy/helm/openshell/templates/_helpers.tpl +++ b/deploy/helm/openshell/templates/_helpers.tpl @@ -81,3 +81,19 @@ Namespaced Issuer (selfSigned) for cert-manager CA bootstrap. {{- define "openshell.issuerSelfSigned" -}} {{- printf "%s-selfsigned" (include "openshell.fullname" .) | trunc 63 | trimSuffix "-" }} {{- end }} + +{{/* +gRPC endpoint sandbox pods use to call back into the gateway. An explicit +.Values.server.grpcEndpoint is used verbatim. Otherwise it is derived from +the in-cluster Service DNS, release namespace, service port, and disableTls +flag — so the default value works for any release name or namespace without +override. +*/}} +{{- define "openshell.grpcEndpoint" -}} +{{- if .Values.server.grpcEndpoint -}} +{{- .Values.server.grpcEndpoint -}} +{{- else -}} +{{- $scheme := ternary "http" "https" (default false .Values.server.disableTls) -}} +{{- printf "%s://%s.%s.svc.cluster.local:%d" $scheme (include "openshell.fullname" .) .Release.Namespace (int .Values.service.port) -}} +{{- end -}} +{{- end }} diff --git a/deploy/helm/openshell/templates/statefulset.yaml b/deploy/helm/openshell/templates/statefulset.yaml index 2db3a0c5f..267c8ae0b 100644 --- a/deploy/helm/openshell/templates/statefulset.yaml +++ b/deploy/helm/openshell/templates/statefulset.yaml @@ -77,7 +77,7 @@ spec: value: {{ .Values.supervisor.image.pullPolicy | quote }} {{- end }} - name: OPENSHELL_GRPC_ENDPOINT - value: {{ if .Values.server.disableTls }}{{ .Values.server.grpcEndpoint | replace "https://" "http://" | quote }}{{ else }}{{ .Values.server.grpcEndpoint | quote }}{{ end }} + value: {{ include "openshell.grpcEndpoint" . | quote }} {{- if .Values.server.sshGatewayHost }} - name: OPENSHELL_SSH_GATEWAY_HOST value: {{ .Values.server.sshGatewayHost | quote }} diff --git a/deploy/helm/openshell/values.yaml b/deploy/helm/openshell/values.yaml index f8e090721..6dd00578d 100644 --- a/deploy/helm/openshell/values.yaml +++ b/deploy/helm/openshell/values.yaml @@ -86,8 +86,12 @@ server: # (Always for :latest, IfNotPresent otherwise). Set to "Always" for dev # clusters so new images are picked up without manual eviction. sandboxImagePullPolicy: "" - # gRPC endpoint for sandboxes to callback to OpenShell (must be reachable from pods) - grpcEndpoint: "https://openshell.openshell.svc.cluster.local:8080" + # gRPC endpoint sandboxes call back into the gateway. Leave empty to derive + # it from the chart fullname, release namespace, service port, and + # disableTls flag (i.e. ://..svc.cluster.local:). + # Override only when sandboxes must reach the gateway via a different + # hostname (e.g. an external ingress or a host alias). + grpcEndpoint: "" # Public host/port returned to CLI clients for SSH proxy CONNECT requests. # For local clusters the default 127.0.0.1:8080 is correct; for remote # clusters these should be set to the externally reachable host and port. diff --git a/deploy/kube/manifests/openshell-helmchart.yaml b/deploy/kube/manifests/openshell-helmchart.yaml index eba79364c..ea4e370dc 100644 --- a/deploy/kube/manifests/openshell-helmchart.yaml +++ b/deploy/kube/manifests/openshell-helmchart.yaml @@ -35,7 +35,6 @@ spec: dbUrl: __DB_URL__ sshGatewayHost: __SSH_GATEWAY_HOST__ sshGatewayPort: __SSH_GATEWAY_PORT__ - grpcEndpoint: "https://openshell.openshell.svc.cluster.local:8080" hostGatewayIP: __HOST_GATEWAY_IP__ disableGatewayAuth: __DISABLE_GATEWAY_AUTH__ disableTls: __DISABLE_TLS__ diff --git a/examples/gateway-deploy-connect.md b/examples/gateway-deploy-connect.md index 27f690334..37ed37bf2 100644 --- a/examples/gateway-deploy-connect.md +++ b/examples/gateway-deploy-connect.md @@ -16,8 +16,7 @@ kubectl create namespace openshell helm upgrade --install openshell deploy/helm/openshell \ --namespace openshell \ --set server.disableTls=true \ - --set service.type=ClusterIP \ - --set server.grpcEndpoint=http://openshell.openshell.svc.cluster.local:8080 + --set service.type=ClusterIP ``` For local evaluation, forward the service and register the forwarded endpoint: From 00ee5d199e975bd30ccfade1b48f34570b307a5e Mon Sep 17 00:00:00 2001 From: Taylor Mutch Date: Thu, 7 May 2026 10:29:44 -0700 Subject: [PATCH 2/2] chore(scripts): validate k3d cluster name length early helm-k3s-local.sh derives the cluster name from the current branch suffix. Long branch names produced names exceeding k3d's 32-char cap and failed deep inside k3d cluster create with a confusing validation error. cmd_create now bails out before invoking docker/k3d with a copy-pasteable HELM_K3S_CLUSTER_NAME override hint. Status, start, stop, delete, and help remain unaffected so an over-long derived name does not block diagnostics. --- tasks/scripts/helm-k3s-local.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tasks/scripts/helm-k3s-local.sh b/tasks/scripts/helm-k3s-local.sh index 3f268c2dc..d4f802c0f 100755 --- a/tasks/scripts/helm-k3s-local.sh +++ b/tasks/scripts/helm-k3s-local.sh @@ -20,6 +20,9 @@ ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)" _branch="$(git -C "${ROOT}" rev-parse --abbrev-ref HEAD 2>/dev/null)" || _branch="" _suffix="$(printf '%s' "${_branch##*/}" | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z0-9' '-' | sed 's/-*$//')" CLUSTER_NAME="${HELM_K3S_CLUSTER_NAME:-openshell-dev${_suffix:+-${_suffix}}}" +# k3d caps cluster names at 32 chars; validated in cmd_create so the operator +# gets an actionable hint instead of a deep-stack k3d validation error. +K3D_CLUSTER_NAME_MAX=32 # Host port forwarded to port 80 via the k3d load balancer. # Used by Envoy Gateway's LoadBalancer service (values-gateway.yaml). HOST_LB_PORT="${HELM_K3S_LB_HOST_PORT:-8080}" @@ -154,6 +157,15 @@ cmd_create() { require_docker require_k3d + if (( ${#CLUSTER_NAME} > K3D_CLUSTER_NAME_MAX )); then + cat >&2 <