Skip to content

Commit 17fd4cd

Browse files
jhjaggarsjhjaggars
committed
fix(helm): satisfy license header and README sync checks
Move the SPDX header in service-ingress-rbac.yaml above the template logic so the license checker sees it within its scan window, and regenerate the chart README after restoring the full serviceIngress description in values.yaml — helm-docs had drifted out of sync with the manually extended README text. Signed-off-by: Jesse Jaggars <[email protected]>
1 parent a868504 commit 17fd4cd

3 files changed

Lines changed: 13 additions & 10 deletions

File tree

‎deploy/helm/openshell/README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -566,11 +566,6 @@ discovery endpoint or its TLS CA.
566566
| server.sandboxJwt.ttlSecs | int | `3600` | Token TTL in seconds. Defaults to 3600 (1h). |
567567
| server.sandboxNamespace | string | `""` | Namespace where sandbox pods are created. Defaults to the Helm release namespace (.Release.Namespace) when left empty. |
568568
| server.sandboxUid | string | `""` | UID for sandbox pods (`sandbox_uid`). Empty (default) = use the OpenShift SCC namespace annotation if present, otherwise the driver default. Must be an integer between 1 and 4294967294. |
569-
| serviceIngress.enabled | bool | `false` | Reconcile ingress objects for exposed sandbox service hostnames, targeting this release's gateway Service. Needed when multiple gateways share one service base domain; a single gateway can use one wildcard host rule instead. |
570-
| serviceIngress.kind | string | `"route"` | Object kind to reconcile: `route` (OpenShift Route with TLS passthrough), `httproute` (Gateway API HTTPRoute), or `ingress` (networking.k8s.io Ingress; requires a controller with SSL passthrough, annotated for nginx). |
571-
| serviceIngress.ingressClass | string | `""` | Ingress class for the `ingress` kind. |
572-
| serviceIngress.httpRouteParentGateway | string | `""` | Parent Gateway name for the `httproute` kind. Defaults to the chart-managed Gateway. |
573-
| serviceIngress.pollIntervalSeconds | int | `15` | Seconds between reconciliation passes. |
574569
| server.serviceRoutingGatewayName | string | `""` | Optional routing name that disambiguates exposed-service hostnames when multiple gateways share one service base domain behind a single ingress and wildcard certificate. Must be unique among those gateways. When set, exposed-service hostnames become opaque fixed-length hashed labels (for example enh47uqyj7bpyttz.apps.example.com) instead of the readable workspace--sandbox--service composite. Unset preserves the composite hostnames. |
575570
| server.telemetryEnabled | bool | `true` | Enable anonymous OpenShell telemetry from the gateway and the sandbox supervisors it launches. |
576571
| server.tls.certSecretName | string | `"openshell-server-tls"` | K8s secret (type kubernetes.io/tls) with tls.crt and tls.key for the server. |
@@ -586,6 +581,11 @@ discovery endpoint or its TLS CA.
586581
| serviceAccount.annotations | object | `{}` | Annotations to add to the generated service account. |
587582
| serviceAccount.create | bool | `true` | Create a service account for the gateway. |
588583
| serviceAccount.name | string | `""` | Existing service account name to use when serviceAccount.create is false. |
584+
| serviceIngress.enabled | bool | `false` | Reconcile ingress objects for exposed sandbox service hostnames, targeting this release's gateway Service. Needed when multiple gateways share one service base domain; a single gateway can use one wildcard host rule instead. |
585+
| serviceIngress.httpRouteParentGateway | string | `""` | Parent Gateway name for the `httproute` kind. Defaults to the chart-managed Gateway. |
586+
| serviceIngress.ingressClass | string | `""` | Ingress class for the `ingress` kind. |
587+
| serviceIngress.kind | string | `"route"` | Object kind to reconcile: `route` (OpenShift Route with TLS passthrough), `httproute` (Gateway API HTTPRoute), or `ingress` (networking.k8s.io Ingress; requires a controller with SSL passthrough, annotated for nginx). |
588+
| serviceIngress.pollIntervalSeconds | int | `15` | Seconds between reconciliation passes. |
589589
| supervisor.image.digest | string | `""` | Supervisor image digest. When set, this takes precedence over tag. |
590590
| supervisor.image.pullPolicy | string | `nil` | Supervisor image pull policy. Empty uses global.image.pullPolicy. Prefer always, if_not_present, or never; the chart also accepts legacy Kubernetes spellings Always, IfNotPresent, and Never. |
591591
| supervisor.image.registry | string | `""` | Supervisor image registry. Empty uses global.image.registry. |

‎deploy/helm/openshell/templates/service-ingress-rbac.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
1-
{{- if include "openshell.rbacCreate" . }}
1+
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
24
{{- /* RBAC for service ingress reconciliation.
35
All reconciled objects (OpenShift Routes, Gateway API HTTPRoutes, and
46
networking.k8s.io Ingresses) are created in the gateway's own
57
namespace, so a namespaced Role is sufficient — no cluster-scoped
68
permissions are required for this feature. The rules cover every
79
supported kind because the reconciled kind is selected by
810
configuration. */ -}}
11+
{{- if include "openshell.rbacCreate" . }}
912
{{- $gatewayConfig := .Values.gatewayConfig | default dict -}}
1013
{{- $serviceIngressTOML := get $gatewayConfig "openshell.drivers.kubernetes.service_ingress" | default dict -}}
1114
{{- $serviceIngressEnabled := false -}}
@@ -15,9 +18,6 @@
1518
{{- $serviceIngressEnabled = .Values.serviceIngress.enabled -}}
1619
{{- end -}}
1720
{{- if $serviceIngressEnabled }}
18-
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
19-
# SPDX-License-Identifier: Apache-2.0
20-
2121
apiVersion: rbac.authorization.k8s.io/v1
2222
kind: Role
2323
metadata:

‎deploy/helm/openshell/values.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -654,7 +654,10 @@ networkPolicy:
654654
# when multiple gateways share one service base domain (exact-host routing);
655655
# a single gateway can instead use one wildcard host rule.
656656
serviceIngress:
657-
# -- Reconcile ingress objects for exposed sandbox service hostnames.
657+
# -- Reconcile ingress objects for exposed sandbox service hostnames,
658+
# targeting this release's gateway Service. Needed when multiple gateways
659+
# share one service base domain; a single gateway can use one wildcard host
660+
# rule instead.
658661
enabled: false
659662
# -- Object kind to reconcile: `route` (OpenShift Route with TLS
660663
# passthrough), `httproute` (Gateway API HTTPRoute), or `ingress`

0 commit comments

Comments
 (0)