feat(helm): add kubernetes local-dev environment#1158
Merged
TaylorMutch merged 6 commits intomainfrom May 5, 2026
Merged
Conversation
|
🌿 Preview your docs: https://nvidia-preview-pr-1158.docs.buildwithfern.com/openshell |
TaylorMutch
force-pushed
the
kube-support/local-dev/tmutch
branch
from
38dda79 to
a4ec87d
Compare
12 tasks
Collaborator
Author
|
/ok to test 5fac9ca |
johntmyers
reviewed
May 5, 2026
johntmyers
reviewed
May 5, 2026
johntmyers
reviewed
May 5, 2026
TaylorMutch
requested review from
derekwaynecarr,
maxamillion and
mrunalp
as code owners
Collaborator
Author
|
/ok to test 5900603 |
Contributor
|
lgtm 👍 |
* Add support for grpcRoute from Kubernetes Gateway API spec * Add pkiInitJob to initialize mTLS resources * Add sshHandshake init job * Test integration with Envoy Gateway * Add keycloak integration testing with Skaffold
… setup Add a TLS behaviour section explaining that values-skaffold.yaml disables TLS by default, and a port-forward connection guide covering both plaintext and mTLS modes with the exact commands to extract client certs from the cluster PKI secret.
Re-add the openshell.issuerSelfSigned helper, the mutual-exclusion guard in pki-hook.yaml, and the certManager condition in the statefulset volume mount. Add server.disableTls: false to values-cert-manager.yaml so the overlay correctly overrides the skaffold dev default. Tested end-to-end with cert-manager issuing mTLS certs and sandbox create over port-forward.
Use port 8090 for direct port-forward to avoid colliding with the k3d LB binding on 8080 when Envoy Gateway is active. Check both server and client TLS secrets before skipping PKI generation. Previously only the server secret was checked, which would silently skip generation if a partial cleanup left one half of the pair behind. Now emits a clear error with a recovery command when partial state is detected.
TaylorMutch
force-pushed
the
kube-support/local-dev/tmutch
branch
from
5900603 to
9d78426
Compare
Collaborator
Author
|
/ok to test 9d78426 |
drew
approved these changes
May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a local Kubernetes development environment for OpenShell using k3d (Docker-backed k3s), Skaffold, and the existing Helm chart. Includes optional Envoy Gateway (GRPCRoute / Gateway API), Keycloak OIDC, and cert-manager PKI add-ons.
Related Issue
Changes
Testing
Checklist