feat(helm): add kubernetes local-dev environment#1158
Open
TaylorMutch wants to merge 5 commits intomainfrom
Open
feat(helm): add kubernetes local-dev environment#1158TaylorMutch wants to merge 5 commits intomainfrom
TaylorMutch wants to merge 5 commits intomainfrom
Conversation
* Add support for grpcRoute from Kubernetes Gateway API spec * Add pkiInitJob to initialize mTLS resources * Add sshHandshake init job * Test integration with Envoy Gateway * Add keycloak integration testing with Skaffold
|
🌿 Preview your docs: https://nvidia-preview-pr-1158.docs.buildwithfern.com/openshell |
TaylorMutch
force-pushed
the
kube-support/local-dev/tmutch
branch
from
38dda79 to
a4ec87d
Compare
… setup Add a TLS behaviour section explaining that values-skaffold.yaml disables TLS by default, and a port-forward connection guide covering both plaintext and mTLS modes with the exact commands to extract client certs from the cluster PKI secret.
Re-add the openshell.issuerSelfSigned helper, the mutual-exclusion guard in pki-hook.yaml, and the certManager condition in the statefulset volume mount. Add server.disableTls: false to values-cert-manager.yaml so the overlay correctly overrides the skaffold dev default. Tested end-to-end with cert-manager issuing mTLS certs and sandbox create over port-forward.
9 tasks
Collaborator
Author
|
/ok to test 5fac9ca |
johntmyers
reviewed
May 5, 2026
|
|
||
| The gateway Service uses ClusterIP. Access is via Envoy Gateway (port `8080`) or `kubectl port-forward`. | ||
|
|
||
| ### TLS behaviour |
johntmyers
reviewed
May 5, 2026
| K8S_CA=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt | ||
| API=https://kubernetes.default.svc | ||
|
|
||
| # Idempotency: skip if server TLS secret already exists |
Collaborator
There was a problem hiding this comment.
Do we need to check if the client TLS secret also exists? I feel like I've hit this before with k3s usage, where a previously cleanup failed and I only get left with one half of the secret pair.
Collaborator
Author
There was a problem hiding this comment.
Yes we should - good catch!
johntmyers
reviewed
May 5, 2026
| ### Connecting via port-forward | ||
|
|
||
| ```bash | ||
| KUBECONFIG=kubeconfig kubectl port-forward -n openshell svc/openshell 8080:8080 |
Collaborator
There was a problem hiding this comment.
Would this kube port-forward on 8080 collide with the LB port on 8080?
Collaborator
Author
There was a problem hiding this comment.
I think so - I'll take another pass and check on this and see if I can come up with a better solution
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a local Kubernetes development environment for OpenShell using k3d (Docker-backed k3s), Skaffold, and the existing Helm chart. Includes optional Envoy Gateway (GRPCRoute / Gateway API), Keycloak OIDC, and cert-manager PKI add-ons.
Related Issue
Changes
Testing
Checklist