feat(helm): support image registry overrides

Signed-off-by: Bobbins228 <mcampbel@redhat.com>
Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: Bobbins228

TESTING.md

@@ -374,10 +374,10 @@ mise run e2e:kubernetes
 ```
 
 `GATEWAY_IMAGE` applies to the Kubernetes gateway container. `SUPERVISOR_IMAGE`
-applies to the supervisor image selected by the Kubernetes, Docker, and Podman
-wrappers. `SANDBOX_IMAGE` applies to the standalone sandbox image selected by
-all test wrappers. A repository-only value inherits `IMAGE_TAG` for gateway and
-supervisor images; a value with an explicit tag or `@sha256:` digest is used
+applies to the trusted supervisor image selected by the Kubernetes, Docker, and
+Podman wrappers. `SANDBOX_IMAGE` applies to the trusted workload-side runtime
+image that stages the `openshell-sandbox` binary. A repository-only value
+inherits `IMAGE_TAG`; a value with an explicit tag or `@sha256:` digest is used
 as-is. When these variables are unset, the existing `OPENSHELL_REGISTRY` plus
 `IMAGE_TAG` behavior is retained.
 The Docker and Podman wrappers continue to give
@@ -419,7 +419,7 @@ Kubernetes e2e environment variables:
 | `OPENSHELL_REGISTRY` | Image registry prefix (default: `ghcr.io/nvidia/openshell`) |
 | `GATEWAY_IMAGE` | Kubernetes gateway image repository or complete tagged/digest-pinned image reference; digests require `OPENSHELL_E2E_KUBE_BUILD_IMAGES=0` |
 | `SUPERVISOR_IMAGE` | Gateway/supervisor image repository or complete tagged/digest-pinned image reference; Kubernetes digests require `OPENSHELL_E2E_KUBE_BUILD_IMAGES=0` |
-| `SANDBOX_IMAGE` | Standalone sandbox image repository or complete tagged/digest-pinned image reference |
+| `SANDBOX_IMAGE` | Trusted sandbox runtime image repository or complete tagged/digest-pinned image reference |
 
 Run a single test directly with cargo:
 

deploy/helm/openshell/README.md

@@ -210,11 +210,12 @@ discovery endpoint or its TLS CA.
 | certManager.serverIssuerRef | object | `{"group":"","kind":"","name":""}` | Override the issuerRef for the external server Certificate (e.g. a real LetsEncrypt/ACME ClusterIssuer for a publicly-trusted cert on an external hostname). When set, the chart creates a second server certificate from this issuer with only the hostnames in serverDnsNames; the internal server certificate is always signed by the chart's own CA. Leave name empty to use the chart CA for all server certificates (default). Requires certManager.enabled=true. |
 | fullnameOverride | string | `""` | Override the full generated resource name. |
 | gateway.image.digest | string | `""` | Gateway image digest. When set, this takes precedence over tag. |
-| gateway.image.pullPolicy | string | `nil` | Gateway image pull policy. |
-| gateway.image.repository | string | `""` | Gateway image repository. |
+| gateway.image.pullPolicy | string | `nil` | Gateway image pull policy. Empty uses global.image.pullPolicy. |
+| gateway.image.registry | string | `""` | Gateway image registry. Empty uses global.image.registry. |
+| gateway.image.repository | string | `"openshell/gateway"` | Gateway image repository. |
 | gateway.image.tag | string | `""` | Gateway image tag. Defaults to the chart appVersion when empty. |
 | global.image.pullPolicy | string | `"IfNotPresent"` | Shared OpenShell image pull policy. Individual image pull policies take precedence. |
-| global.image.repository | string | `"ghcr.io/nvidia/openshell"` | Shared OpenShell image repository. Individual image repositories take precedence. |
+| global.image.registry | string | `"ghcr.io/nvidia"` | Shared OpenShell image registry. Individual image registries take precedence. |
 | global.image.tag | string | `""` | Shared OpenShell image tag. Defaults to the chart appVersion when empty. |
 | grpcRoute.backendTLSPolicy.caCertificateConfigMapName | string | `""` | Name of the ConfigMap containing the CA certificate (key: ca.crt) used to validate the gateway pod's TLS certificate. Defaults to `<fullname>-backend-ca` when empty. The certgen hook auto-creates this: with pkiInitJob (default), immediately on install/upgrade; with cert-manager, the hook polls for pkiInitJob.timeoutSeconds seconds waiting for cert-manager to issue the server certificate, then creates the ConfigMap. A single install usually succeeds; if cert-manager takes longer, increase pkiInitJob.timeoutSeconds. By default (pkiInitJob.failOnTimeout=true), the install fails if the timeout is reached; set failOnTimeout=false to allow the install to succeed and run `helm upgrade` after the certificate is issued. |
 | grpcRoute.backendTLSPolicy.enabled | bool | `false` | Create a BackendTLSPolicy resource for end-to-end TLS between the Gateway proxy and the OpenShell gateway pod. The traffic flow is: client → HTTPS → Gateway (terminate) → TLS (re-encrypt) → gateway pod. Requires server.disableTls=false and server.tls.enableMtls=false. The certgen hook auto-creates the backend CA ConfigMap. |
@@ -262,9 +263,11 @@ discovery endpoint or its TLS CA.
 | sandbox.image.pullPolicy | string | `nil` | Sandbox image pull policy. Leave unset to use the Kubernetes image default. |
 | sandbox.image.repository | string | `"ghcr.io/nvidia/openshell-community/sandboxes/base"` | Default standalone sandbox image repository. |
 | sandbox.image.tag | string | `"latest"` | Sandbox image tag. Defaults to latest when empty. |
-| sandboxRuntime.image.pullPolicy | string | `nil` | Sandbox runtime image pull policy. Defaults to the gateway image pull policy when empty. |
-| sandboxRuntime.image.repository | string | `""` | Sandbox runtime image repository. Changing it uses the effective gateway image tag unless tag is also set. |
-| sandboxRuntime.image.tag | string | `""` | Sandbox runtime image tag override. Empty uses the version pinned into the gateway unless repository is changed. |
+| sandboxRuntime.image.digest | string | `""` | Sandbox runtime image digest. When set, this takes precedence over tag. |
+| sandboxRuntime.image.pullPolicy | string | `nil` | Sandbox runtime image pull policy. Empty uses global.image.pullPolicy. |
+| sandboxRuntime.image.registry | string | `""` | Sandbox runtime image registry. Empty uses global.image.registry. |
+| sandboxRuntime.image.repository | string | `"openshell/sandbox"` | Sandbox runtime image repository. |
+| sandboxRuntime.image.tag | string | `""` | Sandbox runtime image tag. Defaults to the chart appVersion when empty. |
 | sandboxServiceAccount.annotations | object | `{}` | Annotations to add to the generated sandbox service account. |
 | sandboxServiceAccount.create | bool | `true` | Create a service account for sandbox pods. |
 | sandboxServiceAccount.name | string | `""` | Existing service account name for sandbox pods when sandboxServiceAccount.create is false. |
@@ -346,9 +349,10 @@ discovery endpoint or its TLS CA.
 | serviceAccount.create | bool | `true` | Create a service account for the gateway. |
 | serviceAccount.name | string | `""` | Existing service account name to use when serviceAccount.create is false. |
 | supervisor.image.digest | string | `""` | Supervisor image digest. When set, this takes precedence over tag. |
-| supervisor.image.pullPolicy | string | `nil` | Sandbox supervisor pull policy. Leave unset to use the Kubernetes image default. Prefer always, if_not_present, or never; the chart also accepts legacy Kubernetes spellings Always, IfNotPresent, and Never. |
-| supervisor.image.repository | string | `""` | Supervisor image repository. Changing it uses the effective gateway image tag unless tag is also set. |
-| supervisor.image.tag | string | `""` | Supervisor image tag override. Empty uses the version pinned into the gateway unless repository is changed. |
+| supervisor.image.pullPolicy | string | `nil` | Supervisor image pull policy. Empty uses global.image.pullPolicy. Prefer always, if_not_present, or never; the chart also accepts legacy Kubernetes spellings Always, IfNotPresent, and Never. |
+| supervisor.image.registry | string | `""` | Supervisor image registry. Empty uses global.image.registry. |
+| supervisor.image.repository | string | `"openshell/supervisor"` | Supervisor image repository. |
+| supervisor.image.tag | string | `""` | Supervisor image tag. Defaults to the chart appVersion when empty. |
 | supervisor.sandboxRuntime.boundaryPort | int | `5500` | Workload boundary TLS listener port. |
 | supervisor.sandboxRuntime.networkPolicyEnforced | bool | `false` | Required operator acknowledgement that the cluster CNI enforces NetworkPolicy. |
 | tolerations | list | `[]` | Tolerations for the gateway pod. |

deploy/helm/openshell/skaffold.yaml

@@ -139,6 +139,9 @@ deploy:
           # To test multi-replica external PostgreSQL behavior:
           #- ci/values-high-availability.yaml
         setValueTemplates:
+          # Skaffold supplies complete image repositories. Clear the chart's
+          # shared registry so these values are used verbatim.
+          global.image.registry: ''
           gateway.image.repository: '{{.IMAGE_REPO_openshell_gateway}}'
           gateway.image.tag: '{{.IMAGE_TAG_openshell_gateway}}'
           supervisor.image.repository: '{{.IMAGE_REPO_openshell_supervisor}}'

deploy/helm/openshell/templates/_helpers.tpl

@@ -90,7 +90,8 @@ default to enabled so upgrades with --reuse-values preserve the old topology.
 {{- define "openshell.image" -}}
 {{- $image := .Values.gateway.image -}}
 {{- $global := .Values.global.image -}}
-{{- $repository := $image.repository | default (printf "%s/gateway" $global.repository) -}}
+{{- $registry := $image.registry | default $global.registry -}}
+{{- $repository := ternary (printf "%s/%s" $registry $image.repository) $image.repository (ne $registry "") -}}
 {{- if $image.digest -}}
 {{- printf "%s@%s" $repository $image.digest -}}
 {{- else -}}
@@ -117,16 +118,22 @@ ghcr.io/nvidia/openshell/sandbox
 {{- define "openshell.sandboxRuntimeImageOverrideEnabled" -}}
 {{- $defaultRepository := include "openshell.defaultSandboxRuntimeRepository" . -}}
 {{- $global := .Values.global.image -}}
-{{- $repository := .Values.sandboxRuntime.image.repository | default (printf "%s/sandbox" $global.repository) -}}
-{{- if or (ne $repository $defaultRepository) .Values.sandboxRuntime.image.tag .Values.global.image.tag -}}true{{- end -}}
+{{- $registry := .Values.sandboxRuntime.image.registry | default $global.registry -}}
+{{- $repository := ternary (printf "%s/%s" $registry .Values.sandboxRuntime.image.repository) .Values.sandboxRuntime.image.repository (ne $registry "") -}}
+{{- if or (ne $repository $defaultRepository) .Values.sandboxRuntime.image.tag .Values.sandboxRuntime.image.digest .Values.global.image.tag -}}true{{- end -}}
 {{- end }}
 
 {{/* Sandbox runtime image override. */}}
 {{- define "openshell.sandboxRuntimeImage" -}}
 {{- $global := .Values.global.image -}}
-{{- $repository := .Values.sandboxRuntime.image.repository | default (printf "%s/sandbox" $global.repository) -}}
+{{- $registry := .Values.sandboxRuntime.image.registry | default $global.registry -}}
+{{- $repository := ternary (printf "%s/%s" $registry .Values.sandboxRuntime.image.repository) .Values.sandboxRuntime.image.repository (ne $registry "") -}}
+{{- if .Values.sandboxRuntime.image.digest -}}
+{{- printf "%s@%s" $repository .Values.sandboxRuntime.image.digest -}}
+{{- else -}}
 {{- $tag := .Values.sandboxRuntime.image.tag | default $global.tag | default .Chart.AppVersion -}}
-{{- printf "%s:%s" $repository $tag }}
+{{- printf "%s:%s" $repository $tag -}}
+{{- end -}}
 {{- end }}
 
 {{/* Official supervisor repository used by the gateway's built-in default. */}}
@@ -157,13 +164,11 @@ The chart's documented repository and empty tag are the gateway-owned default.
 true
 {{- end }}
 
-{{/*
-Supervisor image override. A tag-only override uses the official repository;
-a repository-only override uses the effective gateway image tag.
-*/}}
+{{/* Supervisor image override. */}}
 {{- define "openshell.supervisorImage" -}}
 {{- $global := .Values.global.image -}}
-{{- $repository := .Values.supervisor.image.repository | default (printf "%s/supervisor" $global.repository) -}}
+{{- $registry := .Values.supervisor.image.registry | default $global.registry -}}
+{{- $repository := ternary (printf "%s/%s" $registry .Values.supervisor.image.repository) .Values.supervisor.image.repository (ne $registry "") -}}
 {{- if .Values.supervisor.image.digest -}}
 {{- printf "%s@%s" $repository .Values.supervisor.image.digest -}}
 {{- else -}}

deploy/helm/openshell/tests/gateway_config_test.yaml

@@ -85,7 +85,8 @@ tests:
   - it: preserves a complete tagged gateway image reference
     template: templates/statefulset.yaml
     set:
-      gateway.image.repository: registry.example/gateway
+      gateway.image.registry: registry.example
+      gateway.image.repository: gateway
       gateway.image.tag: branch
     asserts:
       - equal:
@@ -95,7 +96,8 @@ tests:
   - it: defaults a repository-only gateway image to the chart appVersion
     template: templates/statefulset.yaml
     set:
-      gateway.image.repository: registry.example/gateway
+      gateway.image.registry: registry.example
+      gateway.image.repository: gateway
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
@@ -104,7 +106,7 @@ tests:
   - it: applies global image values to gateway, supervisor, and sandbox runtime
     template: templates/gateway-config.yaml
     set:
-      global.image.repository: registry.example.com/openshell
+      global.image.registry: registry.example.com
       global.image.tag: v0.1.0
       global.image.pullPolicy: IfNotPresent
     asserts:
@@ -115,6 +117,28 @@ tests:
           path: data["gateway.toml"]
           pattern: 'sandbox_runtime_image\s*=\s*"registry\.example\.com/openshell/sandbox:v0\.1\.0"'
 
+  - it: lets an individual registry override the global registry
+    template: templates/statefulset.yaml
+    set:
+      global.image.registry: registry.example.com
+      gateway.image.registry: mirror.example.com
+      gateway.image.repository: custom/gateway
+      global.image.tag: v0.1.0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: mirror.example.com/custom/gateway:v0.1.0
+
+  - it: applies the global registry to the gateway image
+    template: templates/statefulset.yaml
+    set:
+      global.image.registry: registry.example.com
+      global.image.tag: v0.1.0
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].image
+          value: registry.example.com/openshell/gateway:v0.1.0
+
   - it: defaults a repository-only sandbox image to latest
     template: templates/gateway-config.yaml
     set:
@@ -127,7 +151,8 @@ tests:
   - it: gives a gateway digest precedence over its tag
     template: templates/statefulset.yaml
     set:
-      gateway.image.repository: registry.example/gateway
+      gateway.image.registry: registry.example
+      gateway.image.repository: gateway
       gateway.image.tag: ignored
       gateway.image.digest: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
     asserts:
@@ -138,7 +163,8 @@ tests:
   - it: gives supervisor and sandbox digests precedence over their tags
     template: templates/gateway-config.yaml
     set:
-      supervisor.image.repository: registry.example/supervisor
+      supervisor.image.registry: registry.example
+      supervisor.image.repository: supervisor
       supervisor.image.tag: ignored
       supervisor.image.digest: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
       sandbox.image.repository: registry.example/sandbox
@@ -431,10 +457,12 @@ tests:
   - it: renders independent sandbox runtime and supervisor image overrides
     template: templates/gateway-config.yaml
     set:
-      sandboxRuntime.image.repository: registry.example.com/openshell/sandbox
+      sandboxRuntime.image.registry: registry.example.com
+      sandboxRuntime.image.repository: openshell/sandbox
       sandboxRuntime.image.tag: sandbox-build
       sandboxRuntime.image.pullPolicy: Always
-      supervisor.image.repository: registry.example.com/openshell/supervisor
+      supervisor.image.registry: registry.example.com
+      supervisor.image.repository: openshell/supervisor
       supervisor.image.tag: supervisor-build
     asserts:
       - matchRegex:
@@ -447,6 +475,18 @@ tests:
           path: data["gateway.toml"]
           pattern: 'supervisor_image\s*=\s*"registry\.example\.com/openshell/supervisor:supervisor-build"'
 
+  - it: gives a sandbox runtime digest precedence over its tag
+    template: templates/gateway-config.yaml
+    set:
+      sandboxRuntime.image.registry: registry.example.com
+      sandboxRuntime.image.repository: openshell/sandbox
+      sandboxRuntime.image.tag: ignored
+      sandboxRuntime.image.digest: sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc
+    asserts:
+      - matchRegex:
+          path: data["gateway.toml"]
+          pattern: 'sandbox_runtime_image\s*=\s*"registry\.example\.com/openshell/sandbox@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"'
+
   - it: renders a supervisor tag override with the official repository
     template: templates/gateway-config.yaml
     set:
@@ -459,7 +499,8 @@ tests:
   - it: renders a supervisor repository override with the default chart tag
     template: templates/gateway-config.yaml
     set:
-      supervisor.image.repository: registry.example.com/openshell/supervisor
+      supervisor.image.registry: registry.example.com
+      supervisor.image.repository: openshell/supervisor
     asserts:
       - matchRegex:
           path: data["gateway.toml"]
@@ -468,7 +509,8 @@ tests:
   - it: renders complete supervisor repository and tag overrides
     template: templates/gateway-config.yaml
     set:
-      supervisor.image.repository: registry.example.com/openshell/supervisor
+      supervisor.image.registry: registry.example.com
+      supervisor.image.repository: openshell/supervisor
       supervisor.image.tag: supervisor-build
     asserts:
       - matchRegex: