refactor(helm): simplify image configuration

Signed-off-by: Bobbins228 <mcampbel@redhat.com>

Author: Bobbins228

deploy/helm/openshell/README.md

@@ -300,8 +300,6 @@ discovery endpoint or its TLS CA.
 | server.policyValidationFailureMode | string | `"fail_closed"` | Posture when a candidate sandbox policy fails validation. `fail_closed` deactivates the previous policy; `retain_last_valid` keeps it active. |
 | server.providerTokenGrants.spiffe.enabled | bool | `false` | Mount the SPIFFE Workload API socket into gateway and sandbox pods for dynamic provider token grants. |
 | server.providerTokenGrants.spiffe.workloadApiSocketPath | string | `"/spiffe-workload-api/spire-agent.sock"` | Path to the SPIFFE Workload API socket mounted into gateway and sandbox pods. |
-| server.sandboxImage | string | `"ghcr.io/nvidia/openshell-community/sandboxes/base:latest"` | Default sandbox image used when requests do not specify one. |
-| server.sandboxImagePullPolicy | string | `nil` | Pull policy for sandbox pods. Leave unset to use the Kubernetes image default (Always for :latest, IfNotPresent otherwise). Prefer always, if_not_present, or never; the chart also accepts legacy Kubernetes spellings Always, IfNotPresent, and Never. |
 | server.sandboxImagePullSecrets | list | `[]` | Image pull secrets attached to sandbox pods. Referenced Secrets must exist in the sandbox namespace. |
 | server.sandboxJwt.gatewayId | string | `""` | Stable gateway identity embedded in iss/aud of every minted token. Defaults to the release name so HA replicas share identity. |
 | server.sandboxJwt.k8sSaTokenTtlSecs | int | `3600` | Lifetime (seconds) of the projected ServiceAccount token kubelet writes into each sandbox pod for the IssueSandboxToken bootstrap exchange. Kubelet enforces a minimum of 600s; the driver clamps values outside [600, 86400]. Default 3600 — generous, since the supervisor consumes the token within seconds of pod start. |

deploy/helm/openshell/templates/_helpers.tpl

@@ -133,11 +133,6 @@ ghcr.io/nvidia/openshell/sandbox
 {{- end -}}
 {{- end }}
 
-{{/* Official supervisor repository used by the gateway's built-in default. */}}
-{{- define "openshell.defaultSupervisorRepository" -}}
-ghcr.io/nvidia/openshell/supervisor
-{{- end }}
-
 {{/*
 Whether the gateway listener should verify client certificates (mTLS).
 An explicit empty server.tls.clientCaSecretName disables client-CA wiring in
@@ -153,14 +148,6 @@ true
 {{- end -}}
 {{- end -}}
 
-{{/*
-Whether Helm must propagate a supervisor image override into gateway.toml.
-The chart's documented repository and empty tag are the gateway-owned default.
-*/}}
-{{- define "openshell.supervisorImageOverrideEnabled" -}}
-true
-{{- end }}
-
 {{/* Supervisor image override. */}}
 {{- define "openshell.supervisorImage" -}}
 {{- $global := .Values.global.image -}}

deploy/helm/openshell/templates/gateway-config.yaml

@@ -143,9 +143,7 @@ data:
     {{- if include "openshell.sandboxRuntimeImageOverrideEnabled" . }}
     sandbox_runtime_image        = {{ include "openshell.sandboxRuntimeImage" . | quote }}
     {{- end }}
-    {{- if include "openshell.supervisorImageOverrideEnabled" . }}
     supervisor_image             = {{ include "openshell.supervisorImage" . | quote }}
-    {{- end }}
     {{- if .Values.server.hostGatewayIP }}
     host_gateway_ip              = {{ .Values.server.hostGatewayIP | quote }}
     {{- end }}

deploy/helm/openshell/values.yaml

@@ -246,13 +246,6 @@ server:
   # from this Secret instead of using dbUrl. The Secret must contain a
   # `uri` key, e.g. postgresql://user:pass@host:5432/dbname.
   externalDbSecret: ""
-  # -- Default sandbox image used when requests do not specify one.
-  sandboxImage: "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
-  # -- Pull policy for sandbox pods. Leave unset to use the Kubernetes image
-  # default (Always for :latest, IfNotPresent otherwise). Prefer always,
-  # if_not_present, or never; the chart also accepts legacy Kubernetes spellings
-  # Always, IfNotPresent, and Never.
-  sandboxImagePullPolicy: null
   # -- Image pull secrets attached to sandbox pods. Referenced Secrets must exist
   # in the sandbox namespace.
   sandboxImagePullSecrets: []