feat(helm): add global image overrides

Signed-off-by: Bobbins228 <mcampbel@redhat.com>

Author: Bobbins228

deploy/helm/openshell/README.md

@@ -187,9 +187,12 @@ discovery endpoint or its TLS CA.
 | certManager.serverIssuerRef | object | `{"group":"","kind":"","name":""}` | Override the issuerRef for the external server Certificate (e.g. a real LetsEncrypt/ACME ClusterIssuer for a publicly-trusted cert on an external hostname). When set, the chart creates a second server certificate from this issuer with only the hostnames in serverDnsNames; the internal server certificate is always signed by the chart's own CA. Leave name empty to use the chart CA for all server certificates (default). Requires certManager.enabled=true. |
 | fullnameOverride | string | `""` | Override the full generated resource name. |
 | gateway.image.digest | string | `""` | Gateway image digest. When set, this takes precedence over tag. |
-| gateway.image.pullPolicy | string | `"IfNotPresent"` | Gateway image pull policy. |
-| gateway.image.repository | string | `"ghcr.io/nvidia/openshell/gateway"` | Gateway image repository. |
+| gateway.image.pullPolicy | string | `nil` | Gateway image pull policy. |
+| gateway.image.repository | string | `""` | Gateway image repository. |
 | gateway.image.tag | string | `""` | Gateway image tag. Defaults to the chart appVersion when empty. |
+| global.image.pullPolicy | string | `"IfNotPresent"` | Shared OpenShell image pull policy. Individual image pull policies take precedence. |
+| global.image.repository | string | `"ghcr.io/nvidia/openshell"` | Shared OpenShell image repository. Individual image repositories take precedence. |
+| global.image.tag | string | `""` | Shared OpenShell image tag. Defaults to the chart appVersion when empty. |
 | grpcRoute.backendTLSPolicy.caCertificateConfigMapName | string | `""` | Name of the ConfigMap containing the CA certificate (key: ca.crt) used to validate the gateway pod's TLS certificate. Defaults to `<fullname>-backend-ca` when empty. The certgen hook auto-creates this: with pkiInitJob (default), immediately on install/upgrade; with cert-manager, the hook polls for pkiInitJob.timeoutSeconds seconds waiting for cert-manager to issue the server certificate, then creates the ConfigMap. A single install usually succeeds; if cert-manager takes longer, increase pkiInitJob.timeoutSeconds. By default (pkiInitJob.failOnTimeout=true), the install fails if the timeout is reached; set failOnTimeout=false to allow the install to succeed and run `helm upgrade` after the certificate is issued. |
 | grpcRoute.backendTLSPolicy.enabled | bool | `false` | Create a BackendTLSPolicy resource for end-to-end TLS between the Gateway proxy and the OpenShell gateway pod. The traffic flow is: client → HTTPS → Gateway (terminate) → TLS (re-encrypt) → gateway pod. Requires server.disableTls=false and server.tls.enableMtls=false. The certgen hook auto-creates the backend CA ConfigMap. |
 | grpcRoute.backendTLSPolicy.hostname | string | `""` | Hostname the Gateway proxy validates against the backend's TLS certificate SAN. Defaults to the service FQDN (`<fullname>.<namespace>.svc.cluster.local`) when empty, which matches the SAN included by both cert-manager and the pkiInitJob. |
@@ -236,8 +239,8 @@ discovery endpoint or its TLS CA.
 | sandbox.image.pullPolicy | string | `nil` | Sandbox image pull policy. Leave unset to use the Kubernetes image default. |
 | sandbox.image.repository | string | `"ghcr.io/nvidia/openshell-community/sandboxes/base"` | Default standalone sandbox image repository. |
 | sandbox.image.tag | string | `"latest"` | Sandbox image tag. Defaults to latest when empty. |
-| sandboxRuntime.image.pullPolicy | string | `""` | Sandbox runtime image pull policy. Defaults to the gateway image pull policy when empty. |
-| sandboxRuntime.image.repository | string | `"ghcr.io/nvidia/openshell/sandbox"` | Sandbox runtime image repository. Changing it uses the effective gateway image tag unless tag is also set. |
+| sandboxRuntime.image.pullPolicy | string | `nil` | Sandbox runtime image pull policy. Defaults to the gateway image pull policy when empty. |
+| sandboxRuntime.image.repository | string | `""` | Sandbox runtime image repository. Changing it uses the effective gateway image tag unless tag is also set. |
 | sandboxRuntime.image.tag | string | `""` | Sandbox runtime image tag override. Empty uses the version pinned into the gateway unless repository is changed. |
 | sandboxServiceAccount.annotations | object | `{}` | Annotations to add to the generated sandbox service account. |
 | sandboxServiceAccount.create | bool | `true` | Create a service account for sandbox pods. |
@@ -318,7 +321,7 @@ discovery endpoint or its TLS CA.
 | serviceAccount.name | string | `""` | Existing service account name to use when serviceAccount.create is false. |
 | supervisor.image.digest | string | `""` | Supervisor image digest. When set, this takes precedence over tag. |
 | supervisor.image.pullPolicy | string | `nil` | Sandbox supervisor pull policy. Leave unset to use the Kubernetes image default. Prefer always, if_not_present, or never; the chart also accepts legacy Kubernetes spellings Always, IfNotPresent, and Never. |
-| supervisor.image.repository | string | `"ghcr.io/nvidia/openshell/supervisor"` | Supervisor image repository. Changing it uses the effective gateway image tag unless tag is also set. |
+| supervisor.image.repository | string | `""` | Supervisor image repository. Changing it uses the effective gateway image tag unless tag is also set. |
 | supervisor.image.tag | string | `""` | Supervisor image tag override. Empty uses the version pinned into the gateway unless repository is changed. |
 | supervisor.sandboxRuntime.boundaryPort | int | `5500` | Workload boundary TLS listener port. |
 | supervisor.sandboxRuntime.networkPolicyEnforced | bool | `false` | Required operator acknowledgement that the cluster CNI enforces NetworkPolicy. |

deploy/helm/openshell/templates/_gateway-workload.tpl

@@ -43,7 +43,7 @@ spec:
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
       image: {{ include "openshell.image" . | quote }}
-      imagePullPolicy: {{ .Values.gateway.image.pullPolicy }}
+      imagePullPolicy: {{ .Values.gateway.image.pullPolicy | default .Values.global.image.pullPolicy }}
       args:
         - --config
         - /etc/openshell/gateway.toml

deploy/helm/openshell/templates/_helpers.tpl

@@ -86,10 +86,12 @@ default to enabled so upgrades with --reuse-values preserve the old topology.
 {{/* Gateway image reference. A digest takes precedence over a tag. */}}
 {{- define "openshell.image" -}}
 {{- $image := .Values.gateway.image -}}
+{{- $global := .Values.global.image -}}
+{{- $repository := $image.repository | default (printf "%s/gateway" $global.repository) -}}
 {{- if $image.digest -}}
-{{- printf "%s@%s" $image.repository $image.digest -}}
+{{- printf "%s@%s" $repository $image.digest -}}
 {{- else -}}
-{{- printf "%s:%s" $image.repository ($image.tag | default .Chart.AppVersion) -}}
+{{- printf "%s:%s" $repository ($image.tag | default $global.tag | default .Chart.AppVersion) -}}
 {{- end }}
 {{- end }}
 
@@ -111,14 +113,16 @@ ghcr.io/nvidia/openshell/sandbox
 {{/* Whether Helm must propagate a sandbox runtime image override. */}}
 {{- define "openshell.sandboxRuntimeImageOverrideEnabled" -}}
 {{- $defaultRepository := include "openshell.defaultSandboxRuntimeRepository" . -}}
-{{- $repository := .Values.sandboxRuntime.image.repository | default $defaultRepository -}}
-{{- if or (ne $repository $defaultRepository) .Values.sandboxRuntime.image.tag -}}true{{- end -}}
+{{- $global := .Values.global.image -}}
+{{- $repository := .Values.sandboxRuntime.image.repository | default (printf "%s/sandbox" $global.repository) -}}
+{{- if or (ne $repository $defaultRepository) .Values.sandboxRuntime.image.tag .Values.global.image.tag -}}true{{- end -}}
 {{- end }}
 
 {{/* Sandbox runtime image override. */}}
 {{- define "openshell.sandboxRuntimeImage" -}}
-{{- $repository := .Values.sandboxRuntime.image.repository | default (include "openshell.defaultSandboxRuntimeRepository" .) -}}
-{{- $tag := .Values.sandboxRuntime.image.tag | default .Values.gateway.image.tag | default .Chart.AppVersion -}}
+{{- $global := .Values.global.image -}}
+{{- $repository := .Values.sandboxRuntime.image.repository | default (printf "%s/sandbox" $global.repository) -}}
+{{- $tag := .Values.sandboxRuntime.image.tag | default $global.tag | default .Chart.AppVersion -}}
 {{- printf "%s:%s" $repository $tag }}
 {{- end }}
 
@@ -155,11 +159,12 @@ Supervisor image override. A tag-only override uses the official repository;
 a repository-only override uses the effective gateway image tag.
 */}}
 {{- define "openshell.supervisorImage" -}}
-{{- $repository := .Values.supervisor.image.repository | default (include "openshell.defaultSupervisorRepository" .) -}}
+{{- $global := .Values.global.image -}}
+{{- $repository := .Values.supervisor.image.repository | default (printf "%s/supervisor" $global.repository) -}}
 {{- if .Values.supervisor.image.digest -}}
 {{- printf "%s@%s" $repository .Values.supervisor.image.digest -}}
 {{- else -}}
-{{- $tag := .Values.supervisor.image.tag | default .Values.gateway.image.tag | default .Chart.AppVersion -}}
+{{- $tag := .Values.supervisor.image.tag | default $global.tag | default .Chart.AppVersion -}}
 {{- printf "%s:%s" $repository $tag -}}
 {{- end }}
 {{- end }}

deploy/helm/openshell/templates/certgen.yaml

@@ -86,7 +86,7 @@ spec:
       containers:
         - name: certgen
           image: {{ include "openshell.image" . | quote }}
-          imagePullPolicy: {{ .Values.gateway.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.gateway.image.pullPolicy | default .Values.global.image.pullPolicy }}
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -157,7 +157,7 @@ spec:
       containers:
         - name: certgen
           image: {{ include "openshell.image" . | quote }}
-          imagePullPolicy: {{ .Values.gateway.image.pullPolicy }}
+          imagePullPolicy: {{ .Values.gateway.image.pullPolicy | default .Values.global.image.pullPolicy }}
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:

deploy/helm/openshell/templates/gateway-config.yaml

@@ -208,11 +208,11 @@ data:
     {{- if .Values.server.defaultRuntimeClassName }}
     default_runtime_class_name   = {{ .Values.server.defaultRuntimeClassName | quote }}
     {{- end }}
-    {{- if .Values.supervisor.image.pullPolicy }}
-    supervisor_image_pull_policy = {{ include "openshell.canonicalImagePullPolicy" .Values.supervisor.image.pullPolicy | quote }}
+    {{- if (.Values.supervisor.image.pullPolicy | default .Values.global.image.pullPolicy) }}
+    supervisor_image_pull_policy = {{ include "openshell.canonicalImagePullPolicy" (.Values.supervisor.image.pullPolicy | default .Values.global.image.pullPolicy) | quote }}
     {{- end }}
-    {{- if .Values.sandboxRuntime.image.pullPolicy }}
-    sandbox_runtime_image_pull_policy = {{ include "openshell.canonicalImagePullPolicy" .Values.sandboxRuntime.image.pullPolicy | quote }}
+    {{- if (.Values.sandboxRuntime.image.pullPolicy | default .Values.global.image.pullPolicy) }}
+    sandbox_runtime_image_pull_policy = {{ include "openshell.canonicalImagePullPolicy" (.Values.sandboxRuntime.image.pullPolicy | default .Values.global.image.pullPolicy) | quote }}
     {{- end }}
 
     [openshell.drivers.kubernetes.managed_ssh_ingress]

deploy/helm/openshell/tests/gateway_config_test.yaml

@@ -56,6 +56,20 @@ tests:
           path: spec.template.spec.containers[0].image
           value: registry.example/gateway:0.0.0
 
+  - it: applies global image values to gateway, supervisor, and sandbox runtime
+    template: templates/gateway-config.yaml
+    set:
+      global.image.repository: registry.example.com/openshell
+      global.image.tag: v0.1.0
+      global.image.pullPolicy: IfNotPresent
+    asserts:
+      - matchRegex:
+          path: data["gateway.toml"]
+          pattern: 'supervisor_image\s*=\s*"registry\.example\.com/openshell/supervisor:v0\.1\.0"'
+      - matchRegex:
+          path: data["gateway.toml"]
+          pattern: 'sandbox_runtime_image\s*=\s*"registry\.example\.com/openshell/sandbox:v0\.1\.0"'
+
   - it: defaults a repository-only sandbox image to latest
     template: templates/gateway-config.yaml
     set:
@@ -235,12 +249,12 @@ tests:
           path: data["gateway.toml"]
           pattern: '(?ms)\[openshell\.gateway\][^\[]*?grpc_endpoint'
 
-  - it: omits pull policies by default so Kubernetes applies its own defaults
+  - it: applies the global pull policy by default
     template: templates/gateway-config.yaml
     asserts:
-      - notMatchRegex:
+      - matchRegex:
           path: data["gateway.toml"]
-          pattern: '(?m)^\s*(image_pull_policy|supervisor_image_pull_policy)\s*='
+          pattern: '(?ms)supervisor_image_pull_policy\s*=\s*"if_not_present".*?sandbox_runtime_image_pull_policy\s*=\s*"if_not_present"'
 
   - it: renders canonical image pull policies in the Kubernetes driver table
     template: templates/gateway-config.yaml

deploy/helm/openshell/values.yaml

@@ -7,6 +7,15 @@
 # server.externalDbSecret because the default SQLite backend is per pod.
 replicaCount: 1
 
+global:
+  image:
+    # -- Shared OpenShell image repository. Individual image repositories take precedence.
+    repository: ghcr.io/nvidia/openshell
+    # -- Shared OpenShell image tag. Defaults to the chart appVersion when empty.
+    tag: ""
+    # -- Shared OpenShell image pull policy. Individual image pull policies take precedence.
+    pullPolicy: IfNotPresent
+
 workload:
   # -- Gateway workload controller kind. Use `statefulset` for the default
   # SQLite database, or `deployment` when server.externalDbSecret points at an
@@ -21,9 +30,9 @@ workload:
 gateway:
   image:
     # -- Gateway image repository.
-    repository: ghcr.io/nvidia/openshell/gateway
+    repository: ""
     # -- Gateway image pull policy.
-    pullPolicy: IfNotPresent
+    pullPolicy: null
     # -- Gateway image tag. Defaults to the chart appVersion when empty.
     tag: ""
     # -- Gateway image digest. When set, this takes precedence over tag.
@@ -33,17 +42,17 @@ gateway:
 sandboxRuntime:
   image:
     # -- Sandbox runtime image repository. Changing it uses the effective gateway image tag unless tag is also set.
-    repository: ghcr.io/nvidia/openshell/sandbox
+    repository: ""
     # -- Sandbox runtime image pull policy. Defaults to the gateway image pull policy when empty.
-    pullPolicy: ""
+    pullPolicy: null
     # -- Sandbox runtime image tag override. Empty uses the version pinned into the gateway unless repository is changed.
     tag: ""
 
 # Trusted control-side runtime image.
 supervisor:
   image:
     # -- Supervisor image repository. Changing it uses the effective gateway image tag unless tag is also set.
-    repository: ghcr.io/nvidia/openshell/supervisor
+    repository: ""
     # -- Sandbox supervisor pull policy. Leave unset to use the Kubernetes
     # image default. Prefer always, if_not_present, or never; the chart also
     # accepts legacy Kubernetes spellings Always, IfNotPresent, and Never.