diff --git a/deploy/helm/openshell/README.md b/deploy/helm/openshell/README.md index fcb7a108e4..ffa306fd24 100644 --- a/deploy/helm/openshell/README.md +++ b/deploy/helm/openshell/README.md @@ -527,6 +527,7 @@ discovery endpoint or its TLS CA. | server.enableUserNamespaces | bool | `false` | Enable Kubernetes user namespace isolation (hostUsers: false) for sandbox pods. Requires Kubernetes 1.33+ with user namespace support available (beta through 1.35, GA in 1.36+), plus a supporting container runtime and Linux 5.12+. When enabled, container UID 0 maps to an unprivileged host UID and capabilities become namespaced. | | server.enableWebsocketTunnel | bool | `false` | Enable the WebSocket tunnel used by CLI/SDK clients behind an authenticated edge proxy. Leave disabled for direct gateway installs. | | server.externalDbSecret | string | `""` | Name of a pre-existing Opaque Secret containing a PostgreSQL connection URI (key: uri). When set, the gateway reads OPENSHELL_DB_URL from this Secret instead of using dbUrl. The Secret must contain a `uri` key, e.g. postgresql://user:pass@host:5432/dbname. | +| server.extraEnv | list | `[]` | Additional environment variables for the gateway container, such as OTEL_* exporter settings. Entries can read from a Secret with valueFrom. | | server.extraVolumeMounts | list | `[]` | Additional volume mounts for the gateway container. | | server.extraVolumes | list | `[]` | Additional volumes for the gateway pod. | | server.grpcEndpoint | string | `""` | gRPC endpoint sandboxes call back into the gateway. Leave empty to derive it from the chart fullname, release namespace, service port, and disableTls flag, for example https://openshell.openshell.svc.cluster.local:8080. Override only when sandboxes must reach the gateway via a different hostname (e.g. an external ingress or a host alias). | diff --git a/deploy/helm/openshell/templates/_gateway-workload.tpl b/deploy/helm/openshell/templates/_gateway-workload.tpl index 12120a89ce..860be9421f 100644 --- a/deploy/helm/openshell/templates/_gateway-workload.tpl +++ b/deploy/helm/openshell/templates/_gateway-workload.tpl @@ -140,6 +140,9 @@ spec: - name: OPENSHELL_GATEWAY_SPIFFE_WORKLOAD_API_SOCKET value: {{ $spiffeSocketPath | quote }} {{- end }} + {{- with .Values.server.extraEnv }} + {{- toYaml . | nindent 8 }} + {{- end }} volumeMounts: {{- if eq (include "openshell.workloadKind" .) "statefulset" }} - name: openshell-data diff --git a/deploy/helm/openshell/tests/gateway_config_test.yaml b/deploy/helm/openshell/tests/gateway_config_test.yaml index c433bbed69..a28e2db37b 100644 --- a/deploy/helm/openshell/tests/gateway_config_test.yaml +++ b/deploy/helm/openshell/tests/gateway_config_test.yaml @@ -508,6 +508,47 @@ tests: mountPath: /var/log/openshell subPathExpr: $(OPENSHELL_POD_NAME) + - it: adds extra gateway environment variables in a StatefulSet + template: templates/statefulset.yaml + set: + server.extraEnv: + - name: OTEL_TRACES_SAMPLER + value: parentbased_traceidratio + - name: OTEL_EXPORTER_OTLP_HEADERS + valueFrom: + secretKeyRef: + name: otel-collector-auth + key: headers + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_TRACES_SAMPLER + value: parentbased_traceidratio + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_EXPORTER_OTLP_HEADERS + valueFrom: + secretKeyRef: + name: otel-collector-auth + key: headers + + - it: adds extra gateway environment variables in a Deployment + template: templates/deployment.yaml + set: + workload.kind: deployment + server.externalDbSecret: my-pg-secret + server.extraEnv: + - name: OTEL_TRACES_SAMPLER + value: parentbased_traceidratio + asserts: + - contains: + path: spec.template.spec.containers[0].env + content: + name: OTEL_TRACES_SAMPLER + value: parentbased_traceidratio + - it: mounts the OIDC CA bundle when TLS is disabled template: templates/statefulset.yaml set: diff --git a/deploy/helm/openshell/values.yaml b/deploy/helm/openshell/values.yaml index 04fc1152a4..f1ff0580c8 100644 --- a/deploy/helm/openshell/values.yaml +++ b/deploy/helm/openshell/values.yaml @@ -369,6 +369,9 @@ server: extraVolumes: [] # -- Additional volume mounts for the gateway container. extraVolumeMounts: [] + # -- Additional environment variables for the gateway container, such as + # OTEL_* exporter settings. Entries can read from a Secret with valueFrom. + extraEnv: [] # -- Enable anonymous OpenShell telemetry from the gateway and the sandbox # supervisors it launches. telemetryEnabled: true diff --git a/docs/how-it-works/gateways/configuration.mdx b/docs/how-it-works/gateways/configuration.mdx index 7f16929759..e120951880 100644 --- a/docs/how-it-works/gateways/configuration.mdx +++ b/docs/how-it-works/gateways/configuration.mdx @@ -506,6 +506,18 @@ The gateway honors these variables: | `OTEL_EXPORTER_OTLP_LOGS_HEADERS`, `OTEL_EXPORTER_OTLP_LOGS_COMPRESSION`, `OTEL_EXPORTER_OTLP_LOGS_TIMEOUT` | Exporter transport tuning for OCSF log records only. These override the general variables. | | `SSL_CERT_FILE`, `SSL_CERT_DIR` | Additional trust roots for `https://` endpoints, such as a private CA. | +For Helm deployments, set these variables with `server.extraEnv`. Read credentials from a Secret so they stay out of the values file: + +```yaml +server: + extraEnv: + - name: OTEL_EXPORTER_OTLP_HEADERS + valueFrom: + secretKeyRef: + name: otel-collector-auth + key: headers +``` + These variables have no effect. Only `[openshell.gateway.otlp]` decides which signals are exported and where they go, for two reasons: - OCSF events are security records, so where they go must be a deliberate choice. Platform tooling can add `OTEL_*` variables to a process, as the OpenTelemetry Operator does for annotated pods on Kubernetes. Such a variable must not start sending security records to a collector, redirect them, or turn them off.