feat(helm): add server.extraEnv for the gateway container

deploy/helm/openshell/README.md

@@ -527,6 +527,7 @@ discovery endpoint or its TLS CA.
 | server.enableUserNamespaces | bool | `false` | Enable Kubernetes user namespace isolation (hostUsers: false) for sandbox pods. Requires Kubernetes 1.33+ with user namespace support available (beta through 1.35, GA in 1.36+), plus a supporting container runtime and Linux 5.12+. When enabled, container UID 0 maps to an unprivileged host UID and capabilities become namespaced. |
 | server.enableWebsocketTunnel | bool | `false` | Enable the WebSocket tunnel used by CLI/SDK clients behind an authenticated edge proxy. Leave disabled for direct gateway installs. |
 | server.externalDbSecret | string | `""` | Name of a pre-existing Opaque Secret containing a PostgreSQL connection URI (key: uri). When set, the gateway reads OPENSHELL_DB_URL from this Secret instead of using dbUrl. The Secret must contain a `uri` key, e.g. postgresql://user:pass@host:5432/dbname. |
+| server.extraEnv | list | `[]` | Additional environment variables for the gateway container, such as OTEL_* exporter settings. Entries can read from a Secret with valueFrom. |
 | server.extraVolumeMounts | list | `[]` | Additional volume mounts for the gateway container. |
 | server.extraVolumes | list | `[]` | Additional volumes for the gateway pod. |
 | server.grpcEndpoint | string | `""` | gRPC endpoint sandboxes call back into the gateway. Leave empty to derive it from the chart fullname, release namespace, service port, and disableTls flag, for example https://openshell.openshell.svc.cluster.local:8080. Override only when sandboxes must reach the gateway via a different hostname (e.g. an external ingress or a host alias). |

deploy/helm/openshell/templates/_gateway-workload.tpl

@@ -140,6 +140,9 @@ spec:
         - name: OPENSHELL_GATEWAY_SPIFFE_WORKLOAD_API_SOCKET
           value: {{ $spiffeSocketPath | quote }}
         {{- end }}
+        {{- with .Values.server.extraEnv }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       volumeMounts:
         {{- if eq (include "openshell.workloadKind" .) "statefulset" }}
         - name: openshell-data

deploy/helm/openshell/tests/gateway_config_test.yaml

@@ -508,6 +508,47 @@ tests:
             mountPath: /var/log/openshell
             subPathExpr: $(OPENSHELL_POD_NAME)
 
+  - it: adds extra gateway environment variables in a StatefulSet
+    template: templates/statefulset.yaml
+    set:
+      server.extraEnv:
+        - name: OTEL_TRACES_SAMPLER
+          value: parentbased_traceidratio
+        - name: OTEL_EXPORTER_OTLP_HEADERS
+          valueFrom:
+            secretKeyRef:
+              name: otel-collector-auth
+              key: headers
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OTEL_TRACES_SAMPLER
+            value: parentbased_traceidratio
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OTEL_EXPORTER_OTLP_HEADERS
+            valueFrom:
+              secretKeyRef:
+                name: otel-collector-auth
+                key: headers
+
+  - it: adds extra gateway environment variables in a Deployment
+    template: templates/deployment.yaml
+    set:
+      workload.kind: deployment
+      server.externalDbSecret: my-pg-secret
+      server.extraEnv:
+        - name: OTEL_TRACES_SAMPLER
+          value: parentbased_traceidratio
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].env
+          content:
+            name: OTEL_TRACES_SAMPLER
+            value: parentbased_traceidratio
+
   - it: mounts the OIDC CA bundle when TLS is disabled
     template: templates/statefulset.yaml
     set:

deploy/helm/openshell/values.yaml

@@ -369,6 +369,9 @@ server:
   extraVolumes: []
   # -- Additional volume mounts for the gateway container.
   extraVolumeMounts: []
+  # -- Additional environment variables for the gateway container, such as
+  # OTEL_* exporter settings. Entries can read from a Secret with valueFrom.
+  extraEnv: []
   # -- Enable anonymous OpenShell telemetry from the gateway and the sandbox
   # supervisors it launches.
   telemetryEnabled: true

docs/how-it-works/gateways/configuration.mdx

@@ -506,6 +506,18 @@ The gateway honors these variables:
 | `OTEL_EXPORTER_OTLP_LOGS_HEADERS`, `OTEL_EXPORTER_OTLP_LOGS_COMPRESSION`, `OTEL_EXPORTER_OTLP_LOGS_TIMEOUT` | Exporter transport tuning for OCSF log records only. These override the general variables. |
 | `SSL_CERT_FILE`, `SSL_CERT_DIR` | Additional trust roots for `https://` endpoints, such as a private CA. |
 
+For Helm deployments, set these variables with `server.extraEnv`. Read credentials from a Secret so they stay out of the values file:
+
+```yaml
+server:
+  extraEnv:
+    - name: OTEL_EXPORTER_OTLP_HEADERS
+      valueFrom:
+        secretKeyRef:
+          name: otel-collector-auth
+          key: headers
+```
+
 These variables have no effect. Only `[openshell.gateway.otlp]` decides which signals are exported and where they go, for two reasons:
 
 - OCSF events are security records, so where they go must be a deliberate choice. Platform tooling can add `OTEL_*` variables to a process, as the OpenTelemetry Operator does for annotated pods on Kubernetes. Such a variable must not start sending security records to a collector, redirect them, or turn them off.