Skip to content

Commit 53df022

Browse files
dhirajsbdhirajsb
committed
fix(helm): preserve split chart upgrade compatibility
Keep workspace manifests valid after value validation and default legacy reused values to the combined resource topology.
1 parent 025c11b commit 53df022

11 files changed

Lines changed: 53 additions & 12 deletions

File tree

‎deploy/helm/openshell-workspace/templates/_helpers.tpl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
3838
Validate required cross-namespace gateway identity values.
3939
*/}}
4040
{{- define "openshell-workspace.validateValues" -}}
41-
{{- required "gateway.serviceAccount.name is required" .Values.gateway.serviceAccount.name -}}
42-
{{- required "gateway.serviceAccount.namespace is required" .Values.gateway.serviceAccount.namespace -}}
43-
{{- required "sandboxServiceAccount.name is required" .Values.sandboxServiceAccount.name -}}
41+
{{- $gatewayServiceAccountName := required "gateway.serviceAccount.name is required" .Values.gateway.serviceAccount.name -}}
42+
{{- $gatewayServiceAccountNamespace := required "gateway.serviceAccount.namespace is required" .Values.gateway.serviceAccount.namespace -}}
43+
{{- $sandboxServiceAccountName := required "sandboxServiceAccount.name is required" .Values.sandboxServiceAccount.name -}}
4444
{{- end }}

‎deploy/helm/openshell-workspace/templates/networkpolicy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4-
{{- include "openshell-workspace.validateValues" . -}}
4+
{{- include "openshell-workspace.validateValues" . }}
55
{{- if .Values.networkPolicy.enabled }}
66
apiVersion: networking.k8s.io/v1
77
kind: NetworkPolicy

‎deploy/helm/openshell-workspace/templates/role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4-
{{- include "openshell-workspace.validateValues" . -}}
4+
{{- include "openshell-workspace.validateValues" . }}
55
apiVersion: rbac.authorization.k8s.io/v1
66
kind: Role
77
metadata:

‎deploy/helm/openshell-workspace/templates/rolebinding.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4-
{{- include "openshell-workspace.validateValues" . -}}
4+
{{- include "openshell-workspace.validateValues" . }}
55
apiVersion: rbac.authorization.k8s.io/v1
66
kind: RoleBinding
77
metadata:

‎deploy/helm/openshell-workspace/templates/serviceaccount.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4-
{{- include "openshell-workspace.validateValues" . -}}
4+
{{- include "openshell-workspace.validateValues" . }}
55
{{- if .Values.sandboxServiceAccount.create }}
66
apiVersion: v1
77
kind: ServiceAccount

‎deploy/helm/openshell/templates/_helpers.tpl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,19 @@ Create the name of the service account assigned to sandbox pods
7070
{{- end }}
7171
{{- end }}
7272

73+
{{/*
74+
Whether this chart owns workspace-scoped resources. Missing legacy values
75+
default to enabled so upgrades with --reuse-values preserve the old topology.
76+
*/}}
77+
{{- define "openshell.workspaceResourcesEnabled" -}}
78+
{{- $workspaceResources := .Values.workspaceResources | default dict -}}
79+
{{- $enabled := true -}}
80+
{{- if hasKey $workspaceResources "enabled" -}}
81+
{{- $enabled = get $workspaceResources "enabled" -}}
82+
{{- end -}}
83+
{{- if $enabled -}}true{{- end -}}
84+
{{- end }}
85+
7386
{{/*
7487
Gateway image reference. Uses image.tag when set; falls back to .Chart.AppVersion
7588
so a released chart automatically pulls the matching image without extra overrides.

‎deploy/helm/openshell/templates/networkpolicy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: Apache-2.0
33

4-
{{- if and .Values.workspaceResources.enabled .Values.networkPolicy.enabled }}
4+
{{- if and (include "openshell.workspaceResourcesEnabled" .) .Values.networkPolicy.enabled }}
55
# NetworkPolicy restricting SSH ingress on sandbox pods to the gateway pod.
66
# Sandbox pods are dynamically created by the server and labelled with
77
# openshell.ai/managed-by=openshell. This policy ensures only the gateway

‎deploy/helm/openshell/templates/role.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- $workspaceMode := .Values.server.drivers.kubernetes.workspaceMode | default "shared" -}}
2-
{{- if and (eq $workspaceMode "shared") .Values.workspaceResources.enabled }}
2+
{{- if and (eq $workspaceMode "shared") (include "openshell.workspaceResourcesEnabled" .) }}
33
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
44
# SPDX-License-Identifier: Apache-2.0
55
apiVersion: rbac.authorization.k8s.io/v1

‎deploy/helm/openshell/templates/rolebinding.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- $workspaceMode := .Values.server.drivers.kubernetes.workspaceMode | default "shared" -}}
2-
{{- if and (eq $workspaceMode "shared") .Values.workspaceResources.enabled }}
2+
{{- if and (eq $workspaceMode "shared") (include "openshell.workspaceResourcesEnabled" .) }}
33
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
44
# SPDX-License-Identifier: Apache-2.0
55
apiVersion: rbac.authorization.k8s.io/v1

‎deploy/helm/openshell/templates/serviceaccount.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ metadata:
1313
{{- toYaml . | nindent 4 }}
1414
{{- end }}
1515
{{- end }}
16-
{{- if and .Values.serviceAccount.create .Values.workspaceResources.enabled .Values.sandboxServiceAccount.create }}
16+
{{- if and .Values.serviceAccount.create (include "openshell.workspaceResourcesEnabled" .) .Values.sandboxServiceAccount.create }}
1717
---
1818
{{- end }}
19-
{{- if and .Values.workspaceResources.enabled .Values.sandboxServiceAccount.create }}
19+
{{- if and (include "openshell.workspaceResourcesEnabled" .) .Values.sandboxServiceAccount.create }}
2020
apiVersion: v1
2121
kind: ServiceAccount
2222
metadata:

0 commit comments

Comments
 (0)