fix(helm): mount sandbox JWT keys without TLS

Author: TaylorMutch

.agents/skills/debug-openshell-cluster/SKILL.md

@@ -116,9 +116,16 @@ Check required Helm deployment secrets:
 kubectl -n openshell get secret \
   openshell-server-tls \
   openshell-server-client-ca \
-  openshell-client-tls
+  openshell-client-tls \
+  openshell-jwt-keys
 ```
 
+If the gateway exits with `failed to read sandbox JWT signing key from
+/etc/openshell-jwt/signing.pem`, verify that `openshell-jwt-keys` contains
+`signing.pem`, `public.pem`, and `kid`, and that the StatefulSet mounts the
+`sandbox-jwt` secret at `/etc/openshell-jwt`. The sandbox JWT mount is required
+even when local Helm values disable TLS.
+
 Check the image references currently used by the gateway deployment:
 
 ```bash

crates/openshell-server/src/multiplex.rs

@@ -323,6 +323,7 @@ pub struct AuthGrpcRouter<S> {
 }
 
 impl<S> AuthGrpcRouter<S> {
+    #[cfg(test)]
     fn new(
         inner: S,
         authenticator_chain: Option<AuthenticatorChain>,

deploy/helm/openshell/templates/statefulset.yaml

@@ -75,6 +75,9 @@ spec:
             - name: gateway-config
               mountPath: /etc/openshell
               readOnly: true
+            - name: sandbox-jwt
+              mountPath: /etc/openshell-jwt
+              readOnly: true
             {{- if not .Values.server.disableTls }}
             - name: tls-cert
               mountPath: /etc/openshell-tls/server
@@ -84,15 +87,12 @@ spec:
               mountPath: /etc/openshell-tls/client-ca
               readOnly: true
             {{- end }}
-            - name: sandbox-jwt
-              mountPath: /etc/openshell-jwt
-              readOnly: true
+            {{- end }}
             {{- if and .Values.server.oidc.issuer .Values.server.oidc.caConfigMapName }}
             - name: oidc-ca
               mountPath: /etc/openshell-tls/oidc-ca
               readOnly: true
             {{- end }}
-            {{- end }}
           ports:
             - name: grpc
               containerPort: {{ .Values.service.port }}
@@ -134,6 +134,10 @@ spec:
         - name: gateway-config
           configMap:
             name: {{ include "openshell.fullname" . }}-config
+        - name: sandbox-jwt
+          secret:
+            secretName: {{ .Values.server.sandboxJwt.signingSecretName | default (printf "%s-jwt-keys" (include "openshell.fullname" .)) }}
+            defaultMode: 0400
         {{- if not .Values.server.disableTls }}
         - name: tls-cert
           secret:
@@ -150,16 +154,12 @@ spec:
             secretName: {{ .Values.server.tls.clientCaSecretName }}
             {{- end }}
         {{- end }}
-        - name: sandbox-jwt
-          secret:
-            secretName: {{ .Values.server.sandboxJwt.signingSecretName | default (printf "%s-jwt-keys" (include "openshell.fullname" .)) }}
-            defaultMode: 0400
+        {{- end }}
         {{- if and .Values.server.oidc.issuer .Values.server.oidc.caConfigMapName }}
         - name: oidc-ca
           configMap:
             name: {{ .Values.server.oidc.caConfigMapName }}
         {{- end }}
-        {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}