feat(gateway): passthrough Route, remove OPENSHELL_USE_GATEWAY flag, expand RBAC - #430
Draft
markturansky wants to merge 2 commits into
Draft
feat(gateway): passthrough Route, remove OPENSHELL_USE_GATEWAY flag, expand RBAC#430markturansky wants to merge 2 commits into
markturansky wants to merge 2 commits into
Conversation
…l specs All unique knowledge from MTLS.md and rubber-on-road.md has been verified present in the openshell spec files. Remaining gaps merged: - Fix Route exposure contradiction in sandbox-provisioning spec: gateway MAY be exposed via GRPCRoute or NLB passthrough Route (was incorrectly stating "not exposed outside the cluster") - Add GHCR commit-SHA image tag convention note to gateway spec - Add GROUPS bash builtin collision and sandbox create hang to OIDC debugging reference Delete MTLS.md and rubber-on-road.md as redundant — their content now lives authoritatively in specs/platform/openshell-gateway*.spec.md and specs/platform/openshell-sandbox-provisioning.spec.md. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
…ag, expand RBAC Remove the OPENSHELL_USE_GATEWAY feature flag from Go code, manifests, scripts, Makefile, and UI Dockerfile — gateway is now always-on when OpenShell is enabled. Add automatic passthrough Route creation for OpenShift/ROSA clusters without Gateway API, with dynamic OwnerReference kind detection (Deployment vs StatefulSet) to prevent garbage collection. Expand the control-plane project manager Role and ClusterRole with PVC, routes/custom-host, NetworkPolicy, and apps group permissions needed for gateway provisioning. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
markturansky
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tls.termination: passthroughand auto-generate hostnames frombaseDomain. Includes NLB IngressController detection forrouteSelectorlabels androutes/custom-hostRBAC.getWorkloadUIDnow returns the actual workload kind (Deployment vs StatefulSet) instead of hardcodingStatefulSet.persistentvolumeclaims,routes/custom-host,watchverbs onapps,networking.k8s.io,route.openshift.iogroups. Resolves RBAC escalation errors when creating Roles in project namespaces.Test plan
go build ./...andgo vet ./...passgofmt -l .reports no formatting issuestenant-aandacp-01namespaces (no GC churn)kind: Deploymentmatching actual workloadcurl -sk https://openshell-gateway-tenant-a.apps.rosa.vteam-stage.7fpc.p3.openshiftapps.com(returns 404 from gateway — expected for non-gRPC requests)tenant-bRBAC escalation errorpanic()oranytypes in diff🤖 Generated with Claude Code