feat(gateway): passthrough Route, remove OPENSHELL_USE_GATEWAY flag, expand RBAC - #430
Merged
Merged
Conversation
markturansky
changed the title
markturansky
marked this pull request as ready for review
July 29, 2026 20:35
github-actions
Bot
added
auto-merge-pending
…l specs All unique knowledge from MTLS.md and rubber-on-road.md has been verified present in the openshell spec files. Remaining gaps merged: - Fix Route exposure contradiction in sandbox-provisioning spec: gateway MAY be exposed via GRPCRoute or NLB passthrough Route (was incorrectly stating "not exposed outside the cluster") - Add GHCR commit-SHA image tag convention note to gateway spec - Add GROUPS bash builtin collision and sandbox create hang to OIDC debugging reference Delete MTLS.md and rubber-on-road.md as redundant — their content now lives authoritatively in specs/platform/openshell-gateway*.spec.md and specs/platform/openshell-sandbox-provisioning.spec.md. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
…ag, expand RBAC Remove the OPENSHELL_USE_GATEWAY feature flag from Go code, manifests, scripts, Makefile, and UI Dockerfile — gateway is now always-on when OpenShell is enabled. Add automatic passthrough Route creation for OpenShift/ROSA clusters without Gateway API, with dynamic OwnerReference kind detection (Deployment vs StatefulSet) to prevent garbage collection. Expand the control-plane project manager Role and ClusterRole with PVC, routes/custom-host, NetworkPolicy, and apps group permissions needed for gateway provisioning. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
…ed gracefully Remove the bootstrap-admin Job that fails in Kind because the API server image runs as root (runAsNonRoot violation). Admin seeding will be handled through a different mechanism. Add graceful degradation for SetInferenceRoute gRPC call when the gateway does not implement it (older versions), logging a warning instead of failing the session. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
markturansky
force-pushed
the
chore/consolidate-openshell-specs
branch
from
July 30, 2026 04:37
c62e28f to
d640ba8
Compare
jsell-rh
enabled auto-merge
July 30, 2026 04:41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tls.termination: passthroughand auto-generate hostnames frombaseDomain. Includes NLB IngressController detection forrouteSelectorlabels androutes/custom-hostRBAC.getWorkloadUIDnow returns the actual workload kind (Deployment vs StatefulSet) instead of hardcodingStatefulSet.persistentvolumeclaims,routes/custom-host,watchverbs onapps,networking.k8s.io,route.openshift.iogroups. Resolves RBAC escalation errors when creating Roles in project namespaces.Test plan
go build ./...andgo vet ./...passgofmt -l .reports no formatting issuestenant-aandacp-01namespaces (no GC churn)kind: Deploymentmatching actual workloadcurl -sk https://openshell-gateway-tenant-a.apps.rosa.vteam-stage.7fpc.p3.openshiftapps.com(returns 404 from gateway — expected for non-gRPC requests)tenant-bRBAC escalation errorpanic()oranytypes in diff🤖 Generated with Claude Code