feat(helm): split gateway and workspace charts

[dhirajsb]

Summary

Split the OpenShell Helm deployment into independently installable gateway and
workspace charts. This lets platform operators manage a shared gateway
separately from namespace-local sandbox prerequisites while preserving the
existing combined installation by default.

Related Issue

Closes #2485

Changes

• Add an openshell-workspace chart containing only the sandbox ServiceAccount,
  namespaced Role and RoleBinding, and sandbox SSH NetworkPolicy.
• Add the backward-compatible workspaceResources.enabled switch to the
  gateway chart.
• Support cross-namespace RoleBinding subjects through explicit gateway
  ServiceAccount name and namespace values.
• Package and publish both charts through the existing OCI release action.
• Document shared-mode and current operator-mode namespace mappings.
• Add Helm unit coverage and a cross-chart render test that rejects overlapping
  Kubernetes object ownership.

Testing

• Rebased onto current NVIDIA/OpenShell:main (65745a0).
• mise run pre-commit.
• mise run helm:test (111 gateway tests and 4 workspace tests).
• Gateway and workspace chart lint across all current CI values variants.
• Cross-chart ownership render: gateway-only and workspace releases are
  disjoint.
• Helm render verification:
  • default gateway install: 15 → 15 objects, no identity drift;
  • gateway-only install: exactly the intended ServiceAccount, Role,
    RoleBinding, and NetworkPolicy are omitted;
  • no dependency, field-constraint, or YAML-separator findings.
• Both charts package successfully as helm-chart-0.0.0.tgz and
  openshell-workspace-0.0.0.tgz.
• Kubernetes E2E (not added; this PR changes Helm packaging and render
  ownership, covered by chart tests).

Checklist

• Follows Conventional Commits.
• Commit is signed off (DCO).
• Architecture, Kubernetes setup, chart docs, and cluster-debug skill are
  updated.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[johntmyers]

gator-agent

PR Review Status

Thanks @johntmyers—I reviewed the refreshed head you invited for review. Thanks @dhirajsb as well; I checked the rebase, chart split, ownership test, release action, and documentation updates described in your issue follow-up. The linked issue makes this project-valid, and the docs cover the direct Kubernetes workflow, but two rendering and upgrade defects need an author update before CI dispatch.

Action required: @dhirajsb, fix GATOR-025c11b8-01 and GATOR-025c11b8-02, add the requested regressions, and push a new head for follow-up review.

Blocking findings:

• GATOR-025c11b8-01: the new workspace chart renders required values into each manifest and loses apiVersion.
• GATOR-025c11b8-02: older gateway releases upgraded with --reuse-values can fail on the absent workspaceResources map.

Carried findings:

• None

Non-blocking suggestions:

• GATOR-025c11b8-03: update the release-canary skill and consider smoke coverage for the newly published workspace OCI chart.

Gator metadata

• Validation: Project-valid because PR #2643 implements the chart boundary and acceptance criteria in linked issue #2485, and maintainer @johntmyers invited the refreshed PR for review.
• Docs: Fern Kubernetes setup documentation and related architecture/chart/debug guidance are updated.
• Checks: DCO and currently published informational checks are green; required Branch Checks and Helm Lint are pending/not dispatched for this head.
• E2E: test:e2e is required for the Kubernetes Helm deployment path, but dispatch waits until blocking review feedback is resolved.
• Head SHA: 025c11b8249276b870f110b6b8becdd00b205ede
• Base SHA: 65745a06ef7b4aafc00600fd7f2d16ef7da49c26
• Merge base SHA: 65745a06ef7b4aafc00600fd7f2d16ef7da49c26
• Patch ID: e7519f47ed7ec635339375868e1b3fd4fa9f020a
• Gator payload: 7
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[github-actions]

Label test:e2e applied, but pull-request/2643 does not exist yet. A maintainer needs to comment /ok to test 53df022d656727dfbb4743a7103b4c94732ad1c2 to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

[johntmyers]

/ok to test 53df022

[johntmyers]

gator-agent

PR Review Status

Thanks @dhirajsb. I checked your current-head fixes for both prior findings: the workspace validation helper no longer emits required values into rendered manifests, and the gateway helper safely defaults a missing legacy workspaceResources map to enabled while preserving explicit false. The added render regressions cover both obligations, and the follow-up review found no new blocking issue in the author delta.

Blocking findings:

• No blocking findings remain

Carried findings:

• None; GATOR-025c11b8-01 and GATOR-025c11b8-02 are resolved by this head

Gator metadata

• Validation: Project-valid because PR #2643 implements the accepted chart boundary in linked issue #2485.
• Docs: Fern Kubernetes setup documentation and chart/architecture guidance are updated.
• Checks: Current-head Branch Checks and Helm Lint are running on the mirrored branch.
• E2E: test:e2e applied; /ok to test 53df022d656727dfbb4743a7103b4c94732ad1c2 created the current-head mirror, and Branch E2E Checks are running.
• Head SHA: 53df022d656727dfbb4743a7103b4c94732ad1c2
• Base SHA: 65745a06ef7b4aafc00600fd7f2d16ef7da49c26
• Merge base SHA: 65745a06ef7b4aafc00600fd7f2d16ef7da49c26
• Patch ID: 2616509eab62e5eca7b9fb2e734377b3f0414154
• Gator payload: 7
• Review mode: follow_up
• Previous reviewed SHA: 025c11b8249276b870f110b6b8becdd00b205ede
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[dhirajsb]

The two blocking Gator findings are addressed in 53df022d656727dfbb4743a7103b4c94732ad1c2: workspace manifests preserve apiVersion, and missing legacy workspaceResources values render safely while explicit false remains respected. The focused ownership/render regressions and local pre-commit validation pass. Please re-review this head; CI results are being tracked separately.

[github-actions]

Label test:e2e applied for 53df022. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[dhirajsb]

@derekwaynecarr @mrunalp can you please also review and approve? 🙏

[johntmyers]

/ok to test d0576b2

[johntmyers]

gator-agent

PR Review Status

Thanks @johntmyers. I checked the rebase and conflict resolution you requested. Thanks @dhirajsb as well; I verified that the three unchanged author commits remain patch-equivalent and reviewed the VM-runtime CI conflict resolution against current main. The required critical-only delta review found no newly introduced Critical defect, both prior Gator findings remain resolved, and the protected workflows are now dispatched for this head.

Blocking findings:

• No blocking findings remain

Carried findings:

• None; GATOR-025c11b8-01 and GATOR-025c11b8-02 remain resolved

Gator metadata

• Validation: Project-valid because PR #2643 implements the accepted chart ownership boundary in linked issue #2485.
• Docs: Fern Kubernetes setup documentation and chart/architecture guidance remain sufficient.
• Checks: Current-head Branch Checks are queued and Helm Lint is in progress.
• E2E: test:e2e remains applied; /ok to test d0576b2edbce4061fd6eac029498fa0987e2338a updated the mirror and Branch E2E Checks are in progress.
• Head SHA: d0576b2edbce4061fd6eac029498fa0987e2338a
• Base SHA: 9b6d904e880a20178bb54cb5ede1a60689be71a1
• Merge base SHA: 9b6d904e880a20178bb54cb5ede1a60689be71a1
• Patch ID: 653d3aacdea19102ea805d281660fe601c518e76
• Gator payload: 7
• Review mode: critical_only
• Previous reviewed SHA: ca67ab54eeadccaa307e6b1ab345231523bcbe16
• Review budget exhausted: yes
• Maintainer decision required: no
• Next state: gator:watch-pipeline

[dhirajsb]

Validation update for head d0576b2: Branch Checks and Helm Lint are passing, and the latest Gator review has no blocking findings. The only failures in https://github.com/NVIDIA/OpenShell/actions/runs/33426019324 are:

• https://github.com/NVIDIA/OpenShell/actions/runs/33426019324/job/99602448372: the v1beta1 combined E2E test fails after stop/start because the exec relay closes before an exit status is reported.
• https://github.com/NVIDIA/OpenShell/actions/runs/33426019324/job/99602448116: the managed-workspace E2E test times out because its sandbox child Pod reaches Failed.

This PR does not modify either affected E2E test or its workflow, and sibling lifecycle/workspace coverage passed in the same run. I cannot rerun failed jobs from this fork account (GitHub returns: "Must have admin rights to Repository"). Could a maintainer please rerun the failed jobs on this head? If either reproduces, I will investigate it separately rather than broaden this Helm-chart split PR.

[johntmyers]

/ok to test 083a056

[johntmyers]

gator-agent

Blocked

Gator is blocked because the current-head Branch E2E run failed in rust-docker and the Kubernetes v1beta1 combined job. The effective author patch is range-diff equivalent to previously reviewed heads; both exact jobs passed on equivalent head ca67ab54, and the failing job set changed across equivalent runs, so the available evidence points to flaky E2E execution rather than a PR-owned regression.

Next action: a maintainer should re-run the failed jobs in current-head workflow run 33447580533. Gator will re-check the required gate afterward.

Gator metadata

• Head SHA: 083a056fbd48f6127a451cb8a754017b1c4f909a
• Gator payload: 7
• Next state: gator:blocked
• Blocked reason: e2e_flake_rerun_required

[johntmyers]

/ok to test a8c448b

[johntmyers]

gator-agent

Maintainer Approval Needed

Gator validation and PR monitoring are complete. The current head is patch-equivalent to the previously reviewed head, no blocking review feedback remains, and the required Branch Checks, Helm Lint, and E2E gates are green.

Human maintainer approval is now required.

Gator metadata

• Validation: Project-valid Helm packaging work linked to feat(helm): split gateway and workspace namespace charts #2485.
• Review: Previously reviewed equivalent patch; no open Gator findings.
• Docs: Kubernetes setup documentation and chart READMEs are updated.
• Checks: Required Branch Checks and Helm Lint are green.
• E2E: test:e2e applied; OpenShell / E2E is green for the current head.
• Head SHA: a8c448b38de03edc8c920f645a5cc2abe73a13e4
• Gator payload: 7
• Next state: gator:approval-needed

[johntmyers]

gator-agent

Monitoring Complete

Monitoring is complete because this PR has merged.

Final status: the PR reached gator:merge-ready with maintainer approval and the required current-head checks, including E2E and Helm lint, green.

I removed the active gator:* label because there is nothing left for gator to monitor on this PR.

Gator metadata

• Head SHA: a8c448b38de03edc8c920f645a5cc2abe73a13e4
• Gator payload: 7
• Final state: merged