> This page is for version Dev. > For other versions, use one of these documentation indexes: > - Latest (v0.1.3) (default): https://docs.nvidia.com/openshell/latest/llms.txt > - Dev: https://docs.nvidia.com/openshell/dev/llms.txt > - v0.1.3: https://docs.nvidia.com/openshell/v0.1.3/llms.txt > - v0.1.2: https://docs.nvidia.com/openshell/v0.1.2/llms.txt > - v0.1.1: https://docs.nvidia.com/openshell/v0.1.1/llms.txt > - v0.1.0: https://docs.nvidia.com/openshell/v0.1.0/llms.txt > - v0.0.116: https://docs.nvidia.com/openshell/v0.0.116/llms.txt > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.nvidia.com/openshell/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/openshell/_mcp/server. # Migrate Helm gateway configuration to `gatewayConfig` Chart schema v2 replaces application-specific Helm values with one non-secret `gatewayConfig` map. Its top-level keys are TOML tables; nested maps are TOML inline tables. A top-level YAML list is an ordered TOML array of tables, with one map per `[[table]]` entry. Kubernetes resource references (Secrets, certificates, Services, and mounts) remain chart values. ## Upgrade compatibility The chart accepts the 0.1.x application values as deprecated aliases while moving to `gatewayConfig`. When both forms set the same runtime field, `gatewayConfig` wins. Runtime images and proxy settings may therefore be migrated incrementally. Kubernetes pull policy spellings such as `Always` are accepted aliases and normalize to `always`, `if_not_present`, or `never`. `gatewayConfig` is strictly a non-secret configuration contract: do not put passwords, tokens, private keys, `database_url`, or other secret material in it; use Secret-backed environment, file, or volume configuration instead. Helm serializes unknown fields generically and cannot determine whether an arbitrary string such as `api_token` is confidential. It rejects `database_url`, inline URL credentials, and PEM private keys, but is not a general secret scanner. Keep `server.disableTls`, TLS Secret names, `server.hostGatewayIP`, `server.externalDbSecret`, `server.sandboxNamespace`, `server.oidc.caConfigMapName`, certificate settings and Service settings: these own Kubernetes resources. The chart derives their runtime counterparts. ## Mapping | Deprecated alias | Schema-v2 location | | ---------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `server.name`, `server.logLevel`, `server.enableLoopbackServiceHttp`, `server.policyValidationFailureMode` | `openshell.gateway.{name,log_level,enable_loopback_service_http,policy_validation_failure_mode}` | | `server.grpcRateLimit.{requests,windowSeconds}` | `openshell.gateway.{grpc_rate_limit_requests,grpc_rate_limit_window_seconds}` | | `server.otlp.{endpoint,serviceName}` | `openshell.gateway.otlp.{endpoint,service_name}` | | `server.auth.allowUnauthenticatedUsers` | `openshell.gateway.auth.allow_unauthenticated_users` | | `server.oidc.*` | `openshell.gateway.oidc` with snake\_case keys | | `server.sandboxImage*`, workspace storage/runtime and user namespace settings | `openshell.drivers.kubernetes`. Kubernetes AppArmor configuration is removed by RFC 0012. | | `server.drivers.kubernetes.*` | `openshell.drivers.kubernetes` | | `server.sandboxJwt.{gatewayId,ttlSecs,k8sSaTokenTtlSecs}` | `openshell.gateway.gateway_jwt` or `openshell.drivers.kubernetes.sa_token_ttl_secs` | | `supervisor.image.*`, `supervisor.sandboxRuntime.*` | `openshell.drivers.kubernetes.{supervisor_image,supervisor_image_pull_policy,sandbox_runtime}`. `supervisor.topology` and `supervisor.sidecar.*` are removed by RFC 0012 with no replacement. | | `upstreamProxy.*` | `openshell.drivers.kubernetes.{https_proxy,no_proxy,proxy_auth_*,proxy_connect_by_hostname}`. | | `server.credentialDrivers.{kubernetesSecrets,vault}.*` | `openshell.gateway.credential_drivers` and `openshell.credential_drivers.*` | | `server.providerTokenGrants.spiffe.{enabled,workloadApiSocketPath}` | `openshell.drivers.kubernetes.provider_spiffe_workload_api_socket_path`; omit it to disable SPIFFE provider grants. | | `server.hostGatewayIP` | Retained as the chart-owned host-alias input; the chart derives `openshell.drivers.kubernetes.host_gateway_ip`. | ## Examples The following values configure OIDC, telemetry, sandbox images, managed workspaces, rate limiting, and the Kubernetes Secrets credential driver before migration: ```yaml server: oidc: issuer: https://idp.example/realms/openshell audience: openshell-cli jwksTtl: 3600 otlp: endpoint: http://otel-collector:4317 serviceName: production-gateway drivers: kubernetes: workspaceMode: managed grpcRateLimit: requests: 120 windowSeconds: 60 credentialDrivers: kubernetesSecrets: enabled: true namespace: provider-secrets sandbox: image: repository: registry.example/sandbox tag: latest pullPolicy: IfNotPresent supervisor: image: registry: registry.example repository: openshell-supervisor tag: latest sandboxRuntime: boundaryPort: 5500 ``` After migration, the same settings use `gatewayConfig`: ```yaml gatewayConfig: openshell.gateway.oidc: issuer: https://idp.example/realms/openshell audience: openshell-cli jwks_ttl_secs: 3600 openshell.gateway.otlp: endpoint: http://otel-collector:4317 service_name: production-gateway openshell.drivers.kubernetes: default_image: registry.example/sandbox:latest image_pull_policy: if_not_present supervisor_image: registry.example/openshell-supervisor:latest sandbox_runtime: boundary_port: 5500 workspace_mode: managed openshell.gateway: grpc_rate_limit_requests: 120 grpc_rate_limit_window_seconds: 60 credential_drivers: [kubernetes-secrets] openshell.credential_drivers.kubernetes-secrets: namespace: provider-secrets ``` For Vault, set `openshell.gateway.credential_drivers: [vault]` and configure `openshell.credential_drivers.vault`; use `credentialDrivers.vault.caConfigMapName` for a private Vault CA. For a proxy, use the Kubernetes-driver fields in `gatewayConfig`. TLS remains Secret-backed; set `server.disableTls: true` only for trusted external termination. A null map field omits it; null array elements are invalid. Strings are serialized literally; Helm template expressions inside them are not evaluated.