[TaylorMutch]

Summary

Add the optional openshell-sandbox-proxy discovery consumer. It uses exact TLS SNI and unexpired discovered routes to relay application TLS directly to owning supervisors, keeping payloads off the gateway.

Based on main at cb836ea9d. Stacked on feat/4668-discovery-readers/TaylorMutch.

Related Issue

Closes #4954. Part of RFC 0017.

Changes

• Consume snapshots and watches through the Rust SDK client for the separate openshell.v1.ServiceDiscovery service.

• Support one workspace, selected workspaces, or all active workspaces with discovery-only credentials.

• Bound route caches, connections, ClientHello parsing, retries, and setup deadlines; atomically replace validated snapshots.

• Close affected streams on withdrawal, installation replacement, expiry, or authorization loss; reload credentials/trust on reconnect.

• Add health/readiness/metrics, container and release wiring, and a standalone Helm chart with deployment and workspace-scope regression cases.

Release Notes

Testing

• Discovery-service review integration: combined stack passed 642 core, 2,693 server, 54 Rust SDK, and nine proxy tests, including production TLS discovery-only access and proxy snapshot/watch withdrawal in single, finite, and all-workspace modes. Strict all-target Clippy, TypeScript SDK/protobuf checks, and Markdown/Mermaid validation passed. 42 PostgreSQL-dependent server tests were skipped. No new live-cluster or load qualification was performed.

• Hostname integration: 111 standalone application-URL-layer tests and 120 combined-stack routing/schema regressions passed, including shared shutdown fencing and ingress URL stability. Strict Clippy for affected crates, protobuf/docs/Mermaid lint, and lockfile checks passed.

• 40 focused combined-stack Rust regression tests cover listener routing, route-limit concurrency, shutdown fencing, advertisements, discovery, and proxy behavior.

• Local k3d validated the Service removal with dedicated push/poll, abrupt shared-owner takeover, HTTP/WebSockets, network-policy denial, freshness/withdrawal, outage recovery, and disabled-listener gateway access. Workload identity and memory survived owner changes.

• Discovery API snapshots/watches and workspace-restricted discovery credentials drove two proxy replicas; both followed Pod-IP endpoints, graceful owner handover, and route withdrawal without per-sandbox app Services.

• Helm lint/unit/parser/coherence/scaling checks, Python lint/format/type checks, and topology assertions passed.

Live Kubernetes validation preceded integration of the latest listener hardening;
focused Rust regressions validate that final integration. New-head CI is pending.

Qualification limits

Live HA validation exercised supervisor process/Pod loss on a local k3d cluster. Whole-node failure, real network partitions, metric-driven HPA, sustained production load, and published release artifacts remain unqualified. Grant-file projection contributes to revocation propagation time. Both ingress paths now share the gateway hostname format and label generator. The same installation identity and public HTTPS domain/port preserve service URLs when switching ingress. Installation-status presentation (#4670) remains separate work. Live Kubernetes runs above preceded hostname integration; the naming and shutdown-fence integration is validated by focused Rust regressions.

The example Kubernetes HTTPRoute controller is a deferred compatibility POC outside this stack.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Relevant implementation, configuration, and API documentation updated

PR dependency order: #4941 → #4956 → #4963 → #4964 → #4957.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-4957.docs.buildwithfern.com/openshell

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.