OpenShell Dashboard

A web admin UI for OpenShell, the open-source agent sandboxing platform. It is a standalone application: a Go backend-for-frontend (the BFF) that reaches one OpenShell gateway through the OpenShell Go SDK, and a React UI built with PatternFly 6. It ships as a container image and a Helm chart.

Features

• Workspaces: create and delete workspaces, and add and remove their members.
• Sandboxes: create a sandbox with a security policy or from a workspace template, then stop, start and delete it.
• Inside a sandbox: logs, an interactive terminal, file upload and download, exposed services, settings, and the providers attached to it.
• Policy: revision history, a network-rule editor and an inbox of proposed policy changes for each sandbox, and one gateway-wide policy.
• Providers: register credentials from provider profiles, and create, import and export the profiles.
• Gateway: status, version, compute drivers and settings, and lists of sandboxes, providers, templates and services across all workspaces.

Install

The dashboard is installed with its Helm chart, in the namespace of the gateway it manages. You need:

• A Kubernetes cluster with a Gateway API controller, and a Gateway whose HTTPS listener admits routes from the namespace openshell. On OpenShift the chart can create a Route instead.
• An OpenShell gateway 0.1.x, installed from its Helm chart as release openshell in the namespace openshell.
• A Keycloak realm that the gateway trusts. deploy/keycloak/openshell-realm.json is one you can import.

Create the Secret the auth proxy reads:

kubectl -n openshell create secret generic openshell-dashboard-oidc \
  --from-literal=client-secret='<client secret of the openshell-dashboard client>' \
  --from-literal=cookie-secret="$(openssl rand -hex 16)"

Write a values.yaml:

oidc:
  provider: keycloak-oidc
  issuer: https://keycloak.example.com/realms/openshell
  codeChallengeMethod: S256
  adminRole: openshell-admin
  allowedRoles:
    - openshell-api:openshell-admin
    - openshell-api:openshell-user

httpRoute:
  enabled: true
  hostnames: [dashboard.example.com]
  gateway:
    name: <your Gateway>
    namespace: <its namespace>
    sectionName: <name of its HTTPS listener>

networkPolicy:
  ingressNamespace: <namespace of the Gateway's data-plane pods>

Install the chart:

helm upgrade --install openshell-dashboard \
  oci://ghcr.io/gkrumbach07/openshell-dashboard/helm-chart/openshell-dashboard \
  --version <dashboard version> --namespace openshell -f values.yaml

<dashboard version> is the newest dashboard release whose first two numbers match your gateway's: a 0.1.N for a gateway 0.1.x (Compatibility, releases).

Then open https://dashboard.example.com and sign in. The install guide has every step: Keycloak, the gateway's settings, OpenShift, sign-out and workspace membership.

Compatibility

A dashboard release is for one minor release line of the OpenShell gateway: every gateway release that shares a major and a minor number, so 0.1.x is 0.1.0, 0.1.3 and every other release whose version starts with 0.1. To know whether a dashboard works with a gateway, compare the first two numbers of their versions; the patch numbers play no part (ADR 0005).

Your gateway	Dashboard	Container image
0.1.x	0.1.x	quay.io/gkrumbach07/openshell-dashboard:0.1 for the newest release of the line, or an exact :0.1.N
0.0.116	the gateway-0.0.116 release	quay.io/gkrumbach07/openshell-dashboard:gateway-0.0.116

gateway-0.0.116 is a one-off build for gateway 0.0.116 only. It sits outside the version numbering, and no further release is planned for it.

This branch is built on:

Supported gateways	0.1.x
Tested on	0.1.3
OpenShell Go SDK	v0.0.0-20261009050449-e1f3c82caa3e

docs/compatibility.md says what the dashboard shows when the gateway is on another line, and how the claim is tested.

Documentation

• Install: the full guide, with Keycloak, OpenShift and troubleshooting
• Authentication: how sign-in works and what the identity provider must issue
• Configuration: BFF flags and environment variables, feature flags, TLS
• Compatibility: gateway release lines and the compatibility notice
• Development: running it locally, tests, the layout of the code
• Architecture: components, principles, roles
• Releasing: how a release is cut and numbered
• Decision records
• Helm chart: every chart value

Development

You need Go 1.26.7 or newer, Node 22, Docker with Compose, jq, openssl and curl.

make setup     # install the frontend and Go dependencies
make gateway   # the OpenShell gateway this branch pins, in Docker
make dev       # the UI on http://localhost:3000 and the BFF on port 8080, without sign-in
make test      # frontend unit tests and Go tests

make dev-full runs it behind sign-in. docs/development.md has the steps in order, the other targets and the layout of the code.

Contributing

See CONTRIBUTING.md.

Security

To report a vulnerability, see SECURITY.md.

License

Apache License 2.0.