From c27dc639a5857314bbd0ab3fb5f687ed681bf8d9 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Fri, 7 Aug 2026 09:58:18 -0700 Subject: [PATCH] fix(dev): inherit non-expiring sandbox JWT in local gateway scripts The local gateway launcher scripts hardcode gateway_jwt.ttl_secs = 3600, which overrides the non-expiring default introduced in #1721. Local Docker, Podman, and VM sandboxes are still unrecoverable when the gateway is down longer than that TTL: the on-disk token expires and only the Kubernetes ServiceAccount path can rebootstrap, so the supervisor crash-loops on policy fetch and the sandbox never leaves Provisioning. Drop the override so local drivers inherit the default. gateway.sh also serves the kubernetes driver, which is a shared deployment and must keep a positive TTL, so it now emits ttl_secs only for that driver. The e2e regression test added in #1721 does not catch this because the e2e harness uses its own configs, which already set ttl_secs = 0. Signed-off-by: Piotr Mlocek --- tasks/scripts/gateway-docker.sh | 1 - tasks/scripts/gateway-vm.sh | 1 - tasks/scripts/gateway.sh | 8 +++++++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/tasks/scripts/gateway-docker.sh b/tasks/scripts/gateway-docker.sh index 895d5a62fc..d7fd0d0332 100644 --- a/tasks/scripts/gateway-docker.sh +++ b/tasks/scripts/gateway-docker.sh @@ -183,7 +183,6 @@ signing_key_path = "${TLS_DIR}/jwt/signing.pem" public_key_path = "${TLS_DIR}/jwt/public.pem" kid_path = "${TLS_DIR}/jwt/kid" gateway_id = "${GATEWAY_NAME}" -ttl_secs = 3600 [openshell.drivers.docker] default_image = "${SANDBOX_IMAGE}" diff --git a/tasks/scripts/gateway-vm.sh b/tasks/scripts/gateway-vm.sh index 22ba1b039f..4bc6b78f41 100755 --- a/tasks/scripts/gateway-vm.sh +++ b/tasks/scripts/gateway-vm.sh @@ -335,7 +335,6 @@ signing_key_path = "${TLS_DIR}/jwt/signing.pem" public_key_path = "${TLS_DIR}/jwt/public.pem" kid_path = "${TLS_DIR}/jwt/kid" gateway_id = "${GATEWAY_NAME}" -ttl_secs = 3600 [openshell.drivers.vm] default_image = "${SANDBOX_IMAGE}" diff --git a/tasks/scripts/gateway.sh b/tasks/scripts/gateway.sh index 5d3adae2a8..4a9357232c 100644 --- a/tasks/scripts/gateway.sh +++ b/tasks/scripts/gateway.sh @@ -356,9 +356,15 @@ signing_key_path = "${TLS_DIR}/jwt/signing.pem" public_key_path = "${TLS_DIR}/jwt/public.pem" kid_path = "${TLS_DIR}/jwt/kid" gateway_id = "${GATEWAY_NAME}" -ttl_secs = 3600 EOF +# Kubernetes is a shared deployment, so its sandbox JWTs must expire. Local +# drivers omit ttl_secs and inherit the gateway's non-expiring default, so a +# sandbox restarted while the gateway is down can still reconnect. +if [[ "${DRIVER}" == "kubernetes" ]]; then + printf 'ttl_secs = 3600\n' >>"${CONFIG_PATH}" +fi + case "${DRIVER}" in kubernetes) cat >>"${CONFIG_PATH}" <