| type | Index |
|---|---|
| title | OGO Documentation |
| description | OpenShell Gateway Operator - deploy and manage OpenShell on OpenShift. |
Alpha software. OGO and NVIDIA OpenShell are both in active development. APIs, CRDs, and behavior may change without notice. This project is not intended for production use.
OGO is an OpenShift operator that deploys and manages NVIDIA OpenShell gateway instances. It handles TLS, authentication, ingress, and sandbox lifecycle so you can run AI coding agents in isolated sandboxes on any OpenShift cluster — cloud, on-prem, or local.
AI coding agents run arbitrary code in sandboxes - that's an inherently adversarial workload. OpenShift provides the security stack that makes this safe:
- Security Context Constraints (SCC) - enforce non-root execution, drop dangerous capabilities, and apply seccomp profiles on sandbox pods
- SELinux - mandatory access control that agent code cannot bypass, even with container escapes
- OVN-Kubernetes network policy - kernel-level egress enforcement for sandbox network policies, not bypassable from userspace
- Integrated OAuth - user identity tied to your organization's SSO, not self-managed tokens
- cert-manager operator - managed TLS lifecycle with Let's Encrypt
- Audit logging - full audit trail of sandbox API activity
- Operator Lifecycle Manager - managed operator installs with console integration
See Why OpenShift for details.
Core building blocks of an OGO deployment.
- Gateway - the central gRPC server that manages sandboxes
- Sandbox - isolated compute pods where agents run
- Authentication - how users and sandboxes authenticate
- Provider - API credentials injected into sandboxes
- Policy - network, filesystem, and process controls for sandboxes
Step-by-step walkthroughs.
- Quickstart - deploy OGO on OpenShift in 10 minutes
- Envoy Gateway - gRPC ingress with Let's Encrypt TLS
- OpenShift SSO - "Log in with OpenShift" for the CLI
- DevSpaces - create sandboxes from DevSpaces workspaces
CRD specifications and field-level documentation.
- OpenShellGateway - gateway CRD reference
- OpenShellProvider - provider CRD reference
- OpenShellPolicy - policy CRD reference
Ready-to-use configurations.
- Claude Code + Anthropic - direct Anthropic API access
- Claude Code + Vertex AI - Google Vertex AI inference
- Developer Policy - GitHub, PyPI, npm access
make build # Build the binary
make test # Run unit and integration tests
make manifests # Regenerate CRDs and RBAC
make generate # Regenerate deepcopy functionsSee CONTRIBUTING.md for development setup and guidelines.
Copyright 2026. Licensed under the Apache License, Version 2.0.