OGO - OpenShell Gateway Operator

Alpha software. OGO and NVIDIA OpenShell are both in active development. APIs, CRDs, and behavior may change without notice. This project is not intended for production use.

OGO is an OpenShift operator that deploys and manages NVIDIA OpenShell gateway instances. It handles TLS, authentication, ingress, and sandbox lifecycle so you can run AI coding agents in isolated sandboxes on any OpenShift cluster — cloud, on-prem, or local.

Concepts

Core building blocks of an OGO deployment.

Why OpenShift - security and platform features for AI agent workloads
Gateway - the central gRPC server that manages sandboxes
Sandbox - isolated compute pods where agents run
Authentication - how users and sandboxes authenticate
Provider - API credentials injected into sandboxes
Policy - network, filesystem, and process controls for sandboxes

Guides

Step-by-step walkthroughs.

Quickstart - deploy OGO on OpenShift in 10 minutes
Envoy Gateway - gRPC ingress with Let's Encrypt TLS
OpenShift SSO - "Log in with OpenShift" for the CLI
Dev Spaces - create sandboxes from Dev Spaces workspaces

Reference

CRD specifications and field-level documentation.

OpenShellGateway - gateway CRD reference
OpenShellProvider - provider CRD reference
OpenShellPolicy - policy CRD reference

Examples

Ready-to-use configurations.

Claude Code + Anthropic - direct Anthropic API access
Claude Code + Vertex AI - Google Vertex AI inference
Developer Policy - GitHub, PyPI, npm access

Development

make build          # Build the binary
make test           # Run unit and integration tests
make manifests      # Regenerate CRDs and RBAC
make generate       # Regenerate deepcopy functions