refactor(kubernetes): drop the experimental prefix from the supervisor topology

Rename the Helm template to supervisor.yaml, its Kubernetes names and
labels to the -supervisor suffix and supervisor component, and the
driver setting to supervisor_topology. The setting remains opt-in and
workspace remains reserved.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.agents/skills/helm-dev-environment/SKILL.md

@@ -57,15 +57,15 @@ Override with env vars before running `helm:k3s:create`:
   `mcr.microsoft.com/dotnet/aspire-dashboard:latest`)
 - `HELM_K3S_COLLECTOR_HEALTH_TIMEOUT` (default: `120` seconds)
 
-### Experimental supervisor plumbing
+### Shared supervisor plumbing
 
-Set `gatewayConfig.openshell.drivers.kubernetes.experimental_supervisor_topology`
+Set `gatewayConfig.openshell.drivers.kubernetes.supervisor_topology`
 using a values file (the table key is literally `openshell.drivers.kubernetes`):
 
 ```yaml
 gatewayConfig:
   openshell.drivers.kubernetes:
-    experimental_supervisor_topology: gateway
+    supervisor_topology: gateway
 ```
 
 The gateway chart creates a separate, single-replica shared-host placeholder Deployment

crates/openshell-driver-kubernetes/src/config.rs

@@ -194,20 +194,20 @@ where
     Ok(value)
 }
 
-/// Experimental scope of a shared supervisor deployment.
+/// Scope of a shared supervisor deployment.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
-pub enum ExperimentalSupervisorTopology {
+pub enum SupervisorTopology {
     Gateway,
     Workspace,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(default, deny_unknown_fields)]
 pub struct KubernetesComputeConfig {
-    /// Deploy an idle experimental supervisor through Helm. Does not route sessions.
+    /// Deploy an idle shared supervisor through Helm. Does not route sessions.
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub experimental_supervisor_topology: Option<ExperimentalSupervisorTopology>,
+    pub supervisor_topology: Option<SupervisorTopology>,
     /// Permit caller-supplied driver JSON. Does not waive resource admission.
     pub allow_driver_config: bool,
     /// Operator-owned external attachment approval policy.
@@ -400,7 +400,7 @@ pub const ANNOTATION_SCC_SUPPLEMENTAL_GROUPS: &str = "openshift.io/sa.scc.supple
 impl Default for KubernetesComputeConfig {
     fn default() -> Self {
         Self {
-            experimental_supervisor_topology: None,
+            supervisor_topology: None,
             workspace_mode: WorkspaceMode::default(),
             allow_driver_config: false,
             resource_admission:
@@ -454,9 +454,8 @@ impl Default for KubernetesComputeConfig {
 impl KubernetesComputeConfig {
     /// Validate startup configuration without connecting to Kubernetes.
     pub fn validate_configuration(&self) -> Result<(), String> {
-        if self.experimental_supervisor_topology == Some(ExperimentalSupervisorTopology::Workspace)
-        {
-            return Err("experimental_supervisor_topology=workspace is not implemented".into());
+        if self.supervisor_topology == Some(SupervisorTopology::Workspace) {
+            return Err("supervisor_topology=workspace is not implemented".into());
         }
         self.validate_workspace_mode()?;
         self.validate_provider_spiffe_workload_api_socket_path()?;

crates/openshell-driver-kubernetes/src/lib.rs

@@ -12,9 +12,9 @@ mod sandbox_runtime;
 
 pub use config::{
     DEFAULT_GATEWAY_ID, DEFAULT_SANDBOX_SERVICE_ACCOUNT_NAME, DEFAULT_WORKSPACE_STORAGE_SIZE,
-    ExperimentalSupervisorTopology, KubernetesComputeConfig, KubernetesControlConnection,
-    KubernetesImagePullPolicy, KubernetesSandboxRuntimeConfig, ManagedSshIngressConfig,
-    WorkspaceMode, managed_namespace_prefix,
+    KubernetesComputeConfig, KubernetesControlConnection, KubernetesImagePullPolicy,
+    KubernetesSandboxRuntimeConfig, ManagedSshIngressConfig, SupervisorTopology, WorkspaceMode,
+    managed_namespace_prefix,
 };
 pub use driver::{KubernetesComputeDriver, KubernetesDriverError};
 pub use grpc::ComputeDriverService;

crates/openshell-driver-kubernetes/src/main.rs

@@ -260,7 +260,7 @@ async fn main() -> Result<()> {
     let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
     let driver = KubernetesComputeDriver::new(
         KubernetesComputeConfig {
-            experimental_supervisor_topology: None,
+            supervisor_topology: None,
             allow_driver_config: args.admission_config_json.allow_driver_config,
             resource_admission: args.admission_config_json.resource_admission.clone(),
             workspace_mode: args.workspace_mode,

crates/openshell-supervisor/README.md

@@ -61,15 +61,15 @@ belong to the sandbox or isolation backend. Signals use `BoundarySignal`.
 These portable control-plane foundations do not qualify a platform isolation
 backend or enable a Windows workload runtime.
 
-## Experimental shared host
+## Shared host
 
 `openshell-supervisor --mode=shared --gateway-endpoint https://gateway:8080 --address 0.0.0.0:5501`
-starts a shared-host placeholder for the Kubernetes gateway topology experiment.
+starts a shared-host placeholder for the Kubernetes gateway supervisor topology.
 The listener at `--address` accepts and closes connections, including kubelet
 `tcpSocket` probes, and reports process health only. `--gateway-endpoint` selects
 the gateway the supervisor will dial for session control. The outbound connection,
 control RPCs, sandbox sessions, gateway authentication, and tenant routing are not
 implemented yet. Omitting `--mode` keeps the existing dedicated behavior.
-`experimental_supervisor_topology = "gateway"` deploys this placeholder; sandboxes
+`supervisor_topology = "gateway"` deploys this placeholder; sandboxes
 continue using dedicated supervisors. SIGTERM and SIGINT close the listener.
 Shared mode is Unix-only.

deploy/helm/openshell/templates/_helpers.tpl

@@ -569,17 +569,17 @@ Validate chart values that Helm would otherwise accept silently.
 */}}
 {{- define "openshell.validateValues" -}}
 {{- $kubernetes := include "openshell.effectiveKubernetesConfig" . | fromYaml -}}
-{{- if hasKey $kubernetes "experimental_supervisor_topology" -}}
-{{- $topology := get $kubernetes "experimental_supervisor_topology" -}}
+{{- if hasKey $kubernetes "supervisor_topology" -}}
+{{- $topology := get $kubernetes "supervisor_topology" -}}
 {{- if not (has $topology (list "gateway" "workspace")) -}}
-{{- fail "experimental_supervisor_topology must be gateway or workspace; omit it to disable the experiment" -}}
+{{- fail "supervisor_topology must be gateway or workspace; omit it to disable the shared supervisor" -}}
 {{- end -}}
 {{- if eq $topology "workspace" -}}
-{{- fail "experimental_supervisor_topology=workspace is not implemented" -}}
+{{- fail "supervisor_topology=workspace is not implemented" -}}
 {{- end -}}
 {{- $gateway := get (.Values.gatewayConfig | default dict) "openshell.gateway" | default dict -}}
 {{- if ne (get $gateway "compute_driver" | default "kubernetes") "kubernetes" -}}
-{{- fail "experimental_supervisor_topology requires the kubernetes compute driver" -}}
+{{- fail "supervisor_topology requires the kubernetes compute driver" -}}
 {{- end -}}
 {{- end -}}
 {{- $workloadKind := include "openshell.workloadKind" . -}}

…l/templates/experimental-supervisor.yaml …helm/openshell/templates/supervisor.yamldeploy/helm/openshell/templates/experimental-supervisor.yaml renamed to deploy/helm/openshell/templates/supervisor.yaml deploy/helm/openshell/templates/experimental-supervisor.yaml renamed to deploy/helm/openshell/templates/supervisor.yaml

@@ -4,32 +4,32 @@
 {{- range .Values.imagePullSecrets -}}
 {{- $imagePullSecrets = append $imagePullSecrets .name -}}
 {{- end -}}
-{{- if eq (get $kubernetes "experimental_supervisor_topology" | default "") "gateway" }}
+{{- if eq (get $kubernetes "supervisor_topology" | default "") "gateway" }}
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "openshell.fullname" . }}-experimental-supervisor
+  name: {{ include "openshell.fullname" . }}-supervisor
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "openshell.labels" . | nindent 4 }}
-    app.kubernetes.io/component: experimental-supervisor
+    app.kubernetes.io/component: supervisor
 spec:
   replicas: 1
   strategy:
     type: Recreate
   selector:
     matchLabels:
-      app.kubernetes.io/name: openshell-experimental-supervisor
+      app.kubernetes.io/name: openshell-supervisor
       app.kubernetes.io/instance: {{ .Release.Name }}
-      app.kubernetes.io/component: experimental-supervisor
+      app.kubernetes.io/component: supervisor
   template:
     metadata:
       labels:
-        app.kubernetes.io/name: openshell-experimental-supervisor
+        app.kubernetes.io/name: openshell-supervisor
         app.kubernetes.io/instance: {{ .Release.Name }}
-        app.kubernetes.io/component: experimental-supervisor
+        app.kubernetes.io/component: supervisor
     spec:
       automountServiceAccountToken: false
       terminationGracePeriodSeconds: 30

…/tests/experimental_supervisor_test.yaml …elm/openshell/tests/supervisor_test.yamldeploy/helm/openshell/tests/experimental_supervisor_test.yaml renamed to deploy/helm/openshell/tests/supervisor_test.yaml deploy/helm/openshell/tests/experimental_supervisor_test.yaml renamed to deploy/helm/openshell/tests/supervisor_test.yaml

@@ -1,25 +1,25 @@
 # SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
-suite: experimental supervisor deployment
+suite: supervisor deployment
 templates:
-  - templates/experimental-supervisor.yaml
+  - templates/supervisor.yaml
   - templates/gateway-config.yaml
 release:
   name: openshell
   namespace: gateway
 tests:
   - it: adds no supervisor by default
-    template: templates/experimental-supervisor.yaml
+    template: templates/supervisor.yaml
     asserts:
       - hasDocuments:
           count: 0
   - it: deploys one isolated idle process in the gateway namespace
-    template: templates/experimental-supervisor.yaml
+    template: templates/supervisor.yaml
     set:
       gatewayConfig:
         openshell.drivers.kubernetes:
-          experimental_supervisor_topology: gateway
-          supervisor_image: example.com/supervisor:experiment
+          supervisor_topology: gateway
+          supervisor_image: example.com/supervisor:shared
     asserts:
       - equal:
           path: metadata.namespace
@@ -29,10 +29,10 @@ tests:
           value: 1
       - equal:
           path: spec.template.metadata.labels["app.kubernetes.io/name"]
-          value: openshell-experimental-supervisor
+          value: openshell-supervisor
       - equal:
           path: spec.template.spec.containers[0].image
-          value: example.com/supervisor:experiment
+          value: example.com/supervisor:shared
       - equal:
           path: spec.template.spec.containers[0].args
           value:
@@ -69,37 +69,37 @@ tests:
     set:
       gatewayConfig:
         openshell.drivers.kubernetes:
-          experimental_supervisor_topology: gateway
+          supervisor_topology: gateway
     asserts:
       - matchRegex:
           path: data["gateway.toml"]
-          pattern: 'experimental_supervisor_topology = "gateway"'
+          pattern: 'supervisor_topology = "gateway"'
   - it: rejects workspace until implemented
-    template: templates/experimental-supervisor.yaml
+    template: templates/supervisor.yaml
     set:
       gatewayConfig:
         openshell.drivers.kubernetes:
-          experimental_supervisor_topology: workspace
+          supervisor_topology: workspace
     asserts:
       - failedTemplate:
-          errorMessage: experimental_supervisor_topology=workspace is not implemented
+          errorMessage: supervisor_topology=workspace is not implemented
   - it: rejects invalid topology
-    template: templates/experimental-supervisor.yaml
+    template: templates/supervisor.yaml
     set:
       gatewayConfig:
         openshell.drivers.kubernetes:
-          experimental_supervisor_topology: invalid
+          supervisor_topology: invalid
     asserts:
       - failedTemplate:
-          errorMessage: experimental_supervisor_topology must be gateway or workspace; omit it to disable the experiment
+          errorMessage: supervisor_topology must be gateway or workspace; omit it to disable the shared supervisor
   - it: rejects enabled topology for another compute driver
-    template: templates/experimental-supervisor.yaml
+    template: templates/supervisor.yaml
     set:
       gatewayConfig:
         openshell.gateway:
           compute_driver: docker
         openshell.drivers.kubernetes:
-          experimental_supervisor_topology: gateway
+          supervisor_topology: gateway
     asserts:
       - failedTemplate:
-          errorMessage: experimental_supervisor_topology requires the kubernetes compute driver
+          errorMessage: supervisor_topology requires the kubernetes compute driver