fix(helm): validate gateway listener ports

[guanchzhou]

Summary

Reject invalid gateway listener port values during Helm rendering, before Kubernetes admission or gateway startup.

Related Issue

No issue required: this is localized chart validation for configurations the gateway already cannot run.

Changes

• Reject booleans, fractional numbers, and other malformed port values before integer conversion
• Require the primary and probe-backed health listener ports to be valid TCP ports
• Allow metrics port 0 as disabled and validate enabled metrics ports
• Reject collisions between primary, health, and metrics listeners
• Add focused Helm unit tests for malformed values, invalid ranges, boundaries, and collisions

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable)
• helm unittest deploy/helm/openshell (133 tests)
• helm unittest deploy/helm/openshell-workspace (4 tests)
• Helm lint passes for defaults and all CI values variants
• Direct deployment render rejects malformed listener ports

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[guanchzhou]

I have read the DCO document and I hereby sign the DCO.

[guanchzhou]

recheck

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[guanchzhou]

not stale

[sylvesterkaczmarek]

service.metricsPort: false still slips through this validation. Helm's default treats false as empty, so it becomes 0 before the type check. Could this distinguish a missing value from an explicit boolean and add a false case?

[guanchzhou]

@sylvesterkaczmarek good catch. Helm's default treats false as empty, so the previous fallback turned service.metricsPort: false into 0 before the integer check.

Fixed in d8cd988. The "0" fallback now applies only when the key is absent; an explicit value is stringified as-is, so false stays false and fails the integer validation. Added a service.metricsPort: false unit case. Helm tests and lint pass on this head.

[sylvesterkaczmarek]

Rechecked 93d0317. metricsPort now distinguishes an absent key from an explicit value before string conversion, so false remains "false" and fails the integer check instead of being defaulted to 0. The focused Helm regression covers the exact case I raised. My concern is resolved.

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[guanchzhou]

Not stale.

…

On 4. Oct 2026 at 13.19 +0300, github-actions[bot] ***@***.***>, wrote: github-actions[bot] left a comment (NVIDIA/OpenShell#3179) This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity. — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>