From aef9f88844b427b6a8319a447aa82bd5388ee798 Mon Sep 17 00:00:00 2001
From: Nick Parker <nick@nickbp.com>
Date: Tue, 21 Jul 2026 23:12:00 +1200
Subject: [PATCH] feat(helm): Support disabling telemetry

---
 deploy/helm/openshell/README.md                       | 1 +
 deploy/helm/openshell/templates/_gateway-workload.tpl | 4 ++++
 deploy/helm/openshell/values.yaml                     | 3 +++
 3 files changed, 8 insertions(+)

diff --git a/deploy/helm/openshell/README.md b/deploy/helm/openshell/README.md
index 8723535d1a..26008e25df 100644
--- a/deploy/helm/openshell/README.md
+++ b/deploy/helm/openshell/README.md
@@ -148,6 +148,7 @@ add `ci/values-spire.yaml` to the OpenShell release values files.
 | certManager.enabled | bool | `false` | Create cert-manager Issuer and Certificate resources. When enabled, cert-manager owns TLS and the chart runs a JWT-only certgen hook to create the sandbox JWT signing Secret that cert-manager does not manage. |
 | certManager.serverDnsNames | list | `["openshell","openshell.openshell.svc","openshell.openshell.svc.cluster.local","localhost","openshell.localhost","*.openshell.localhost","host.docker.internal"]` | DNS SANs on the cert-manager-issued server certificate. |
 | certManager.serverIpAddresses | list | `["127.0.0.1"]` | IP SANs on the cert-manager-issued server certificate. |
+| enableTelemetry | bool | `true` | Whether to enable telemetry in gateway and sandbox pods. |
 | fullnameOverride | string | `""` | Override the full generated resource name. |
 | grpcRoute.enabled | bool | `false` | Create a Gateway API GRPCRoute for the gateway service. |
 | grpcRoute.gateway.className | string | `"eg"` | GatewayClass to reference. Envoy Gateway installs one named "eg". |
diff --git a/deploy/helm/openshell/templates/_gateway-workload.tpl b/deploy/helm/openshell/templates/_gateway-workload.tpl
index 5931047e5f..bfa9734782 100644
--- a/deploy/helm/openshell/templates/_gateway-workload.tpl
+++ b/deploy/helm/openshell/templates/_gateway-workload.tpl
@@ -57,6 +57,10 @@ spec:
               name: {{ .Values.server.externalDbSecret }}
               key: uri
         {{- end }}
+        {{- if not .Values.enableTelemetry }}
+        - name: OPENSHELL_TELEMETRY_ENABLED
+          value: "false"
+        {{- end }}
         # All gateway settings live in the ConfigMap-backed TOML file
         # mounted at /etc/openshell/gateway.toml. The only env var below
         # is a process-level setting consumed by libraries outside
diff --git a/deploy/helm/openshell/values.yaml b/deploy/helm/openshell/values.yaml
index e89a234912..16ab379450 100644
--- a/deploy/helm/openshell/values.yaml
+++ b/deploy/helm/openshell/values.yaml
@@ -160,6 +160,9 @@ tolerations: []
 # -- Affinity rules for the gateway pod.
 affinity: {}
 
+# -- Whether to enable telemetry in gateway and sandbox pods.
+enableTelemetry: true
+
 # Server configuration
 server:
   # -- Gateway log level.