feat(helm): Support disabling telemetry

deploy/helm/openshell/README.md

@@ -148,6 +148,7 @@ add `ci/values-spire.yaml` to the OpenShell release values files.
 | certManager.enabled | bool | `false` | Create cert-manager Issuer and Certificate resources. When enabled, cert-manager owns TLS and the chart runs a JWT-only certgen hook to create the sandbox JWT signing Secret that cert-manager does not manage. |
 | certManager.serverDnsNames | list | `["openshell","openshell.openshell.svc","openshell.openshell.svc.cluster.local","localhost","openshell.localhost","*.openshell.localhost","host.docker.internal"]` | DNS SANs on the cert-manager-issued server certificate. |
 | certManager.serverIpAddresses | list | `["127.0.0.1"]` | IP SANs on the cert-manager-issued server certificate. |
+| enableTelemetry | bool | `true` | Whether to enable telemetry in gateway and sandbox pods. |
 | fullnameOverride | string | `""` | Override the full generated resource name. |
 | grpcRoute.enabled | bool | `false` | Create a Gateway API GRPCRoute for the gateway service. |
 | grpcRoute.gateway.className | string | `"eg"` | GatewayClass to reference. Envoy Gateway installs one named "eg". |

deploy/helm/openshell/templates/_gateway-workload.tpl

@@ -57,6 +57,10 @@ spec:
               name: {{ .Values.server.externalDbSecret }}
               key: uri
         {{- end }}
+        {{- if not .Values.enableTelemetry }}
+        - name: OPENSHELL_TELEMETRY_ENABLED
+          value: "false"
+        {{- end }}
         # All gateway settings live in the ConfigMap-backed TOML file
         # mounted at /etc/openshell/gateway.toml. The only env var below
         # is a process-level setting consumed by libraries outside

deploy/helm/openshell/values.yaml

@@ -160,6 +160,9 @@ tolerations: []
 # -- Affinity rules for the gateway pod.
 affinity: {}
 
+# -- Whether to enable telemetry in gateway and sandbox pods.
+enableTelemetry: true
+
 # Server configuration
 server:
   # -- Gateway log level.