Icu 18817 backup

[Rkabra7]

Summary

Adds values.openshift.yaml with ready-to-use OpenShift overrides.
Adds an OpenShift Route template to provide TCP passthrough access to the worker proxy port.
Switches the proxy Service to ClusterIP when OpenShift support is enabled, with the Route handling external traffic.
Applies an OpenShift-compatible security context by removing fixed UID/GID settings so SCC can assign values from the namespace range.
Makes PVC storageClass conditional, allowing the cluster default storage class to be used when left unset.
Adds a new openshift: configuration section to values.yaml (disabled by default).
Adds unit tests covering all new OpenShift-specific paths.

Behaviour Changes

recording-storage mount is now always present (all users, not just OpenShift):
Previously, the recording-storage volumeMount was only added when worker.persistence.recording.enabled=true.
It is now always mounted — using a real PVC when recording is enabled, or a non-persistent emptyDir when it is not.
This ensures the worker process always has a writable path at the recording mount point regardless of whether
recording is configured, which prevents startup failures on clusters where the path must exist.

Testing

Tested on OpenShift Local (CRC). The worker successfully authenticated to a self-managed Boundary controller using the OpenShift-specific chart configuration.

• Issue:
• Chart/Component:

Checklist

• I have documented a clear reason for, and description of, the change I am making.

• Added/updated tests or validation steps (if applicable)

• Verified local lint/validation

• No breaking changes, or clearly documented

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[MayukhSobo]

The Route/Service/security-context template logic is solid and well-tested, same as the controller chart PR. A few things worth a look before merge, kept to the important ones only:

[smayukh]

Thanks for the PR! Please review the PR comments.

[hashicorp-cla-app]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

1 out of 2 committers have signed the CLA.

• Rkabra7
• smayukh

_{Have you signed the CLA already but the status is still pending? Recheck it.}