Required env vars are passed individually for clarity at call sites; grouping into a struct would not improve readability for this internal helper.
(
env: &mut Vec<serde_json::Value>,
sandbox_id: &str,
sandbox_name: &str,
grpc_endpoint: &str,
ssh_socket_path: &str,
tls_enabled: bool,
provider_spiffe_socket_path: Option
| 1997 | // Required env vars are passed individually for clarity at call sites; grouping into a struct |
| 1998 | // would not improve readability for this internal helper. |
| 1999 | fn apply_required_env( |
| 2000 | env: &mut Vec<serde_json::Value>, |
| 2001 | sandbox_id: &str, |
| 2002 | sandbox_name: &str, |
| 2003 | grpc_endpoint: &str, |
| 2004 | ssh_socket_path: &str, |
| 2005 | tls_enabled: bool, |
| 2006 | provider_spiffe_socket_path: Option<&str>, |
| 2007 | ) { |
| 2008 | upsert_env(env, openshell_core::sandbox_env::SANDBOX_ID, sandbox_id); |
| 2009 | upsert_env(env, openshell_core::sandbox_env::SANDBOX, sandbox_name); |
| 2010 | upsert_env(env, openshell_core::sandbox_env::ENDPOINT, grpc_endpoint); |
| 2011 | upsert_env( |
| 2012 | env, |
| 2013 | openshell_core::sandbox_env::SANDBOX_COMMAND, |
| 2014 | "sleep infinity", |
| 2015 | ); |
| 2016 | upsert_env( |
| 2017 | env, |
| 2018 | openshell_core::sandbox_env::TELEMETRY_ENABLED, |
| 2019 | openshell_core::telemetry::enabled_env_value(), |
| 2020 | ); |
| 2021 | if !ssh_socket_path.is_empty() { |
| 2022 | upsert_env( |
| 2023 | env, |
| 2024 | openshell_core::sandbox_env::SSH_SOCKET_PATH, |
| 2025 | ssh_socket_path, |
| 2026 | ); |
| 2027 | } |
| 2028 | // TLS cert paths for sandbox-to-server mTLS. Only set when TLS is enabled |
| 2029 | // and the client TLS secret is mounted into the sandbox pod. |
| 2030 | if tls_enabled { |
| 2031 | upsert_env( |
| 2032 | env, |
| 2033 | openshell_core::sandbox_env::TLS_CA, |
| 2034 | "/etc/openshell-tls/client/ca.crt", |
| 2035 | ); |
| 2036 | upsert_env( |
| 2037 | env, |
| 2038 | openshell_core::sandbox_env::TLS_CERT, |
| 2039 | "/etc/openshell-tls/client/tls.crt", |
| 2040 | ); |
| 2041 | upsert_env( |
| 2042 | env, |
| 2043 | openshell_core::sandbox_env::TLS_KEY, |
| 2044 | "/etc/openshell-tls/client/tls.key", |
| 2045 | ); |
| 2046 | } |
| 2047 | // Projected ServiceAccount token written by kubelet (see the volume |
| 2048 | // definition in `sandbox_template_to_k8s`). The supervisor reads this |
| 2049 | // and exchanges it for a gateway-minted JWT via `IssueSandboxToken`. |
| 2050 | upsert_env( |
| 2051 | env, |
| 2052 | openshell_core::sandbox_env::K8S_SA_TOKEN_FILE, |
| 2053 | "/var/run/secrets/openshell/token", |
| 2054 | ); |
| 2055 | if let Some(socket_path) = provider_spiffe_socket_path { |
| 2056 | upsert_env( |