Function sandbox_owner_reference

crates/openshell-server/src/auth/k8s_sa.rs:409–454

(pod: &Pod)

#[allow(clippy::result_large_err)]
fn sandbox_owner_reference(pod: &Pod) -> Result<SandboxOwnerReference, Status> {
    let owner_refs = pod.metadata.owner_references.as_deref().unwrap_or_default();
    let mut sandbox_refs = owner_refs
        .iter()
        .filter(|owner| is_supported_sandbox_owner_reference(owner));
    let Some(owner) = sandbox_refs.next() else {
        let unsupported_sandbox_api_versions = owner_refs
            .iter()
            .filter(|owner| owner.kind == SANDBOX_KIND)
            .map(|owner| owner.api_version.as_str())
            .collect::<Vec<_>>();
        if !unsupported_sandbox_api_versions.is_empty() {
            warn!(
                api_versions = ?unsupported_sandbox_api_versions,
                supported_api_versions = ?[
                    SANDBOX_API_VERSION_FULL_V1BETA1,
                    SANDBOX_API_VERSION_FULL_V1ALPHA1,
                ],
                "pod Sandbox ownerReference uses unsupported apiVersion"
            );
        }
        return Err(Status::permission_denied(
            "pod is not controlled by an OpenShell Sandbox",
        ));
    };
    if sandbox_refs.next().is_some() {
        return Err(Status::permission_denied(
            "pod has multiple OpenShell Sandbox owners",
        ));
    }
    if owner.controller != Some(true) {
        return Err(Status::permission_denied(
            "pod Sandbox ownerReference is not controlling",
        ));
    }
    if owner.name.is_empty() || owner.uid.is_empty() {
        return Err(Status::permission_denied(
            "pod Sandbox ownerReference is incomplete",
        ));
    }
    Ok(SandboxOwnerReference {
        api_version: owner.api_version.clone(),
        name: owner.name.clone(),
        uid: owner.uid.clone(),
    })
}

fn is_supported_sandbox_owner_reference(
    owner: &k8s_openapi::apimachinery::pkg::apis::meta::v1::OwnerReference,