Method create_sandbox

crates/openshell-driver-kubernetes/src/driver.rs:528–645

(&self, sandbox: &Sandbox)

    #[allow(clippy::similar_names)]
    pub async fn create_sandbox(&self, sandbox: &Sandbox) -> Result<(), KubernetesDriverError> {
        let _ = KubernetesSandboxDriverConfig::from_sandbox(sandbox)
            .map_err(KubernetesDriverError::InvalidArgument)?;
        let gpu_requirements = sandbox
            .spec
            .as_ref()
            .and_then(|spec| driver_gpu_requirements(spec.resource_requirements.as_ref()));
        validate_gpu_request(gpu_requirements).map_err(|status| {
            KubernetesDriverError::InvalidArgument(status.message().to_string())
        })?;
        let name = sandbox.name.as_str();
        info!(
            sandbox_id = %sandbox.id,
            sandbox_name = %name,
            namespace = %self.config.namespace,
            "Creating sandbox in Kubernetes"
        );

        let agent_sandbox_api = self
            .supported_agent_sandbox_api(self.client.clone())
            .await
            .map_err(KubernetesDriverError::Message)?;

        // Resolve sandbox UID/GID from config or OpenShift SCC namespace annotations.
        let (resolved_uid, resolved_gid, ns_annotations) = self.resolve_sandbox_identity().await;

        let params = SandboxPodParams {
            default_image: &self.config.default_image,
            image_pull_policy: &self.config.image_pull_policy,
            image_pull_secrets: &self.config.image_pull_secrets,
            supervisor_image: &self.config.supervisor_image,
            supervisor_image_pull_policy: &self.config.supervisor_image_pull_policy,
            supervisor_sideload_method: self.config.supervisor_sideload_method,
            service_account_name: &self.config.service_account_name,
            sandbox_id: &sandbox.id,
            sandbox_name: &sandbox.name,
            grpc_endpoint: &self.config.grpc_endpoint,
            ssh_socket_path: self.ssh_socket_path(),
            client_tls_secret_name: &self.config.client_tls_secret_name,
            host_gateway_ip: &self.config.host_gateway_ip,
            enable_user_namespaces: self.config.enable_user_namespaces,
            app_armor_profile: self.config.app_armor_profile.as_ref(),
            workspace_default_storage_size: &self.config.workspace_default_storage_size,
            default_runtime_class_name: &self.config.default_runtime_class_name,
            sa_token_ttl_secs: self.config.effective_sa_token_ttl_secs(),
            provider_spiffe_enabled: self.config.provider_spiffe_enabled(),
            provider_spiffe_workload_api_socket_path: &self
                .config
                .provider_spiffe_workload_api_socket_path,
            sandbox_uid: resolved_uid,
            sandbox_gid: resolved_gid,
        };

        let mut obj = DynamicObject::new(name, &agent_sandbox_api.resource);
        // Copy only the SCC-related annotations onto the Sandbox CR for
        // traceability. Copying the full namespace annotation map exposes
        // unrelated cluster metadata and can fail with oversized annotations.
        let scc_annotations: BTreeMap<String, String> = [