Method resolve_sandbox_identity

crates/openshell-driver-kubernetes/src/driver.rs:345–406

Resolve sandbox UID/GID from config or `OpenShift` SCC namespace annotations. Returns `(uid, gid, ns_annotations_map)`: - If `sandbox_uid` is set in config, returns that (with fallback GID) - Otherwise fetches the target namespace and checks for `openshift.io/sa.scc.uid-range` / `openshift.io/sa.scc.supplemental-groups` annotations. - If neither config nor `OpenShift` is found, returns `(1000, 10

(&self)

    ///   annotations.
    /// - If neither config nor `OpenShift` is found, returns `(1000, 1000, {})` as defaults.
    async fn resolve_sandbox_identity(&self) -> (u32, u32, BTreeMap<String, String>) {
        // Explicit config takes priority — skip namespace lookup entirely.
        if self.config.sandbox_uid.is_some() {
            let uid = self.config.resolve_sandbox_uid(None);
            let gid = self.config.resolve_sandbox_gid(uid, None);
            return (uid, gid, BTreeMap::new());
        }

        // Try to read namespace annotations for OpenShift SCC.
        // Namespace is namespaced so Api::all works (it's cluster-scoped but
        // can list all namespaces) and we filter by name, or use Api::namespaced.
        let ns_api: Api<Namespace> = Api::all(self.client.clone());
        match tokio::time::timeout(KUBE_API_TIMEOUT, ns_api.get(self.config.namespace.as_str()))
            .await
        {
            Ok(Ok(ns)) => {
                let anns = ns.metadata.annotations.unwrap_or_default();
                tracing::info!(
                    namespace = %self.config.namespace,
                    uid_range = ?anns.get(crate::config::ANNOTATION_SCC_UID_RANGE),
                    sup_groups = ?anns.get(crate::config::ANNOTATION_SCC_SUPPLEMENTAL_GROUPS),
                    "Resolved namespace annotations for sandbox identity"
                );
                let uid = self.config.resolve_sandbox_uid(Some(&anns));
                // Explicit sandbox_gid config wins; SCC annotation only applies when not set.
                let baseline_gid = self.config.resolve_sandbox_gid(uid, None);
                let gid = self.config.sandbox_gid.map_or_else(
                    || {
                        anns.get(crate::config::ANNOTATION_SCC_SUPPLEMENTAL_GROUPS)
                            .and_then(|sup_range| {
                                KubernetesComputeConfig::from_open_shift_supplemental_groups(
                                    sup_range,
                                )
                            })
                            .unwrap_or(baseline_gid)
                    },
                    |_| baseline_gid,
                );
                tracing::info!(uid, gid, "Resolved sandbox identity");
                (uid, gid, anns)
            }
            Ok(Err(e)) => {
                tracing::warn!(
                    namespace = %self.config.namespace,
                    error = %e,
                    "Failed to fetch namespace for SCC annotations, falling back to defaults"
                );
                let uid = DEFAULT_SANDBOX_UID;
                let gid = self.config.resolve_sandbox_gid(uid, None);
                (uid, gid, BTreeMap::new())
            }
            Err(_) => {
                tracing::warn!(
                    namespace = %self.config.namespace,
                    "Namespace fetch timed out, falling back to defaults"
                );
                let uid = DEFAULT_SANDBOX_UID;
                let gid = self.config.resolve_sandbox_gid(uid, None);