feat(controller): bind sandbox namespaces to workspace and instance ownership - #548
Draft
Pal Lakatos-Toth (pallakatos) wants to merge 4 commits into
Draft
feat(controller): bind sandbox namespaces to workspace and instance ownership#548Pal Lakatos-Toth (pallakatos) wants to merge 4 commits into
Pal Lakatos-Toth (pallakatos) wants to merge 4 commits into
Conversation
Add atomic namespace claims, conservative legacy adoption, preconditioned cleanup, and workspace-aware guards for approval cleanup and router token reads. Preserve pre-CR credential staging through explicit namespace reservations, and preflight both upgrade paths before changing controllers. Validation: 107 focused CLI/Helm tests, TypeScript typecheck, changed-file lint, and Rust formatting pass. The 26 focused Rust tests await the coordinated shared Cargo slot; no Rust build or target directory was created. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
Keep the prestage fixture initializer compliant with strict Clippy. Qualified the actual namespace adoption, preservation, collision, UID recreation, CAS retry, and cleanup cases: all 107 affected controller tests pass, including 26 namespace ownership tests. Controller all-targets Clippy passes with warnings denied, using only the shared Cargo target and CARGO_INCREMENTAL=0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
…dentials Complete the dev/SRE namespace producer migration, retain legacy Helm resources, preserve cancellation during claim binding, and fence existing handoff credential writes by the created sandbox and Secret identities. Keep genuine audit sign-offs and final independent closure pending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: eb3654cd-f1e0-445a-8734-430800af1903
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| })) | ||
| } | ||
|
|
||
| fn metadata_response(object: &Value) -> ResponseTemplate { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Publication stack
Follows #543 -> #544 -> #545 -> #547. This draft targets the inference branch so the diff contains only namespace ownership and its directly coupled creation/cleanup paths. Do not merge into the intermediate feature branch. After its parent lands, retarget to the protected
kars-bridgeintegration branch and require fresh exact-head CI and independent approval. Main promotion remains a separate final gate.Scope
kars namespace preflightand explicit reviewed-UID administrator adoption for ambiguous cases.kars addand local-Kuberneteskars devcredential prestaging through a two-way reservation. Fresh SRE installs let the controller claim the namespace before creating the writer account; real Helm upgrades retain exact-release legacy resources.This is a safety prerequisite, not generic credential sources, durable aggregate budgets, complete Team execution, or Bridge publication. Kars still has no dependency on Bridge. No live cluster migration, customer deployment, image publication, release or main merge is performed by this PR.
Compatibility and migration
Read
docs/how-to/namespace-ownership.mdbefore controller replacement. Proven legacy namespaces keep their UID, data and pod templates. Same-second/ambiguous ownership requires an explicit administrator decision; conflicts leave running resources untouched rather than silently adopting them. Old unfinished pre-CR reservations require separate inventory. Direct Helm/GitOps upgrades must run preflight; client-only rendering cannot infer previous Helm ownership, so pruning workflows must preserve migrated legacy runtime namespaces. Rolling back to an older controller removes claim-v1 enforcement.Evidence and open gates
Candidate:
62093414cb8d5d9937c1d9974504047c84669d6c, based on inference head45cfa009.security-audit-required: zero genuine Signed-off-by entries are present and two are required (author plus independent reviewer).62093414, including handoff credential fencing and reservation cancellation; no significant regressions were found in those bounded paths. This was source-level review and regression inspection, not independent execution, live-cluster qualification or human approval. Genuine review/sign-offs and the full CI gates remain required.docs/security-audits/2026-09-07-sandbox-namespace-ownership.md. Genuine author and independent reviewer sign-offs are pending. The audit gate must remain blocked until those sign-offs exist; no identity or approval is fabricated.Keep this PR draft until its remaining review and CI gates are satisfied.