refactor(kubernetes): use sandbox backend protocol

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Cargo.lock

@@ -4146,6 +4146,7 @@ dependencies = [
  "openshell-otel",
  "openshell-otel-test-support",
  "openshell-policy",
+ "openshell-sandbox-backend",
  "opentelemetry",
  "opentelemetry_sdk",
  "prost",

crates/openshell-driver-kubernetes/Cargo.toml

@@ -17,6 +17,7 @@ path = "src/main.rs"
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false }
 openshell-isolation-interface = { path = "../openshell-isolation-interface" }
+openshell-sandbox-backend = { path = "../openshell-sandbox-backend" }
 openshell-otel = { path = "../openshell-otel" }
 openshell-policy = { path = "../openshell-policy" }
 

crates/openshell-driver-kubernetes/src/driver.rs

@@ -59,11 +59,11 @@ use openshell_core::proto::compute::v1::{
     WatchSandboxesSandboxEvent, watch_sandboxes_event,
 };
 use openshell_core::proto_struct::{struct_to_json_object, value_to_json};
-use openshell_isolation_interface::boundary_protocol::{
+use openshell_isolation_interface::contract::ResolvedWorkloadIdentity;
+use openshell_sandbox_backend::boundary_protocol::{
     GatewayVerificationKey, SandboxTlsClientConfig, SandboxTlsServerConfig,
     generate_sandbox_tls_material,
 };
-use openshell_isolation_interface::contract::ResolvedWorkloadIdentity;
 use rand::RngCore as _;
 use serde::Deserialize;
 use std::collections::{BTreeMap, HashSet};

crates/openshell-driver-kubernetes/src/isolation.rs

@@ -20,11 +20,11 @@ use k8s_openapi::api::networking::v1::{
 use k8s_openapi::apimachinery::pkg::apis::meta::v1::LabelSelector;
 use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
 use kube::core::ObjectMeta;
-use openshell_isolation_interface::boundary_protocol::{
+use openshell_isolation_interface::contract::{DriverFenceEvidence, ResolvedWorkloadIdentity};
+use openshell_sandbox_backend::boundary_protocol::{
     BoundaryConfig, BoundaryListener, BoundaryTopology, GatewayVerificationKey,
     SandboxTlsClientConfig, SandboxTlsServerConfig, SandboxTransport,
 };
-use openshell_isolation_interface::contract::{DriverFenceEvidence, ResolvedWorkloadIdentity};
 
 /// Registered RFC 0012 backend name for the proxy-pod topology.
 pub const BACKEND_NAME: &str = "kubernetes-proxy-pod";