mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-17 05:31:16 +08:00
Taylor Mutch
9dee6380cc
Add workload/enforcer supervisor roles and an external-enforcer network mode so Kubernetes sandbox pods can run without privileged netns setup while a privileged node DaemonSet owns coarse pod-netns egress enforcement. Wire the mode through gateway config, Helm values/RBAC, the supervisor image, and Kubernetes driver pod rendering. Add workload registration, node-side nftables installation, docs, and focused tests for the prototype topology.