Seth Jennings 32e73bff73 feat(driver-kubernetes): resolve sandbox UID/GID from config or OpenShift SCC annotations ...

Phase 3 of the numeric-UID plan: allow operators to specify explicit
sandbox_uid/sandbox_gid in Kubernetes driver config, auto-detect from
OpenShift SCC namespace annotations, and propagate resolved values to
supervisor container env vars and PVC init container securityContext.

Changes:
- Add sandbox_uid/sandbox_gid fields to KubernetesComputeConfig
- Add SANDBOX_UID/SANDBOX_GID env var constants to openshell-core
- Implement resolve_sandbox_identity() to fetch namespace annotations
  and auto-detect OpenShift SCC UID ranges (sa.scc.uid-range)
- Pass resolved UID/GID through SandboxPodParams to pod spec builder
- Inject SANDBOX_UID/SANDBOX_GID env vars into supervisor container
- Update PVC init container securityContext with resolved UID/GID
  instead of hard-coded root
- Add comprehensive unit tests for resolution logic and annotation
  parsing (resolve_sandbox_uid, resolve_sandbox_gid, OpenShift SCC
  annotation parsing)

Signed-off-by: Seth Jennings <sjenning@redhat.com>

2026-06-29 13:53:01 -07:00

..

src

feat(driver-kubernetes): resolve sandbox UID/GID from config or OpenShift SCC annotations

2026-06-29 13:53:01 -07:00

Cargo.toml

feat(telemetry): add build-time option to compile out telemetry (#1845)

2026-06-09 14:19:26 -07:00