fix(server): apply sandbox labels to the compute resource#2105
Open
Gal-Zaidman wants to merge 1 commit into
Open
fix(server): apply sandbox labels to the compute resource#2105Gal-Zaidman wants to merge 1 commit into
Gal-Zaidman wants to merge 1 commit into
Conversation
Request labels were stored only as sandbox metadata and never reached the pod or container. Propagate them onto the sandbox template so drivers tag the compute resource; explicit template labels win on key conflicts. Reject the driver-managed `openshell.ai/` label namespace and validate the label count in the gateway so the merged template map stays bounded. Signed-off-by: Gal Zaidman <gzaidman@nvidia.com>
Gal-Zaidman
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sandbox labels supplied via
openshell sandbox create --label k=vwere stored only as sandbox metadata and never reached the underlying compute resource. This propagates them onto the sandbox template so drivers apply them to the pod (Kubernetes) or container (Docker), while guarding the driver-managedopenshell.ai/namespace.Related Issue
Closes #2102
Changes
CreateSandboxRequest.labelsontoSandboxTemplate.labelsin the gateway create path, so they flow throughDriverSandboxTemplate.labelsto the driver's native tagging. An explicit template label wins on key conflicts.openshell.ai/label-key namespace (driver-managed: managed-by, sandbox id) so callers cannot collide with or spoof managed labels. Folded intovalidate_label_key, so it applies wherever labels are validated.validate_labels) in the gateway so merging request labels onto the template stays within the template map limit — keeping all label validation in the validation module.openshell.ai/is reserved (docs/sandboxes/manage-sandboxes.mdx).Testing
cargo fmt --checkandcargo clippypass on the touched crateshelm upgraded, created a sandbox with--label verifyfix=v4, and confirmedkubectl get pods -l verifyfix=v4matched the pod; confirmed a reservedopenshell.ai/*key is rejectedChecklist