fix(compute): complete server driver decoupling

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

.agents/skills/debug-openshell-cluster/SKILL.md

@@ -454,8 +454,13 @@ Then inspect sandbox resources in that namespace.
 
 Check the configured sandbox service account when TokenReview bootstrap or
 sandbox registration fails. Helm creates a dedicated sandbox service account by
-default and writes it to `[openshell.drivers.kubernetes].service_account_name`;
-the gateway rejects projected tokens from other service accounts.
+default. The driver receives it in
+`[openshell.drivers.kubernetes].service_account_name`, while the independent
+gateway authenticator receives it in
+`[openshell.gateway.sandbox_token_bootstrap].service_account_name`; the gateway
+rejects projected tokens from other service accounts. Confirm the bootstrap
+table also contains exactly one of `namespace`, `namespace_prefix`,
+`namespace_label`, or `namespace_file`.
 
 ```bash
 helm -n openshell get values openshell | grep -A3 sandboxServiceAccount

architecture/compute-runtimes.md

@@ -455,15 +455,22 @@ watcher emits only sandbox CR changes, not platform events.
 
 ### SA Token Authentication
 
-The gateway's `K8sServiceAccountAuthenticator` adapts its `NamespaceValidator`
-per mode (`crates/openshell-server/src/auth/k8s_sa.rs`):
+The gateway owns ServiceAccount bootstrap under
+`[openshell.gateway.sandbox_token_bootstrap]`, independently of compute-driver
+selection. The Helm chart maps its workspace mode into the corresponding
+`NamespaceValidator` (`crates/openshell-server/src/auth/k8s_sa.rs`):
 
 - **Shared:** `Exact` — accepts only the single configured namespace.
 - **Managed:** `Prefix` — accepts any namespace starting with `openshell-{gateway_id}-`.
 - **Operator:** `Allowlist` — accepts namespaces present in the dynamic
   `BTreeSet` populated by the label/file watchers. Starts empty (fail-closed)
   until the first watcher update.
 
+The compiled Kubernetes registration derives the same policy from legacy
+driver configuration for compatibility. Operator-managed external drivers use
+the gateway-owned table directly; unrelated external drivers do not acquire a
+Kubernetes bootstrap requirement merely because the gateway runs in-cluster.
+
 These checks rely on an ownership invariant. In shared and managed modes, the
 gateway and its trusted Agent Sandbox controller exclusively administer the
 sandbox namespace, Sandbox CRs, sandbox pods, and configured sandbox

crates/openshell-driver-kubernetes/src/driver.rs

@@ -3506,9 +3506,14 @@ fn sandbox_template_to_k8s_with_validated_config(
     }
     apply_pod_driver_config(&mut spec, &driver_config.pod);
 
-    // Per-sandbox platform_config.host_users overrides the cluster-wide default.
-    let use_user_namespaces = platform_config_bool(template, "host_users")
-        .map_or(params.enable_user_namespaces, |host_users| !host_users);
+    // Per-sandbox portable intent overrides the cluster-wide default. This
+    // driver owns the Kubernetes-specific `hostUsers` translation. Accept the
+    // former platform_config encoding during rolling upgrades from gateways
+    // that predate the typed field.
+    let use_user_namespaces = template
+        .user_namespaces
+        .or_else(|| platform_config_bool(template, "host_users").map(|host_users| !host_users))
+        .unwrap_or(params.enable_user_namespaces);
 
     if use_user_namespaces {
         spec.insert("hostUsers".to_string(), serde_json::json!(false));
@@ -4124,7 +4129,7 @@ fn platform_config_bool(template: &SandboxTemplate, key: &str) -> Option<bool> {
     let config = template.platform_config.as_ref()?;
     let value = config.fields.get(key)?;
     match value.kind.as_ref() {
-        Some(prost_types::value::Kind::BoolValue(b)) => Some(*b),
+        Some(prost_types::value::Kind::BoolValue(value)) => Some(*value),
         _ => None,
     }
 }
@@ -6846,15 +6851,7 @@ mod tests {
     #[test]
     fn user_namespaces_per_sandbox_override_enables() {
         let template = SandboxTemplate {
-            platform_config: Some(Struct {
-                fields: std::iter::once((
-                    "host_users".to_string(),
-                    Value {
-                        kind: Some(Kind::BoolValue(false)),
-                    },
-                ))
-                .collect(),
-            }),
+            user_namespaces: Some(true),
             ..SandboxTemplate::default()
         };
 
@@ -6870,7 +6867,7 @@ mod tests {
         assert_eq!(
             pod_template["spec"]["hostUsers"],
             serde_json::json!(false),
-            "per-sandbox host_users: false must enable user namespaces"
+            "per-sandbox user namespace intent must set hostUsers: false"
         );
         let caps = pod_template["spec"]["containers"][0]["securityContext"]["capabilities"]["add"]
             .as_array()
@@ -6881,15 +6878,7 @@ mod tests {
     #[test]
     fn user_namespaces_per_sandbox_override_disables() {
         let template = SandboxTemplate {
-            platform_config: Some(Struct {
-                fields: std::iter::once((
-                    "host_users".to_string(),
-                    Value {
-                        kind: Some(Kind::BoolValue(true)),
-                    },
-                ))
-                .collect(),
-            }),
+            user_namespaces: Some(false),
             ..SandboxTemplate::default()
         };
 
@@ -6907,7 +6896,7 @@ mod tests {
 
         assert!(
             pod_template["spec"]["hostUsers"].is_null(),
-            "per-sandbox host_users: true must disable user namespaces even when cluster default is on"
+            "per-sandbox user namespace intent must override the cluster default"
         );
         let caps = pod_template["spec"]["containers"][0]["securityContext"]["capabilities"]["add"]
             .as_array()
@@ -6919,6 +6908,37 @@ mod tests {
         );
     }
 
+    #[test]
+    fn user_namespaces_accepts_legacy_host_users_encoding() {
+        let template = SandboxTemplate {
+            platform_config: Some(Struct {
+                fields: std::iter::once((
+                    "host_users".to_string(),
+                    Value {
+                        kind: Some(Kind::BoolValue(false)),
+                    },
+                ))
+                .collect(),
+            }),
+            ..SandboxTemplate::default()
+        };
+
+        let params = SandboxPodParams::default();
+        let pod_template = sandbox_template_to_k8s(
+            &template,
+            false,
+            &std::collections::HashMap::new(),
+            true,
+            &params,
+        );
+
+        assert_eq!(
+            pod_template["spec"]["hostUsers"],
+            serde_json::json!(false),
+            "legacy host_users: false must still enable user namespaces"
+        );
+    }
+
     #[test]
     fn automount_service_account_token_is_disabled() {
         let pod_template = {
@@ -7084,43 +7104,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn platform_config_bool_extracts_value() {
-        let template = SandboxTemplate {
-            platform_config: Some(Struct {
-                fields: std::iter::once((
-                    "my_bool".to_string(),
-                    Value {
-                        kind: Some(Kind::BoolValue(true)),
-                    },
-                ))
-                .collect(),
-            }),
-            ..SandboxTemplate::default()
-        };
-
-        assert_eq!(platform_config_bool(&template, "my_bool"), Some(true));
-        assert_eq!(platform_config_bool(&template, "missing"), None);
-    }
-
-    #[test]
-    fn platform_config_bool_returns_none_for_non_bool() {
-        let template = SandboxTemplate {
-            platform_config: Some(Struct {
-                fields: std::iter::once((
-                    "a_string".to_string(),
-                    Value {
-                        kind: Some(Kind::StringValue("hello".to_string())),
-                    },
-                ))
-                .collect(),
-            }),
-            ..SandboxTemplate::default()
-        };
-
-        assert_eq!(platform_config_bool(&template, "a_string"), None);
-    }
-
     #[test]
     fn log_level_propagates_as_env_var_to_sandbox_pod() {
         let spec = SandboxSpec {

crates/openshell-gateway/src/lib.rs

@@ -38,6 +38,7 @@ fn install_in_tree_compute_drivers(registry: &mut ComputeDriverRegistry) {
             registration
                 .with_telemetry_category(TelemetryComputeDriver::anonymous_category("kubernetes"))
                 .without_mtls_user_auth()
+                .with_token_bootstrap(kubernetes_token_bootstrap)
                 .with_inherited_config_keys(&[
                     "namespace",
                     "default_image",
@@ -107,6 +108,48 @@ fn install_in_tree_compute_drivers(registry: &mut ComputeDriverRegistry) {
     }
 }
 
+#[cfg(all(not(target_os = "windows"), feature = "in-tree-compute-drivers"))]
+fn kubernetes_token_bootstrap(
+    context: &openshell_server::ComputeDriverBuildContext<'_>,
+) -> openshell_core::Result<Option<openshell_server::config_file::SandboxTokenBootstrapConfig>> {
+    let config: openshell_driver_kubernetes::KubernetesComputeConfig = context.driver_config()?;
+    Ok(Some(kubernetes_token_bootstrap_from_config(config)))
+}
+
+#[cfg(all(not(target_os = "windows"), feature = "in-tree-compute-drivers"))]
+fn kubernetes_token_bootstrap_from_config(
+    config: openshell_driver_kubernetes::KubernetesComputeConfig,
+) -> openshell_server::config_file::SandboxTokenBootstrapConfig {
+    use openshell_driver_kubernetes::WorkspaceMode;
+
+    let (namespace, namespace_prefix, namespace_label, namespace_file) = match config.workspace_mode
+    {
+        WorkspaceMode::Shared => (Some(config.namespace), None, None, None),
+        WorkspaceMode::Managed => (
+            None,
+            Some(openshell_driver_kubernetes::managed_namespace_prefix(
+                &config.gateway_id,
+            )),
+            None,
+            None,
+        ),
+        WorkspaceMode::Operator => (
+            None,
+            None,
+            config.operator_namespace_label,
+            config.operator_namespace_file.map(std::path::PathBuf::from),
+        ),
+    };
+
+    openshell_server::config_file::SandboxTokenBootstrapConfig::KubernetesServiceAccount {
+        service_account_name: config.service_account_name,
+        namespace,
+        namespace_prefix,
+        namespace_label,
+        namespace_file,
+    }
+}
+
 #[cfg(all(not(target_os = "windows"), feature = "in-tree-compute-drivers"))]
 fn podman_tracing_setup(
     otlp_endpoint: Option<&str>,
@@ -288,3 +331,31 @@ fn apply_guest_tls(
         *key = Some(default_key.to_owned());
     }
 }
+
+#[cfg(all(test, not(target_os = "windows"), feature = "in-tree-compute-drivers"))]
+mod tests {
+    use super::*;
+    use openshell_driver_kubernetes::{KubernetesComputeConfig, WorkspaceMode};
+    use openshell_server::config_file::SandboxTokenBootstrapConfig;
+
+    #[test]
+    fn kubernetes_bootstrap_compatibility_uses_managed_namespace_prefix() {
+        let config = KubernetesComputeConfig {
+            workspace_mode: WorkspaceMode::Managed,
+            gateway_id: "test-gateway".to_string(),
+            service_account_name: "sandbox-sa".to_string(),
+            ..KubernetesComputeConfig::default()
+        };
+
+        assert_eq!(
+            kubernetes_token_bootstrap_from_config(config),
+            SandboxTokenBootstrapConfig::KubernetesServiceAccount {
+                service_account_name: "sandbox-sa".to_string(),
+                namespace: None,
+                namespace_prefix: Some("openshell-test-gateway-".to_string()),
+                namespace_label: None,
+                namespace_file: None,
+            }
+        );
+    }
+}

crates/openshell-gateway/src/vm.rs

@@ -20,14 +20,10 @@
 //! [`openshell_core::Config`] so the shared core stays free of driver-specific
 //! plumbing.
 //!
-//! TODO(driver-abstraction): this module still assumes the concrete VM driver
-//! (argv shape, guest-TLS flags, libkrun-specific settings). Once we land the
-//! generalized compute-driver interface, the CLI-arg plumbing below should
-//! be replaced with a driver-agnostic launcher that speaks gRPC to
-//! configure the driver — and this file should collapse to the types that
-//! are genuinely VM-specific (libkrun log level, vCPU / memory shape) plus a
-//! trait implementation registering the VM driver against the generic
-//! interface.
+//! Process launch remains deliberately VM-specific at this binary composition
+//! boundary: it translates gateway configuration into the standalone driver's
+//! argv and then connects through the same public compute-driver RPC interface
+//! used by operator-managed external drivers.
 
 #[cfg(unix)]
 use hyper_util::rt::TokioIo;

crates/openshell-server/Cargo.toml

@@ -27,7 +27,8 @@ openshell-router = { path = "../openshell-router" }
 openshell-supervisor-middleware = { path = "../openshell-supervisor-middleware" }
 openshell-supervisor-middleware-builtins = { path = "../openshell-supervisor-middleware-builtins" }
 
-# Kubernetes client (used by the `generate-certs` subcommand)
+# Kubernetes client used by ServiceAccount bootstrap authentication and the
+# `generate-certs` subcommand.
 kube = { workspace = true }
 k8s-openapi = { workspace = true }
 

crates/openshell-server/src/auth/k8s_sa.rs

@@ -164,40 +164,53 @@ impl NamespaceValidator {
     }
 }
 
-pub fn operator_namespace_allowlist(
-    config: &crate::compute::driver_config::KubernetesSaBootstrapConfig,
+pub fn namespace_validator(
+    namespace: Option<String>,
+    namespace_prefix: Option<String>,
+    namespace_label: Option<String>,
+    namespace_file: Option<PathBuf>,
     client: kube::Client,
     shutdown_rx: watch::Receiver<bool>,
-) -> openshell_core::Result<OperatorNamespaceAllowlist> {
-    let allowlist = OperatorNamespaceAllowlist::new();
-    match (
-        config.operator_namespace_label.as_deref(),
-        config.operator_namespace_file.as_deref(),
-    ) {
-        (Some(label), None) if !label.trim().is_empty() => {
-            spawn_namespace_label_watcher(
+) -> openshell_core::Result<NamespaceValidator> {
+    let exact = namespace.filter(|value| !value.trim().is_empty());
+    let prefix = namespace_prefix.filter(|value| !value.trim().is_empty());
+    let label = namespace_label.filter(|value| !value.trim().is_empty());
+    let file = namespace_file.filter(|value| !value.as_os_str().is_empty());
+
+    match (exact, prefix, label, file) {
+        (Some(namespace), None, None, None) => Ok(NamespaceValidator::Exact(namespace)),
+        (None, Some(prefix), None, None) => Ok(NamespaceValidator::Prefix(prefix)),
+        (None, None, label, file) if label.is_some() || file.is_some() => {
+            Ok(NamespaceValidator::Allowlist(dynamic_namespace_allowlist(
+                label,
+                file,
                 client,
-                label.to_string(),
-                allowlist.clone(),
                 shutdown_rx,
-            );
-        }
-        (None, Some(path)) if !path.trim().is_empty() => {
-            spawn_namespace_file_watcher(path.into(), allowlist.clone(), shutdown_rx);
+            )?))
         }
-        (None, None) => {
-            return Err(openshell_core::Error::config(
-                "operator workspace mode requires operator_namespace_label or operator_namespace_file",
-            ));
+        _ => Err(openshell_core::Error::config(
+            "sandbox_token_bootstrap requires exactly one namespace policy: namespace, namespace_prefix, namespace_label, or namespace_file",
+        )),
+    }
+}
+
+fn dynamic_namespace_allowlist(
+    namespace_label: Option<String>,
+    namespace_file: Option<PathBuf>,
+    client: kube::Client,
+    shutdown_rx: watch::Receiver<bool>,
+) -> openshell_core::Result<OperatorNamespaceAllowlist> {
+    let allowlist = OperatorNamespaceAllowlist::new();
+    match (namespace_label, namespace_file) {
+        (Some(label), None) => {
+            spawn_namespace_label_watcher(client, label, allowlist.clone(), shutdown_rx);
         }
-        (Some(_), Some(_)) => {
-            return Err(openshell_core::Error::config(
-                "operator workspace mode accepts only one of operator_namespace_label or operator_namespace_file",
-            ));
+        (None, Some(path)) => {
+            spawn_namespace_file_watcher(path, allowlist.clone(), shutdown_rx);
         }
         _ => {
             return Err(openshell_core::Error::config(
-                "operator namespace source must not be empty",
+                "sandbox_token_bootstrap accepts only one dynamic namespace source",
             ));
         }
     }