fix: add K8s API egress and sandbox scheduling env vars

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: stubbi

internal/resources/networkpolicy.go

@@ -61,6 +61,21 @@ func BuildNetworkPolicy(instance *paperclipv1alpha1.Instance) *networkingv1.Netw
 		},
 	}
 
+	// Allow egress to K8s API server when cloud sandbox is enabled.
+	// The server needs to create/manage sandbox pods via the K8s API.
+	// An explicit rule is needed because some CNIs (k3s Flannel, Calico)
+	// do not match host-network destinations with portOnly egress rules.
+	if instance.Spec.Adapters.CloudSandbox != nil && instance.Spec.Adapters.CloudSandbox.Enabled {
+		np.Spec.Egress = append(np.Spec.Egress, networkingv1.NetworkPolicyEgressRule{
+			Ports: []networkingv1.NetworkPolicyPort{
+				{
+					Port:     Ptr(intstr.FromInt32(6443)),
+					Protocol: Ptr(corev1.ProtocolTCP),
+				},
+			},
+		})
+	}
+
 	// Allow egress to managed database if applicable
 	if instance.Spec.Database.Mode == "managed" || instance.Spec.Database.Mode == "" {
 		np.Spec.Egress = append(np.Spec.Egress, networkingv1.NetworkPolicyEgressRule{

internal/resources/resources_test.go

@@ -10,7 +10,6 @@ import (
 	paperclipv1alpha1 "github.com/paperclipinc/paperclip-operator/api/v1alpha1"
 )
 
-//nolint:unparam // test helper kept flexible for future test cases
 func newTestInstance(name string) *paperclipv1alpha1.Instance {
 	return &paperclipv1alpha1.Instance{
 		ObjectMeta: metav1.ObjectMeta{
@@ -277,6 +276,39 @@ func TestBuildNetworkPolicy(t *testing.T) {
 	}
 }
 
+func TestBuildNetworkPolicyCloudSandboxK8sAPIEgress(t *testing.T) {
+	instance := newTestInstance("my-paperclip")
+	instance.Spec.Adapters.CloudSandbox = &paperclipv1alpha1.CloudSandboxSpec{
+		Enabled: true,
+	}
+	np := BuildNetworkPolicy(instance)
+
+	found := false
+	for _, rule := range np.Spec.Egress {
+		for _, port := range rule.Ports {
+			if port.Port != nil && port.Port.IntValue() == 6443 {
+				found = true
+			}
+		}
+	}
+	if !found {
+		t.Error("expected egress rule for K8s API port 6443 when cloud sandbox enabled")
+	}
+}
+
+func TestBuildNetworkPolicyNoK8sAPIEgressWithoutSandbox(t *testing.T) {
+	instance := newTestInstance("my-paperclip")
+	np := BuildNetworkPolicy(instance)
+
+	for _, rule := range np.Spec.Egress {
+		for _, port := range rule.Ports {
+			if port.Port != nil && port.Port.IntValue() == 6443 {
+				t.Error("should not have K8s API egress rule when cloud sandbox is not enabled")
+			}
+		}
+	}
+}
+
 func TestBuildIngress(t *testing.T) {
 	instance := newTestInstance("my-paperclip")
 	instance.Spec.Networking.Ingress = &paperclipv1alpha1.IngressSpec{
@@ -666,6 +698,68 @@ func TestBuildStatefulSetNoCloudSandbox(t *testing.T) {
 	}
 }
 
+func TestBuildStatefulSetCloudSandboxSchedulingEnvVars(t *testing.T) {
+	instance := newTestInstance("my-paperclip")
+	instance.Spec.Adapters.CloudSandbox = &paperclipv1alpha1.CloudSandboxSpec{
+		Enabled: true,
+	}
+	instance.Spec.Availability.NodeSelector = map[string]string{
+		"cloud.google.com/gke-nodepool": "sandbox",
+	}
+	instance.Spec.Availability.Tolerations = []corev1.Toleration{
+		{
+			Key:      "sandbox",
+			Operator: corev1.TolerationOpEqual,
+			Value:    "true",
+			Effect:   corev1.TaintEffectNoSchedule,
+		},
+	}
+
+	sts := BuildStatefulSet(instance, nil)
+	container := sts.Spec.Template.Spec.Containers[0]
+
+	envMap := make(map[string]string)
+	for _, env := range container.Env {
+		if env.Value != "" {
+			envMap[env.Name] = env.Value
+		}
+	}
+
+	// Verify nodeSelector env var
+	nsVal, ok := envMap["PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR"]
+	if !ok {
+		t.Fatal("expected PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR to be set")
+	}
+	if nsVal != `{"cloud.google.com/gke-nodepool":"sandbox"}` {
+		t.Errorf("unexpected nodeSelector JSON: %s", nsVal)
+	}
+
+	// Verify tolerations env var
+	tolVal, ok := envMap["PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS"]
+	if !ok {
+		t.Fatal("expected PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS to be set")
+	}
+	if tolVal != `[{"key":"sandbox","operator":"Equal","value":"true","effect":"NoSchedule"}]` {
+		t.Errorf("unexpected tolerations JSON: %s", tolVal)
+	}
+
+	// Verify these are NOT set when availability scheduling is empty
+	instance2 := newTestInstance("my-paperclip-2")
+	instance2.Spec.Adapters.CloudSandbox = &paperclipv1alpha1.CloudSandboxSpec{
+		Enabled: true,
+	}
+	sts2 := BuildStatefulSet(instance2, nil)
+	container2 := sts2.Spec.Template.Spec.Containers[0]
+	for _, env := range container2.Env {
+		if env.Name == "PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR" {
+			t.Error("unexpected PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR when nodeSelector is empty")
+		}
+		if env.Name == "PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS" {
+			t.Error("unexpected PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS when tolerations is empty")
+		}
+	}
+}
+
 func TestBuildSandboxRole(t *testing.T) {
 	instance := newTestInstance("my-paperclip")
 	role := BuildSandboxRole(instance, "test-ns")

internal/resources/statefulset.go

@@ -1,6 +1,7 @@
 package resources
 
 import (
+	"encoding/json"
 	"fmt"
 
 	appsv1 "k8s.io/api/apps/v1"
@@ -447,6 +448,25 @@ func buildCloudSandboxEnvVars(instance *paperclipv1alpha1.Instance) []corev1.Env
 		vars = append(vars, corev1.EnvVar{Name: "PAPERCLIP_CLOUD_SANDBOX_MULTI_NAMESPACE", Value: "true"})
 	}
 
+	// Node scheduling: pass the instance's scheduling constraints so the
+	// Paperclip server can apply them to sandbox pods it creates.
+	if len(instance.Spec.Availability.NodeSelector) > 0 {
+		if b, err := json.Marshal(instance.Spec.Availability.NodeSelector); err == nil {
+			vars = append(vars, corev1.EnvVar{
+				Name:  "PAPERCLIP_CLOUD_SANDBOX_NODE_SELECTOR",
+				Value: string(b),
+			})
+		}
+	}
+	if len(instance.Spec.Availability.Tolerations) > 0 {
+		if b, err := json.Marshal(instance.Spec.Availability.Tolerations); err == nil {
+			vars = append(vars, corev1.EnvVar{
+				Name:  "PAPERCLIP_CLOUD_SANDBOX_TOLERATIONS",
+				Value: string(b),
+			})
+		}
+	}
+
 	return vars
 }