# Adapts OpenShell's generated workload pod to a Nitro sandbox, in this sample's
# namespaces only. OpenShell itself is unmodified: the gateway chart, the gateway, the
# supervisor and the in-pod runtime are the upstream v0.1.6 builds that versions.json pins.
#
# One detail of that pod needs adjusting inside a sandbox guest, and this policy is the
# whole of the adjustment: one persistent volume cannot be mounted at two paths across
# the containers of a sandbox pod. The runtime refuses the second container with
# "Mounting the same PVC at different paths across containers in one sandbox pod is not
# supported." OpenShell mounts the workspace at /mnt/openshell-workspace in its seeding
# init container and at /sandbox in the agent container. The adapter gives the seeding
# container an emptyDir at that first path instead, so the workspace volume is mounted
# once, at /sandbox. A consequence worth knowing: files an image keeps under /sandbox are
# not copied into the workspace, so a workload image that needs starting content there
# has to seed it another way.
#
# Nothing else is changed. OpenShell's in-pod runtime starts unmodified as the workload
# container's entrypoint, straight from the pod volume its init container copies it onto,
# and init containers with no CPU or memory requests are admitted unchanged. The adapter
# does not touch the runtime's command, arguments, user, capabilities, seccomp profile or
# policy: the page reads all of those from the running process, so an adapter that
# changed them would be changing the thing the sample measures.
#
# <ADAPTER_NAME> and <MANAGED_BY> are replaced at apply time by scripts/setup.sh.
#
# A MutatingAdmissionPolicy is a cluster-scoped object, so the binding below is what
# keeps it from reaching anyone else's pods: it applies only in namespaces carrying this
# sample's managed-by label, and only to pods OpenShell labels as a workload boundary.
# Every other pod on the cluster, including other OpenShell gateways' pods, is outside
# both conditions.
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicy
metadata:
  name: <ADAPTER_NAME>
  labels:
    app.kubernetes.io/managed-by: <MANAGED_BY>
spec:
  failurePolicy: Fail
  reinvocationPolicy: Never
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
        resources: ["pods"]
    namespaceSelector:
      matchLabels:
        app.kubernetes.io/managed-by: <MANAGED_BY>
  matchConditions:
    - name: openshell-workload
      expression: >-
        object.metadata.?labels[?'openshell.ai/boundary-role'].orValue('') == 'workload'
  variables:
    - name: inits
      expression: object.spec.?initContainers.orValue([])
    - name: seed
      expression: >-
        [0, 1, 2, 3].filter(i, size(variables.inits) > i
          && variables.inits[i].name == 'workspace-init')
    - name: seedMounts
      expression: >-
        size(variables.seed) == 1
          ? [0, 1, 2, 3, 4, 5].filter(m,
              size(variables.inits[variables.seed[0]].?volumeMounts.orValue([])) > m
              && variables.inits[variables.seed[0]].volumeMounts[m].mountPath == '/mnt/openshell-workspace')
          : []
  mutations:
    - patchType: JSONPatch
      jsonPatch:
        expression: >-
          variables.seedMounts.map(m, JSONPatch{op: 'replace',
              path: '/spec/initContainers/' + string(variables.seed[0]) + '/volumeMounts/' + string(m) + '/name',
              value: 'openshell-seed-scratch'})
          + (size(variables.seedMounts) > 0
              ? [JSONPatch{op: 'add', path: '/spec/volumes/-',
                  value: Object.spec.volumes{name: 'openshell-seed-scratch',
                                             emptyDir: Object.spec.volumes.emptyDir{}}}]
              : [])
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicyBinding
metadata:
  name: <ADAPTER_NAME>
  labels:
    app.kubernetes.io/managed-by: <MANAGED_BY>
spec:
  policyName: <ADAPTER_NAME>