# Adapts OpenShell's generated workload pod to a Nitro sandbox, in this sample's
# namespace only. OpenShell itself is unmodified: the chart, the gateway, the supervisor
# and the in-pod runtime are the upstream builds that versions.json pins.
#
# OpenShell mounts the workspace PVC at /mnt/openshell-workspace in its seeding init
# container and at /sandbox in the agent container. A sandbox guest accepts one persistent
# volume mounted at one path only, so this policy is the whole of the adjustment: the
# seeding container gets an emptyDir at its path instead, and the workspace volume is
# mounted once, at /sandbox. Files an image keeps under /sandbox are therefore not copied
# into the workspace, so the analyst image keeps its content elsewhere.
# A third adjustment was tried and removed. OpenShell's init containers set no resources,
# and copying the agent container's `resources` onto them looks like an improvement, but
# the API server refuses the patch: a JSONPatch value has to be JSON, and the object's
# `resources` is a typed ResourceRequirements, so admission fails with "type conversion
# error from struct type v1.ResourceRequirements to *structpb.Value". With
# failurePolicy: Fail that rejects the pod outright, and because the driver had already
# created the Sandbox, the symptom was "timed out waiting for gated workload Pod" with no
# pod ever appearing, which does not point at admission at all. Nothing needs it: the
# sandbox boots and is sized from the agent container's own requests, so the adjustment is
# simply absent rather than reinstated in another form.
#
# What it deliberately does not touch: the runtime's command arguments, its user, its
# capabilities, its seccomp profile and its policy. The page reads all of those from the
# running process, so an adapter that changed them would be changing the thing the sample
# measures.
#
# <ADAPTER_NAME> and <MANAGED_BY> are replaced at apply time by scripts/setup.sh.
#
# A MutatingAdmissionPolicy is cluster-scoped, so the binding below scopes it three ways: it
# applies only to pods in this sample's own namespace (the match condition this-namespace),
# only in namespaces carrying this sample's own managed-by label, which setup.sh sets to this
# sample's name and nothing else, and only to pods OpenShell labels as workload boundaries.
# A second installation in another namespace is outside the first condition, even if someone
# copied the label onto that namespace.
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicy
metadata:
  name: <ADAPTER_NAME>
  labels:
    app.kubernetes.io/managed-by: <MANAGED_BY>
spec:
  failurePolicy: Fail
  reinvocationPolicy: Never
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
        resources: ["pods"]
    namespaceSelector:
      matchLabels:
        app.kubernetes.io/managed-by: <MANAGED_BY>
  matchConditions:
    - name: openshell-workload
      expression: >-
        object.metadata.?labels[?'openshell.ai/boundary-role'].orValue('') == 'workload'
    - name: this-namespace
      expression: "request.namespace == '<NAMESPACE>'"
  variables:
    - name: inits
      expression: object.spec.?initContainers.orValue([])
    - name: seed
      expression: >-
        [0, 1, 2, 3].filter(i, size(variables.inits) > i
          && variables.inits[i].name == 'workspace-init')
    - name: seedMounts
      expression: >-
        size(variables.seed) == 1
          ? [0, 1, 2, 3, 4, 5].filter(m,
              size(variables.inits[variables.seed[0]].?volumeMounts.orValue([])) > m
              && variables.inits[variables.seed[0]].volumeMounts[m].mountPath == '/mnt/openshell-workspace')
          : []
  mutations:
    - patchType: JSONPatch
      jsonPatch:
        expression: >-
          variables.seedMounts.map(m, JSONPatch{op: 'replace',
              path: '/spec/initContainers/' + string(variables.seed[0]) + '/volumeMounts/' + string(m) + '/name',
              value: 'openshell-seed-scratch'})
          + (size(variables.seedMounts) > 0
              ? [JSONPatch{op: 'add', path: '/spec/volumes/-',
                  value: Object.spec.volumes{name: 'openshell-seed-scratch',
                                             emptyDir: Object.spec.volumes.emptyDir{}}}]
              : [])
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicyBinding
metadata:
  name: <ADAPTER_NAME>
  labels:
    app.kubernetes.io/managed-by: <MANAGED_BY>
spec:
  policyName: <ADAPTER_NAME>