Feat: support sandbox

[kerthcet]

What this PR does / why we need it

Which issue(s) this PR fixes

Fixes #

Special notes for your reviewer

Does this PR introduce a user-facing change?

[Copilot]

Pull request overview

This PR introduces first-class Sandbox and SandboxSet workload APIs/controllers (to provision interactive “remote box” sandboxes via the existing Pod placement path), and replaces the prior webhook-certificate setup (cert-manager or hack/gen-webhook-cert.sh) with an in-process certificate rotator so deploy/e2e no longer require out-of-band cert steps.

Changes:

• Add Sandbox + SandboxSet CRDs, controllers, samples, and unit/integration tests.
• Add pkg/cert (OPA cert-controller-based) webhook serving cert rotation and defer controller/webhook registration until cert readiness.
• Remove cert-manager and gen-webhook-cert.sh setup from e2e/deploy flows; update docs and dependencies accordingly.

Reviewed changes

Copilot reviewed 34 out of 37 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
test/utils/utils.go	Removes cert-manager helpers from e2e utilities (suite no longer installs cert-manager).
test/e2e/e2e_test.go	Updates e2e flow to rely on in-process cert rotation; adjusts secret name assertions and CA injection checks.
test/e2e/e2e_suite_test.go	Removes cert-manager setup/teardown logic and related env vars.
pkg/cert/cert.go	Adds in-process webhook cert rotator wiring (Secret + caBundle patching).
Makefile	Updates e2e comments to reflect cert-manager is no longer needed.
internal/webhook/v1/pod_webhook.go	Uses EnabledValue constant for opt-in label comparison.
internal/controller/sandboxset_controller.go	Adds SandboxSet reconciler (maintains N Sandboxes; status rollups; scale-in victim selection).
internal/controller/sandboxset_controller_test.go	Adds unit tests for SandboxSet scaling, idempotency, pruning, status, and victim selection.
internal/controller/sandbox_validation_test.go	Adds envtest-based admission tests for Sandbox CEL/schema behavior.
internal/controller/sandbox_controller.go	Adds Sandbox reconciler (synthesizes Pod, projects status, enforces TTL).
internal/controller/sandbox_controller_test.go	Adds unit tests for Sandbox pod synthesis, status projection, TTL behavior, and foreign-pod refusal.
internal/controller/pod_placement_helpers.go	Uses EnabledValue constant for opt-in label comparison.
internal/controller/pod_placement_controller.go	Uses EnabledValue constant for opt-in label comparison.
hack/gen-webhook-cert.sh	Removes legacy script-based webhook cert provisioning.
hack/deploy.sh	Removes legacy cert/caBundle steps; documents in-process rotation behavior and startup ordering.
go.sum	Updates/bumps deps (adds cert-controller; bumps k8s libs, go-restful, jsonreference, etc.).
go.mod	Adds cert-controller dep; bumps k8s libs to v0.33.4; adds go.uber.org/atomic indirect.
docs/deploy.md	Updates deployment docs to describe in-process cert rotation and Sandbox-era behavior.
docs/architecture.md	Removes outdated “Build status” section.
config/webhook/secret.yaml	Adds empty Secret manifest intended for rotator-managed keypair storage.
config/webhook/kustomization.yaml	Includes the new webhook Secret manifest in webhook kustomization.
config/samples/nebula_v1alpha1_sandboxset.yaml	Adds a SandboxSet sample manifest.
config/samples/nebula_v1alpha1_sandbox.yaml	Adds a Sandbox sample manifest.
config/rbac/role.yaml	Extends manager ClusterRole for new CRDs and cert-rotator needs (secrets + webhook config updates).
config/manager/manager.yaml	Adds POD_NAMESPACE env var for cert rotator scoping.
config/default/manager_webhook_patch.yaml	Adjusts webhook mount/port wiring for the new cert approach.
config/default/kustomization.yaml	Updates cert-manager commentary and patch scoping notes.
config/crd/kustomization.yaml	Includes new Sandbox/SandboxSet CRD bases.
config/crd/bases/nebula.inftyai.com_sandboxsets.yaml	Adds generated SandboxSet CRD (schema, scale subresource, columns, validations).
config/crd/bases/nebula.inftyai.com_sandboxes.yaml	Adds generated Sandbox CRD (schema, columns, CEL validations).
cmd/main.go	Registers cert rotator; defers controller/webhook setup until cert readiness; adds Sandbox + SandboxSet controllers.
api/v1alpha1/zz_generated.deepcopy.go	Adds generated deepcopy implementations for Sandbox and SandboxSet types.
api/v1alpha1/sandboxset_types.go	Defines SandboxSet API types, status, conditions, and markers (incl. /scale).
api/v1alpha1/sandbox_types.go	Defines Sandbox API types, phases/reasons, TTL, and markers.
api/v1alpha1/groupversion_info.go	Documents new workload types; adds constants (EnabledValue, Sandbox labels, SandD path).
.golangci.yml	Exempts kubebuilder marker lines from lll (line-length) linting.
.gitignore	Ignores locally built cmd binaries in repo root (e.g., /manager, /keybroker).

Files not reviewed (1)

• api/v1alpha1/zz_generated.deepcopy.go: Generated file

Suppressed comments (1)

config/default/manager_webhook_patch.yaml:44

• The patch currently mounts the webhook cert directory from a Secret volume read-only. That conflicts with the rest of this PR (docs/deploy.md and pkg/cert) which states the rotator writes the keypair to CertDir; a Secret projection is read-only and will prevent the rotator from writing cert files, potentially leaving certsReady never closing and controllers/webhook never registering. Use a writable emptyDir for CertDir (and keep the Secret as API storage, not a volume projection).

# The directory the keypair is projected into and the webhook server serves from.
# Must match certDir in pkg/cert (controller-runtime's default path), which is also
# the path the rotator polls to decide readiness.
- op: add
  path: /spec/template/spec/containers/0/volumeMounts/-
  value:
    mountPath: /tmp/k8s-webhook-server/serving-certs
    name: webhook-certs
    readOnly: true

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kerthcet]

/lgtm
/kind feature

[Copilot]

Pull request overview

Copilot reviewed 34 out of 37 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• api/v1alpha1/zz_generated.deepcopy.go: Generated file

Suppressed comments (1)

internal/controller/sandbox_controller.go:155

• ensurePod uses (nil, nil) as the sentinel for “a foreign Pod exists”, and Reconcile turns that into a PodConflict status. But on Create returning AlreadyExists (a normal race with a concurrent reconcile), this code also returns (nil, nil), which can incorrectly mark a healthy Sandbox as PodConflict. Re-read the Pod on AlreadyExists and only return nil when it truly isn’t owned by this Sandbox.

	if err := r.Create(ctx, pod); err != nil {
		if apierrors.IsAlreadyExists(err) {
			// Lost a race with another reconcile (or with a foreign creator). Re-read on
			// the next pass rather than guessing which it was.
			return nil, nil
		}

[kerthcet]

/hold

[Copilot]

Pull request overview

Copilot reviewed 34 out of 37 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• api/v1alpha1/zz_generated.deepcopy.go: Generated file

Suppressed comments (3)

internal/controller/sandboxset_controller_test.go:272

• This test uses for i := range 3, but Go can’t range over an integer. The test file won’t compile as written.
  config/default/manager_webhook_patch.yaml:54
• config/default/kustomization.yaml sets namePrefix: nebula-, and Kustomize also prefixes name references like volumes[].secret.secretName. Setting secretName: nebula-webhook-server-cert here will likely be transformed into nebula-nebula-webhook-server-cert, breaking the cert Secret mount (and the in-process rotator’s Secret lookup). Use the unprefixed base name so Kustomize can apply the prefix exactly once.

  path: /spec/template/spec/volumes/-
  value:
    name: webhook-certs
    secret:
      secretName: nebula-webhook-server-cert

internal/controller/sandbox_controller.go:156

• ensurePod returns (nil, nil) on AlreadyExists, but the caller treats pod == nil as a foreign-Pod name conflict and sets ReasonPodConflict. A normal reconcile race (two reconciles creating the same Pod) will therefore incorrectly mark the Sandbox as conflicted instead of just reading the existing owned Pod.

	if err := r.Create(ctx, pod); err != nil {
		if apierrors.IsAlreadyExists(err) {
			// Lost a race with another reconcile (or with a foreign creator). Re-read on
			// the next pass rather than guessing which it was.
			return nil, nil
		}

[Copilot]

Pull request overview

Copilot reviewed 34 out of 37 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• api/v1alpha1/zz_generated.deepcopy.go: Generated file

Suppressed comments (3)

internal/controller/sandbox_controller.go:153

• When Pod creation races and returns AlreadyExists, this returns (nil, nil), which the caller interprets as a foreign-Pod conflict and sets ReasonPodConflict. In the common race case where the Pod was actually created by another reconcile for the same Sandbox, this will incorrectly mark the Sandbox as conflicting. Re-read the Pod on AlreadyExists and return it when it is owned by this Sandbox; only return (nil, nil) for a truly foreign Pod.

	if err := r.Create(ctx, pod); err != nil {
		if apierrors.IsAlreadyExists(err) {
			// Lost a race with another reconcile (or with a foreign creator). Re-read on
			// the next pass rather than guessing which it was.
			return nil, nil
		}

docs/deploy.md:106

• This states the cert volume is an emptyDir because the rotator writes files there, but the rest of the PR (pkg/cert and config/default/manager_webhook_patch.yaml) explicitly relies on a Secret projection and notes cert-controller does not write to disk. This documentation is internally inconsistent and will mislead operators into deploying a non-functional webhook cert mount.

The cert volume is an `emptyDir`, not a Secret projection, because the rotator
*writes* to that path; a Secret volume is read-only and its kubelet refresh would
fight the rotator.

internal/controller/sandboxset_controller.go:329

• For spec.replicas == 0, the Ready condition reason/message is set to ScaledToZero but the condition Status stays False. The API doc on SandboxSetConditionReady says it is True when every desired box is Ready; when replicas is 0, that condition should be True (vacuously) so kubectl wait --for=condition=Ready works for a parked set.

[kerthcet]

/unhold

[kerthcet]

/lgtm

[InftyAI-Agent]

Approved: PR has both lgtm and approved labels