[CI only] validate snapshot registry cleanup - #1

Filter backend Date and Server headers before constructing the client-facing response because Uvicorn generates those fields. Add focused regression coverage and document the proxy behavior.

The server parses config.toml once at startup, but the chart mounts it
from a ConfigMap with no content hash on the pod template. Helm (or a
GitOps sync) updates the ConfigMap in place, so the running pod keeps
serving the previous configuration: the mounted file shows the new
values while the process does not.

We hit this in production with [kubernetes].sandbox_create_timeout_seconds.
The ConfigMap carried 180 for days while the server kept timing out
sandbox creates at the 60s default, and the only reason it eventually
picked the new value up was an unrelated node rotation.

Add a checksum/config pod annotation over the rendered TOML (.Values.configToml
plus the [ingress] block the chart appends) so any config change rolls the
Deployment. server.podAnnotations still merge on top. The ingress gateway
does not mount the ConfigMap, so it needs no equivalent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…r-interface

…chart-config-checksum

fix(chart/server): roll the server Deployment when config.toml changes

…pensandbox-group#1545)

…oup#1504)

* feat(egress): auto-allow OTLP endpoint egress traffic (opensandbox-group#1491)

Parse OTEL_EXPORTER_OTLP_METRICS_ENDPOINT / OTEL_EXPORTER_OTLP_ENDPOINT at
egress startup and inject an always-allow rule for the endpoint host so
telemetry export works under the default deny-all policy without manual
allowlist rules. The rule survives user policy updates and always-rule file
reloads; deny.always still takes precedence.

* docs(egress): use FQDN in OTLP endpoint example (opensandbox-group#1491)

Single-label names are subject to search-domain expansion; the deny-all DNS
proxy answers expanded names with NXDOMAIN without fallback, so the example
would not reach the collector.

* fix(egress): cover fallback OTLP endpoint and trailing-dot FQDNs (opensandbox-group#1491)

- Auto-allow the exporter fallback node IP (HOST_IP / /etc/hostinfo) when no
  OTEL endpoint env var is set, so egress's own metric export is not blocked
  by its own deny-all chain in that configuration.
- Trim the trailing root dot from FQDN endpoint hosts before building the
  rule so it matches DNS policy normalization.

* fix(execd): reduce ptyViewerClientReadLoop cognitive complexity

Refactor the nested switch/if message handling into small helpers so the
function stays under the gocognit threshold (37 > 30). The execd CI lint
(installing golangci-lint@latest) fails every PR on this pre-existing issue.

* fix(egress): require URL-form OTLP endpoint and gate node-IP fallback (opensandbox-group#1491)

The otlpmetrichttp exporter parses endpoint env vars with url.Parse and reads
u.Host, so bare host:port values become opaque URLs with an empty host and are
never dialed; only scheme://host URLs are valid. Restrict parseOTLPEndpoint to
URL form to avoid injecting allow rules for hosts the exporter never connects
to. Also skip the node-IP fallback when an endpoint env var is set but
unparseable: metricsClientOptions never falls back once the env var is
non-empty, so the rule would open unrelated node-IP egress.

---------

Co-authored-by: Wenxiang Jin <wenxiang.jin@alibaba-inc.com>
Co-authored-by: Sky <yutian.taoyt@alibaba-inc.com>

The template container's securityContext was dropped when creating
BatchSandbox workloads: merge_with_runtime_values replaces the runtime
containers list wholesale, and only volumeMounts were carried forward.
Extract the template main container's securityContext and merge it into
the generated pod's main container, supplementing the runtime
securityContext key-by-key so network-policy/isolation wiring keeps
precedence.

Closes opensandbox-group#1556

Co-Authored-By: Claude <noreply@anthropic.com>

The previous merge only setdefault'd at the top level, so when the
runtime container already had a securityContext (e.g. capabilities.drop
from network-policy wiring), a template's nested members such as
capabilities.add never reached the generated Pod. Merge nested dicts
recursively, keeping runtime precedence on actual conflicting leaves.

Co-Authored-By: Claude <noreply@anthropic.com>

…0007) (opensandbox-group#1558)

* feat(fleets): add FastPath v2 gRPC client for fast-sandbox

- FastPathClient: async wrapper for all FastPathService v2 RPCs with typed
  error normalization (NotFound -> FastPathNotFound; no string matching)
- commit deterministic protoc-generated stubs under
  server/opensandbox_server/services/fleets/generated (.gitignore exception
  for the fleets generated dir; __pycache__ stays excluded)
- Apache license headers on all new files; verify-license skips generated
  markers (gRPC/protobuf)
- runtime deps: grpcio, protobuf>=7.35.1; grpcio-tools as dev dependency;
  ruff/pyright config covers the generated package
- 13 unit tests against an in-process fake FastPath server

* fix(fleets): apply RPC deadlines; address review feedback

- pass the configured timeout to every RPC so stalled calls raise
  DEADLINE_EXCEEDED -> FastPathUnavailable instead of hanging
- wait_sandbox_ready / resolve_endpoint extend the deadline beyond the
  server-side readiness wait only when waiting is requested
- add a test recording the deadline of each stub call

---------

Co-authored-by: Sky <yutian.taoyt@alibaba-inc.com>

…hsandbox-container-security-context

fix(server,k8s): propagate template container securityContext to pods

…erver-http-metrics

feat(server): export HTTP request metrics via OTLP

…x chart to 0.2.2 (opensandbox-group#1557)

* fix(chart): default containerdSocketPath to empty and bump opensandbox chart to 0.2.2

- Set controller.snapshot.containerdSocketPath default to empty string to avoid crash-looping with v0.2.0 controller image
- Bump opensandbox all-in-one chart version and appVersion to 0.2.2
- Update aks-kata documentation note regarding containerdSocketPath
- Enhance kubernetes Makefile helm-lint target to lint all charts and verify dependencies
- Add helm-lint step in kubernetes-test CI workflow to prevent lockfile desynchronization

* fix(chart): publish controller chart independently

* fix(chart): align server app version metadata

…07) (opensandbox-group#1559)

* feat(fleets): add create/status mapping for fast-sandbox backend

- map_create_request: OpenSandbox CreateSandboxRequest subset -> FastPath v2
  CreateRequest; reject pod-identity fields (volumes, platform,
  resourceRequests, credentialProxy, snapshotId, image.auth, networkPolicy,
  secureAccess, null env values, unknown extension keys) with clear errors
- map_state/map_sandbox: fast-sandbox states -> OpenSandbox lifecycle states;
  Running requires RuntimeReady + DataPlaneReady; retained Stopped ->
  Terminated; strip fleets-reserved metadata keys from public reads
- persist access.renew.extend.seconds under a reserved metadata key
- commit deterministic protoc-generated stubs (.gitignore exception),
  Apache license headers, grpcio/protobuf runtime deps, ruff/pyright config
- 29 unit tests

* fix(fleets): idempotent expiry, pool resource validation; review feedback

- map_create_request accepts a pre-normalized expires_at_unix_seconds so
  transport retries of the same sandbox_id reuse the first absolute expiry
  (FastPath persists expiry as initial intent; changed intent on retry is a
  conflict)
- validate request resource_limits against the selected SandboxPool profile
  when known: pool-undefined keys and mismatched values are rejected instead
  of silently ignored
- map_reason no longer reports Expired for retained Stopped objects
  (SandboxInfo carries no Conditions); reason stays unset unless
  self-describing (Failed)
- relocate pyright directives to file tops (client-adjacent files, mappings,
  generated stubs)
- add tests for expiry reuse, pool compatibility, and Stopped reason

* fix(fleets): strip poolRef; canonical quantity comparison

- normalize extensions.poolRef (whitespace-only falls back to the default
  pool; padded names are stripped before reaching FastPath)
- compare request resource_limits against the pool profile canonically:
  parse Kubernetes quantities (m, k/M/G/T/P/E, Ki/Mi/Gi/Ti/Pi/Ei) with
  Decimal so "0.5" == "500m" and "1Gi" == "1024Mi"

* fix(fleets): make metadata keys DNS1123-label compliant

fast-sandbox persists metadata as labels under metadata.sandbox.fast.io/
and validates every key with IsDNS1123Label (lowercase alphanumeric +
hyphens only) plus IsValidLabelValue for values.

- rename the reserved renew-on-access key from
  opensandbox.io/renew-extend-seconds to renew-extend-seconds, which is
  DNS-safe (previously every create with access.renew.extend.seconds was
  rejected by fast-sandbox)
- validate user metadata keys/values in map_create_request and raise a
  clear UnsupportedFieldError instead of surfacing a confusing gRPC error

---------

Co-authored-by: Sky <yutian.taoyt@alibaba-inc.com>

…t-nonfinite-cpu

fix(server): reject non-finite CPU limits

…ndpoint-cache-invalidation

fix(sdk-python): preserve replacement endpoint fetches

…ol-retry-after-1500

fix(kotlin): Honor Retry-After for pool warmups