feat(kubernetes): adopt shared supervisor boundary mode

[drew]

Summary

Make the Kubernetes proxy-pod topology operational using the shared openshell-sandbox --mode=control / --mode=boundary protocol. A dedicated control pod holds policy, credentials, gateway connectivity, and upstream egress; the workload pod contains only the process-owning boundary beside the agent workload.

This is PR 6 of 6. Its incremental runtime implementation stays in the existing Kubernetes driver, with the Helm, CI, documentation, troubleshooting-skill, and E2E task updates required to expose and operate the topology.

Stack: #2941 → #2942 → #3151 → #2945 → #2965 → this PR.

Related Issue

Part of #1737 and informed by the proxy-pod work in #2885. The issue does not currently carry state:accepted or roadmap placement; this implementation proceeds under direct maintainer instruction without changing those labels.

Changes

• Replace the duplicated Kubernetes-specific backend protocol with the common RFC 0012 boundary protocol.
• Provision the workload pod, control Deployment, boundary Service, immutable bootstrap Secret, and per-sandbox NetworkPolicies as one reconciled companion set.
• Establish authenticated TLS between control and boundary and bind it to namespace, Sandbox resource, control Deployment, NetworkPolicy, image, generation, and policy-resource claims.
• Create and observe the workload egress fence before releasing the suspended Agent Sandbox resource; fail closed unless the operator acknowledges an enforcing CNI/NetworkPolicy posture.
• Keep gateway credentials, provider material, DNS, policy evaluation, middleware, and mediated upstream egress out of the workload pod.
• Share exec, signal/terminate, wait, PTY, loopback forwarding, binary identity, and mediated-egress capabilities with the VM and Docker backends.
• Implement create, readiness, stop/start, delete, restart, failure cleanup, orphan cleanup, and recovery with UID/resource-version checks and semantic control readiness.
• Run control non-root with all Linux capabilities dropped and a read-only root filesystem; retain only the boundary bootstrap capabilities needed to prepare and own the workload.
• Render the topology, configuration, RBAC, and operator acknowledgement through Helm; add a dedicated branch-E2E matrix entry and troubleshooting guidance.

Testing

• mise run pre-commit
• cargo test -p openshell-driver-kubernetes
• cargo clippy -p openshell-driver-kubernetes --all-targets -- -D warnings
• Helm lint and Helm unit tests for supported workspace modes and proxy-pod RBAC/config rendering
• mise run e2e:kubernetes — 106 passed, 1 known ignored
• mise run e2e:kubernetes:proxy-pod — 106 passed, 1 known ignored
• Live proxy-pod gateway smoke: create, policy allow/deny, exec, connect, logs, stop/start, and delete

Checklist

• Authored implementation commits follow Conventional Commits and include DCO sign-off
• Kubernetes runtime behavior remains implemented in crates/openshell-driver-kubernetes
• Helm, CI, docs, E2E tasks, and troubleshooting guidance expose and support the new topology
• Existing combined and sidecar topologies remain covered

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3144.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for f17a633. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.