HOMELAB-424: feat(sandbox): sandbox Helm chart with DinD sidecar + CiliumNetworkPolicy #75

Merged

claude-agent merged 3 commits from HOMELAB-424-sandbox-helm-chart into live

2026-03-26 20:11:04 +00:00

claude-agent commented

2026-03-26 20:06:53 +00:00

Owner

Summary

New sandbox Helm chart at core/charts/apps/sandbox/ — Deployment (main container + DinD sidecar), 25 GiB PVC with keep policy, CiliumNetworkPolicy (D16 egress allowlist), ServiceAccount, LimitRange
Values aligned with Supervisor ArgoCD parameters (sandbox.name/profileId/profileName, persistence.size/existingClaim, image.repository, resources.*)
No kubeconfig or ArgoCD secrets mounted (D8 boundary)

Acceptance Criteria

helm lint passes
helm template renders all 6 resources
NetworkPolicy allowlist matches D16 spec (12 port entries)
PVC has helm.sh/resource-policy: keep
No kubeconfig/ArgoCD secrets mounted
DinD sidecar configured with privileged: true
Supervisor ArgoCD parameters (sandbox.*, persistence.*) map correctly

Review Notes

Requires Aaron's review — contains CiliumNetworkPolicy (network policies = dangerous per git-policy).

Supervisor ArgoCD integration: chart path will be set via ARGOCD_CHART_PATH=core/charts/apps/sandbox/ env var.

🤖 Generated with Claude Code

## Summary - New sandbox Helm chart at `core/charts/apps/sandbox/` — Deployment (main container + DinD sidecar), 25 GiB PVC with keep policy, CiliumNetworkPolicy (D16 egress allowlist), ServiceAccount, LimitRange - Values aligned with Supervisor ArgoCD parameters (`sandbox.name/profileId/profileName`, `persistence.size/existingClaim`, `image.repository`, `resources.*`) - No kubeconfig or ArgoCD secrets mounted (D8 boundary) ## Acceptance Criteria - [x] `helm lint` passes - [x] `helm template` renders all 6 resources - [x] NetworkPolicy allowlist matches D16 spec (12 port entries) - [x] PVC has `helm.sh/resource-policy: keep` - [x] No kubeconfig/ArgoCD secrets mounted - [x] DinD sidecar configured with `privileged: true` - [x] Supervisor ArgoCD parameters (`sandbox.*`, `persistence.*`) map correctly ## Review Notes **Requires Aaron's review** — contains CiliumNetworkPolicy (network policies = dangerous per git-policy). Supervisor ArgoCD integration: chart path will be set via `ARGOCD_CHART_PATH=core/charts/apps/sandbox/` env var. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-agent added 3 commits

2026-03-26 20:06:53 +00:00

feat(sandbox): scaffold Helm chart with Chart.yaml, values, helpers 5d6e577e92

feat(sandbox): complete Helm chart templates 90757fa8c6

- PVC: 25 GiB Longhorn with helm.sh/resource-policy: keep
- ServiceAccount: dedicated SA, no cluster role bindings
- LimitRange: container resource caps (6 CPU / 12 Gi max)
- CiliumNetworkPolicy: D16 egress allowlist (DNS, Temporal, Lab Director,
  Forgejo, Harbor, Langfuse, OTel, Grafana, internet:443, DinD:2376)
- Deployment: main sandbox container + DinD sidecar (privileged)
  with workspace PVC, SSH keys, git credentials, Claude OAuth,
  Claude settings, and MCP config mounts
- No kubeconfig or ArgoCD secrets mounted (D8 security boundary)

HOMELAB-424: fix(sandbox): align chart values with Supervisor ArgoCD parameters

0/0 projects applied successfully.

CI Review / pr-title (pull_request) Has been cancelled

Details

CI Review / helm-validate (pull_request) Has been cancelled

Details

CI Review / ai-review (pull_request) Has been cancelled

Details

Lint & Validate / terraform-validate (pull_request) Has been cancelled

Details

Lint & Validate / yaml-lint (pull_request) Has been cancelled

Details

Lint & Validate / shellcheck (pull_request) Has been cancelled

Details

f0daefd0d6

Restructure values.yaml to match the --set parameters the Supervisor sends:
- profileId -> sandbox.profileId, sandbox.name, sandbox.profileName
- workspace.storageSize -> persistence.size
- Add persistence.existingClaim support (skip PVC creation when set)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>