[AlonLiwsky]

Overview

Two small additions to SandboxPolicyNodeStatus.status, on top of #428.

appliedGeneration — the parent policy generation the node enforces now. observedGeneration records the latest attempt, including a rejected one, so a node that keeps last-good bindings had no typed way to say which generation it still enforces; that was only in the free-text ActiveRevision message. When bindings differ it is the oldest one; it is absent when the node enforces nothing. Admission rejects appliedGeneration > observedGeneration.

tier: none — without BPF LSM the node-agent's enforcement programs attach but never run, so the node neither blocks nor audits. None of the existing tiers is true in that case (audit-only would promise events that never come).

How to Test

go test ./pkg/apis/sandbox/... ./hack/sandbox-crds
hack/verify-sandbox-crds.sh -count=1

New validation cases: applied ahead of observed (rejected), negative applied (rejected), last-good applied behind observed (accepted), tier: none (accepted).

Related issues/PRs

• Base: feat: add sandbox policy CRD API foundation #428
• Consumer: feat(sandboxpolicy): drive the privilege gadget from the sandbox policy controller node-agent#1068 (per-node status section)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8f3bc56c-f1a7-4c18-9733-8f7fee54cdfe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[matthyx]

Reviewed head 284ce4d2 against base feat/sandbox-policy-crd-api (136b4c98, #428 head).

Purpose: adds status.appliedGeneration (generation actually enforced, lags observedGeneration on a rejected revision) and a none tier for nodes without BPF LSM. Both are additive and fit the stated node-agent consumer (node-agent#1068).

Findings: no blockers. The field is optional with minimum: 0; the CEL rule !has(appliedGeneration) || appliedGeneration <= observedGeneration is null-safe. The enum addition is only in schema.go and the generated CRD, with no other tier consumers in the repo. Docs, example and the generated CRD agree.

Validation (local): go test ./pkg/apis/sandbox/... ./hack/sandbox-crds and hack/verify-sandbox-crds.sh -count=1 pass. The new tests cover applied ahead of observed (rejected), negative applied (rejected), applied behind observed (accepted) and tier: none (accepted). Only DCO and GitGuardian ran in CI (both pass, CodeRabbit skipped), so no full CI run backs this.

Related PRs: no duplicates or earlier rejected approaches found (searched appliedGeneration and node status tier). The only related PR is the base, #428, which is still open.

Note (non-blocking): with omitempty, a real applied generation of 0 can't be told apart from "enforces nothing". Policy generations start at 1, so this is fine.

Verdict: approve.