feat(kubernetes): add proxy-pod supervisor topology - #2885

Open

russellb wants to merge 48 commits into

NVIDIA:mainfrom

russellb:feat/kubernetes-proxy-pod-topology

Commits on Aug 24, 2026

feat(kubernetes): add proxy-pod supervisor topology

TaylorMutch
authored and
russellb
committed
72d06f0
refactor(kubernetes): run proxy-pod workloads directly

TaylorMutch
authored and
russellb
committed
a15f26c
fix(kubernetes): harden proxy-pod workloads

TaylorMutch
authored and
russellb
committed
129230d
docs(rfc): add proxy-pod supervisor topology draft RFC
russellb
committed
b4556c8
feat(kubernetes): configurable proxy-pod cluster DNS peers
russellb
committed
38cd20c
fix(kubernetes): stop the proxy-pod supervisor when the sandbox stops
russellb
committed
62da677
feat(helm): gated OpenShift nonroot-v2 SCC grant for sandbox pods
russellb
committed
e765704
fix(kubernetes): make the proxy-pod DNS peer port configurable
russellb
committed
cb7d2fc
docs(rfc): record proxy-pod OpenShift validation results
russellb
committed
ed41a58
feat(compute): let drivers declare that a sandbox has no supervisor session
russellb
committed
386e796
feat(kubernetes): workload entrypoint override for proxy-pod topology
russellb
committed
7d6eccf
fix(kubernetes): derive proxy-pod resource names from the sandbox name
russellb
committed
9738557
docs(rfc): correct the readiness and workload-command analysis
russellb
committed
cfbbe0e
docs(rfc): explain the relay boundary and observability tradeoffs
russellb
committed
36ad3a3
fix(cli): explain sessionless topologies instead of surfacing a raw error
russellb
committed
8825e0f
fix(cli): detect a sessionless topology before opening a session
russellb
committed
5df8174
docs(rfc): note Kata kernel isolation and clarify workload log location
russellb
committed
d3218c8
fix(kubernetes): strip MAIN_PROCESS_SPEC from proxy-pod workloads
russellb
committed
a2ea65e
fix(cli): warn before implicit detach when a sessionless topology drops the command
russellb
committed
b73f0ba
fix(kubernetes): correct proxy-pod companion lifecycle, isolation, and placement
russellb
committed
0695914
fix(server): release the sessionless marker when a sandbox is removed
russellb
committed
a515294
fix(cli): detect a sessionless topology before session-bound create steps
russellb
committed
2d9a221
test(e2e): add a capability-scoped proxy-pod suite
russellb
committed
3fa96e4
docs(rfc): reflect gateway-forward removal in proxy-pod design
russellb
committed
2086e28
fix(kubernetes): reference proxy-pod companions by CR name in the pod template
russellb
committed
6cf496d
fix(kubernetes): harden proxy-pod companion lifecycle and placement
russellb
committed
492ff77
fix(kubernetes): tighten proxy-pod RBAC, GC, and DNS from review
russellb
committed
b60945b
fix(kubernetes): reconcile proxy-pod companions idempotently
russellb
committed
9956573
fix(supervisor-network): ignore image-baked proxy launch env in combined topology
russellb
committed
5de78f2
fix(kubernetes): key proxy-pod companions on UUID, verify 409s, forward upstream proxy, track supervisor readiness
russellb
committed
4adeda8
fix(kubernetes): least-privilege proxy-pod RBAC and gateway-scoped reconciliation
russellb
committed
be8b332
fix(kubernetes): order proxy-pod egress fence teardown after workload exit
russellb
committed
df638e6
fix(kubernetes): confirm workload exit before fence teardown and harden reconciliation
russellb
committed
8f009c1
fix(server): preserve relay status code for sessionless topologies
russellb
committed
aa403b1
test(helm): align proxy-pod RBAC tests and docs with least-privilege contract
russellb
committed
5fec6e3

Commits on Aug 25, 2026