Integration with SandD

[kerthcet]

What this PR does / why we need it

Which issue(s) this PR fixes

Fixes #

Special notes for your reviewer

Does this PR introduce a user-facing change?

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Suppressed comments (3)

pkg/provider/aws/translate.go:86

• When SandD is enabled, the shim ultimately runs exec "$@", but runArgs is built from spec.Command then spec.Args. If spec.Command is empty (a valid Kubernetes case where the image ENTRYPOINT should run), $@ starts with the first arg from spec.Args (or is empty), which will fail and break workloads. Consider only enabling the shim when an explicit Command is present; otherwise fall back to the normal Docker ENTRYPOINT/CMD mapping to preserve Kubernetes semantics.

	var runArgs []string
	if spec.Sandd.Enabled() {
		runArgs = writeSanddEntrypoint(&b, spec)
	} else {
		// No shim: map Command/Args straight onto Docker's --entrypoint/CMD as before.

pkg/provider/provider.go:340

• SanddConfig.Enabled() only checks AuthKey, but the struct doc states ControlServer and ServerURL are required when AuthKey is set. As written, a partially configured SandD setup will be treated as enabled and attempt injection with empty values. Either validate elsewhere or make Enabled() reflect the documented requirements.

// Enabled reports whether the SandD daemon should be injected. A missing AuthKey
// means the operator did not opt in, so an adapter emits its plain bootstrap.
func (s SanddConfig) Enabled() bool { return s.AuthKey != "" }

cmd/main.go:364

• SandD env configuration is read from process env, but there is no validation/logging if SANDD_TUNNEL_AUTHKEY is set while SANDD_TUNNEL_SERVER or SANDD_SERVER_URL are missing. With the current fail-open shim this can silently disable the access channel (or attempt to start it with empty values) while still launching workloads. Add a guard that logs the missing required vars (without logging the auth key) and disables SandD injection when incomplete.

	sanddCfg := provider.SanddConfig{
		AuthKey:       os.Getenv("SANDD_TUNNEL_AUTHKEY"),
		ControlServer: os.Getenv("SANDD_TUNNEL_SERVER"),
		ServerURL:     os.Getenv("SANDD_SERVER_URL"),
	}