k8s-agent-sandbox-awx

A broker-backed, kubeconfig-free overlay for the Agentic Sandbox client. It adds a BrokerSandboxClient that drives the sandbox control plane (create → wait ready → terminate) through an identity broker service over HTTPS instead of the Kubernetes API — so client applications need no kubeconfig and no direct Kubernetes API access.

pip install k8s-agent-sandbox-awx
from k8s_agent_sandbox_awx import BrokerSandboxClient, SandboxBrokerConnectionConfig

How it works

The client presents its projected Kubernetes ServiceAccount token to the broker. The broker cryptographically verifies the caller from that token, creates the SandboxClaim under its own identity, and stamps the verified caller identity onto the claim — attribution the client cannot forge.

This package is a purely additive overlay: it builds on k8s-agent-sandbox-base (a seamed re-publish of the upstream client) and edits zero upstream files. The import package is k8s_agent_sandbox_awx.

Requirements

• A deployed identity broker service reachable over HTTPS.
• A projected ServiceAccount token whose audience matches the broker's.
• k8s-agent-sandbox-base (installed automatically as a dependency).

License

Apache-2.0 — see LICENSE.