alasio 8.0.0 → 10.0.0

package/dist/cli/src/manifests/admission.js

@@ -1,34 +1,38 @@
 /**
- * What alasio may do beyond what RBAC can say: ValidatingAdmissionPolicies of the
- * cluster's, each matching what alasio's ServiceAccount asks (main's, or a branch
- * environment's), and holding it to what alasio up renders:
+ * What alasio's components may do beyond what RBAC can say: ValidatingAdmissionPolicies of
+ * the cluster's, each matching what one of their ServiceAccounts asks, and holding it to
+ * what alasio up renders:
  *
- * - a Job alasio makes is the clone of a session's volume, as rendered, but for the
- *   claims it is told: RBAC lets it make any Job in its namespace, as another
- *   ServiceAccount there, a controller's whose rights reach the cluster, or of another
- *   image or command, privileged as the clone is;
- * - a Sandbox alasio makes, or moves onto another pod template, is made from the template
- *   of its namespace's workspaces, but for what alasio adds to each (src/kube/
- *   sandbox-shape.ts): RBAC lets it make Sandboxes of any pod, as any ServiceAccount, under
- *   any runtime;
- * - a Secret alasio makes is a Sandbox's token: RBAC lets it make Secrets of any type, a
- *   ServiceAccount's token among them;
+ * - a pod made in the folder namespace is a folder instance's, which the sandbox gateway
+ *   alone makes, of the folder template, but for what the gateway adds to each
+ *   (src/gateway/names.ts folderPodSpec), and a Secret the gateway makes there is an
+ *   instance's token: RBAC lets it make pods of any spec, as any ServiceAccount, under any
+ *   runtime, and Secrets of any type, a ServiceAccount's token among them;
+ * - a pod the sandbox gateway updates or deletes in an environment's own namespace is one of
+ *   its harness pools', which it binds and releases, and a Lease it writes there one of their
+ *   bindings': RBAC lets it update and delete every pod there, and write every Lease;
  * - a pod alasio patches changes its busy label and annotations alone (src/kube/busy.ts),
  *   and in alasio's own namespace is alasio's own: RBAC lets it patch its namespaces'
  *   pods whole, their images among it;
  * - a compute's Deployment neon-control patches changes its pod template's restartedAt
  *   annotation alone, which restarts it (neon/control/computes.ts): RBAC lets it patch the
- *   Deployment whole, its image and command among it.
+ *   Deployment whole, its image and command among it;
+ * - a pod neon-control patches is a compute's, and changes its serving label alone, which
+ *   takes it off its Service as a sleep stops it: RBAC lets it patch any pod of a
+ *   compute's namespace whole.
  *
  * Where a policy holds an object to a rendered one, `pinned` makes the CEL that says so:
  * the object's fields are the rendered ones', key for key and item for item, but for what
  * a Check allows, and what the API server defaults where the rendered one has nothing.
  */
 import { posix } from "node:path";
-import { branchNamespace } from "../../../src/branch/names.js";
+import { SERVING_LABEL } from "../../../neon/control/endpoints.js";
+import { BINDING_LABEL, FREE_LABEL, KEY_ANNOTATION, POOL_LABEL } from "../../../src/binder/names.js";
+import { branchNamespace, branchSessionsNamespace } from "../../../src/branch/names.js";
+import { ATTACH_VOLUME, FOLDER_KEY_PREFIX, FOLDER_POOL, FOLDER_POD, folderPodSpec, folderTokenSecret, ownDirectory, SANDBOX_POD_POLICY } from "../../../src/gateway/names.js";
 import { BUSY_ANNOTATIONS, BUSY_LABEL } from "../../../src/kube/busy-label.js";
-import { CLONE_VARIABLES } from "../../../src/kube/config.js";
-import { BAYMA_CONTAINER, DEFAULT_FULL_MODE_NAMESERVERS, EGRESS_GATE, EGRESS_GATE_SCRIPT, HARNESS_LABEL, MANAGED_BY, NET_MODE_LABEL, RESTORE_ANNOTATION, RESTORE_PAUSED_ANNOTATION, RESUMED_CONDITION, SANDBOX_LABEL, SESSION_TEMPLATE_ANNOTATION, SNAPSHOT_CACHE_DIR, SNAPSHOT_ID, STATE_DIR_ARG, TELEMETRY_TOKEN_FILE_ARGS, TOKEN_DIR, TOKEN_FILE_ARGS, TOKEN_KEY, TOKEN_MODE, TOKEN_VOLUME, tokenSecretName, WORKLOAD_LABEL, } from "../../../src/kube/sandbox-shape.js";
+import { RESTORE_ANNOTATION, RESTORE_PAUSED_ANNOTATION, RESUMED_CONDITION, SNAPSHOT_CACHE_DIR, SNAPSHOT_ID } from "../../../src/kube/sandbox-shape.js";
+import { ATTACH_ROOT, RESTORE_POD } from "../../../src/node-agent/names.js";
 import { componentName, labels, NAMESPACE, neonName, RELEASE } from "./common.js";
 /** A field's test, beyond its being a rendered value: given the field's CEL expression and how deep it is, the CEL that holds where it passes. */
 class Check {
@@ -41,23 +45,16 @@ class Check {
 const ANY = new Check(() => "true");
 /** Any string. */
 const ANY_STRING = new Check((expression) => `type(${expression}) == string`);
-/** A map with nothing in it, as the API server defaults one. */
-const EMPTY = new Check((expression) => `size(${expression}) == 0`);
 /** A string all of which `pattern` matches. */
 const matching = (pattern) => new Check((expression) => `type(${expression}) == string && ${expression}.matches(${JSON.stringify(`^(${pattern})$`)})`);
 /** What the CEL `value` is, of the object asked about. */
 const sameAs = (value) => new Check((expression) => `${expression} == ${value}`);
+/** A quantity, as the API server writes one, of the amount `value` is. */
+const quantityOf = (value) => new Check((expression) => `isQuantity(${expression}) && quantity(${expression}).compareTo(quantity(${JSON.stringify(value)})) == 0`);
+/** A quantity, as the API server writes one, of at least `least`'s amount, and at most `most`'s where given. */
+const quantityWithin = (least, most) => new Check((expression) => [`isQuantity(${expression})`, `quantity(${expression}).compareTo(quantity(${JSON.stringify(least)})) >= 0`, ...(most ? [`quantity(${expression}).compareTo(quantity(${JSON.stringify(most)})) <= 0`] : [])].join(" && "));
 /** Any of `alternatives`. */
 const oneOf = (...alternatives) => new Check((expression, depth) => `(${alternatives.map((each) => pinned(expression, each, depth)).join(" || ")})`);
-/** A list of `first`, then any number of items each `rest`. */
-const startingWith = (first, rest) => new Check((expression, depth) => {
-    const item = `item${depth}`;
-    return [
-        `size(${expression}) >= ${first.length}`,
-        ...first.map((each, index) => pinned(`${expression}[${index}]`, each, depth + 1)),
-        `${expression}.all(${item}, ${[...first, rest].map((each) => pinned(item, each, depth + 1)).join(" || ")})`,
-    ].join(" && ");
-});
 /** Of a map's key: that it may be absent; where present, `value`. */
 class Optional extends Check {
     value;
@@ -105,12 +102,10 @@ function pinnedMap(expression, expected, defaults, depth) {
         ...extra.map((key) => `(!(${JSON.stringify(key)} in ${expression}) || ${pinned(at(key), defaults[key], depth)})`),
     ].join(" && ");
 }
-/** The name the ServiceAccount of the alasio of the namespace `namespace` asks as. */
-export const alasioAccount = (namespace) => `system:serviceaccount:${namespace}:${RELEASE}`;
 /** Whether the request is by main's alasio or a branch environment's, as CEL. */
 const BY_ANY_ALASIO = `request.userInfo.username.matches('^system:serviceaccount:(${NAMESPACE}|${branchNamespace("")}[a-z0-9-]+):${RELEASE}$')`;
 /** A ValidatingAdmissionPolicy `name` of alasio's, on `rules`, of what `by` asks, refusing what `validations` do not hold for, and its binding. */
-function admissionPolicy(name, rules, by, validations, variables) {
+function admissionPolicy(name, rules, by, validations, variables, namespaceSelector) {
     const metadata = { name, labels: labels("alasio") };
     const policy = {
         apiVersion: "admissionregistration.k8s.io/v1",
@@ -118,7 +113,7 @@ function admissionPolicy(name, rules, by, validations, variables) {
         metadata,
         spec: {
             failurePolicy: "Fail",
-            matchConstraints: { resourceRules: rules.map((rule) => ({ ...rule, apiVersions: ["*"] })) },
+            matchConstraints: { resourceRules: rules.map((rule) => ({ ...rule, apiVersions: ["*"] })), ...(namespaceSelector ? { namespaceSelector } : {}) },
             matchConditions: [{ name: "by-alasio", expression: by }],
             ...(variables ? { variables } : {}),
             validations,
@@ -193,208 +188,557 @@ export function computeRestartPolicy() {
         { name: "newAnnotations", expression: "object.spec.template.metadata.?annotations.orValue({})" },
     ]);
 }
+/** The components of the computes' pods: a primary's, and a read replica's. */
+const COMPUTE_COMPONENTS = ["neon-compute", "neon-compute-ro"];
 /**
- * What the API server gives a Job, its template, and the template's pod and containers,
- * when its maker does not: a pinned Job may have them so. Its selector and its template's
- * labels of its own are the Job's; a pod's scheduling and termination are no matter of
- * its rights; and a pod's security context, defaulted, is empty.
- */
-const JOB_DEFAULTS = {
-    spec: { completions: 1, parallelism: 1, completionMode: "NonIndexed", suspend: false, manualSelector: false, podReplacementPolicy: ANY_STRING, selector: ANY },
-    metadata: { creationTimestamp: ANY },
-    labels: {
-        "batch.kubernetes.io/controller-uid": ANY_STRING,
-        "controller-uid": ANY_STRING,
-        "batch.kubernetes.io/job-name": sameAs("object.metadata.name"),
-        "job-name": sameAs("object.metadata.name"),
-    },
-    pod: { dnsPolicy: ANY, schedulerName: ANY, terminationGracePeriodSeconds: ANY, securityContext: EMPTY },
-    container: { terminationMessagePath: ANY, terminationMessagePolicy: ANY },
-};
-/**
- * What alasio may run as a Job: the clone of a session's volume (src/sandbox/index.ts),
- * `job`, its spec and its pod's as rendered, but for the claims each of its containers is
- * told, as alasio adds them (cloneJobManifest), each a DNS label (DNS_LABEL). Main's
- * alasio's, the one that clones.
+ * What neon-control may change of a pod, which RBAC lets it patch whole, of any in a
+ * compute's namespace (./neon.ts's computeScaling): of a compute's pod, its serving label
+ * (neon/control/endpoints.ts's SERVING_LABEL), which takes it off its Service as a sleep
+ * stops it, or gives it back, and nothing else.
  */
-export function cloneJobPolicy(job) {
-    const spec = job.spec ?? {};
-    const pod = spec.template?.spec;
-    const claims = CLONE_VARIABLES.map((variable) => ({ name: variable, value: matching(DNS_LABEL) }));
-    const template = spec.template;
-    const containers = (pod?.containers ?? []).map((container) => defaulted({ ...container, env: [...(container.env ?? []), ...claims] }, JOB_DEFAULTS.container));
-    const expected = defaulted({
-        ...spec,
-        template: {
-            metadata: defaulted({ ...template?.metadata, labels: defaulted(template?.metadata?.labels ?? {}, JOB_DEFAULTS.labels) }, JOB_DEFAULTS.metadata),
-            spec: defaulted({ ...pod, containers }, JOB_DEFAULTS.pod),
+export function computeServingPolicy() {
+    const component = "app.kubernetes.io/component";
+    const account = `system:serviceaccount:${NAMESPACE}:${neonName("control")}`;
+    return admissionPolicy(componentName("compute-serving"), [{ apiGroups: [""], resources: ["pods"], operations: ["UPDATE"] }], `request.userInfo.username == "${account}"`, [
+        { expression: "object.spec == oldObject.spec", message: "neon-control changes no pod's spec" },
+        {
+            expression: `"${component}" in variables.oldLabels && variables.oldLabels["${component}"] in ${JSON.stringify(COMPUTE_COMPONENTS)}`,
+            message: "neon-control labels no pod but a compute's",
         },
-    }, JOB_DEFAULTS.spec);
-    return admissionPolicy(componentName("clone-job"), [{ apiGroups: ["batch"], resources: ["jobs"], operations: ["CREATE", "UPDATE"] }], `request.userInfo.username == "${alasioAccount(NAMESPACE)}"`, [{
-            expression: pinned("object.spec", expected),
-            message: "alasio runs no Job but its clone of a session's volume, as alasio up renders it",
-        }]);
+        {
+            expression: "object.metadata.?annotations.orValue({}) == oldObject.metadata.?annotations.orValue({}) && " +
+                "object.metadata.?finalizers.orValue([]) == oldObject.metadata.?finalizers.orValue([]) && " +
+                "object.metadata.?ownerReferences.orValue([]) == oldObject.metadata.?ownerReferences.orValue([])",
+            message: "neon-control changes no pod's annotations, finalizers or owners",
+        },
+        { expression: unchanged("Labels", [SERVING_LABEL]), message: `neon-control changes no label of a pod's but ${SERVING_LABEL}` },
+        {
+            expression: `!("${SERVING_LABEL}" in variables.newLabels) || variables.newLabels["${SERVING_LABEL}"] == "true"`,
+            message: `neon-control sets ${SERVING_LABEL} to true alone, or takes it off`,
+        },
+    ], [
+        { name: "oldLabels", expression: "oldObject.metadata.?labels.orValue({})" },
+        { name: "newLabels", expression: "object.metadata.?labels.orValue({})" },
+    ]);
 }
-/** A container of a Sandbox's pod template as its CRD stores it: its ports' protocol defaulted. */
-const stored = (container) => {
-    const ports = container["ports"];
-    return Array.isArray(ports) ? { ...container, ports: ports.map((port) => defaulted(port, { protocol: "TCP" })) } : container;
-};
-/** The token Secret of the Sandbox asked about, as CEL. */
-const OWN_TOKEN = sameAs(`object.metadata.name + ${JSON.stringify(tokenSecretName(""))}`);
 /** A path segment as sanitizePathToken makes one. */
 const PATH_TOKEN = "[A-Za-z0-9_][A-Za-z0-9_.-]*";
 /** `text`, as a pattern that matches it alone. */
 const literally = (text) => text.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-/** A variable of the environment, set to a string. */
-const SET = { name: ANY_STRING, value: ANY_STRING };
 /** A node's name: a DNS subdomain. */
 const NODE_NAME = "[a-z0-9]([-a-z0-9.]{0,251}[a-z0-9])?";
-/** A pod template's hash, as podTemplateHash makes one (src/kube/sandboxes.ts). */
-const TEMPLATE_HASH = "[0-9a-f]{64}";
+/** Any number. */
+const ANY_NUMBER = new Check((expression) => `type(${expression}) == int || type(${expression}) == double`);
+/** The tolerations the API server gives a pod of a node not ready or unreachable, for five minutes, where it has none of its own of them (DefaultTolerationSeconds). */
+const DEFAULT_TOLERATIONS = ["node.kubernetes.io/not-ready", "node.kubernetes.io/unreachable"].map((key) => ({ key, operator: "Exists", effect: "NoExecute", tolerationSeconds: 300 }));
+/**
+ * What the API server gives a sandbox pool's pod, of its template, where the template has
+ * not: its own defaults, its priority from its class, its ServiceAccount the namespace's
+ * default, which it mounts no token of; of each container, where its termination message
+ * goes, and its resources as VPA sizes them; of a probe, its timeout and thresholds; of a
+ * port, its protocol; of a field reference, its API version.
+ */
+const POOL_POD_DEFAULTS = {
+    pod: {
+        restartPolicy: "Always",
+        terminationGracePeriodSeconds: 30,
+        schedulerName: "default-scheduler",
+        serviceAccountName: "default",
+        serviceAccount: "default",
+        priority: ANY_NUMBER,
+        preemptionPolicy: oneOf("PreemptLowerPriority", "Never"),
+    },
+    container: { terminationMessagePath: "/dev/termination-log", terminationMessagePolicy: "File", resources: ANY },
+    probe: { timeoutSeconds: 1, successThreshold: 1, failureThreshold: 3 },
+};
+/**
+ * `container` of a pool's template, as the API server stores it in a pod (POOL_POD_DEFAULTS):
+ * its resources any, as VPA sizes a pool's pod as it is made, and resizes it after
+ * (pods/resize).
+ */
+const poolContainer = (container) => templateContainer(container, ANY);
+/** `container` of a template, as the API server stores it in a pod (POOL_POD_DEFAULTS), its resources as `resources` says. */
+function templateContainer(container, resources) {
+    const each = container;
+    const probe = each["readinessProbe"];
+    return defaulted({
+        ...each,
+        resources,
+        ...(container.ports ? { ports: container.ports.map((port) => defaulted(port, { protocol: "TCP" })) } : {}),
+        ...(container.env
+            ? {
+                env: container.env.map((variable) => variable.valueFrom?.fieldRef
+                    ? { ...variable, valueFrom: { fieldRef: defaulted(variable.valueFrom.fieldRef, { apiVersion: "v1" }) } }
+                    : variable),
+            }
+            : {}),
+        ...(probe ? { readinessProbe: defaulted(probe, POOL_POD_DEFAULTS.probe) } : {}),
+    }, POOL_POD_DEFAULTS.container);
+}
+/** The spec of a pod of the pool template `template`, as the API server stores it: what POOL_POD_DEFAULTS adds, and its tolerations, its template's then the API server's own. */
+function poolPodSpec(template) {
+    const spec = template.spec ?? { containers: [] };
+    const tolerations = (spec.tolerations ?? []);
+    return defaulted({
+        ...spec,
+        containers: spec.containers.map(poolContainer),
+        ...(spec.initContainers ? { initContainers: spec.initContainers.map(poolContainer) } : {}),
+        // The API server's of a node not ready and unreachable, in either order.
+        tolerations: oneOf([...tolerations, ...DEFAULT_TOLERATIONS], [...tolerations, ...[...DEFAULT_TOLERATIONS].reverse()]),
+    }, POOL_POD_DEFAULTS.pod);
+}
 /**
- * Where a node agent prepares a snapshot of the Sandbox asked about, of the sessions of
- * `namespace`, for its pod to be restored from: under the snapshot cache, in its
- * environment's directory, in its workspace's, the Sandbox's own, a snapshot's.
+ * The image a restore's pod of main's sessions, `namespace`'s, is restored from, as the
+ * gateway's node agent prepared it: of the workspace its binding's key names, in the node's
+ * snapshot cache, under a snapshot's id.
  */
-const restoredFrom = (namespace) => new Check((expression) => {
-    const own = `${JSON.stringify(`${SNAPSHOT_CACHE_DIR}/${namespace}/`)} + object.metadata.name + "/"`;
+const restoredFromKey = (namespace) => new Check((expression) => {
+    const own = `${JSON.stringify(`${SNAPSHOT_CACHE_DIR}/${namespace}/`)} + variables.annotations[${JSON.stringify(KEY_ANNOTATION)}].substring(${"sessionfs:".length}) + "/"`;
     return `type(${expression}) == string && ${expression}.startsWith(${own}) && ${expression}.substring(size(${own})).matches(${JSON.stringify(`^${SNAPSHOT_ID}$`)})`;
 });
+/** A restore's pod's own directory on its node: its namespace's and its own name's, under every pod's, its name a restore's pod's, as its node's agent makes a directory for no other. */
+const OWN_DIRECTORY = new Check((expression) => `${expression} == ${JSON.stringify(`${ATTACH_ROOT}/`)} + object.metadata.namespace + "/" + object.metadata.name && object.metadata.name.matches(${JSON.stringify(RESTORE_POD.source)})`);
 /**
- * The Sandbox of a workspace alasio makes from `template`: a session's (`session`, with
- * the session's profile, and `current`, the profile its snapshots are restored by) or a
- * folder's bayma's (`folder`, with its state root), as sandboxManifest and
- * sessionSandboxManifest or hostBaymaManifest make it.
- *
- * Of a session's, what its snapshots add (src/sandbox/snapshots.ts): the hash of the
- * template its pod is made from, which they record; and, restored from one, the image of the Sandbox's own that its
- * node prepared, left paused until it is resumed, under a release `current` keeps, on
- * that node, and ready once resumed.
+ * A restore's pod of the pool template `template`, as the gateway makes it (src/gateway/snapshots.ts)
+ * and the API server stores it: its template's, bound from the first, never free, its sandbox
+ * restored paused from the image its node's agent prepared, under one of `runtimeClasses`, on that
+ * node, its own directory there its volume's, ready once resumed, and never started again.
  */
-function sandboxOf(template, workspace) {
-    const podTemplate = template.podTemplate;
-    const spec = podTemplate.spec ?? { containers: [] };
-    const session = "session" in workspace ? workspace.session : null;
-    const snapshots = "current" in workspace ? (workspace.current.snapshots ?? null) : null;
-    const bayma = spec.containers.find(({ name }) => name === BAYMA_CONTAINER);
-    const tokenMount = { name: TOKEN_VOLUME, mountPath: TOKEN_DIR, readOnly: true };
-    // Under the state root as hostBaymaStateDir joins it: normalized, its one slash after it.
-    const stateDir = "folder" in workspace ? [STATE_DIR_ARG, matching(`${literally(posix.join(workspace.folder.stateRoot, "/"))}${PATH_TOKEN}/${PATH_TOKEN}`)] : [];
-    // A session's bayma that exports telemetry reads the token it exports with from its token's file too.
-    const args = (each) => {
-        const own = [...(each.args ?? []), ...TOKEN_FILE_ARGS, ...stateDir];
-        return session ? oneOf(own, [...own, ...TELEMETRY_TOKEN_FILE_ARGS]) : own;
+function restorePod(template, namespace, runtimeClasses) {
+    // Its own directory named by its volume's path, its own name's (ownDirectory).
+    const owned = ownDirectory(template.spec ?? { containers: [] }, "", "");
+    const volumes = (owned.volumes ?? []).map((volume) => (volume.name === ATTACH_VOLUME ? { name: ATTACH_VOLUME, hostPath: { path: OWN_DIRECTORY, type: "Directory" } } : volume));
+    const restoredOn = {
+        nodeAffinity: { requiredDuringSchedulingIgnoredDuringExecution: { nodeSelectorTerms: [{ matchFields: [{ key: "metadata.name", operator: "In", values: [matching(NODE_NAME)] }] }] } },
     };
-    const container = (each) => stored((each.name !== BAYMA_CONTAINER ? each : {
-        ...each,
-        args: args(each),
-        volumeMounts: [...(each.volumeMounts ?? []), tokenMount],
-        env: optional(startingWith((each.env ?? []), SET)),
-    }));
-    const gate = session && session.egressGate !== false
-        ? [{
-                name: EGRESS_GATE.name,
-                ...(bayma?.image === undefined ? {} : { image: bayma.image }),
-                command: ["node", "-e", EGRESS_GATE_SCRIPT],
-                ...(bayma?.securityContext === undefined ? {} : { securityContext: bayma.securityContext }),
-                resources: EGRESS_GATE.resources,
-            }]
+    // Its template's spec, as the API server stores a pod of it, but what a restore gives it.
+    const restoring = poolPodSpec({
+        ...template,
+        spec: {
+            ...owned,
+            volumes,
+            restartPolicy: "Never",
+            runtimeClassName: oneOf(...runtimeClasses),
+            readinessGates: [...(template.spec?.readinessGates ?? []), { conditionType: RESUMED_CONDITION }],
+            affinity: restoredOn,
+        },
+    });
+    const { [FREE_LABEL]: _free, ...own } = (template.metadata?.labels ?? {});
+    const labels = { ...own, [BINDING_LABEL]: matching("[0-9a-f]{40}") };
+    const annotations = {
+        ...(template.metadata?.annotations ?? {}),
+        [KEY_ANNOTATION]: matching(`sessionfs:${DNS_LABEL}`),
+        ...BUSY_ANNOTATIONS,
+        [RESTORE_ANNOTATION]: restoredFromKey(namespace),
+        [RESTORE_PAUSED_ANNOTATION]: "true",
+        vpaObservedContainers: optional(ANY_STRING),
+        vpaUpdates: optional(ANY_STRING),
+    };
+    return `(${pinned("object.spec", restoring)} && ${pinned("variables.labels", labels)} && ${pinned("variables.annotations", annotations)})`;
+}
+/**
+ * Every pod of a namespace of sessions, main's or a branch environment's, made or changed by
+ * anyone, held to what the pools' templates, `templates`, make, as Pod Security's restricted
+ * level, which the namespaces keep warning and auditing of, cannot: a pool's pod mounts its
+ * own directory on its node, a hostPath no level but privileged allows, which the namespaces
+ * enforce, so this policy is their boundary.
+ *
+ * - A pod made is a pod of one of `templates`, as the API server stores it (poolPodSpec), its
+ *   template's labels and annotations, its ReplicaSet's template hash beside them, and what
+ *   VPA notes; or a restore's of main's sessions, of a template a snapshot restores onto
+ *   (restorePod), made by the gateway alone; and no other pod is made there.
+ * - A pod changed keeps its spec whole (its resources change by pods/resize, which this does
+ *   not match), and of its labels and annotations changes those a binding has alone (its free
+ *   label taken off, its binding's put on) and those that keep its node, and of its owners lets
+ *   go alone.
+ * - No pod gets an ephemeral container.
+ *
+ * It fails closed: where it cannot say, the API server refuses.
+ */
+export function sandboxPodPolicy(templates, { sessionsNamespace, restores = null }) {
+    const name = SANDBOX_POD_POLICY;
+    const metadata = { name, labels: labels("session") };
+    // Each template's pin a variable of its own, as CEL holds each expression to 100,000 code points, which all of them together pass.
+    const made = templates.map((template, index) => {
+        const labels = { ...(template.metadata?.labels ?? {}), "pod-template-hash": ANY_STRING };
+        const annotations = { ...(template.metadata?.annotations ?? {}), vpaObservedContainers: optional(ANY_STRING), vpaUpdates: optional(ANY_STRING) };
+        return { name: `made${index}`, expression: `${pinned("object.spec", poolPodSpec(template))} && ${pinned("variables.labels", labels)} && ${pinned("variables.annotations", annotations)}` };
+    });
+    const restoring = (restores?.templates ?? []).map((template, index) => ({ name: `restored${index}`, expression: restorePod(template, sessionsNamespace, restores?.runtimeClasses ?? []) }));
+    const restored = restores
+        ? [`(request.namespace == ${JSON.stringify(sessionsNamespace)} && request.userInfo.username == ${JSON.stringify(restores.restorer)} && (${restoring.map(({ name }) => `variables.${name}`).join(" || ")}))`]
         : [];
-    const initContainers = [...gate, ...(spec.initContainers ?? [])].map(stored);
-    const volumes = [...(spec.volumes ?? []), { name: TOKEN_VOLUME, secret: { secretName: OWN_TOKEN, defaultMode: TOKEN_MODE } }];
-    const own = {
-        ...MANAGED_BY,
-        [SANDBOX_LABEL]: sameAs("object.metadata.name"),
-        ...(session ? { [WORKLOAD_LABEL]: "session", [NET_MODE_LABEL]: oneOf("none", "full") } : { [WORKLOAD_LABEL]: "folder", [HARNESS_LABEL]: matching(PATH_TOKEN) }),
+    const bound = [BINDING_LABEL, FREE_LABEL];
+    const policy = {
+        apiVersion: "admissionregistration.k8s.io/v1",
+        kind: "ValidatingAdmissionPolicy",
+        metadata,
+        spec: {
+            failurePolicy: "Fail",
+            matchConstraints: {
+                resourceRules: [
+                    { apiGroups: [""], apiVersions: ["*"], resources: ["pods"], operations: ["CREATE", "UPDATE"] },
+                    { apiGroups: [""], apiVersions: ["*"], resources: ["pods/ephemeralcontainers"], operations: ["CREATE", "UPDATE"] },
+                ],
+            },
+            matchConditions: [{
+                    name: "of-sessions",
+                    expression: `request.namespace == ${JSON.stringify(sessionsNamespace)} || request.namespace.matches(${JSON.stringify(`^${literally(branchSessionsNamespace("\u0000")).replace("\u0000", DNS_LABEL)}$`)})`,
+                }],
+            variables: [
+                { name: "labels", expression: "object.metadata.?labels.orValue({})" },
+                { name: "annotations", expression: "object.metadata.?annotations.orValue({})" },
+                { name: "oldLabels", expression: "request.operation == 'UPDATE' ? oldObject.metadata.?labels.orValue({}) : {}" },
+                { name: "newLabels", expression: "object.metadata.?labels.orValue({})" },
+                { name: "oldAnnotations", expression: "request.operation == 'UPDATE' ? oldObject.metadata.?annotations.orValue({}) : {}" },
+                { name: "newAnnotations", expression: "object.metadata.?annotations.orValue({})" },
+                { name: "pooled", expression: `${JSON.stringify(POOL_LABEL)} in variables.labels || ${JSON.stringify(POOL_LABEL)} in variables.oldLabels` },
+                ...made,
+                ...restoring,
+            ],
+            validations: [
+                { expression: "request.?subResource.orValue('') != 'ephemeralcontainers'", message: "no pod of a namespace of sessions gets an ephemeral container" },
+                {
+                    expression: `request.operation != 'CREATE' || !variables.pooled || ${[...made.map(({ name }) => `variables.${name}`), ...restored].join(" || ")}`,
+                    message: "a pod of a sandbox pool is its pool's template, as alasio up renders it, or a restore's of one, as the sandbox gateway makes it, and nothing else",
+                },
+                { expression: "request.operation != 'CREATE' || variables.pooled", message: "no pod is made in a namespace of sessions but a sandbox pool's" },
+                { expression: "request.operation != 'UPDATE' || object.spec == oldObject.spec", message: "no pod's spec changes in a namespace of sessions" },
+                {
+                    expression: `request.operation != 'UPDATE' || !variables.pooled || (${unchanged("Labels", bound)})`,
+                    message: `no label of a sandbox pool's pod changes but ${bound.join(" and ")}, as it is bound`,
+                },
+                {
+                    expression: `request.operation != 'UPDATE' || !variables.pooled || (${unchanged("Annotations", [KEY_ANNOTATION, ...Object.keys(BUSY_ANNOTATIONS)])})`,
+                    message: `no annotation of a sandbox pool's pod changes but ${KEY_ANNOTATION} and what keeps its node, as it is bound`,
+                },
+                {
+                    expression: "request.operation != 'UPDATE' || object.metadata.?ownerReferences.orValue([]).all(owner, owner in oldObject.metadata.?ownerReferences.orValue([]))",
+                    message: "a pod of a namespace of sessions gets no owner it had not",
+                },
+            ],
+        },
     };
-    const annotations = (podTemplate.metadata?.annotations ?? {});
-    const added = session
-        ? {
-            [SESSION_TEMPLATE_ANNOTATION]: optional(matching(TEMPLATE_HASH)),
-            ...(snapshots && session
-                ? {
-                    [RESTORE_ANNOTATION]: optional(restoredFrom(session.namespace)),
-                    [RESTORE_PAUSED_ANNOTATION]: optional("true"),
-                }
-                : {}),
-        }
-        : {};
-    // The template's annotations, and those added where they may be; a template of none has a map of them only where some are added.
-    const metadataAnnotations = Object.keys(added).length === 0 ? {} : { annotations: Object.keys(annotations).length > 0 ? { ...annotations, ...added } : optional({ ...added }) };
-    const restoredOn = {
-        ...(spec.affinity ?? {}),
-        nodeAffinity: {
-            requiredDuringSchedulingIgnoredDuringExecution: { nodeSelectorTerms: [{ matchFields: [{ key: "metadata.name", operator: "In", values: [matching(NODE_NAME)] }] }] },
+    const binding = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingAdmissionPolicyBinding", metadata, spec: { policyName: name, validationActions: ["Deny"] } };
+    return [policy, binding];
+}
+/**
+ * What the sandbox gateway, `gateway`, its ServiceAccount, may do to a pod or a Lease of an
+ * environment's own namespace, main's or a branch's, where RBAC lets it update and delete pods
+ * and write Leases to bind and release its harness pools' (./harness-pools.ts): a pod of one
+ * of `pools` alone, which it makes none of, of no other workload beside it; and a Lease of a
+ * binding of one of them alone, by its pool's label, as it was and as it is to be, of none of
+ * what else keeps Leases there (KEDA's, VPA's, their leaders'). How a pool's pod may change, by
+ * anyone, its pool's own policy says (harnessPoolPodPolicy).
+ */
+export function harnessPodPolicy(gateway, pools) {
+    // An environment's own namespace, main's or a branch's: not a branch's sessions' namespace,
+    // whose name may be of the same form, whose sandbox pods the gateway binds, as its labels say.
+    const environments = `request.namespace == ${JSON.stringify(NAMESPACE)} || request.namespace.startsWith(${JSON.stringify(branchNamespace(""))})`;
+    const ofNoSessions = { matchExpressions: [{ key: "app.kubernetes.io/component", operator: "NotIn", values: ["session"] }] };
+    const ofPools = (labels) => `${JSON.stringify(POOL_LABEL)} in ${labels} && ${labels}[${JSON.stringify(POOL_LABEL)}] in ${JSON.stringify(pools)}`;
+    return admissionPolicy(componentName("harness-pods"), [
+        { apiGroups: [""], resources: ["pods"], operations: ["UPDATE", "DELETE"] },
+        { apiGroups: ["coordination.k8s.io"], resources: ["leases"], operations: ["CREATE", "UPDATE", "DELETE"] },
+    ], `request.userInfo.username == ${JSON.stringify(gateway)} && (${environments})`, [
+        {
+            expression: `request.resource.resource != 'pods' || (${ofPools("variables.oldLabels")})`,
+            message: "the sandbox gateway changes and deletes no pod of an environment's namespace but its harness pools'",
         },
+        {
+            expression: `request.resource.resource != 'leases' || ((request.operation == 'CREATE' || (${ofPools("variables.oldLabels")})) && (request.operation == 'DELETE' || (${ofPools("variables.newLabels")})))`,
+            message: "the sandbox gateway writes no Lease of an environment's namespace but its harness pools' bindings'",
+        },
+    ], [
+        { name: "oldLabels", expression: "request.operation == 'CREATE' ? {} : oldObject.metadata.?labels.orValue({})" },
+        { name: "newLabels", expression: "request.operation == 'DELETE' ? {} : object.metadata.?labels.orValue({})" },
+    ], ofNoSessions);
+}
+/**
+ * The spec of a pod of the harness pool template `template`, as the API server stores it: as a
+ * sandbox pool's pod's (poolPodSpec), and what the API server gives a pod that a harness
+ * pool's template leaves out: its DNS policy, the mode of each Secret's volume, each of the
+ * machine's paths' type where its mount names none, and the scheme of its readiness probe's
+ * request.
+ */
+function harnessPodSpec(template) {
+    const spec = template.spec ?? { containers: [] };
+    const container = (each) => {
+        const probe = each.readinessProbe;
+        const httpGet = probe?.httpGet;
+        return poolContainer({ ...each, ...(probe && httpGet ? { readinessProbe: { ...probe, httpGet: defaulted(httpGet, { scheme: "HTTP" }) } } : {}) });
     };
-    const readinessGates = (spec.readinessGates ?? []);
-    const restorable = snapshots
-        ? {
-            runtimeClassName: oneOf(...new Set([spec.runtimeClassName ?? "", ...snapshots.releases.map(({ runtimeClassName }) => runtimeClassName)].filter((each) => each !== ""))),
-            readinessGates: spec.readinessGates ? oneOf(readinessGates, [...readinessGates, { conditionType: RESUMED_CONDITION }]) : optional([{ conditionType: RESUMED_CONDITION }]),
-            affinity: spec.affinity ? oneOf(spec.affinity, restoredOn) : optional(restoredOn),
-        }
-        : {};
-    const nameservers = session ? [...(session.fullModeNameservers ?? DEFAULT_FULL_MODE_NAMESERVERS)] : [];
-    const podSpec = {
+    const volumes = (spec.volumes ?? []).map((volume) => volume.secret
+        ? { ...volume, secret: defaulted(volume.secret, { defaultMode: 420 }) }
+        : volume.hostPath && volume.hostPath.type === undefined
+            ? { ...volume, hostPath: defaulted(volume.hostPath, { type: "" }) }
+            : volume);
+    const tolerations = (spec.tolerations ?? []);
+    return defaulted({
         ...spec,
         containers: spec.containers.map(container),
-        ...(initContainers.length > 0 ? { initContainers } : {}),
-        volumes,
-        // A session's pod speaks to the cluster as no one, and resolves names as its internet says.
-        ...(session
-            ? { automountServiceAccountToken: false, enableServiceLinks: false, dnsPolicy: "None", dnsConfig: { nameservers: oneOf(nameservers, ["127.0.0.1"]) } }
-            : {}),
-        ...restorable,
+        ...(spec.volumes ? { volumes } : {}),
+        tolerations: oneOf([...tolerations, ...DEFAULT_TOLERATIONS], [...tolerations, ...[...DEFAULT_TOLERATIONS].reverse()]),
+    }, { ...POOL_POD_DEFAULTS.pod, dnsPolicy: "ClusterFirst" });
+}
+/** `templates` by what each is but for its pool's label, in their order. */
+function kindsOf(templates) {
+    const kinds = new Map();
+    for (const template of templates) {
+        const { [POOL_LABEL]: pool = "", ...others } = template.metadata?.labels ?? {};
+        const key = JSON.stringify({ ...template, metadata: { ...template.metadata, labels: others } });
+        const kind = kinds.get(key) ?? { template, pools: [] };
+        kind.pools.push(pool);
+        kinds.set(key, kind);
+    }
+    return [...kinds.values()];
+}
+/** The name of the policy that holds the harness pools' pods of main's environment (`branch` null) or of the branch environment `branch` to their templates. */
+export const harnessPoolPodPolicyName = (branch) => (branch === null ? componentName("harness-pool-pods") : `${componentName("harness-pool-pods")}-${branch}`);
+/**
+ * Every pod of a harness pool (./harness-pools.ts) made in the environment's own namespace
+ * `namespace`, held to its pool's template, `templates` as `alasio up` renders them for main
+ * (`branch` null) or `alasio branch create` for the branch `branch`, of its own
+ * configuration, its overrides among it: main's folder conversations' among them, which run
+ * as the operator with the machine's mounts, so none is made of another user, other mounts, or
+ * capabilities beyond the template's. Each environment's policy is its own, made and deleted
+ * with it, as main's alasio up cannot render a branch's templates, whose configuration is the
+ * branch's. A pod is made by its Deployment's ReplicaSet, of its template, as the API server
+ * stores it (harnessPodSpec), free, of its pool's labels and the template hash alone; a pod
+ * labelled of no harness pool is no harness pool's, and is left to what else holds the
+ * namespace. A pool's pod changed by anyone, as it was or as it is to be, keeps its spec whole
+ * (its resources change by pods/resize, as VPA resizes it, which this does not match), of its
+ * labels and annotations changes those a binding has alone and those that keep its node, and
+ * of its owners lets go alone; and none gets an ephemeral container, as a sandbox pool's pod
+ * gets none (sandboxPodPolicy).
+ *
+ * It fails closed: where it cannot say, the API server refuses.
+ */
+export function harnessPoolPodPolicy({ namespace, branch, templates }) {
+    const name = harnessPoolPodPolicyName(branch);
+    const metadata = { name, labels: labels("harness") };
+    const pinOf = ({ template, pools }) => {
+        const podLabels = { ...(template.metadata?.labels ?? {}), [POOL_LABEL]: oneOf(...pools), "pod-template-hash": ANY_STRING };
+        const annotations = { ...(template.metadata?.annotations ?? {}), vpaObservedContainers: optional(ANY_STRING), vpaUpdates: optional(ANY_STRING) };
+        return `${pinned("object.spec", harnessPodSpec(template))} && ${pinned("variables.labels", podLabels)} && ${pinned("variables.annotations", annotations)}`;
     };
-    // A Sandbox restored onto the template before the current one keeps the claims it was made with, of either.
-    const claims = [...new Set([session, "current" in workspace ? workspace.current : null].map((each) => JSON.stringify(each?.volumeClaimTemplates ?? [])))]
-        .map((each) => JSON.parse(each))
-        .filter((each) => each.length > 0);
-    // Its CRD defaults what is done with it at its shutdown time, which alasio gives none.
-    return defaulted({
-        operatingMode: oneOf("Running", "Suspended"),
-        service: true,
-        podTemplate: { ...podTemplate, metadata: { ...podTemplate.metadata, labels: { ...podTemplate.metadata?.labels, ...own }, ...metadataAnnotations }, spec: podSpec },
-        ...(claims.length > 0 ? { volumeClaimTemplates: claims.length === 1 ? claims[0] : oneOf(...claims) } : {}),
-    }, { shutdownPolicy: "Retain" });
+    // Each kind of template's pin a variable of its own, as CEL holds each expression to 100,000
+    // code points; the templates of pools that differ in their pool's label alone pinned once, so
+    // the policy stays one the API server compiles in time.
+    const pins = kindsOf(templates).map((kind, index) => ({ name: `pin${index}`, expression: pinOf(kind) }));
+    const pools = [...new Set(templates.map((template) => template.metadata?.labels?.[POOL_LABEL] ?? ""))];
+    const ofPools = (pod) => `has(${pod}.metadata.labels) && ${JSON.stringify(POOL_LABEL)} in ${pod}.metadata.labels && ${pod}.metadata.labels[${JSON.stringify(POOL_LABEL)}] in ${JSON.stringify(pools)}`;
+    const bound = [BINDING_LABEL, FREE_LABEL];
+    const policy = {
+        apiVersion: "admissionregistration.k8s.io/v1",
+        kind: "ValidatingAdmissionPolicy",
+        metadata,
+        spec: {
+            failurePolicy: "Fail",
+            matchConstraints: {
+                resourceRules: [
+                    { apiGroups: [""], apiVersions: ["*"], resources: ["pods"], operations: ["CREATE", "UPDATE"] },
+                    { apiGroups: [""], apiVersions: ["*"], resources: ["pods/ephemeralcontainers"], operations: ["CREATE", "UPDATE"] },
+                ],
+            },
+            matchConditions: [
+                { name: "of-the-environment", expression: `request.namespace == ${JSON.stringify(namespace)}` },
+                { name: "of-harness-pools", expression: `(${ofPools("object")}) || (request.operation == 'UPDATE' && ${ofPools("oldObject")})` },
+            ],
+            variables: [
+                { name: "labels", expression: "object.metadata.?labels.orValue({})" },
+                { name: "annotations", expression: "object.metadata.?annotations.orValue({})" },
+                { name: "oldLabels", expression: "request.operation == 'UPDATE' ? oldObject.metadata.?labels.orValue({}) : {}" },
+                { name: "newLabels", expression: "object.metadata.?labels.orValue({})" },
+                { name: "oldAnnotations", expression: "request.operation == 'UPDATE' ? oldObject.metadata.?annotations.orValue({}) : {}" },
+                { name: "newAnnotations", expression: "object.metadata.?annotations.orValue({})" },
+                ...pins,
+            ],
+            validations: [
+                { expression: "request.?subResource.orValue('') != 'ephemeralcontainers'", message: "no pod of a harness pool gets an ephemeral container" },
+                {
+                    expression: `request.operation != 'CREATE' || ${pins.map(({ name: each }) => `variables.${each}`).join(" || ") || "false"}`,
+                    message: "a pod of a harness pool is its pool's template, as alasio up renders it, and nothing else",
+                },
+                { expression: "request.operation != 'UPDATE' || object.spec == oldObject.spec", message: "no harness pool's pod's spec changes" },
+                { expression: `request.operation != 'UPDATE' || (${unchanged("Labels", bound)})`, message: `no label of a harness pool's pod changes but ${bound.join(" and ")}, as it is bound` },
+                {
+                    expression: `request.operation != 'UPDATE' || (${unchanged("Annotations", [KEY_ANNOTATION, ...Object.keys(BUSY_ANNOTATIONS)])})`,
+                    message: `no annotation of a harness pool's pod changes but ${KEY_ANNOTATION} and what keeps its node, as it is bound`,
+                },
+                {
+                    expression: "request.operation != 'UPDATE' || object.metadata.?ownerReferences.orValue([]).all(owner, owner in oldObject.metadata.?ownerReferences.orValue([]))",
+                    message: "a harness pool's pod gets no owner it had not",
+                },
+            ],
+        },
+    };
+    const binding = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingAdmissionPolicyBinding", metadata, spec: { policyName: name, validationActions: ["Deny"] } };
+    return [policy, binding];
 }
-/** The name of the Sandbox policy of the alasio of the namespace `namespace`. */
-export const sandboxPolicyName = (namespace) => `${namespace}-sandboxes`;
+/** The folder pods' policy, which holds every pod of the folder namespace to the folder template (folderPodPolicy). */
+export const FOLDER_POD_POLICY = "alasio-folder-pods";
+/** What stands for a folder instance's pod's own name, and its state directory, in its spec as folderPodSpec makes it, which the policy pins by what they must be. */
+const POD_NAME = "\u0000pod";
+const STATE_DIR = "\u0000state-dir";
 /**
- * What alasio may make as a Sandbox, by `account`, the ServiceAccount of the alasio of
- * `name`: a session's from `sessions`, or from `previousSessions`, the sessions' template
- * before it, which `alasio up` carries forward until the template changes again, so a
- * snapshot taken on it restores onto it whole (src/sandbox/snapshots.ts), in any namespace
- * but `host`'s; and a folder's bayma's from `host`, in its namespace. A Sandbox moved onto
- * no other pod template, as alasio suspends and resumes it, is left as it was made. Each
- * template is a variable of its own, as each is checked whole.
+ * The spec `spec` of a folder instance's pod, as the API server stores it: as a pool's pod's
+ * (poolPodSpec), and what the API server gives a pod that the folder template, unlike the
+ * pools', leaves out: its DNS policy, its Service links, and each of the machine's paths'
+ * type where its mount names none.
  */
-export function sandboxPolicy(name, account, templates) {
-    const { sessions, previousSessions, host } = templates;
-    const ofSessions = sessions
-        ? [
-            { name: "sessions", expression: pinned("object.spec", sandboxOf(sessions, { session: sessions, current: sessions })) },
-            ...(previousSessions ? [{ name: "previousSessions", expression: pinned("object.spec", sandboxOf(previousSessions, { session: previousSessions, current: sessions })) }] : []),
-        ]
-        : [];
-    const ofHost = host ? [{ name: "host", expression: pinned("object.spec", sandboxOf(host, { folder: host })) }] : [];
-    const session = ofSessions.length > 0 ? `(${ofSessions.map((each) => `variables.${each.name}`).join(" || ")})` : "false";
-    const made = host ? `(request.namespace == ${JSON.stringify(host.namespace)} ? variables.host : ${session})` : session;
-    const unmoved = "request.operation == \"UPDATE\" && object.spec.podTemplate == oldObject.spec.podTemplate && " +
-        "object.spec.?volumeClaimTemplates.orValue([]) == oldObject.spec.?volumeClaimTemplates.orValue([])";
-    // A restore's pod is left paused, and ready only once resumed; no other pod is paused.
-    const annotations = "object.spec.podTemplate.?metadata.?annotations.orValue({})";
-    const restoring = `(${JSON.stringify(RESTORE_ANNOTATION)} in ${annotations})`;
-    const gated = `object.spec.podTemplate.?spec.?readinessGates.orValue([]).exists(gate, gate.conditionType == ${JSON.stringify(RESUMED_CONDITION)})`;
-    return admissionPolicy(name, [{ apiGroups: ["agents.x-k8s.io"], resources: ["sandboxes"], operations: ["CREATE", "UPDATE"] }], `request.userInfo.username == "${account}"`, [
-        { expression: `${unmoved} || ${made}`, message: "alasio makes no Sandbox but from its workspaces' templates, as alasio up renders them" },
+function folderPodPinned(spec) {
+    const { map, defaults } = folderPodParts(spec);
+    return defaulted(map, defaults);
+}
+/**
+ * A folder instance's container's `resources`, its template's: its limits theirs, its CPU
+ * request its, and its memory request, where it has one, the gateway's, as it sizes each pod
+ * of its folder's instances' use (src/gateway/folders.ts SIZING), between its template's and
+ * its limit.
+ */
+function folderResources(resources) {
+    const quantities = (of) => Object.fromEntries(Object.entries(of ?? {}).map(([name, value]) => [name, quantityOf(value)]));
+    const memory = resources?.requests?.["memory"];
+    return {
+        ...(resources?.limits ? { limits: quantities(resources.limits) } : {}),
+        ...(resources?.requests ? { requests: { ...quantities(resources.requests), ...(memory ? { memory: quantityWithin(memory, resources.limits?.["memory"]) } : {}) } } : {}),
+    };
+}
+/** folderPodPinned's map and the defaults it is pinned with. */
+export function folderPodParts(spec) {
+    const tolerations = (spec.tolerations ?? []);
+    const volumes = (spec.volumes ?? []).map((volume) => volume.hostPath && volume.hostPath.type === undefined ? { ...volume, hostPath: defaulted(volume.hostPath, { type: "" }) } : volume);
+    return {
+        map: {
+            ...spec,
+            containers: spec.containers.map((container) => templateContainer(container, folderResources(container.resources))),
+            ...(spec.volumes ? { volumes } : {}),
+            tolerations: oneOf([...tolerations, ...DEFAULT_TOLERATIONS], [...tolerations, ...[...DEFAULT_TOLERATIONS].reverse()]),
+        },
+        defaults: {
+            ...POOL_POD_DEFAULTS.pod,
+            // The account the template names, as the API server copies it to the field it deprecated.
+            ...(spec.serviceAccountName ? { serviceAccountName: spec.serviceAccountName, serviceAccount: spec.serviceAccountName } : {}),
+            dnsPolicy: "ClusterFirst",
+            enableServiceLinks: true,
+        },
+    };
+}
+/** `value`, each string of it `stands` names the Check of, as that Check. */
+function standingFor(value, stands) {
+    if (typeof value === "string")
+        return stands[value] ?? value;
+    if (value instanceof Check || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => standingFor(item, stands));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, item === undefined ? undefined : standingFor(item, stands)]));
+}
+/**
+ * Every pod of the folder namespace, `namespace`, made or changed by anyone, held to what the
+ * folder template, `template`, makes (src/gateway/folders.ts): a folder instance's pod is the
+ * operator's, of the machine's own mounts and the capabilities bayma's process snapshots need,
+ * which no Pod Security level but privileged allows, as the namespace enforces, so this policy
+ * is its boundary.
+ *
+ * - A pod made is made by `maker`, the gateway, alone, and is the template's, as the API server
+ *   stores it (poolPodSpec), with what folderPodSpec adds, alone: its token's Secret, named for
+ *   it, and its state directory under `stateRoot`, of a harness's and a conversation's names;
+ *   its bayma's memory request the gateway's, between its template's and its limit
+ *   (folderResources); bound from the first, to a folder instance's key, its node kept; and
+ *   named as one.
+ * - A pod changed keeps its spec, its labels, and its owners, and of its annotations changes
+ *   those that keep its node alone.
+ * - No pod gets an ephemeral container.
+ *
+ * It fails closed: where it cannot say, the API server refuses.
+ */
+export function folderPodPolicy(template, { namespace, maker, stateRoot }) {
+    const metadata = { name: FOLDER_POD_POLICY, labels: labels("folder-bayma") };
+    // The spec as folderPodSpec makes it, its own name's and state directory's places standing for what they must be, then pinned.
+    const spec = folderPodPinned(standingFor(folderPodSpec(template.spec ?? { containers: [] }, POD_NAME, STATE_DIR), {
+        [folderTokenSecret(POD_NAME)]: sameAs(`object.metadata.name + ${JSON.stringify(folderTokenSecret(""))}`),
+        [STATE_DIR]: matching(`${literally(posix.join(stateRoot, "/"))}${PATH_TOKEN}/${PATH_TOKEN}`),
+    }));
+    const podLabels = { ...(template.metadata?.labels ?? {}), [POOL_LABEL]: FOLDER_POOL, [BINDING_LABEL]: matching("[0-9a-f]{40}") };
+    const podAnnotations = {
+        ...(template.metadata?.annotations ?? {}),
+        [KEY_ANNOTATION]: matching(`${literally(FOLDER_KEY_PREFIX)}[a-z][a-z0-9-]{0,30}:.{1,512}`),
+        ...BUSY_ANNOTATIONS,
+        vpaObservedContainers: optional(ANY_STRING),
+        vpaUpdates: optional(ANY_STRING),
+    };
+    const policy = {
+        apiVersion: "admissionregistration.k8s.io/v1",
+        kind: "ValidatingAdmissionPolicy",
+        metadata,
+        spec: {
+            failurePolicy: "Fail",
+            matchConstraints: {
+                resourceRules: [
+                    { apiGroups: [""], apiVersions: ["*"], resources: ["pods"], operations: ["CREATE", "UPDATE"] },
+                    { apiGroups: [""], apiVersions: ["*"], resources: ["pods/ephemeralcontainers"], operations: ["CREATE", "UPDATE"] },
+                ],
+            },
+            matchConditions: [{ name: "of-folders", expression: `request.namespace == ${JSON.stringify(namespace)}` }],
+            variables: [
+                { name: "oldAnnotations", expression: "request.operation == 'UPDATE' ? oldObject.metadata.?annotations.orValue({}) : {}" },
+                { name: "newAnnotations", expression: "object.metadata.?annotations.orValue({})" },
+                // Each pin a variable of its own, as CEL holds each expression to 100,000 code points.
+                { name: "folderSpec", expression: pinned("object.spec", spec) },
+                { name: "folderLabels", expression: pinned("object.metadata.?labels.orValue({})", podLabels) },
+                { name: "folderAnnotations", expression: pinned("object.metadata.?annotations.orValue({})", podAnnotations) },
+            ],
+            validations: [
+                { expression: "request.?subResource.orValue('') != 'ephemeralcontainers'", message: "no pod of the folder namespace gets an ephemeral container" },
+                { expression: `request.operation != 'CREATE' || request.userInfo.username == ${JSON.stringify(maker)}`, message: "no pod is made in the folder namespace but by the sandbox gateway" },
+                { expression: `request.operation != 'CREATE' || object.metadata.name.matches(${JSON.stringify(FOLDER_POD.source)})`, message: "a pod made in the folder namespace is named as a folder instance's" },
+                { expression: "request.operation != 'CREATE' || variables.folderSpec", message: "a pod made in the folder namespace is a folder instance's, of the folder template, as alasio up renders it" },
+                { expression: "request.operation != 'CREATE' || variables.folderLabels", message: "a pod made in the folder namespace is labelled as a folder instance bound" },
+                { expression: "request.operation != 'CREATE' || variables.folderAnnotations", message: "a pod made in the folder namespace is annotated with a folder instance's key, its node kept" },
+                { expression: "request.operation != 'UPDATE' || object.spec == oldObject.spec", message: "no pod's spec changes in the folder namespace" },
+                { expression: "request.operation != 'UPDATE' || object.metadata.?labels.orValue({}) == oldObject.metadata.?labels.orValue({})", message: "no pod's labels change in the folder namespace" },
+                {
+                    expression: `request.operation != 'UPDATE' || (${unchanged("Annotations", Object.keys(BUSY_ANNOTATIONS))})`,
+                    message: "no annotation of a folder instance's pod changes but what keeps its node",
+                },
+                {
+                    expression: "request.operation != 'UPDATE' || object.metadata.?ownerReferences.orValue([]).all(owner, owner in oldObject.metadata.?ownerReferences.orValue([]))",
+                    message: "a pod of the folder namespace gets no owner it had not",
+                },
+            ],
+        },
+    };
+    const binding = { apiVersion: "admissionregistration.k8s.io/v1", kind: "ValidatingAdmissionPolicyBinding", metadata, spec: { policyName: FOLDER_POD_POLICY, validationActions: ["Deny"] } };
+    return [policy, binding];
+}
+/** What the sandbox gateway, `maker`, may make as a Secret in the folder namespace, `namespace`: a folder instance's token, of its one key, named for its pod. */
+export function folderSecretPolicy({ namespace, maker }) {
+    return admissionPolicy(componentName("folder-secrets"), [{ apiGroups: [""], resources: ["secrets"], operations: ["CREATE", "UPDATE"] }], `request.userInfo.username == ${JSON.stringify(maker)}`, [{
+            expression: `request.namespace == ${JSON.stringify(namespace)} && object.?type.orValue("Opaque") == "Opaque" && ` +
+                `object.metadata.name.matches(${JSON.stringify(`^${FOLDER_POD.source.slice(1, -1)}${literally(folderTokenSecret(""))}$`)}) && ` +
+                `object.?data.orValue({}).all(key, key == "token")`,
+            message: "the sandbox gateway makes no Secret but a folder instance's token, in the folder namespace",
+        }]);
+}
+/**
+ * What the sandbox gateway, `maker`, may delete in the folder namespace, `namespace`, as RBAC
+ * lets it delete any pod and Secret there: a folder instance's pod, of the folder pool, and a
+ * folder instance's token's Secret, alone.
+ */
+export function folderDeletionPolicy({ namespace, maker }) {
+    const pool = `oldObject.metadata.?labels.orValue({})`;
+    return admissionPolicy(componentName("folder-deletions"), [{ apiGroups: [""], resources: ["pods", "secrets"], operations: ["DELETE"] }], `request.userInfo.username == ${JSON.stringify(maker)} && request.namespace == ${JSON.stringify(namespace)}`, [
+        {
+            expression: `request.resource.resource != "pods" || (oldObject.metadata.name.matches(${JSON.stringify(FOLDER_POD.source)}) && ${JSON.stringify(POOL_LABEL)} in ${pool} && ${pool}[${JSON.stringify(POOL_LABEL)}] == ${JSON.stringify(FOLDER_POOL)})`,
+            message: "the sandbox gateway deletes no pod in the folder namespace but a folder instance's",
+        },
         {
-            expression: `${restoring} == (${JSON.stringify(RESTORE_PAUSED_ANNOTATION)} in ${annotations}) && (!${restoring} || ${gated})`,
-            message: "alasio restores a Sandbox from a snapshot only paused, its pod ready once resumed, and pauses none it does not restore",
+            expression: `request.resource.resource != "secrets" || oldObject.metadata.name.matches(${JSON.stringify(`^${FOLDER_POD.source.slice(1, -1)}${literally(folderTokenSecret(""))}$`)})`,
+            message: "the sandbox gateway deletes no Secret in the folder namespace but a folder instance's token",
         },
-    ], [...ofSessions, ...ofHost]);
+    ]);
 }
 /**
  * The fields of a pod's status but its conditions that every Kubernetes alasio runs on
@@ -417,39 +761,31 @@ const POD_STATUS_FIELDS = [
     "startTime",
 ];
 /**
- * What the alasio of `account` may change of a pod's status, as it lets a restored session's
- * pod be ready once its node's agent resumed its sandbox (src/sandbox/snapshots.ts): the
- * RESUMED_CONDITION of a session's pod in `namespace` that is gated on it, set true, and
- * nothing else, its addresses above all, which network policies are programmed from.
+ * What `account`, the sandbox gateway's, may change of a pod's status, as it lets a restore's
+ * pod be ready once its node's agent resumed its sandbox (src/gateway/snapshots.ts): the
+ * RESUMED_CONDITION of a pool's pod in `namespace` that is gated on it, set true, and nothing
+ * else, its addresses above all, which network policies are programmed from. RBAC lets it
+ * patch the status of any pod of the namespace, whole.
  */
 export function resumedConditionPolicy(name, account, namespace) {
     const resumed = JSON.stringify(RESUMED_CONDITION);
     const others = (object) => `${object}.status.?conditions.orValue([]).filter(condition, condition.type != ${resumed})`;
     return admissionPolicy(name, [{ apiGroups: [""], resources: ["pods/status"], operations: ["UPDATE"] }], `request.userInfo.username == "${account}"`, [
         {
-            expression: `request.namespace == ${JSON.stringify(namespace)} && ${JSON.stringify(WORKLOAD_LABEL)} in object.metadata.?labels.orValue({}) && ` +
-                `object.metadata.labels[${JSON.stringify(WORKLOAD_LABEL)}] == "session" && ` +
+            expression: `request.namespace == ${JSON.stringify(namespace)} && ${JSON.stringify(POOL_LABEL)} in object.metadata.?labels.orValue({}) && ` +
                 `object.spec.?readinessGates.orValue([]).exists(gate, gate.conditionType == ${resumed})`,
-            message: "alasio sets the status of no pod but a restored session's",
+            message: "the sandbox gateway sets the status of no pod but a restore's of its pools'",
         },
         {
             expression: `${others("object")} == ${others("oldObject")} && ` +
                 `object.status.?conditions.orValue([]).all(condition, condition.type != ${resumed} || condition.status == "True")`,
-            message: `alasio sets no condition of a pod's but ${RESUMED_CONDITION}, and that true`,
+            message: `the sandbox gateway sets no condition of a pod's but ${RESUMED_CONDITION}, and that true`,
         },
         {
             expression: POD_STATUS_FIELDS.map((field) => `(has(object.status.${field}) ? has(oldObject.status.${field}) && object.status.${field} == oldObject.status.${field} : !has(oldObject.status.${field}))`).join(" && ") +
                 " && object.metadata.?labels.orValue({}) == oldObject.metadata.?labels.orValue({}) && object.metadata.?annotations.orValue({}) == oldObject.metadata.?annotations.orValue({})",
-            message: "alasio changes nothing of a pod's status but its conditions, nor its labels or annotations",
+            message: "the sandbox gateway changes nothing of a pod's status but its conditions, nor its labels or annotations",
         },
     ]);
 }
-/** What alasio may make as a Secret: a Sandbox's token, of its one key, as tokenSecretManifest makes it. Main's alasio's and each branch environment's. */
-export function secretPolicy() {
-    return admissionPolicy(componentName("secrets"), [{ apiGroups: [""], resources: ["secrets"], operations: ["CREATE", "UPDATE"] }], BY_ANY_ALASIO, [{
-            expression: `object.?type.orValue("Opaque") == "Opaque" && object.metadata.name.endsWith(${JSON.stringify(tokenSecretName(""))}) && ` +
-                `object.?data.orValue({}).all(key, key == ${JSON.stringify(TOKEN_KEY)})`,
-            message: "alasio makes no Secret but a Sandbox's token",
-        }]);
-}
 //# sourceMappingURL=admission.js.map