From 1ed0277b69641a7d064e0cb1c4e38c74a6e21dfe Mon Sep 17 00:00:00 2001
From: sparkzky <sparkhhhhhhhhhh@outlook.com>
Date: Wed, 1 Apr 2026 02:00:15 +0800
Subject: [PATCH] 1

Signed-off-by: sparkzky <sparkhhhhhhhhhh@outlook.com>
---
 backend/cmd/server/main.go      | 25 ++++++++++++++--
 backend/cmd/server/main_test.go | 51 +++++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+), 3 deletions(-)
 create mode 100644 backend/cmd/server/main_test.go

diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index 767b5a5..63f97e0 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"log"
 	"log/slog"
 	"net/http"
@@ -24,6 +25,10 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+type namespaceEnsurer interface {
+	EnsureNamespace(ctx context.Context) error
+}
+
 func main() {
 	mode := "server"
 	if len(os.Args) > 1 && os.Args[1] != "" {
@@ -127,10 +132,9 @@ func runServer() {
 	}
 
 	ctx := context.Background()
-	if err := k8sClient.EnsureNamespace(ctx); err != nil {
+	if err := ensureSandboxNamespaceIfRequired(ctx, k8sClient, true); err != nil {
 		log.Fatalf("Failed to ensure namespace: %v", err)
 	}
-	slog.Info("sandbox namespace ensured", "component", "k8s", "namespace", k8sClient.SandboxNamespace())
 
 	// Ensure network policies are applied
 	netPolicyMgr := k8s.NewNetworkPolicyManager(k8sClient)
@@ -366,7 +370,7 @@ func runNetworkController() {
 	}
 
 	ctx := context.Background()
-	if err := k8sClient.EnsureNamespace(ctx); err != nil {
+	if err := ensureSandboxNamespaceIfRequired(ctx, k8sClient, false); err != nil {
 		log.Fatalf("Failed to ensure namespace: %v", err)
 	}
 
@@ -391,3 +395,18 @@ func runNetworkController() {
 	<-quit
 	log.Println("Shutting down network controller...")
 }
+
+func ensureSandboxNamespaceIfRequired(ctx context.Context, ensurer namespaceEnsurer, required bool) error {
+	if !required {
+		slog.Info("skipping sandbox namespace ensure", "component", "k8s")
+		return nil
+	}
+	if ensurer == nil {
+		return errors.New("namespace ensurer is nil")
+	}
+	if err := ensurer.EnsureNamespace(ctx); err != nil {
+		return err
+	}
+	slog.Info("sandbox namespace ensured", "component", "k8s")
+	return nil
+}
diff --git a/backend/cmd/server/main_test.go b/backend/cmd/server/main_test.go
new file mode 100644
index 0000000..96f6fb6
--- /dev/null
+++ b/backend/cmd/server/main_test.go
@@ -0,0 +1,51 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+type fakeNamespaceEnsurer struct {
+	calls int
+	err   error
+}
+
+func (f *fakeNamespaceEnsurer) EnsureNamespace(context.Context) error {
+	f.calls++
+	return f.err
+}
+
+func TestEnsureSandboxNamespaceIfRequiredSkipsWhenNotRequired(t *testing.T) {
+	ensurer := &fakeNamespaceEnsurer{}
+
+	if err := ensureSandboxNamespaceIfRequired(context.Background(), ensurer, false); err != nil {
+		t.Fatalf("ensureSandboxNamespaceIfRequired returned error: %v", err)
+	}
+	if ensurer.calls != 0 {
+		t.Fatalf("EnsureNamespace called %d times, want 0", ensurer.calls)
+	}
+}
+
+func TestEnsureSandboxNamespaceIfRequiredCallsEnsurer(t *testing.T) {
+	ensurer := &fakeNamespaceEnsurer{}
+
+	if err := ensureSandboxNamespaceIfRequired(context.Background(), ensurer, true); err != nil {
+		t.Fatalf("ensureSandboxNamespaceIfRequired returned error: %v", err)
+	}
+	if ensurer.calls != 1 {
+		t.Fatalf("EnsureNamespace called %d times, want 1", ensurer.calls)
+	}
+}
+
+func TestEnsureSandboxNamespaceIfRequiredReturnsEnsurerError(t *testing.T) {
+	ensurer := &fakeNamespaceEnsurer{err: errors.New("forbidden")}
+
+	err := ensureSandboxNamespaceIfRequired(context.Background(), ensurer, true)
+	if err == nil || err.Error() != "forbidden" {
+		t.Fatalf("ensureSandboxNamespaceIfRequired error = %v, want forbidden", err)
+	}
+	if ensurer.calls != 1 {
+		t.Fatalf("EnsureNamespace called %d times, want 1", ensurer.calls)
+	}
+}