20260401-0201

backend/cmd/server/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"log"
 	"log/slog"
 	"net/http"
@@ -24,6 +25,10 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+type namespaceEnsurer interface {
+	EnsureNamespace(ctx context.Context) error
+}
+
 func main() {
 	mode := "server"
 	if len(os.Args) > 1 && os.Args[1] != "" {
@@ -127,10 +132,9 @@ func runServer() {
 	}
 
 	ctx := context.Background()
-	if err := k8sClient.EnsureNamespace(ctx); err != nil {
+	if err := ensureSandboxNamespaceIfRequired(ctx, k8sClient, true); err != nil {
 		log.Fatalf("Failed to ensure namespace: %v", err)
 	}
-	slog.Info("sandbox namespace ensured", "component", "k8s", "namespace", k8sClient.SandboxNamespace())
 
 	// Ensure network policies are applied
 	netPolicyMgr := k8s.NewNetworkPolicyManager(k8sClient)
@@ -366,7 +370,7 @@ func runNetworkController() {
 	}
 
 	ctx := context.Background()
-	if err := k8sClient.EnsureNamespace(ctx); err != nil {
+	if err := ensureSandboxNamespaceIfRequired(ctx, k8sClient, false); err != nil {
 		log.Fatalf("Failed to ensure namespace: %v", err)
 	}
 
@@ -391,3 +395,18 @@ func runNetworkController() {
 	<-quit
 	log.Println("Shutting down network controller...")
 }
+
+func ensureSandboxNamespaceIfRequired(ctx context.Context, ensurer namespaceEnsurer, required bool) error {
+	if !required {
+		slog.Info("skipping sandbox namespace ensure", "component", "k8s")
+		return nil
+	}
+	if ensurer == nil {
+		return errors.New("namespace ensurer is nil")
+	}
+	if err := ensurer.EnsureNamespace(ctx); err != nil {
+		return err
+	}
+	slog.Info("sandbox namespace ensured", "component", "k8s")
+	return nil
+}

backend/cmd/server/main_test.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+type fakeNamespaceEnsurer struct {
+	calls int
+	err   error
+}
+
+func (f *fakeNamespaceEnsurer) EnsureNamespace(context.Context) error {
+	f.calls++
+	return f.err
+}
+
+func TestEnsureSandboxNamespaceIfRequiredSkipsWhenNotRequired(t *testing.T) {
+	ensurer := &fakeNamespaceEnsurer{}
+
+	if err := ensureSandboxNamespaceIfRequired(context.Background(), ensurer, false); err != nil {
+		t.Fatalf("ensureSandboxNamespaceIfRequired returned error: %v", err)
+	}
+	if ensurer.calls != 0 {
+		t.Fatalf("EnsureNamespace called %d times, want 0", ensurer.calls)
+	}
+}
+
+func TestEnsureSandboxNamespaceIfRequiredCallsEnsurer(t *testing.T) {
+	ensurer := &fakeNamespaceEnsurer{}
+
+	if err := ensureSandboxNamespaceIfRequired(context.Background(), ensurer, true); err != nil {
+		t.Fatalf("ensureSandboxNamespaceIfRequired returned error: %v", err)
+	}
+	if ensurer.calls != 1 {
+		t.Fatalf("EnsureNamespace called %d times, want 1", ensurer.calls)
+	}
+}
+
+func TestEnsureSandboxNamespaceIfRequiredReturnsEnsurerError(t *testing.T) {
+	ensurer := &fakeNamespaceEnsurer{err: errors.New("forbidden")}
+
+	err := ensureSandboxNamespaceIfRequired(context.Background(), ensurer, true)
+	if err == nil || err.Error() != "forbidden" {
+		t.Fatalf("ensureSandboxNamespaceIfRequired error = %v, want forbidden", err)
+	}
+	if ensurer.calls != 1 {
+		t.Fatalf("EnsureNamespace called %d times, want 1", ensurer.calls)
+	}
+}