Metadata-Version: 2.4
Name: k8s-agent-sandbox-awx
Version: 0.2.0
Summary: Broker-backed, kubeconfig-free overlay for the Agentic Sandbox client.
Keywords: kubernetes,sandbox,agent,broker,identity,attribution
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Operating System :: OS Independent
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: k8s-agent-sandbox-base==0.5.3.post16
Requires-Dist: requests
Requires-Dist: pydantic
Provides-Extra: test
Requires-Dist: pytest; extra == "test"
Dynamic: license-file

# k8s-agent-sandbox-awx

A broker-backed, **kubeconfig-free** overlay for the Agentic Sandbox client. It
adds a `BrokerSandboxClient` that drives the sandbox control plane (create → wait
ready → terminate) through an **identity broker service over HTTPS** instead of the
Kubernetes API — so client applications need no kubeconfig and no direct Kubernetes
API access.

```python
pip install k8s-agent-sandbox-awx
from k8s_agent_sandbox_awx import BrokerSandboxClient, SandboxBrokerConnectionConfig
```

## How it works

The client presents its projected Kubernetes ServiceAccount token to the broker.
The broker **cryptographically verifies** the caller from that token, creates the
`SandboxClaim` under its own identity, and **stamps the verified caller identity**
onto the claim — attribution the client cannot forge.

This package is a purely additive overlay: it builds on
[`k8s-agent-sandbox-base`](https://pypi.org/project/k8s-agent-sandbox-base/) (a
seamed re-publish of the upstream client) and edits zero upstream files. The import
package is `k8s_agent_sandbox_awx`.

## Requirements

- A deployed identity broker service reachable over HTTPS.
- A projected ServiceAccount token whose audience matches the broker's.
- `k8s-agent-sandbox-base` (installed automatically as a dependency).

## License

Apache-2.0 — see `LICENSE`.
