feat(runtimeclass): add dedicated execTerminal capability

api/v1alpha/runtimeclass_types.go

@@ -30,7 +30,7 @@ type RuntimeClassControllerName string
 // decline. Enumerating the features keeps a class from declaring one that no
 // provider can interpret.
 //
-// +kubebuilder:validation:Enum=sandboxRuntime;virtualMachineRuntime;configMapVolumes;secretVolumes;diskVolumes;deviceVolumeAttachments;envFrom;imagePullSecrets;containerCapabilities;sandboxSysctls;exec;gracefulTermination
+// +kubebuilder:validation:Enum=sandboxRuntime;virtualMachineRuntime;configMapVolumes;secretVolumes;diskVolumes;deviceVolumeAttachments;envFrom;imagePullSecrets;containerCapabilities;sandboxSysctls;exec;execTerminal;gracefulTermination
 type RuntimeClassFeature string
 
 const (
@@ -80,10 +80,13 @@ const (
 	RuntimeClassFeatureSandboxSysctls RuntimeClassFeature = "sandboxSysctls"
 
 	// RuntimeClassFeatureExec is the ability to run a command in a running
-	// instance's container through an InstanceConsoleSession, such as an
-	// interactive shell.
+	// instance's container through an InstanceConsoleSession.
 	RuntimeClassFeatureExec RuntimeClassFeature = "exec"
 
+	// RuntimeClassFeatureExecTerminal is the ability to give a shell session's
+	// command an interactive terminal. A class declaring it also declares exec.
+	RuntimeClassFeatureExecTerminal RuntimeClassFeature = "execTerminal"
+
 	// RuntimeClassFeatureGracefulTermination is the ability to signal an
 	// instance's processes when it stops and wait up to the instance's
 	// termination grace period for them to exit.
@@ -105,6 +108,7 @@ var runtimeClassFeatureDescriptions = map[RuntimeClassFeature]string{
 	RuntimeClassFeatureContainerCapabilities:   "container capability requests",
 	RuntimeClassFeatureSandboxSysctls:          "sandbox sysctls",
 	RuntimeClassFeatureExec:                    "shell sessions into running instances",
+	RuntimeClassFeatureExecTerminal:            "interactive terminals in shell sessions",
 	RuntimeClassFeatureGracefulTermination:     "termination grace periods",
 }
 
@@ -195,6 +199,7 @@ type RuntimeClassIsolation struct {
 // +kubebuilder:validation:XValidation:message="supportedSysctls requires the sandboxSysctls feature",rule="!has(self.supportedSysctls) || size(self.supportedSysctls) == 0 || (has(self.features) && 'sandboxSysctls' in self.features)"
 // +kubebuilder:validation:XValidation:message="the sandboxSysctls feature requires a non-empty supportedSysctls",rule="!has(self.features) || !('sandboxSysctls' in self.features) || (has(self.supportedSysctls) && size(self.supportedSysctls) > 0)"
 // +kubebuilder:validation:XValidation:message="the sandboxSysctls feature requires the sandboxRuntime feature",rule="!has(self.features) || !('sandboxSysctls' in self.features) || 'sandboxRuntime' in self.features"
+// +kubebuilder:validation:XValidation:message="the execTerminal feature requires the exec feature",rule="!has(self.features) || !('execTerminal' in self.features) || 'exec' in self.features"
 type RuntimeClassCapabilities struct {
 	// The optional parts of the instance API this class serves. Anything absent
 	// is unsupported, so a class that omits a feature rejects requests for it

config/base/crd/bases/compute.datumapis.com_runtimeclasses.yaml

@@ -116,6 +116,7 @@ spec:
                       - containerCapabilities
                       - sandboxSysctls
                       - exec
+                      - execTerminal
                       - gracefulTermination
                       type: string
                     maxItems: 32
@@ -221,6 +222,9 @@ spec:
                     feature
                   rule: '!has(self.features) || !(''sandboxSysctls'' in self.features)
                     || ''sandboxRuntime'' in self.features'
+                - message: the execTerminal feature requires the exec feature
+                  rule: '!has(self.features) || !(''execTerminal'' in self.features)
+                    || ''exec'' in self.features'
               controllerName:
                 description: |-
                   The controller that implements this class. A provider watches for classes

docs/api/runtimeclasses.md

@@ -104,7 +104,7 @@ Spec is the published contract for this execution tier.
         <td>
           What this class can serve, and what it cannot.<br/>
           <br/>
-            <i>Validations</i>:<li>!has(self.grantableCapabilities) || size(self.grantableCapabilities) == 0 || (has(self.features) && 'containerCapabilities' in self.features): grantableCapabilities requires the containerCapabilities feature</li><li>!has(self.features) || !('containerCapabilities' in self.features) || (has(self.grantableCapabilities) && size(self.grantableCapabilities) > 0): the containerCapabilities feature requires a non-empty grantableCapabilities</li><li>!has(self.supportedSysctls) || size(self.supportedSysctls) == 0 || (has(self.features) && 'sandboxSysctls' in self.features): supportedSysctls requires the sandboxSysctls feature</li><li>!has(self.features) || !('sandboxSysctls' in self.features) || (has(self.supportedSysctls) && size(self.supportedSysctls) > 0): the sandboxSysctls feature requires a non-empty supportedSysctls</li><li>!has(self.features) || !('sandboxSysctls' in self.features) || 'sandboxRuntime' in self.features: the sandboxSysctls feature requires the sandboxRuntime feature</li>
+            <i>Validations</i>:<li>!has(self.grantableCapabilities) || size(self.grantableCapabilities) == 0 || (has(self.features) && 'containerCapabilities' in self.features): grantableCapabilities requires the containerCapabilities feature</li><li>!has(self.features) || !('containerCapabilities' in self.features) || (has(self.grantableCapabilities) && size(self.grantableCapabilities) > 0): the containerCapabilities feature requires a non-empty grantableCapabilities</li><li>!has(self.supportedSysctls) || size(self.supportedSysctls) == 0 || (has(self.features) && 'sandboxSysctls' in self.features): supportedSysctls requires the sandboxSysctls feature</li><li>!has(self.features) || !('sandboxSysctls' in self.features) || (has(self.supportedSysctls) && size(self.supportedSysctls) > 0): the sandboxSysctls feature requires a non-empty supportedSysctls</li><li>!has(self.features) || !('sandboxSysctls' in self.features) || 'sandboxRuntime' in self.features: the sandboxSysctls feature requires the sandboxRuntime feature</li><li>!has(self.features) || !('execTerminal' in self.features) || 'exec' in self.features: the execTerminal feature requires the exec feature</li>
         </td>
         <td>true</td>
       </tr><tr>
@@ -249,7 +249,7 @@ statement before committing an image to the tier.<br/>
 is unsupported, so a class that omits a feature rejects requests for it
 rather than serving it by accident.<br/>
           <br/>
-            <i>Enum</i>: sandboxRuntime, virtualMachineRuntime, configMapVolumes, secretVolumes, diskVolumes, deviceVolumeAttachments, envFrom, imagePullSecrets, containerCapabilities, sandboxSysctls, exec, gracefulTermination<br/>
+            <i>Enum</i>: sandboxRuntime, virtualMachineRuntime, configMapVolumes, secretVolumes, diskVolumes, deviceVolumeAttachments, envFrom, imagePullSecrets, containerCapabilities, sandboxSysctls, exec, execTerminal, gracefulTermination<br/>
         </td>
         <td>false</td>
       </tr><tr>

internal/validation/runtimeclass_crd_test.go

@@ -196,6 +196,21 @@ func TestRuntimeClassCRD(t *testing.T) {
 			"the sandboxSysctls feature requires the sandboxRuntime feature")
 	})
 
+	t.Run("the terminal feature requires exec", func(t *testing.T) {
+		class := newCatalogEntry("terminal-without-exec")
+		class.Spec.Capabilities.Features = append(class.Spec.Capabilities.Features,
+			computev1alpha.RuntimeClassFeatureExecTerminal)
+		require.ErrorContains(t, c.Create(ctx, class),
+			"the execTerminal feature requires the exec feature")
+	})
+
+	t.Run("a class may declare terminals with exec", func(t *testing.T) {
+		class := newCatalogEntry("terminal-with-exec")
+		class.Spec.Capabilities.Features = append(class.Spec.Capabilities.Features,
+			computev1alpha.RuntimeClassFeatureExec, computev1alpha.RuntimeClassFeatureExecTerminal)
+		require.NoError(t, c.Create(ctx, class))
+	})
+
 	for i, invalid := range []string{
 		"net..ipv4.forwarding",
 		"net.ipv4.forwarding.",

pkg/runtimeclass/capabilities.go

@@ -42,6 +42,7 @@ const (
 	FeatureContainerCapabilities   = computev1alpha.RuntimeClassFeatureContainerCapabilities
 	FeatureSandboxSysctls          = computev1alpha.RuntimeClassFeatureSandboxSysctls
 	FeatureExec                    = computev1alpha.RuntimeClassFeatureExec
+	FeatureExecTerminal            = computev1alpha.RuntimeClassFeatureExecTerminal
 	FeatureGracefulTermination     = computev1alpha.RuntimeClassFeatureGracefulTermination
 )
 

pkg/runtimeclass/capabilities_test.go

@@ -69,6 +69,7 @@ func TestFeatureDescriptions(t *testing.T) {
 		FeatureContainerCapabilities,
 		FeatureSandboxSysctls,
 		FeatureExec,
+		FeatureExecTerminal,
 		FeatureGracefulTermination,
 	}