fix: don't set Privileged when AllowPrivilegeEscalation is false for skills (#1551)

## Problem

When an `Agent` spec includes a container `securityContext` with
`allowPrivilegeEscalation: false` (PSS Restricted profile) **and** the
agent
has `spec.skills.refs` configured, the controller generates an invalid
pod spec:

```
cannot set allowPrivilegeEscalation to false and privileged to true
```

Kubernetes rejects this combination at admission time, leaving the agent
stuck
in a reconciliation loop with all pods failing to start.

## Root cause

`buildManifest()` sets `needSandbox = true` when skills are present
(because
skills use `BashTool` which calls `srt` → bubblewrap for sandboxing),
then
blindly sets `Privileged: true` on whatever `securityContext` is
provided —
including one that already has `AllowPrivilegeEscalation: false`.

The securityContext merge did not check for this conflict before setting
`Privileged: true`.

## Fix

Add a helper `allowPrivilegeEscalationExplicitlyFalse()` that detects
when the
user has opted out of privilege escalation, and skip `Privileged: true`
in
that case.

When `Privileged` is withheld, `srt` degrades gracefully: on modern
kernels
(EKS, GKE, AL2023 ≥ 5.10) that have unprivileged user namespaces enabled
(`user.max_user_namespaces > 0`), bubblewrap can still create sandboxes
using
`clone(CLONE_NEWUSER)` without requiring a privileged seccomp profile.

> **Note on seccomp**: The containerd `RuntimeDefault` seccomp profile
blocks
> `clone(CLONE_NEWUSER)` without `CAP_SYS_ADMIN`. Users who need full
bwrap
> sandbox execution (running bash scripts inside skills) must
additionally
> provide a custom `seccompProfile: Localhost` with a profile that
allows
> user namespace syscalls. This PR makes agent deployment possible for
> PSS-Restricted namespaces; the seccomp tuning is an operational
concern
> separate from this bug.

## Behaviour matrix

| Agent spec | needSandbox | Result |
|---|---|---|
| skills or executeCode, **no** custom securityContext | `true` |
`Privileged: true` — full bwrap sandbox (unchanged) |
| skills + `allowPrivilegeEscalation: false` | `true` | No `Privileged`
— srt uses user-namespace mode |
| executeCode + `allowPrivilegeEscalation: false` | `true` | No
`Privileged` — srt uses user-namespace mode |
| No skills, no executeCode | `false` | No securityContext created
(unchanged) |

## Changes

### `go/core/internal/controller/translator/agent/adk_api_translator.go`

- Add comment explaining *why* `needSandbox = true` for skills (BashTool
→ srt → bwrap)
- Fix securityContext merge: guard `Privileged: true` with
`allowPrivilegeEscalationExplicitlyFalse()`
- Add `allowPrivilegeEscalationExplicitlyFalse()` helper

###
`go/core/internal/controller/translator/agent/security_context_test.go`

- Replace `TestSecurityContext_WithSandbox` (which tested an internally
  contradictory state) with two focused tests:
  - `TestSecurityContext_SkillsDefaultPrivilegedSandbox`: no custom
    securityContext → `Privileged: true` (default sandbox path)
- `TestSecurityContext_SkillsPSSRestricted`: `allowPrivilegeEscalation:
false`
    → no `Privileged`, original securityContext fields preserved intact

## Testing

```bash
cd go
go test -race -skip 'TestE2E.*' -v ./core/internal/controller/translator/agent/...
```

All existing tests pass. Two new tests cover both code paths.

## Related

- PSS Restricted policy:
https://kubernetes.io/docs/concepts/security/pod-security-standards/
- Bubblewrap user namespaces:
https://github.com/containers/bubblewrap#usage

Signed-off-by: skhedim <sebastien.khedim@gmail.com>
Co-authored-by: Eitan Yarmush <eitan.yarmush@solo.io>

Author: skhedim

go/core/internal/controller/translator/agent/adk_api_translator.go

@@ -452,6 +452,10 @@ func (a *adkApiTranslator) buildManifest(
 			Name:  env.KagentSkillsFolder.Name(),
 			Value: "/skills",
 		}
+		// Skills use the BashTool which calls srt (Anthropic Sandbox Runtime) → bubblewrap.
+		// Mark that a sandbox is needed so Privileged is set when possible.
+		// Exception: if the user explicitly set AllowPrivilegeEscalation=false (PSS Restricted),
+		// we respect their security context and let srt fall back to user-namespace sandboxing.
 		needSandbox = true
 		volumes = append(volumes, corev1.Volume{
 			Name: "kagent-skills",
@@ -515,12 +519,16 @@ func (a *adkApiTranslator) buildManifest(
 	if dep.SecurityContext != nil {
 		// Deep copy the user-provided security context
 		securityContext = dep.SecurityContext.DeepCopy()
-		// If sandbox is needed, ensure Privileged is set (may override user setting)
-		if needSandbox {
+		// Set Privileged for sandbox ONLY if it won't create an invalid securityContext.
+		// Kubernetes rejects {Privileged:true, AllowPrivilegeEscalation:false} as contradictory.
+		// When the user explicitly sets AllowPrivilegeEscalation=false (PSS Restricted namespace),
+		// we respect their choice: srt will use unprivileged user-namespace sandboxing instead.
+		// On modern kernels (EKS, GKE) unprivileged_userns_clone is enabled by default.
+		if needSandbox && !allowPrivilegeEscalationExplicitlyFalse(securityContext) {
 			securityContext.Privileged = new(true)
 		}
 	} else if needSandbox {
-		// Only create security context if sandbox is needed
+		// No user-provided securityContext: create one with Privileged for full sandbox
 		securityContext = &corev1.SecurityContext{
 			Privileged: new(true),
 		}
@@ -1800,3 +1808,11 @@ func (a *adkApiTranslator) runPlugins(ctx context.Context, agent *v1alpha2.Agent
 	}
 	return errs
 }
+
+// allowPrivilegeEscalationExplicitlyFalse reports whether the security context
+// has AllowPrivilegeEscalation explicitly set to false (PSS Restricted profile).
+// This is used to detect when adding Privileged:true would create an invalid
+// securityContext that Kubernetes refuses to admit.
+func allowPrivilegeEscalationExplicitlyFalse(sc *corev1.SecurityContext) bool {
+	return sc != nil && sc.AllowPrivilegeEscalation != nil && !*sc.AllowPrivilegeEscalation
+}

go/core/internal/controller/translator/agent/security_context_test.go

@@ -275,7 +275,83 @@ func TestSecurityContext_OnlyContainerSecurityContext(t *testing.T) {
 	assert.Equal(t, int64(3000), *containerSecurityContext.RunAsGroup)
 }
 
-func TestSecurityContext_WithSandbox(t *testing.T) {
+// TestSecurityContext_SkillsDefaultPrivilegedSandbox verifies that when skills are
+// configured and the user has NOT set any securityContext (i.e., no PSS restriction),
+// the controller sets Privileged=true so that srt/bubblewrap can fully sandbox the BashTool.
+func TestSecurityContext_SkillsDefaultPrivilegedSandbox(t *testing.T) {
+	ctx := context.Background()
+
+	agent := &v1alpha2.Agent{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-agent",
+			Namespace: "test",
+		},
+		Spec: v1alpha2.AgentSpec{
+			Type: v1alpha2.AgentType_Declarative,
+			Skills: &v1alpha2.SkillForAgent{
+				Refs: []string{"test-skill:latest"},
+			},
+			Declarative: &v1alpha2.DeclarativeAgentSpec{
+				SystemMessage: "Test agent",
+				ModelConfig:   "test-model",
+				// No Deployment.SecurityContext set — default behaviour
+			},
+		},
+	}
+
+	modelConfig := &v1alpha2.ModelConfig{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "test-model",
+			Namespace: "test",
+		},
+		Spec: v1alpha2.ModelConfigSpec{
+			Provider: "OpenAI",
+			Model:    "gpt-4o",
+		},
+	}
+
+	scheme := schemev1.Scheme
+	err := v1alpha2.AddToScheme(scheme)
+	require.NoError(t, err)
+
+	kubeClient := fake.NewClientBuilder().
+		WithScheme(scheme).
+		WithObjects(agent, modelConfig).
+		Build()
+
+	defaultModel := types.NamespacedName{
+		Namespace: "test",
+		Name:      "test-model",
+	}
+	translatorInstance := translator.NewAdkApiTranslator(kubeClient, defaultModel, nil, "")
+
+	result, err := translatorInstance.TranslateAgent(ctx, agent)
+	require.NoError(t, err)
+
+	var deployment *appsv1.Deployment
+	for _, obj := range result.Manifest {
+		if dep, ok := obj.(*appsv1.Deployment); ok {
+			deployment = dep
+			break
+		}
+	}
+	require.NotNil(t, deployment)
+	podTemplate := &deployment.Spec.Template
+
+	containerSecurityContext := podTemplate.Spec.Containers[0].SecurityContext
+	require.NotNil(t, containerSecurityContext, "SecurityContext should be created for sandbox")
+	// Without an explicit AllowPrivilegeEscalation=false constraint, skills trigger Privileged=true
+	// so that srt/bubblewrap can use kernel namespaces for full BashTool sandboxing.
+	require.NotNil(t, containerSecurityContext.Privileged, "Privileged should be set when no securityContext restriction")
+	assert.True(t, *containerSecurityContext.Privileged, "Privileged should be true for skills without PSS restrictions")
+}
+
+// TestSecurityContext_SkillsPSSRestricted verifies that when a user explicitly sets
+// AllowPrivilegeEscalation=false (PSS Restricted profile), adding skills does NOT
+// force Privileged=true — which Kubernetes rejects as an invalid combination.
+// srt (Anthropic Sandbox Runtime) falls back to unprivileged user-namespace sandboxing
+// on modern kernels (EKS, GKE) that have unprivileged_userns_clone enabled.
+func TestSecurityContext_SkillsPSSRestricted(t *testing.T) {
 	ctx := context.Background()
 
 	agent := &v1alpha2.Agent{
@@ -294,8 +370,12 @@ func TestSecurityContext_WithSandbox(t *testing.T) {
 				Deployment: &v1alpha2.DeclarativeDeploymentSpec{
 					SharedDeploymentSpec: v1alpha2.SharedDeploymentSpec{
 						SecurityContext: &corev1.SecurityContext{
-							RunAsUser:  new(int64(1000)),
-							RunAsGroup: new(int64(1000)),
+							RunAsUser:                new(int64(1000)),
+							RunAsGroup:               new(int64(1000)),
+							AllowPrivilegeEscalation: new(false),
+							Capabilities: &corev1.Capabilities{
+								Drop: []corev1.Capability{"ALL"},
+							},
 						},
 					},
 				},
@@ -342,9 +422,10 @@ func TestSecurityContext_WithSandbox(t *testing.T) {
 	require.NotNil(t, deployment)
 	podTemplate := &deployment.Spec.Template
 
-	// When sandbox is needed, Privileged should be set even if user provided securityContext
 	containerSecurityContext := podTemplate.Spec.Containers[0].SecurityContext
 	require.NotNil(t, containerSecurityContext)
-	assert.True(t, *containerSecurityContext.Privileged, "Privileged should be true when sandbox is needed")
-	assert.Equal(t, int64(1000), *containerSecurityContext.RunAsUser, "User-provided runAsUser should still be set")
+	// AllowPrivilegeEscalation=false prevents Privileged=true (invalid Kubernetes combination)
+	assert.Nil(t, containerSecurityContext.Privileged, "Privileged must not be set when AllowPrivilegeEscalation=false")
+	assert.Equal(t, int64(1000), *containerSecurityContext.RunAsUser, "User-provided runAsUser should be preserved")
+	assert.False(t, *containerSecurityContext.AllowPrivilegeEscalation, "AllowPrivilegeEscalation should be preserved as false")
 }