fix(kubernetes): address PVC config review follow-up

Signed-off-by: mjamiv <michael.commack@gmail.com>

Author: mjamiv

crates/openshell-core/src/driver_mounts.rs

@@ -33,11 +33,6 @@ const RESERVED_MOUNT_TARGETS: &[&str] = &[
     "/run/netns",
 ];
 
-/// Serde default helper for mount options that default to read-only.
-pub fn default_true() -> bool {
-    true
-}
-
 /// Validate a non-empty driver mount source.
 pub fn validate_mount_source(source: &str, field: &str) -> Result<(), String> {
     if source.is_empty() {

crates/openshell-driver-docker/src/lib.rs

@@ -262,15 +262,15 @@ enum DockerDriverMountConfig {
     Bind {
         source: String,
         target: String,
-        #[serde(default = "driver_mounts::default_true")]
+        #[serde(default = "default_true")]
         read_only: bool,
         #[serde(default)]
         selinux_label: Option<SelinuxLabel>,
     },
     Volume {
         source: String,
         target: String,
-        #[serde(default = "driver_mounts::default_true")]
+        #[serde(default = "default_true")]
         read_only: bool,
         #[serde(default)]
         subpath: Option<String>,
@@ -287,13 +287,17 @@ enum DockerDriverMountConfig {
     Image {
         source: String,
         target: String,
-        #[serde(default = "driver_mounts::default_true")]
+        #[serde(default = "default_true")]
         read_only: bool,
         #[serde(default)]
         subpath: Option<String>,
     },
 }
 
+fn default_true() -> bool {
+    true
+}
+
 type WatchStream =
     Pin<Box<dyn Stream<Item = Result<WatchSandboxesEvent, Status>> + Send + 'static>>;
 

crates/openshell-driver-kubernetes/README.md

@@ -117,13 +117,13 @@ nested schema and currently accepts:
 - `pod.priority_class_name`
 - `containers.agent.resources.requests`
 - `containers.agent.resources.limits`
-- `volumes[].name`
-- `volumes[].persistent_volume_claim.claim_name`
-- `volumes[].persistent_volume_claim.read_only`
 - `containers.agent.volume_mounts[].name`
 - `containers.agent.volume_mounts[].mount_path`
 - `containers.agent.volume_mounts[].sub_path`
 - `containers.agent.volume_mounts[].read_only`
+- `volumes[].name`
+- `volumes[].persistent_volume_claim.claim_name`
+- `volumes[].persistent_volume_claim.read_only`
 
 Nested keys inside the `kubernetes` block use snake_case. The top-level
 `driver_config` envelope is keyed by driver names, so `kubernetes` is not part
@@ -151,9 +151,9 @@ Use PVC volumes to mount existing Kubernetes PersistentVolumeClaims into the
 agent container. PVC volumes and mounts default to read-only unless
 `read_only: false` is set explicitly. Read-write access requires
 `read_only: false` on both the PVC volume and each writable mount. The driver
-rejects duplicate volume names, invalid DNS-1123 volume or PVC claim names,
-mounts that reference unknown volumes, non-normalized or protected mount paths,
-and absolute or parent-traversing `sub_path` values.
+rejects duplicate volume names, invalid DNS-1123 volume labels or PVC claim
+subdomain names, mounts that reference unknown volumes, non-normalized or
+protected mount paths, and absolute or parent-traversing `sub_path` values.
 
 Any explicit driver-config mount under `/sandbox` disables the driver's
 default `/sandbox` workspace PVC injection for that sandbox. Only the explicit