feature(server,helm): support env override for api_key

[sauce-git]

Summary

Add OPENSANDBOX_SERVER_API_KEY environment variable to override server.api_key from TOML config.

Problem

Previously, OpenSandbox only supported API key configuration via a config file. However, in environments such as Kubernetes, secrets are typically injected via environment variables, making it difficult to integrate OpenSandbox securely without additional workarounds.

Changes

• Add _apply_env_overrides() to apply env vars after parsing
• Define API_KEY_ENV_VAR constant for the environment variable name
• Accept extraEnv in server Helm chart

Testing

• Not run (explain why)
• Unit tests
• Integration tests
• e2e / manual verification

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[CLAassistant]

All committers have signed the CLA.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5364838ea

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[Copilot]

Pull request overview

This PR adds support for overriding server.api_key via the OPENSANDBOX_SERVER_API_KEY environment variable and wires that into the server Helm chart so Kubernetes deployments can source the API key from container env instead of baking it into config.toml. It extends the server’s configuration-loading path and the chart values/template used to deploy the API service.

Changes:

• Added API key env-override handling in server/opensandbox_server/config.py.
• Added config tests covering env override precedence over TOML values.
• Added extraEnv support to the opensandbox-server Helm chart so operators can inject OPENSANDBOX_SERVER_API_KEY.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
server/tests/test_config.py	Adds tests for API key override behavior and TOML fallback behavior.
server/opensandbox_server/config.py	Introduces the new env var constant and applies env-based config overrides after TOML parsing.
kubernetes/charts/opensandbox-server/values.yaml	Adds chart values for passing additional container environment variables.
kubernetes/charts/opensandbox-server/templates/server.yaml	Renders extraEnv into the server Deployment container spec.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Pangjiping]

I'm not sure what the purpose of doing this is.

[sauce-git]

@Pangjiping

Previously, OpenSandbox only supported API key configuration via a config file. However, in environments such as Kubernetes, secrets are typically injected via environment variables, making it difficult to integrate OpenSandbox securely without additional workarounds.

[Pangjiping]

LGTM