fix(sandbox): Add missing dependencies and SSL/auth support for sandbox testing

- Add cryptography and kubernetes dependencies to cluster-registry
- Add python-jose dependency to realtime-streaming for JWT auth
- Update prometheus_collector to skip TLS verification in dev mode
- Use pod's service account token for Prometheus auth in dev mode

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: fenar

src/cluster-registry/requirements.txt

@@ -23,6 +23,12 @@ structlog>=24.1.0,<25.0.0
 # HTTP client
 httpx>=0.26.0,<0.30.0
 
+# Cryptography for credential encryption
+cryptography>=42.0.0,<43.0.0
+
+# Kubernetes client
+kubernetes>=29.0.0,<30.0.0
+
 # Testing
 pytest>=8.0.0,<9.0.0
 pytest-asyncio>=0.23.0,<1.0.0

src/observability-collector/app/collectors/prometheus_collector.py

@@ -11,6 +11,7 @@
 
 import httpx
 
+from shared.config import get_settings
 from shared.observability import get_logger
 
 logger = get_logger(__name__)
@@ -23,9 +24,14 @@ class PrometheusCollector:
     """
 
     def __init__(self):
+        self.settings = get_settings()
+        # Create client with SSL verification based on settings
+        # In sandbox/development mode, we may skip TLS verification
+        verify = not self.settings.is_development
         self.client = httpx.AsyncClient(
             timeout=httpx.Timeout(30.0, connect=5.0),
             follow_redirects=True,
+            verify=verify,
         )
 
     async def query(
@@ -97,7 +103,7 @@ async def query(
                 "data": self._parse_result(result),
             }
 
-        except asyncio.TimeoutError:
+        except TimeoutError:
             return {
                 "cluster_id": str(cluster["id"]),
                 "cluster_name": cluster["name"],
@@ -193,7 +199,7 @@ async def query_range(
                 "data": self._parse_result(result),
             }
 
-        except asyncio.TimeoutError:
+        except TimeoutError:
             return {
                 "cluster_id": str(cluster["id"]),
                 "cluster_name": cluster["name"],
@@ -251,9 +257,25 @@ async def get_labels(self, cluster: dict) -> list[str]:
 
     def _get_auth_headers(self, cluster: dict) -> dict[str, str]:
         """Get authentication headers for cluster."""
-        # In a real implementation, this would get the token from credentials
-        # For now, return empty headers
-        return {}
+        headers = {}
+
+        # First check if cluster has a token in credentials
+        credentials = cluster.get("credentials", {})
+        token = credentials.get("token")
+
+        # For sandbox/development, use the pod's service account token
+        # if querying the same cluster
+        if not token and self.settings.is_development:
+            try:
+                with open("/var/run/secrets/kubernetes.io/serviceaccount/token") as f:
+                    token = f.read().strip()
+            except FileNotFoundError:
+                pass
+
+        if token:
+            headers["Authorization"] = f"Bearer {token}"
+
+        return headers
 
     def _parse_result(self, result: dict) -> list[dict]:
         """Parse Prometheus result into standard format."""

src/realtime-streaming/requirements.txt

@@ -7,3 +7,6 @@ pydantic>=2.5.0
 pydantic-settings>=2.1.0
 structlog>=24.1.0
 httpx>=0.26.0
+
+# JWT authentication
+python-jose[cryptography]>=3.3.0