Skip to content

fix(kubernetes): update agent-sandbox to v0.5.4 - #2937

Open
sjenning wants to merge 1 commit into
NVIDIA:mainfrom
sjenning:fix/2764-agent-sandbox-v0.5.4-from-main/sjenning
Open

fix(kubernetes): update agent-sandbox to v0.5.4#2937
sjenning wants to merge 1 commit into
NVIDIA:mainfrom
sjenning:fix/2764-agent-sandbox-v0.5.4-from-main/sjenning

Conversation

@sjenning

@sjenningsjenning commented Aug 25, 2026•
edited
Loading

Copy link
Copy Markdown
Collaborator

🏗️ build-from-issue-agent

Summary

Update OpenShell's default Agent Sandbox dependency from v0.5.0 to v0.5.4 across local Kubernetes setup, E2E, branch CI, and release-canary coverage. Select the renamed release manifest at the v0.5.2 boundary so current releases use sandbox.yaml while the v0.4.6 compatibility lane continues using manifest.yaml.

Related Issue

Closes#2764

Changes

  • Default local and E2E Kubernetes setup to Agent Sandbox v0.5.4.
  • Select manifest.yaml before v0.5.2 and sandbox.yaml for v0.5.2 and later.
  • Update branch E2E and release-canary workflow pins while retaining the v0.4.6 compatibility lane.
  • Add regression coverage for v0.5.4's persistent Suspended=False/NotSuspended running condition.
  • Update Kubernetes setup, Helm prerequisite, generated chart README, and compute-driver lifecycle documentation.

Deviations from Plan

None — implemented as planned.

Testing

  • mise run pre-commit passes
  • Unit tests added/updated
  • E2E setup updated
  • mise run e2e:kubernetes:agent-sandbox-versions passes locally

Tests run:

  • Unit: Kubernetes driver stopped-condition regression; gateway v0.5.4 running-condition regression; legacy stale-suspended resume regression — all pass.
  • Integration:mise run helm:docs:check, shell syntax checks, and release asset resolution for v0.4.6, v0.5.1, v0.5.2, and v0.5.4 — all pass.
  • E2E:mise run e2e:kubernetes:agent-sandbox-versions passes against both Agent Sandbox v0.5.4 (sandbox.yaml) and v0.4.6 (manifest.yaml). All executable tests passed in both runs; the existing user_namespaces test remained ignored as documented in its source.

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

Documentation updated:

  • docs/kubernetes/setup.mdx: use the current sandbox.yaml release asset.
  • deploy/helm/openshell/README.md.gotmpl and generated README: update the Agent Sandbox prerequisite URL.
  • docs/reference/sandbox-compute-drivers.mdx: document Suspended condition status semantics.

@sjenning
fix(kubernetes): update agent-sandbox to v0.5.4
4376382
ClosesNVIDIA#2764
Select the renamed release manifest by Agent Sandbox version, update CI and documentation, and cover v0.5.4 lifecycle conditions.
Signed-off-by: Seth Jennings <sjenning@redhat.com>
@copy-pr-bot

copy-pr-botBot commented Aug 25, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@sjenningsjenning mentioned this pull request Aug 25, 2026
Open
@sjenningsjenning added the test:e2e Requires end-to-end coverage label Aug 25, 2026
@github-actions

github-actionsBot commented Aug 25, 2026

Copy link
Copy Markdown

Label test:e2e applied, but pull-request/2937 does not exist yet. A maintainer needs to comment /ok to test 4376382371c1e75d2d8f75fbaef6eded76b980ff to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

@sjenning

sjenning commented Aug 25, 2026

Copy link
Copy Markdown
CollaboratorAuthor

🏗️ build-from-issue-agent

E2E Test Attestation

Local Kubernetes E2E compatibility tests passed. CI does not currently provide this complete local E2E record.

FieldValue
Commit4376382371c1e75d2d8f75fbaef6eded76b980ff
Commandmise run e2e:kubernetes:agent-sandbox-versions
Gateway modeHelm on ephemeral k3d clusters
Agent Sandbox versionsv0.5.4 (sandbox.yaml) and v0.4.6 (manifest.yaml)
Result✅ Both version lanes passed

Test Summary

  • v0.5.4: 105 passed, 1 ignored
  • v0.4.6: 105 passed, 1 ignored
  • Both ephemeral clusters were deleted successfully.
  • The Fedora host lacked /usr/bin/script; util-linux-script was extracted into a temporary user-owned directory and added to PATH for the PTY lifecycle tests. No repository changes were needed.

Tests Executed

The following set ran against both Agent Sandbox versions:

  • harness::binary::tests::workspace_root_resolves — PASSED
  • harness::container::tests::defaults_to_auto_detected_podman_first — PASSED
  • harness::container::tests::defaults_to_docker_when_podman_is_unavailable — PASSED
  • harness::container::tests::defaults_to_logical_podman_when_docker_is_a_podman_shim — PASSED
  • harness::container::tests::driver_selects_container_engine_without_explicit_engine — PASSED
  • harness::container::tests::explicit_container_engine_wins_over_auto_detection — PASSED
  • harness::container::tests::explicit_docker_rejects_podman_compatibility_shim — PASSED
  • harness::container::tests::explicit_podman_can_use_docker_compatibility_shim — PASSED
  • harness::container::tests::fails_when_no_container_engine_is_available — PASSED
  • harness::container::tests::ignores_non_container_drivers_and_auto_detects — PASSED
  • harness::container::tests::rejects_explicit_driver_conflict — PASSED
  • harness::container::tests::rejects_invalid_explicit_engine — PASSED
  • harness::container::tests::rejects_removed_selector — PASSED
  • harness::output::tests::extract_field_finds_value — PASSED
  • harness::output::tests::extract_field_missing_returns_none — PASSED
  • harness::output::tests::extract_field_with_ansi — PASSED
  • harness::output::tests::strip_ansi_passthrough_plain_text — PASSED
  • harness::output::tests::strip_ansi_removes_color_codes — PASSED
  • harness::port::tests::find_free_port_returns_nonzero — PASSED
  • harness::port::tests::wait_for_port_succeeds_when_listening — PASSED
  • harness::port::tests::wait_for_port_times_out_when_nothing_listens — PASSED
  • bypass_attempt_is_rejected_fast — PASSED
  • gateway_add_creates_cf_metadata — PASSED
  • gateway_add_derives_name_from_hostname — PASSED
  • gateway_add_help_shows_flags — PASSED
  • gateway_add_rejects_duplicate_name — PASSED
  • gateway_add_rejects_removed_ssh_key_flag — PASSED
  • gateway_add_remote_and_local_conflict — PASSED
  • gateway_add_ssh_url_conflicts_with_local — PASSED
  • gateway_add_ssh_url_conflicts_with_remote — PASSED
  • gateway_add_ssh_url_requires_port — PASSED
  • gateway_help_omits_lifecycle_commands — PASSED
  • gateway_help_shows_add_and_login — PASSED
  • gateway_login_help_is_recognized — PASSED
  • gateway_add_can_shadow_system_gateway_with_user_registration — PASSED
  • gateway_help_shows_subcommands — PASSED
  • gateway_lifecycle_subcommands_are_removed — PASSED
  • gateway_list_json_includes_user_and_system_sources — PASSED
  • gateway_list_table_shows_user_and_system_sources — PASSED
  • gateway_remove_rejects_system_only_registration_and_preserves_entry — PASSED
  • help_shows_restructured_commands — PASSED
  • sandbox_connect_help_shows_editor_flag — PASSED
  • sandbox_create_help_shows_new_flags — PASSED
  • sandbox_help_shows_upload_download — PASSED
  • status_without_gateway_prints_friendly_message — PASSED
  • sandbox_from_community_base_image — PASSED
  • sandbox_from_explicit_ghcr_image — PASSED
  • sandbox_processes_disable_core_dumps — PASSED
  • credentialed_endpoint_gates_work_end_to_end — PASSED
  • gateway_status_reports_healthy — PASSED
  • ws_tunnel_status_through_edge_proxy — PASSED
  • graphql_l7_enforces_allow_and_deny_rules_on_forward_and_connect_paths — PASSED
  • jsonrpc_forward_proxy_hard_denies_response_frames_in_default_audit_mode — PASSED
  • jsonrpc_l7_enforces_method_rules_on_forward_and_connect_paths — PASSED
  • forward_proxy_allows_l7_permitted_request — PASSED
  • forward_proxy_denies_l7_blocked_request — PASSED
  • inference_set_supports_no_verify_for_unreachable_endpoint — PASSED
  • sandbox_inference_local_routes_to_host_openshell_internal — PASSED
  • sandbox_reaches_host_openshell_internal_via_host_gateway_alias — PASSED
  • static_provider_credentials_are_bound_to_profile_endpoints — PASSED
  • kubernetes_corporate_proxy_uses_secret_and_never_falls_back — PASSED
  • hard_requirement_accepts_enriched_device_path — PASSED
  • initial_sparse_policy_is_acknowledged_as_loaded — PASSED
  • live_policy_update_from_empty_network_policies — PASSED
  • live_policy_update_round_trip — PASSED
  • local_driver_restart_or_stop_respects_main_process_lifecycle — PASSED
  • sandbox_bypasses_proxy_for_localhost_http — PASSED
  • port_forward_echo — PASSED
  • auto_created_provider_credential_available_in_sandbox — PASSED
  • ambiguous_policy_update_is_rejected_without_replacing_active_policy — PASSED
  • destination_denial_modes_match_across_connect_and_forward_adapters — PASSED
  • explicit_allowed_ips_and_implicit_ip_literals_succeed_through_both_adapters — PASSED
  • fail_closed_middleware_blocks_uninspectable_connect_payload_before_upstream — PASSED
  • fail_open_middleware_bypasses_uninspectable_tls_skip_connect — PASSED
  • forward_pipeline_never_reaches_upstream_as_first_request_overflow — PASSED
  • http_credentials_are_rewritten_in_headers_and_bodies_for_both_adapters — PASSED
  • middleware_redacts_request_bodies_through_both_adapters — PASSED
  • policy_reload_updates_both_adapters_and_closes_existing_http_tunnel — PASSED
  • tls_skip_connect_relays_opaque_bytes_bidirectionally — PASSED
  • readyz_reports_healthy_database_check — PASSED
  • sandbox_labels_are_stored_and_filterable — PASSED
  • canonical_main_disconnect_reconnect_replays_history_for_same_process — PASSED
  • canonical_main_exit_transitions_persistent_sandbox_to_error — PASSED
  • canonical_tty_main_uses_sandbox_environment — PASSED
  • sandbox_can_be_deleted_while_stopped — PASSED
  • sandbox_create_with_no_keep_cleans_up_after_tty_command — PASSED
  • sandbox_stop_start_preserves_workspace — PASSED
  • settings_global_override_round_trip — PASSED
  • gateway_smoke — PASSED
  • sandbox_download_directory_only — PASSED
  • sandbox_download_file_only — PASSED
  • sandbox_download_handles_dash_leading_basename — PASSED
  • sandbox_download_rejects_symlinks_pointing_outside_workspace — PASSED
  • sandbox_file_upload_download_round_trip — PASSED
  • upload_gitignored_directory_falls_back_to_unfiltered — PASSED
  • upload_respects_gitignore_by_default — PASSED
  • upload_single_file_from_git_repo_only_uploads_that_file — PASSED
  • local_container_native_tcp_uses_policy_dns_and_fails_closed — PASSED
  • rootless_podman_musl_getaddrinfo_uses_udp_policy_dns — PASSED
  • create_with_multiple_uploads — PASSED
  • create_with_upload_directory_preserves_source_basename — PASSED
  • create_with_upload_single_file — PASSED
  • sandbox_pod_spec_has_user_namespace_fields — IGNORED (pre-existing source annotation)
  • websocket_text_placeholder_is_rewritten_through_both_adapters — PASSED
  • workspace_full_crud_lifecycle — PASSED
  • workspace_terminating_rejects_creates — PASSED

@sjenning

sjenning commented Aug 26, 2026

Copy link
Copy Markdown
CollaboratorAuthor

/ok to test 4376382

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalpmrunalpAwaiting requested review from mrunalpmrunalp is a code owner
@derekwaynecarrderekwaynecarrAwaiting requested review from derekwaynecarrderekwaynecarr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

test:e2eRequires end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fix(kubernetes): move agent-sandbox to v0.5.4

1 participant

@sjenning