Skip to content

fix(kubernetes): update agent-sandbox to v0.5.4 - #2937

Open
sjenning wants to merge 1 commit into
NVIDIA:mainfrom
sjenning:fix/2764-agent-sandbox-v0.5.4-from-main/sjenning
Open

fix(kubernetes): update agent-sandbox to v0.5.4#2937
sjenning wants to merge 1 commit into
NVIDIA:mainfrom
sjenning:fix/2764-agent-sandbox-v0.5.4-from-main/sjenning

Conversation

@sjenning

@sjenning sjenning commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

🏗️ build-from-issue-agent

Summary

Update OpenShell's default Agent Sandbox dependency from v0.5.0 to v0.5.4 across local Kubernetes setup, E2E, branch CI, and release-canary coverage. Select the renamed release manifest at the v0.5.2 boundary so current releases use sandbox.yaml while the v0.4.6 compatibility lane continues using manifest.yaml.

Related Issue

Closes #2764

Changes

  • Default local and E2E Kubernetes setup to Agent Sandbox v0.5.4.
  • Select manifest.yaml before v0.5.2 and sandbox.yaml for v0.5.2 and later.
  • Update branch E2E and release-canary workflow pins while retaining the v0.4.6 compatibility lane.
  • Add regression coverage for v0.5.4's persistent Suspended=False/NotSuspended running condition.
  • Update Kubernetes setup, Helm prerequisite, generated chart README, and compute-driver lifecycle documentation.

Deviations from Plan

None — implemented as planned.

Testing

  • mise run pre-commit passes
  • Unit tests added/updated
  • E2E setup updated
  • mise run e2e:kubernetes:agent-sandbox-versions passes locally

Tests run:

  • Unit: Kubernetes driver stopped-condition regression; gateway v0.5.4 running-condition regression; legacy stale-suspended resume regression — all pass.
  • Integration: mise run helm:docs:check, shell syntax checks, and release asset resolution for v0.4.6, v0.5.1, v0.5.2, and v0.5.4 — all pass.
  • E2E: mise run e2e:kubernetes:agent-sandbox-versions passes against both Agent Sandbox v0.5.4 (sandbox.yaml) and v0.4.6 (manifest.yaml). All executable tests passed in both runs; the existing user_namespaces test remained ignored as documented in its source.

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

Documentation updated:

  • docs/kubernetes/setup.mdx: use the current sandbox.yaml release asset.
  • deploy/helm/openshell/README.md.gotmpl and generated README: update the Agent Sandbox prerequisite URL.
  • docs/reference/sandbox-compute-drivers.mdx: document Suspended condition status semantics.

@sjenning
fix(kubernetes): update agent-sandbox to v0.5.4
4376382 
Closes NVIDIA#2764

Select the renamed release manifest by Agent Sandbox version, update CI and documentation, and cover v0.5.4 lifecycle conditions.

Signed-off-by: Seth Jennings <sjenning@redhat.com>
@sjenning
sjenning requested review from a team, derekwaynecarr and mrunalp as code owners August 25, 2026 21:09
@copy-pr-bot

copy-pr-bot Bot commented Aug 25, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@sjenning sjenning mentioned this pull request Aug 25, 2026
Open
@sjenning sjenning added the test:e2e Requires end-to-end coverage label Aug 25, 2026
@github-actions

github-actions Bot commented Aug 25, 2026

Copy link
Copy Markdown

Label test:e2e applied, but pull-request/2937 does not exist yet. A maintainer needs to comment /ok to test 4376382371c1e75d2d8f75fbaef6eded76b980ff to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

@sjenning

sjenning commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator Author

🏗️ build-from-issue-agent

E2E Test Attestation

Local Kubernetes E2E compatibility tests passed. CI does not currently provide this complete local E2E record.

Field Value
Commit 4376382371c1e75d2d8f75fbaef6eded76b980ff
Command mise run e2e:kubernetes:agent-sandbox-versions
Gateway mode Helm on ephemeral k3d clusters
Agent Sandbox versions v0.5.4 (sandbox.yaml) and v0.4.6 (manifest.yaml)
Result ✅ Both version lanes passed

Test Summary

  • v0.5.4: 105 passed, 1 ignored
  • v0.4.6: 105 passed, 1 ignored
  • Both ephemeral clusters were deleted successfully.
  • The Fedora host lacked /usr/bin/script; util-linux-script was extracted into a temporary user-owned directory and added to PATH for the PTY lifecycle tests. No repository changes were needed.

Tests Executed

The following set ran against both Agent Sandbox versions:

  • harness::binary::tests::workspace_root_resolves — PASSED
  • harness::container::tests::defaults_to_auto_detected_podman_first — PASSED
  • harness::container::tests::defaults_to_docker_when_podman_is_unavailable — PASSED
  • harness::container::tests::defaults_to_logical_podman_when_docker_is_a_podman_shim — PASSED
  • harness::container::tests::driver_selects_container_engine_without_explicit_engine — PASSED
  • harness::container::tests::explicit_container_engine_wins_over_auto_detection — PASSED
  • harness::container::tests::explicit_docker_rejects_podman_compatibility_shim — PASSED
  • harness::container::tests::explicit_podman_can_use_docker_compatibility_shim — PASSED
  • harness::container::tests::fails_when_no_container_engine_is_available — PASSED
  • harness::container::tests::ignores_non_container_drivers_and_auto_detects — PASSED
  • harness::container::tests::rejects_explicit_driver_conflict — PASSED
  • harness::container::tests::rejects_invalid_explicit_engine — PASSED
  • harness::container::tests::rejects_removed_selector — PASSED
  • harness::output::tests::extract_field_finds_value — PASSED
  • harness::output::tests::extract_field_missing_returns_none — PASSED
  • harness::output::tests::extract_field_with_ansi — PASSED
  • harness::output::tests::strip_ansi_passthrough_plain_text — PASSED
  • harness::output::tests::strip_ansi_removes_color_codes — PASSED
  • harness::port::tests::find_free_port_returns_nonzero — PASSED
  • harness::port::tests::wait_for_port_succeeds_when_listening — PASSED
  • harness::port::tests::wait_for_port_times_out_when_nothing_listens — PASSED
  • bypass_attempt_is_rejected_fast — PASSED
  • gateway_add_creates_cf_metadata — PASSED
  • gateway_add_derives_name_from_hostname — PASSED
  • gateway_add_help_shows_flags — PASSED
  • gateway_add_rejects_duplicate_name — PASSED
  • gateway_add_rejects_removed_ssh_key_flag — PASSED
  • gateway_add_remote_and_local_conflict — PASSED
  • gateway_add_ssh_url_conflicts_with_local — PASSED
  • gateway_add_ssh_url_conflicts_with_remote — PASSED
  • gateway_add_ssh_url_requires_port — PASSED
  • gateway_help_omits_lifecycle_commands — PASSED
  • gateway_help_shows_add_and_login — PASSED
  • gateway_login_help_is_recognized — PASSED
  • gateway_add_can_shadow_system_gateway_with_user_registration — PASSED
  • gateway_help_shows_subcommands — PASSED
  • gateway_lifecycle_subcommands_are_removed — PASSED
  • gateway_list_json_includes_user_and_system_sources — PASSED
  • gateway_list_table_shows_user_and_system_sources — PASSED
  • gateway_remove_rejects_system_only_registration_and_preserves_entry — PASSED
  • help_shows_restructured_commands — PASSED
  • sandbox_connect_help_shows_editor_flag — PASSED
  • sandbox_create_help_shows_new_flags — PASSED
  • sandbox_help_shows_upload_download — PASSED
  • status_without_gateway_prints_friendly_message — PASSED
  • sandbox_from_community_base_image — PASSED
  • sandbox_from_explicit_ghcr_image — PASSED
  • sandbox_processes_disable_core_dumps — PASSED
  • credentialed_endpoint_gates_work_end_to_end — PASSED
  • gateway_status_reports_healthy — PASSED
  • ws_tunnel_status_through_edge_proxy — PASSED
  • graphql_l7_enforces_allow_and_deny_rules_on_forward_and_connect_paths — PASSED
  • jsonrpc_forward_proxy_hard_denies_response_frames_in_default_audit_mode — PASSED
  • jsonrpc_l7_enforces_method_rules_on_forward_and_connect_paths — PASSED
  • forward_proxy_allows_l7_permitted_request — PASSED
  • forward_proxy_denies_l7_blocked_request — PASSED
  • inference_set_supports_no_verify_for_unreachable_endpoint — PASSED
  • sandbox_inference_local_routes_to_host_openshell_internal — PASSED
  • sandbox_reaches_host_openshell_internal_via_host_gateway_alias — PASSED
  • static_provider_credentials_are_bound_to_profile_endpoints — PASSED
  • kubernetes_corporate_proxy_uses_secret_and_never_falls_back — PASSED
  • hard_requirement_accepts_enriched_device_path — PASSED
  • initial_sparse_policy_is_acknowledged_as_loaded — PASSED
  • live_policy_update_from_empty_network_policies — PASSED
  • live_policy_update_round_trip — PASSED
  • local_driver_restart_or_stop_respects_main_process_lifecycle — PASSED
  • sandbox_bypasses_proxy_for_localhost_http — PASSED
  • port_forward_echo — PASSED
  • auto_created_provider_credential_available_in_sandbox — PASSED
  • ambiguous_policy_update_is_rejected_without_replacing_active_policy — PASSED
  • destination_denial_modes_match_across_connect_and_forward_adapters — PASSED
  • explicit_allowed_ips_and_implicit_ip_literals_succeed_through_both_adapters — PASSED
  • fail_closed_middleware_blocks_uninspectable_connect_payload_before_upstream — PASSED
  • fail_open_middleware_bypasses_uninspectable_tls_skip_connect — PASSED
  • forward_pipeline_never_reaches_upstream_as_first_request_overflow — PASSED
  • http_credentials_are_rewritten_in_headers_and_bodies_for_both_adapters — PASSED
  • middleware_redacts_request_bodies_through_both_adapters — PASSED
  • policy_reload_updates_both_adapters_and_closes_existing_http_tunnel — PASSED
  • tls_skip_connect_relays_opaque_bytes_bidirectionally — PASSED
  • readyz_reports_healthy_database_check — PASSED
  • sandbox_labels_are_stored_and_filterable — PASSED
  • canonical_main_disconnect_reconnect_replays_history_for_same_process — PASSED
  • canonical_main_exit_transitions_persistent_sandbox_to_error — PASSED
  • canonical_tty_main_uses_sandbox_environment — PASSED
  • sandbox_can_be_deleted_while_stopped — PASSED
  • sandbox_create_with_no_keep_cleans_up_after_tty_command — PASSED
  • sandbox_stop_start_preserves_workspace — PASSED
  • settings_global_override_round_trip — PASSED
  • gateway_smoke — PASSED
  • sandbox_download_directory_only — PASSED
  • sandbox_download_file_only — PASSED
  • sandbox_download_handles_dash_leading_basename — PASSED
  • sandbox_download_rejects_symlinks_pointing_outside_workspace — PASSED
  • sandbox_file_upload_download_round_trip — PASSED
  • upload_gitignored_directory_falls_back_to_unfiltered — PASSED
  • upload_respects_gitignore_by_default — PASSED
  • upload_single_file_from_git_repo_only_uploads_that_file — PASSED
  • local_container_native_tcp_uses_policy_dns_and_fails_closed — PASSED
  • rootless_podman_musl_getaddrinfo_uses_udp_policy_dns — PASSED
  • create_with_multiple_uploads — PASSED
  • create_with_upload_directory_preserves_source_basename — PASSED
  • create_with_upload_single_file — PASSED
  • sandbox_pod_spec_has_user_namespace_fields — IGNORED (pre-existing source annotation)
  • websocket_text_placeholder_is_rewritten_through_both_adapters — PASSED
  • workspace_full_crud_lifecycle — PASSED
  • workspace_terminating_rejects_creates — PASSED

@sjenning

sjenning commented Aug 26, 2026

Copy link
Copy Markdown
Collaborator Author

/ok to test 4376382

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner
@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fix(kubernetes): move agent-sandbox to v0.5.4

1 participant

@sjenning