chore(kubernetes): update Agent Sandbox to v1.0.3 (#3578)

Signed-off-by: Mrunal Patel <mrunalp@gmail.com>

Author: mrunalp

.github/workflows/branch-e2e.yml

@@ -354,7 +354,7 @@ jobs:
       matrix:
         include:
           - agent_sandbox_api: v1beta1
-            agent_sandbox_version: v0.5.0
+            agent_sandbox_version: v1.0.3
           - agent_sandbox_api: v1alpha1
             agent_sandbox_version: v0.4.6
     permissions:

.github/workflows/e2e-kubernetes-test.yml

@@ -36,7 +36,7 @@ on:
         description: "Agent Sandbox release to install before OpenShell"
         required: false
         type: string
-        default: "v0.5.0"
+        default: "v1.0.3"
       e2e-task:
         description: "mise task to run for the Kubernetes e2e job"
         required: false

.github/workflows/release-canary.yml

@@ -276,7 +276,7 @@ jobs:
       RELEASE_NAME: openshell
       RELEASE_NAMESPACE: openshell
       KIND_GATEWAY_NAME: kind
-      AGENT_SANDBOX_VERSION: v0.5.0
+      AGENT_SANDBOX_VERSION: v1.0.3
     steps:
       - name: Checkout Agent Sandbox helper
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

architecture/compute-runtimes.md

@@ -439,7 +439,9 @@ database-backed installs can render a Deployment with `workload.kind=deployment`
 HA deployments must point `server.externalDbSecret` at an operator-managed
 PostgreSQL database. Agent Sandbox CRDs and controller lifecycle remain
 operator-owned; the chart can optionally preflight for a served supported API
-but does not install the cluster-scoped dependency.
+but does not install the cluster-scoped dependency. OpenShell's Kubernetes test
+clusters install the upstream core manifest; Agent Sandbox extensions are not
+required by the gateway.
 Standalone local deployments start the gateway with a selected runtime such as
 Docker, Podman, or VM. The CLI can register multiple gateways and switch between
 them without changing the sandbox architecture.

deploy/helm/openshell/README.md

@@ -22,7 +22,7 @@ multiple pre-provisioned workspace namespaces.
 The Kubernetes Agent Sandbox CRDs and controller must be installed on the cluster before deploying OpenShell. Install them with:
 
 ```shell
-kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/manifest.yaml
+kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/sandbox.yaml
 ```
 
 The chart does not install this cluster-scoped dependency. By default, it

deploy/helm/openshell/README.md.gotmpl

@@ -22,7 +22,7 @@ multiple pre-provisioned workspace namespaces.
 The Kubernetes Agent Sandbox CRDs and controller must be installed on the cluster before deploying OpenShell. Install them with:
 
 ```shell
-kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/manifest.yaml
+kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/sandbox.yaml
 ```
 
 The chart does not install this cluster-scoped dependency. By default, it

docs/kubernetes/setup.mdx

@@ -33,7 +33,7 @@ OpenShell uses the [Agent Sandbox](https://agent-sandbox.sigs.k8s.io) Kubernetes
 Apply the latest release manifest:
 
 ```shell
-kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/manifest.yaml
+kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/latest/download/sandbox.yaml
 ```
 
 This creates the `agent-sandbox-system` namespace, installs the `sandboxes.agents.x-k8s.io` CRD, and starts the controller.

e2e/support/install-agent-sandbox.sh

@@ -6,7 +6,14 @@
 # context arguments (for example, --context kind-e2e) as script arguments.
 set -euo pipefail
 
-agent_sandbox_version="${AGENT_SANDBOX_VERSION:-v0.5.0}"
+agent_sandbox_version="${AGENT_SANDBOX_VERSION:-v1.0.3}"
+
+# Agent Sandbox renamed its core release manifest after v0.5.1. Keep the
+# v1alpha1 compatibility lane on the asset published with that release.
+case "${agent_sandbox_version}" in
+  v0.[0-4].*|v0.5.[01]) agent_sandbox_manifest="manifest.yaml" ;;
+  *) agent_sandbox_manifest="sandbox.yaml" ;;
+esac
 
 wait_for_agent_sandbox_crd() {
   local deadline
@@ -32,7 +39,7 @@ wait_for_agent_sandbox_crd() {
 
 echo "Installing agent-sandbox CRDs and controller (${agent_sandbox_version})..."
 agent_sandbox_base="https://github.com/kubernetes-sigs/agent-sandbox/releases/download/${agent_sandbox_version}"
-kubectl "$@" apply -f "${agent_sandbox_base}/manifest.yaml"
+kubectl "$@" apply -f "${agent_sandbox_base}/${agent_sandbox_manifest}"
 wait_for_agent_sandbox_crd "$@"
 kubectl "$@" -n agent-sandbox-system rollout status \
   deployment/agent-sandbox-controller --timeout=300s

e2e/with-kube-gateway.sh

@@ -75,7 +75,7 @@ source "${ROOT}/e2e/support/gateway-common.sh"
 # Upstream agent-sandbox release. The Kubernetes driver supports the v1beta1
 # Sandbox API introduced in v0.5.0 and falls back to v1alpha1 for v0.4.6
 # clusters. Override this env var to exercise the v1alpha1 controller release.
-AGENT_SANDBOX_VERSION="${AGENT_SANDBOX_VERSION:-v0.5.0}"
+AGENT_SANDBOX_VERSION="${AGENT_SANDBOX_VERSION:-v1.0.3}"
 
 e2e_preserve_mise_dirs
 e2e_align_docker_host_with_cli_context

tasks/scripts/helm-k3s-local.sh

@@ -32,11 +32,11 @@ HOST_LB_PORT="${HELM_K3S_LB_HOST_PORT:-8080}"
 DEFAULT_SANDBOX_PRELOAD_IMAGE="nvcr.io/nvidia/base/ubuntu:24.04"
 PRELOAD_SANDBOX_IMAGE="${HELM_K3S_PRELOAD_SANDBOX_IMAGE-${DEFAULT_SANDBOX_PRELOAD_IMAGE}}"
 
-# Upstream agent-sandbox release pinned for both CRDs/controller and extensions.
+# Upstream agent-sandbox release pinned for the core CRDs and controller.
 # The Kubernetes driver supports the v1beta1 Sandbox API introduced in v0.5.0
 # and falls back to v1alpha1 for v0.4.6 clusters. Override this env var to
 # exercise the v1alpha1 controller release.
-AGENT_SANDBOX_VERSION="${AGENT_SANDBOX_VERSION:-v0.5.0}"
+AGENT_SANDBOX_VERSION="${AGENT_SANDBOX_VERSION:-v1.0.3}"
 
 # Local OTLP receiver and trace UI. The current Aspire implementation accepts
 # OTLP/gRPC directly, so the development cluster needs only one deployment.
@@ -164,9 +164,9 @@ merge_kubeconfig() {
 
 apply_base_manifests() {
   require_kubectl
-  local base="https://github.com/kubernetes-sigs/agent-sandbox/releases/download/${AGENT_SANDBOX_VERSION}"
-  echo "Applying agent-sandbox manifest (${AGENT_SANDBOX_VERSION})..."
-  kubectl --kubeconfig="${KUBECONFIG_TARGET}" apply -f "${base}/manifest.yaml"
+  AGENT_SANDBOX_VERSION="${AGENT_SANDBOX_VERSION}" \
+    bash "${ROOT}/e2e/support/install-agent-sandbox.sh" \
+      --kubeconfig="${KUBECONFIG_TARGET}"
 }
 
 install_trace_collector() {