Use a Deployment instead of a StatefulSet for the controller

[antonipp]

Description

While trying out the agent-sandbox project, I noticed that the main controller is deployed as a StatefulSet. I couldn't really find a justification for it in the commit history, so this looks like an oversight. The controller is stateless and doesn't require a stable network identity, so I don't really see a reason to use a much heavier abstraction here. Moreover, STS ordered rollout semantics are unnecessary for a stateless controller and could complicate scaling/updates if leader election is enabled for HA.

So my PR switches the controller to be deployed as a simple Deployment, I think it will make operations easier for everyone

Migration Guide

The controller changed from StatefulSet to Deployment and leader election is now enabled by default. Before you deploy the new charts, you need to clean-up the existing StatefulSet (this will cause a brief disruption to Sandbox state reconciliation):

kubectl delete statefulset agent-sandbox-controller -n agent-sandbox-system

Then deploy the new charts. Verify that the Deployment has been properly created:

kubectl get deployment agent-sandbox-controller -n agent-sandbox-system

If needed, the rollback steps are:

kubectl delete deployment agent-sandbox-controller -n agent-sandbox-system
kubectl apply -f <previous-version-manifest.yaml>

[netlify]

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	91e6a31
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/69957f4a11fea40008faea52

[k8s-ci-robot]

Hi @antonipp. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[janetkuo]

/ok-to-test

[barney-s]

This is an acceptable change. We can switch back to sts later if needed. Would you check the docs and check if they need a change.

[barney-s]

Thanks for the changes

[antonipp]

/retest

[janetkuo]

/label release-note-action-required

[k8s-ci-robot]

@janetkuo: The label(s) /label release-note-action-required cannot be applied. These labels are supported: api-review, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, team/katacoda, refactor, ci-short, ci-extended, ci-full. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

Details

In response to this:

/label release-note-action-required

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[janetkuo]

/retest

[janetkuo]

@antonipp it seems that the e2e tests are broken, would you fix them?

[antonipp]

Right, looks like there was an issue reconciling an existing Service:

        	            	timed out waiting for object: ValidateObject *v1alpha1.Sandbox (sandbox-shutdown-test-1770086557148676937/my-sandbox): unexpected sandbox status (-want,+got):
        	            	  v1alpha1.SandboxStatus{
        	            	- 	ServiceFQDN: "my-sandbox.sandbox-shutdown-test-1770086557148676937.svc.cluster.local",
        	            	+ 	ServiceFQDN: "",
        	            	- 	Service:     "my-sandbox",
        	            	+ 	Service:     "",

I fixed the logic by ensuring that it's always reconciled, I think it should do the trick.

[antonipp]

Looks like there was an RBAC issue after I enabled leader election as well, I fixed it too, the tests now seem to pass

[aditya-shantanu]

/lgtm

[k8s-ci-robot]

@aditya-shantanu: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[janetkuo]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: antonipp, janetkuo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [janetkuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment