feat: support workspace resource overrides on SandboxClaims

[noeljackson]

Summary

Adds SandboxClaim.Spec.WorkspaceResources (CPU / memory / disk) for per-claim sizing of the workspace container at cold-start.

API

spec:
  workspaceResources:
    cpuMillicores: 2000
    memoryMiB: 4096
    diskGiB: 20

• Each field is int32, minimum: 0 in the CRD; omitted or zero means no override.
• Empty struct workspaceResources: {} is a no-op (gated by hasWorkspaceResourceOverrides).
• Set values become both request and limit on the container named workspace. Other containers untouched.
• MiB/GiB names match the binary math the controller does internally.

Behavior

Cold creation: override applied to the PodSpec before the Sandbox is created. Pod runs at the requested size from day one.

Warm-pool adoption: skipped when overrides are set. Adopting would mutate Sandbox.Spec.PodTemplate while leaving the running Pod at pool defaults until restart. Cold creation gives a correctly-sized Pod immediately.

The skip is permanent. Resize-after-creation is a separate operation; per janetkuo's guidance on #612 it lives at the controller that owns the lifecycle decision (Pod /resize subresource).

Tests

go test ./extensions/... and make lint-go / make lint-api clean. New cases:

• TestSandboxClaimCreateAppliesWorkspaceResources
• TestSandboxClaimCreateIgnoresWorkspaceResourcesWithoutWorkspaceContainer
• TestSandboxClaimWithWorkspaceResourcesSkipsWarmAdoption
• TestApplyWorkspaceResourceOverridesEmptyOverridesIsNoOp
• falls through to cold creation when claim sets WorkspaceResources in TestSandboxClaimSandboxAdoption

Refs: #347, #612.

Summary by CodeRabbit

• New Features
  • Added optional per-SandboxClaim workspaceResources to override the workspace container’s CPU, memory, and ephemeral-storage requests/limits.
• Bug Fixes
  • Apply overrides to the correct workspace container during sandbox creation.
  • When workspaceResources is set, the system skips warm-pool adoption; creation fails if the workspace container is missing.
• Documentation
  • Updated API docs and CRD/OpenAPI schema to include spec.workspaceResources.
• Tests
  • Expanded coverage for override application, no-op empty overrides, missing-container rejection, and warm-pool skip behavior.

[netlify]

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	4b39bdc
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/6a43dbc58617c7000804e3b9

[k8s-ci-robot]

Hi @noeljackson. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codebot-robot]

Overall, this PR introduces a clean and narrow way to override workspace resources at the claim level. The struct additions, deep copying, and Sandbox template modifications are solidly implemented.

However, there is a critical flaw regarding the warm pool adoption path. The PR updates the Sandbox CR's PodTemplate upon adoption, but the sandbox_controller (which manages the actual Pod) currently ignores PodTemplate.Spec changes for existing, running pods. As a result, when a claim adopts a warm sandbox, the actual Pod will continue running with the template's default resources instead of the requested overrides.

To fix this, the system must either:

1. Support in-place Pod resource resizing in sandbox_controller (requires K8s 1.27+ InPlacePodVerticalScaling), or
2. Skip warm pool adoption if the claim's requested resources differ from the warm pool's default sizing, ensuring it falls back to a cold start to guarantee the correct sizing.

I've left detailed inline comments on this and a few minor optimizations.

(This review was generated by Overseer)

[noeljackson]

Thanks for the thorough review.

Warm pool resource drift: The sandbox_controller.reconcilePod path now includes generic resource drift detection — it compares container resources between the Sandbox CR's PodTemplate and the running pod using equality.Semantic.DeepEqual. When they differ (e.g., after warm pool adoption with workspace resource overrides), the pod is deleted and recreated with the correct sizing. This handles the concern without requiring in-place resizing.

resource.NewMilliQuantity / resource.NewQuantity: Applied — replaced fmt.Sprintf + MustParse with direct quantity constructors.

int32 vs *int32: Zero means "no override" by design. Removing limits set by a template is not a supported use case — the override is purely additive.

Redundant nil check: The ensureClaimIdentityLabels helper handles nil map initialization, so the manual check was removed (addressed in #455).

[noeljackson]

Friendly bump. All review comments addressed, tests pass. Could a maintainer run /ok-to-test when convenient?

[aditya-shantanu]

/ok-to-test

[janetkuo]

@noeljackson FYI the changes we need for v1beta1 are in. You can now rebase and update the PR accordingly.

[k8s-ci-robot]

@noeljackson: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
presubmit-test-autogen-up-to-date	38f9a43	link	true	/test presubmit-test-autogen-up-to-date
presubmit-agent-sandbox-unit-test	38f9a43	link	true	/test presubmit-agent-sandbox-unit-test
presubmit-agent-sandbox-e2e-test	38f9a43	link	true	/test presubmit-agent-sandbox-e2e-test

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[noeljackson]

Been on vacation. Will rebase and ping next week.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: noeljackson
Once this PR has been reviewed and has the lgtm label, please ask for approval from janetkuo. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

SandboxClaim now accepts per-claim workspace resource overrides in the API and CRD. The controller applies those overrides during cold sandbox creation, skips warm-pool adoption when overrides are set, and tests cover the new behavior.

Changes

Workspace resource overrides

Layer / File(s)	Summary
API contract and CRD extensions/api/v1beta1/sandboxclaim_types.go, extensions/api/v1beta1/zz_generated.deepcopy.go, helm/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml, k8s/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml, docs/api.md	SandboxClaimSpec gains workspaceResources, the v1beta1 CRD schemas add the matching resource fields, deepcopy support is updated, and the API docs describe the new type and field.
Resource helpers and sandbox flow extensions/controllers/sandboxclaim_controller.go	Adds workspace container resource override helpers, applies them during cold sandbox creation, and skips warm-pool adoption when workspaceResources is set.
Controller tests extensions/controllers/sandboxclaim_controller_test.go	Tests update warm-pool fixtures and cover resource application, missing workspace containers, adoption skipping, and empty overrides.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Possibly related PRs

• kubernetes-sigs/agent-sandbox#878 — Also touches warm-pool adoption logic in extensions/controllers/sandboxclaim_controller.go.

Suggested labels

lgtm

Suggested reviewers

• justinsb
• janetkuo
• aditya-shantanu

Poem

🐰 I packed a pod with carrots and clover,
tuned workspace bytes from toe to rover.
Warm pools paused, then sprang to light,
cold sandboxes hopped out just right.
Huzzah! The sandbox fits tonight.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 41.18% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: workspace resource overrides for SandboxClaims.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description is clear and comprehensive, covering purpose, API, behavior, tests, and related issues, even though it omits the template’s release-note block.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 12 comments.

Files not reviewed (1)

• extensions/api/v1beta1/zz_generated.deepcopy.go: Generated file

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@extensions/controllers/sandboxclaim_controller_test.go`:
- Line 109: The warm pool test fixtures in SandboxClaim controller are
referencing a template name that does not exist in the paired SandboxTemplate
objects. Update each SandboxWarmPool.Spec.TemplateRef.Name in the affected test
cases to match the template object they create, using the TemplateRef field in
the sandboxclaim_controller_test setup so the reconciler resolves the intended
template instead of hitting TemplateNotFound.
- Around line 2568-2572: The new workspace-resource tests are missing the
referenced SandboxWarmPool, so they never reach the workspace-resource code
paths. Update the affected test fixtures in sandboxclaim_controller_test.go to
include a matching SandboxWarmPool object alongside the existing template/claim
setup, using the same warmPoolRef name (test-pool) so the claim can resolve it.
Apply this to the new test cases around the fake.NewClientBuilder setups in the
relevant test functions, including the adoption scenario that also needs the
warm pool present.

In `@helm/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml`:
- Around line 328-342: The served v1beta1 schema is missing the
workspaceResources field, so spec.workspaceResources is not preserved for normal
claims. Update the CRD schema generation in the sandboxclaims CRD so
workspaceResources appears under the v1beta1.spec schema as well as the
deprecated v1alpha1 schema, using the same structure and validation as the
existing workspaceResources definition.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 04881ccf-923b-4dc8-ad23-1dcfa5410396

📥 Commits

Reviewing files that changed from the base of the PR and between bce2dda and 87c20fc.

⛔ Files ignored due to path filters (2)

• extensions/api/v1beta1/zz_generated.deepcopy.go is excluded by !**/*_generated*.go, !**/zz_generated.*.go
• k8s/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml is excluded by !k8s/crds/**

📒 Files selected for processing (4)

• extensions/api/v1beta1/sandboxclaim_types.go
• extensions/controllers/sandboxclaim_controller.go
• extensions/controllers/sandboxclaim_controller_test.go
• helm/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

Files not reviewed (1)

• extensions/api/v1beta1/zz_generated.deepcopy.go: Generated file

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@k8s/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml`:
- Around line 202-216: The workspaceResources schema currently rejects zero
values for cpuMillicores, memoryMiB, and diskGiB, which prevents the
controller’s no-op handling from being used by raw YAML/JSON clients. Update the
SandboxClaim CRD validation on workspaceResources to allow 0 by removing the
minimum constraint on these fields, or alternatively adjust the contract/docs to
make omission the only supported way to express “no override”; use the
workspaceResources properties as the place to make this change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4eafc78f-92e4-44c3-9121-f938f2628e62

📥 Commits

Reviewing files that changed from the base of the PR and between 7d65d6d and aa11111.

📒 Files selected for processing (4)

• docs/api.md
• extensions/api/v1beta1/zz_generated.deepcopy.go
• helm/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml
• k8s/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml

✅ Files skipped from review due to trivial changes (1)

• extensions/api/v1beta1/zz_generated.deepcopy.go

[aditya-shantanu]

/lgtm

[aditya-shantanu]

One blocking compile error in the test; the production changes look good.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• extensions/api/v1beta1/zz_generated.deepcopy.go: Generated file

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Files not reviewed (1)

• extensions/api/v1beta1/zz_generated.deepcopy.go: Generated file

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@extensions/controllers/sandboxclaim_controller_test.go`:
- Around line 2544-2877: Add a partial-override regression test for
applyWorkspaceResourceOverrides and SandboxClaimReconciler. The current tests
cover fully populated and fully empty WorkspaceResources, but not the case where
only some fields are set and omitted fields should preserve the template’s
existing CPU/memory/disk values. Add a unit test near
TestApplyWorkspaceResourceOverridesEmptyOverridesIsNoOp or the
SandboxClaimCreate* tests that seeds a container with existing Requests/Limits,
applies a WorkspaceResources override with only one or two fields set, and
asserts unmentioned entries remain unchanged while mentioned ones are updated.
- Around line 2779-2780: The warm queue in the sandbox claim test is being
seeded with the template hash instead of the warm-pool key, so the warm sandbox
cannot be found by WarmSandboxQueue. Update the setup around warmQueue.Add in
sandboxclaim_controller_test.go to use the same namespace/warm-pool identifier
that WarmSandboxQueue expects, and keep the check aligned with the warm-pool
lookup path used by the controller/test helpers rather than
sandboxcontrollers.NameHash("test-template").

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 23d9e1e8-1897-4ca3-8fd5-98c5d7c2eedc

📥 Commits

Reviewing files that changed from the base of the PR and between 4c8baa6 and b06d260.

⛔ Files ignored due to path filters (2)

• extensions/api/v1beta1/zz_generated.deepcopy.go is excluded by !**/*_generated*.go, !**/zz_generated.*.go
• k8s/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml is excluded by !k8s/crds/**

📒 Files selected for processing (5)

• docs/api.md
• extensions/api/v1beta1/sandboxclaim_types.go
• extensions/controllers/sandboxclaim_controller.go
• extensions/controllers/sandboxclaim_controller_test.go
• helm/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml

🚧 Files skipped from review as they are similar to previous changes (4)

• helm/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml
• extensions/api/v1beta1/sandboxclaim_types.go
• docs/api.md
• extensions/controllers/sandboxclaim_controller.go

[kubernetes-prow]

@noeljackson: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
presubmit-agent-sandbox-lint-go	4b39bdc	link	true	/test presubmit-agent-sandbox-lint-go

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• extensions/api/v1beta1/zz_generated.deepcopy.go: Generated file

[aditya-shantanu]

/lgtm

[aditya-shantanu]

/lgtm

[aditya-shantanu]

/lgtm

[kubernetes-prow]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.