Add helm chart for agent sandbox

[pandaji]

For Issue #483

1. Add a new helm chart
2. Extract the controller configs and expose through the helm chart
3. Add codegen output destination to helm template folder

[netlify]

✅ Deploy Preview for agent-sandbox ready!

Name	Link
🔨 Latest commit	41adc6b
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/69f15258fcd15800090a724d
😎 Deploy Preview	https://deploy-preview-618--agent-sandbox.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[k8s-ci-robot]

Welcome @pandaji!

It looks like this is your first PR to kubernetes-sigs/agent-sandbox 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/agent-sandbox has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @pandaji. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Copilot]

Pull request overview

Adds a Helm chart–based installation path for the agent-sandbox controller (and optional extensions), migrating generated CRDs/RBAC into the chart and wiring CI/tools to keep generated assets synchronized.

Changes:

• Replace legacy static Kubernetes manifests with a Helm chart (templates + values + README).
• Move controller-gen outputs (CRDs/RBAC) to helm/crds and helm/templates, and update docs accordingly.
• Add tooling/CI checks to keep generated outputs up-to-date and enforce chart version bumping when generated assets change.

Reviewed changes

Copilot reviewed 22 out of 28 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
k8s/extensions.controller.yaml	Removes legacy extensions Deployment manifest.
k8s/controller.yaml	Removes legacy core install manifest (namespace/SA/RBAC/service/deploy).
helm/Chart.yaml	Introduces Helm chart metadata.
helm/values.yaml	Adds chart values for image/controller flags/resources/scheduling and extensions toggle.
helm/README.md	Documents Helm install/upgrade/uninstall and values reference.
helm/templates/_helpers.tpl	Adds helper templates (labels, namespace, image reference).
helm/templates/_controller-args.generated.tpl	Generates controller CLI args from Helm values.
helm/templates/namespace.yaml	Optionally creates the target namespace.
helm/templates/serviceaccount.yaml	Creates controller ServiceAccount.
helm/templates/service.yaml	Exposes metrics Service.
helm/templates/deployment.yaml	Deploys controller with probes, args, and resource/scheduling knobs.
helm/templates/rbac.generated.yaml	Adds generated core ClusterRole rules for the controller.
helm/templates/clusterrolebinding.yaml	Binds core ClusterRole to controller ServiceAccount.
helm/templates/extensions-rbac.generated.yaml	Adds generated extensions ClusterRole rules.
helm/templates/clusterrolebinding-extensions.yaml	Conditionally binds extensions ClusterRole when extensions are enabled.
helm/crds/agents.x-k8s.io_sandboxes.yaml	Packages generated Sandbox CRD for Helm install.
helm/crds/extensions.agents.x-k8s.io_sandboxclaims.yaml	Packages generated SandboxClaim CRD for Helm install.
helm/crds/extensions.agents.x-k8s.io_sandboxtemplates.yaml	Packages generated SandboxTemplate CRD for Helm install.
helm/crds/extensions.agents.x-k8s.io_sandboxwarmpools.yaml	Packages generated SandboxWarmPool CRD for Helm install.
docs/development.md	Updates development deployment instructions to use Helm and helm/crds.
docs/configuration.md	Reframes configuration docs around Helm values and examples.
README.md	Updates top-level install guidance to point to Helm chart README.
codegen.go	Redirects controller-gen CRD/RBAC outputs to Helm chart directories.
dev/tools/fix-helm-values	Adds generator to sync Helm values/args template from controller flags.
dev/tools/bump-chart-version	Adds script to bump chart patch version when generated chart files change.
dev/tools/fix-go-generate	Runs go generate then bumps chart version when generated outputs change.
dev/ci/presubmits/test-autogen-up-to-date	Adds check ensuring chart version bump accompanies generated Helm asset changes.
.github/workflows/ci.yml	Adds verify-generate CI job and broadens path triggers to include Helm/codegen-related paths.

[aditya-shantanu]

/ok-to-test

[barney-s]

/lgtm
/approve

[pandaji]

Rebased to get the latest go type in main. Reconciled ci.yml conflicts in previous commits.
PTAL, thanks. @barney-s

[barney-s]

/lgtm
/approve

[pandaji]

@barney-s @janetkuo The main moves fast and the go type changed again.
I just rebased to pick up the latest.
PTAL and appreciate your immediate review on this one.

[pandaji]

/retest

[k8s-ci-robot]

@pandaji: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
presubmit-agent-sandbox-benchmarks-kops-gcp	41adc6b	link	false	/test presubmit-agent-sandbox-benchmarks-kops-gcp

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[pandaji]

presubmit-agent-sandbox-benchmarks-kops-gcp

failed with Error: error calling Boskos: Post "boskos.test-pods.svc.cluster.local/acquire?type=gcp-project&state=free&dest=busy": unsupported protocol scheme ""

Looks like a misconfiguration in the test job?

[pandaji]

Discuss on Slack. It is not required yet and can be ignored now.

Root case PR - kubernetes/test-infra#36884 (review).

[aditya-shantanu]

/lgtm

[barney-s]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: barney-s, janetkuo, pandaji

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [barney-s,janetkuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment