support automatic service creation opt-in

[flpanbin]

What this PR does / why we need it:

This PR introduces a new spec.service field to make automatic headless Service creation opt-in instead of the default behavior, while preserving backward compatibility for existing Sandboxes.

spec.service is a *bool so the controller can distinguish three states:

• unset (nil): default, backward-compatible — preserves existing owned Service but does not create new ones.

• false: explicitly disables Service management — deletes any existing owned Service.

• true: explicitly enables Service management — creates or reconciles the headless Service.

Which issue(s) this PR is related to:

Fixes #746

Changes:

• Added spec.service as *bool with //nolint:kubeapilinter to bypass the nobools linter rule.

• Updated reconcileService to conditionally create, adopt, or delete the headless Service based on spec.service.

• Updated computeReadyCondition.

• Added controller tests covering all three states.

Release Note

The Sandbox controller no longer creates a headless Service by default for new Sandboxes. Existing Sandboxes with an auto-provisioned Service are preserved automatically.

To enable automatic headless Service creation, set spec.service: true. To explicitly remove an existing Service, set spec.service: false.

After upgrading, for new Sandboxes that need an auto-provisioned headless Service, set spec.service: true.

[netlify]

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	0274558
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/6a0482f8f74c0800083dc5c6

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: flpanbin / name: bin (e761d3f)

[Copilot]

Pull request overview

This PR makes headless Service creation/management by the Sandbox controller opt-in via a new spec.service boolean (default false), aligning behavior with typical Kubernetes patterns and reducing per-Sandbox Service overhead.

Changes:

• Added spec.service (default false) to the Sandbox API/CRD to gate automatic headless Service management.
• Updated the Sandbox controller to conditionally create/adopt/repair Services only when spec.service: true, and to delete owned Services when toggled off.
• Relaxed Ready condition gating so Service readiness is only required when spec.service: true.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
api/v1alpha1/sandbox_types.go	Adds SandboxSpec.Service field with defaulting marker and doc comment.
controllers/sandbox_controller.go	Gates Service reconcile and Ready-condition logic on spec.service; clears status when disabled; deletes owned Service when toggled off.
controllers/sandbox_controller_test.go	Updates existing tests and adds new cases for the new default (no Service) and for Service deletion/ignoring when disabled.
k8s/crds/agents.x-k8s.io_sandboxes.yaml	Adds CRD schema for spec.service with default false.
helm/crds/agents.x-k8s.io_sandboxes.yaml	Mirrors CRD schema change for Helm packaging.

[flpanbin]

Hi @janetkuo @justinsb
I implemented spec.service as a bool (default false) as discussed, but the CI kube-api-linterfails on the nobools rule:

../../api/v1alpha1/sandbox_types.go:146:2: nobools: field SandboxSpec.Service should not use a bool. Use a string type with meaningful constant values as an enum.

Should I:
Add a //nolint comment to bypass this check for this field, or
Change it to a string enum (e.g., Enabled / Disabled) to satisfy the linter?

[flpanbin]

/retest

[aditya-shantanu]

/ok-to-test
/lgtm
/approve

[janetkuo]

nit: should be // nolint: nobool. We just want to bypass this lint check. The reason should be clearly documented as well.

Suggested change

	//nolint:kubeapilinter
	//nolint:nobools // Reason why boolean is used despite the linter rule

[janetkuo]

SandboxClaim should leverage the new default, instead of keeping the old behavior. Otherwise it will be inconsistent with sandbox.

[janetkuo]

Same comment here regarding adopting the right default.

[janetkuo]

nit

Suggested change

	// When unset (nil), the controller preserves existing Services for backward
	// When unset, the controller preserves existing Services for backward

because users can't set nil in json/yaml

[janetkuo]

/lgtm

The review comments can be addressed in a follow-up PR.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aditya-shantanu, flpanbin, janetkuo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [janetkuo]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment