feat(kubernetes): support agent-sandbox v1beta1#2009
Merged
Conversation
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
|
Label |
|
🌿 Preview your docs: https://nvidia-preview-pr-2009.docs.buildwithfern.com/openshell |
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
elezar
reviewed
Jun 26, 2026
elezar
reviewed
Jun 26, 2026
3 tasks
elezar
reviewed
Jun 26, 2026
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
Signed-off-by: Taylor Mutch <taylormutch@gmail.com>
pimlock
approved these changes
Jun 26, 2026
4 tasks
aredenba-rh
added a commit
to openshift-hyperfleet/kartograph
that referenced
this pull request
Jul 15, 2026
… support kartograph-stage's Graph Management Assistant was failing to start sessions: the openshell-gateway sidecar's Kubernetes compute driver errored on every sandbox list/watch call with a raw "404 page not found" (not a structured NotFound Status) once the previously-blocking RBAC issue (openshell-rbac.yaml, fixed via hybrid-platforms-gitops/infrastructure!76) was resolved. Root cause: our pinned OpenShell release (v0.0.62) hardcodes the Kubernetes driver's Sandbox custom resource to agents.x-k8s.io/v1alpha1 with no fallback. NVIDIA/OpenShell#2009 (first released in v0.0.72) added runtime detection of the served Sandbox API version, trying v1beta1 before falling back to v1alpha1 - required because the Agent Sandbox CRD installed on this cluster serves v1beta1, not v1alpha1. A raw (non-JSON) 404 is exactly the signature of probing a group/version the API server's router doesn't recognize at all, which matches this failure precisely. Bumps both Dockerfiles that vendor the OpenShell binaries (the CLI in src/api/Dockerfile and the gateway sidecar in deploy/container/openshell-gateway/Dockerfile) to v0.0.83, the latest published release, keeping CLI/gateway protocol versions in lockstep. Adds a regression test enforcing that invariant plus a minimum-version floor so this can't silently regress. Co-authored-by: Cursor <cursoragent@cursor.com>
aredenba-rh
added a commit
to openshift-hyperfleet/kartograph
that referenced
this pull request
Jul 15, 2026
… support (#794) * fix(extraction): bump pinned OpenShell to v0.0.83 for Sandbox v1beta1 support kartograph-stage's Graph Management Assistant was failing to start sessions: the openshell-gateway sidecar's Kubernetes compute driver errored on every sandbox list/watch call with a raw "404 page not found" (not a structured NotFound Status) once the previously-blocking RBAC issue (openshell-rbac.yaml, fixed via hybrid-platforms-gitops/infrastructure!76) was resolved. Root cause: our pinned OpenShell release (v0.0.62) hardcodes the Kubernetes driver's Sandbox custom resource to agents.x-k8s.io/v1alpha1 with no fallback. NVIDIA/OpenShell#2009 (first released in v0.0.72) added runtime detection of the served Sandbox API version, trying v1beta1 before falling back to v1alpha1 - required because the Agent Sandbox CRD installed on this cluster serves v1beta1, not v1alpha1. A raw (non-JSON) 404 is exactly the signature of probing a group/version the API server's router doesn't recognize at all, which matches this failure precisely. Bumps both Dockerfiles that vendor the OpenShell binaries (the CLI in src/api/Dockerfile and the gateway sidecar in deploy/container/openshell-gateway/Dockerfile) to v0.0.83, the latest published release, keeping CLI/gateway protocol versions in lockstep. Adds a regression test enforcing that invariant plus a minimum-version floor so this can't silently regress. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(extraction): apply ruff formatting to openshell version pin test Co-authored-by: Cursor <cursoragent@cursor.com> * fix(extraction): verify OpenShell release checksums, address CodeRabbit review Verifies the downloaded openshell/openshell-gateway release archives against NVIDIA's published sha256 checksums before extraction, so a compromised or corrupted CDN response fails the build instead of silently landing in the image. Build-tested locally with podman for both Dockerfile stages, including a deliberate checksum mismatch to confirm the build fails closed. Also softens a verify-fleet-apps-kartograph.sh comment that stated the openshell-rbac.yaml RBAC/CRD prerequisites as a live authoritative fact rather than a dated historical note, per review feedback. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Support both Agent Sandbox
agents.x-k8s.io/v1beta1andagents.x-k8s.io/v1alpha1APIs so OpenShell works with controller releases still used in the field.Related Issue
Closes #2013
Changes
Testing
mise run pre-commitpassesChecklist