这是重新组织的变更日志，按功能、修复和杂项分类：

What's Changed

Features

• feat: add sandbox lifecycle metrics for kube-state-metrics style monitoring by @liangxiaoping in #258
• feat: add feature gate to cache PodLabelSelector by @PersistentJZH in #259
• feat: support inplace CPU resize for warm pool sandboxes by @PersistentJZH in #228
• feat(sandbox-controller): support rolling update of sandboxset by @BITLiutianyang in #256
• add e2b template list&get by @ZhaoQing7892 in #265
• feat: support negative TTL for never delete SandboxClaim by @AiRanthem in #277
• update labels when claiming by @furykerry in #201
• sandbox printcolumn add claimed by @zmberg in #285
• update pod labels when claiming by @furykerry in #288
• add ExtensionAnnotations to InPlaceUpdateOptions by @zmberg in #289
• feat(e2b/keys): add pluggable KeyStorage with MySQL backend by @AiRanthem in #291
• Add gateway flow by @ZhaoQing7892 in #299
• feat(e2b): support custom CDP port for browser use by @AiRanthem in #298
• feat: support kruise custom api for gateway by @chengzhycn in #278
• sandbox support recreate upgradeStrategy and lifecycle by @zmberg in #302
• sandboxupdateops controller by @zmberg in #307
• feat: enhance prometheus metrics observability for sandbox ecosystem by @KeyOfSpectator in #292
• update manager metrics by @ZhaoQing7892 in #268
• Validate SandboxSet volume claim template mounts by @ajatshatru01 in #359
• feat(controller): consider SandboxTemplate for SandboxSet rolling update by @BITLiutianyang in #317
• Improve claim sandbox failure diagnostics by @AiRanthem in #356
• feat: add team-based namespace isolation and team-scoped API key authorization by @AiRanthem in #325
• feature: skip InitRuntime when no agent-runtime configured in Sandbox by @zmberg in #340
• add validation for TTLAfterCompleted and WaitReadyTimeout by @BH4AWS in #361
• feat: add SandboxMultiClusterNaming feature gate to embed cluster ID by @zmberg in #370
• feat: add strategic merge patch markers to CRD types for kubectl apply by @zmberg in #372
• feat(metrics): add operation counters, deletion duration, resume type label, and abnormal state detection by @KeyOfSpectator in #336

Fixes

• fix(controller): fix sbx fails to enter the Running stage when using templateRef by @PersistentJZH in #260
• fix: update EnvdVersion from 0.1.1 to 0.2.10 by @AiRanthem in #276
• bugfix for a design flaw, the sandbox-controller inconsistently injects by @BH4AWS in #279
• fix: checkpoint bugfix by @BH4AWS in #275
• fix(utils): panic when logging sidecar config error by @lxs137 in #301
• fix(e2b): enforce connect timeout extension semantics by @AiRanthem in #303
• CSI remounting in the sandbox-controller during the wakeup phase by @BH4AWS in #305
• after a recreate upgrade, the pod is brand new, so runtime and dynamic sidecar need re-injection by @BH4AWS in #316
• security: reduce filesystem permissions for certificates and keys by @PRAteek-singHWY in #330
• fix: use ceil rounding for maxUnavailable percentage to ensure at least 1 pod by @zmberg in #348
• fix: clear stale Upgrading condition on upgrade re-trigger by @zmberg in #349
• fix(sandbox): make pause/resume concurrency-safe under parallel requests by @AiRanthem in #358
• fix: include initContainers in resize body to prevent inplace VPA failure by @zmberg in #368
• fix: include stdout/stderr in lifecycle hook failure messages by @zmberg in #380

Chores

• upgrade k8s sdk to v0.35 by @zmberg in #238
• add roadmap by @furykerry in #271
• chore: add fmt-imports.sh and fmt imports by @PersistentJZH in #272
• build(deps): bump actions/cache from 5.0.3 to 5.0.5 by @dependabot[bot] in #281
• build(deps): bump crate-ci/typos from 1.44.0 to 1.45.1 by @dependabot[bot] in #283
• build(deps): bump ruby/setup-ruby from 1.286.0 to 1.302.0 by @dependabot[bot] in #284
• add docker sandbox-gateway workflows by @ZhaoQing7892 in #295
• add observability prometheus metric proposal doc by @KeyOfSpectator in #306
• add code-reviewer agents and OWNERS file by @furykerry in #310
• build(deps): bump crate-ci/typos from 1.45.1 to 1.45.2 by @dependabot[bot] in #318
• build(deps): bump crate-ci/typos from 1.45.2 to 1.46.0 by @dependabot[bot] in #338
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.3 by @dependabot[bot] in #339
• docs: add claude code deployment guide by @bcfre in #334
• docs: add proposal for sandbox container image commit by @Luckydog691 in #331
• docs: fix SandboxClaim Labels comment to reflect template sync and claiming by @zmberg in #350
• docs: add Gateway Identity Provider proposal with token refresh and multi-scenario support by @BH4AWS in #357
• build(deps): bump crate-ci/typos from 1.46.0 to 1.46.1 by @dependabot[bot] in #376
• build(deps): bump ruby/setup-ruby from 1.302.0 to 1.307.0 by @dependabot[bot] in #377
• build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #378
• refactor(sandbox-manager): migrate cache layer to controller-runtime architecture by @AiRanthem in #287
• refactor: unify post-resume initialization into sandbox-controller by @BH4AWS in #360
• optimize CSI mounting logic by replacing serial mode with parallel by @BH4AWS in #290
• Improve middleware logs by @AiRanthem in #363
• test(sandbox): remove unnecessary TestEnsureSandboxPaused_DelegatesTo by @AiRanthem in #384

New Contributors

• @liangxiaoping made their first contribution in #258
• @BITLiutianyang made their first contribution in #256
• @KeyOfSpectator made their first contribution in #306
• @PRAteek-singHWY made their first contribution in #330
• @ajatshatru01 made their first contribution in #359
• @Luckydog691 made their first contribution in #331

Full Changelog: v0.2.0...v0.3.0

Change log since v0.2.0

Key Features

• Implemented rolling update support for SandboxSet with configurable maxUnavailable policy. (#256, @BITLiutianyang)
• Introduced pluggable KeyStorage with MySQL backend for E2B API key management. (#291, @AiRanthem)
• Added team-based namespace isolation and team-scoped API key authorization for multi-tenant support. (#325, @AiRanthem)
• Added Kruise custom path-based routing protocol in sandbox-gateway, supporting /kruise/{namespace}--{sandbox-name}/{port}/{user-defined-path} URL format to route requests directly to sandbox pods with path rewrite. (#278, @chengzhycn)
• Added in-place CPU resize capability when claiming warm pool sandboxes via SandboxClaim or E2B Create API, allowing resource reconfiguration without pod recreation. (#228, @PersistentJZH)
• Implemented Recreate upgrade strategy for Sandbox with preUpgrade/postUpgrade lifecycle hooks support. (#302, @zmberg)
• Introduced SandboxUpdateOps CR for batch upgrading claimed sandboxes with lifecycle hooks support. (#307, @zmberg)
• Added E2B-compatible GET /templates and GET /templates/{templateID} API endpoints for SandboxTemplate listing and retrieval. (#265, @ZhaoQing7892)

Performance Improvements

• Added strategic merge patch markers to CRD types to improve kubectl apply performance and reduce API server load. (#372, @zmberg)
• Optimized CSI mounting logic from serial to parallel mounting capability for faster sandbox creation. (#290, @BH4AWS)
• Added feature gate to cache PodLabelSelector for performance optimization. (#259, @PersistentJZH)

Observability & Metrics

• Added Prometheus metrics for Sandbox, SandboxClaim, SandboxSet and sandbox-manager lifecycle observability. (#258, @liangxiaoping; #292, @KeyOfSpectator)
• Improved claim sandbox failure diagnostics by recording retry pick failures with sandbox key and reason in ClaimMetrics, and exposing aggregated diagnostics in E2B CreateSandbox API errors. (#356, @AiRanthem)

Other Notable Changes

sandbox-controller

• Added support for negative TTL in SandboxClaim to prevent automatic deletion of the SandboxClaim CR. (#277, @AiRanthem)
• Introduced SandboxMultiClusterNaming feature gate to embed cluster ID hash in sandbox generateName prefix, preventing name collisions across clusters. (#370, @zmberg)
• Added CSI dynamic remounting when resuming sandbox to ensure consistent mount state. (#305, @BH4AWS)

sandbox-manager

• Added custom CDP port support for BrowserUse API, allowing users to specify a cdpPort query parameter to proxy Chrome DevTools Protocol requests. (#298, @AiRanthem)
• Added support for updating Sandbox and Pod labels during E2B Create Sandbox. (#201, @furykerry)

Bug Fixes

• Fixed unnecessary InitRuntime execution when no agent-runtime is configured in Sandbox. (#340, @zmberg)
• Fixed E2B connect timeout extension semantics to properly handle sandbox lifecycle timeouts. (#303, @AiRanthem)
• Fixed pause/resume operations to be concurrency-safe under parallel requests. (#358, @AiRanthem)
• Fixed templateRef sandbox hashing to avoid nil template panic. (#260, @PersistentJZH)
• Fixed volume injection issue when user already specified posthook containers. (#279, @BH4AWS)
• Fixed panic when logging sidecar config errors. (#301, @lxs137)
• Updated EnvdVersion from 0.1.1 to 0.2.10 for compatibility. (#276, @AiRanthem)
• Fixed checkpoint not recording CSI mount state, causing cloned pods to fail mounting. (#275, @BH4AWS)

Security

• Reduced filesystem permissions for certificate and key files to prevent unauthorized access. (#330, @PRAteek-singHWY)

Misc (Chores and tests)

• Added validation for TTLAfterCompleted and WaitReadyTimeout parameters. (#361, @BH4AWS)
• Implemented validation for SandboxSet volume claim template mounts. (#359, @ajatshatru01)
• Added Claude Code deployment guide for AI agent sandbox integration. (#334, @bcfre)
• Added comprehensive roadmap for future development. (#271, @furykerry)
• Added code-reviewer agents and OWNERS file for maintainership clarity. (#310, @furykerry)
• Added fmt-imports.sh script and applied formatting across codebase. (#272, @PersistentJZH)

Change Log

v0.2.0

Change log since v0.1.0

Key Features

• Introduced the sandbox-gateway component to separate the data plane (ingress traffic handling) from the component sandbox-manager, enhancing system stability and fault isolation. (#203, @chengzhycn)
• Added support for mounting multiple NAS/OSS volumes dynamically. (#211, @BH4AWS)
• Enhanced E2B APIs with snapshot and clone capabilities. (#204, @AiRanthem)
• Implemented paginated listing and deletion of snapshots. (#233, @AiRanthem)
• Added protection to prevent unauthorized deletion of Sandbox Pods, and only the sandbox controller may delete them. (#214, @zmberg)
• Enabled CSI volume mounting during sandbox creation via SandboxClaim. (#229, @BH4AWS)
• Added support for automatically injecting runtime and CSI sidecar containers based on sandbox ConfigMap configuration. (#232, @BH4AWS)

Performance Improvements

• Improved performance in large-scale sandbox creation scenarios by optimizing ListSandboxesInPool using singleflight deduplication. (#186, @AiRanthem)
• Introduced feature gate SandboxCreatePodRateLimitGate to enable prioritized sandbox pod creation. (#171, @zmberg)

Other Notable Changes

agents-sandbox-manager

• Extended the E2B CreateSandbox API with the e2b.agents.kruise.io/never-timeout annotation to support sandboxes that never auto-delete. (#183, @AiRanthem)
• Enabled CreateOnNoStock by default when claiming a sandbox. (#187, @AiRanthem)
• Removed default timeout assignment for paused sandboxes, preventing automatic deletion. (#196, @AiRanthem)
• Sandbox Manager now supports filtering sandbox-related custom resources via configurable sandbox-namespace and sandbox-label-selector. (#217, @lxs137)

agents-sandbox-controller

• Add flag parsing support (e.g., -v) for configurable logging verbosity. (#184, @songtao98)
• Add label selector for Pod informer to reduce cache size. (#198, @PersistentJZH)

Misc (Chores and tests)

• Docs: add OpenClaw deployment guide. (#235, @bcfre)
• docs(AGENTS): add AGENTS.md. (#237, @AiRanthem)
• Add sandboxSet Prometheus metrics. (#223, @ZhaoQing7892)
• agent(skills): add detailed deployment skill for Qoder. (#170, @AiRanthem)

Change log since v0.1.0

Key Features

• Introduced the sandbox-gateway component to separate the data plane (ingress traffic handling) from the component sandbox-manager, enhancing system stability and fault isolation. (#203, @chengzhycn)
• Added support for mounting multiple NAS/OSS volumes dynamically. (#211, @BH4AWS)
• Enhanced E2B APIs with snapshot and clone capabilities. (#204, @AiRanthem)
• Implemented paginated listing and deletion of snapshots. (#233, @AiRanthem)
• Added protection to prevent unauthorized deletion of Sandbox Pods, and only the sandbox controller may delete them. (#214, @zmberg)
• Enabled CSI volume mounting during sandbox creation via SandboxClaim. (#229, @BH4AWS)
• Added support for automatically injecting runtime and CSI sidecar containers based on sandbox ConfigMap configuration. (#232, @BH4AWS)

Performance Improvements

• Improved performance in large-scale sandbox creation scenarios by optimizing ListSandboxesInPool using singleflight deduplication. (#186, @AiRanthem)
• Introduced feature gate SandboxCreatePodRateLimitGate to enable prioritized sandbox pod creation. (#171, @zmberg)

Other Notable Changes

agents-sandbox-manager

• Extended the E2B CreateSandbox API with the e2b.agents.kruise.io/never-timeout annotation to support sandboxes that never auto-delete. (#183, @AiRanthem)
• Enabled CreateOnNoStock by default when claiming a sandbox. (#187, @AiRanthem)
• Removed default timeout assignment for paused sandboxes, preventing automatic deletion. (#196, @AiRanthem)
• Sandbox Manager now supports filtering sandbox-related custom resources via configurable sandbox-namespace and sandbox-label-selector. (#217, @lxs137)

agents-sandbox-controller

• Add flag parsing support (e.g., -v) for configurable logging verbosity. (#184, @songtao98)
• Add label selector for Pod informer to reduce cache size. (#198, @PersistentJZH)

Misc (Chores and tests)

• Docs: add OpenClaw deployment guide. (#235, @bcfre)
• docs(AGENTS): add AGENTS.md. (#237, @AiRanthem)
• Add sandboxSet Prometheus metrics. (#223, @ZhaoQing7892)
• agent(skills): add detailed deployment skill for Qoder. (#170, @AiRanthem)

🚀 Announcing OpenKruise Agent v0.1.0!

We are thrilled to announce the first official release of OpenKruise Agent v0.1.0!

OpenKruise Agent brings Kubernetes-native best practices for managing AI agent workloads at scale. Designed with both AI researchers and infrastructure engineers in mind, it simplifies and accelerates the deployment, operation, and lifecycle management of AI agents in cloud-native environments.

The project introduces two core components: agents-sandbox-controller and agents-sandbox-manager, delivering the following key capabilities:

agents-sandbox-controller

• Declaratively define and manage agent sandboxes using the new Sandbox and SandboxClaim custom resource definitions (CRDs).
• Achieve faster sandbox provisioning and improved scalability through SandboxSet, an optimized controller for batch sandbox management.

agents-sandbox-manager

• Implements the widely adopted E2B protocol, providing essential runtime capabilities such as sandbox creation, request routing, and lifecycle orchestration.
• Extends the E2B protocol with advanced features including in-place image updates and dynamic mounting of NAS/OSS storage into running sandboxes-enabling greater flexibility and efficiency for AI workloads.

With OpenKruise Agent v0.1.0, we’re taking the first step toward a robust, scalable, and developer-friendly solution for running AI agents on Kubernetes. We invite the community to try it out, contribute, and help shape the future of AI infrastructure!

🔗 Learn more and get started: website

agents-sandbox-controller

• Define and manage sandboxes declaratively using the new Sandbox, SandboxClaim APIs.
• Improve performance with SandboxSet, allowing for faster sandbox creation.

agents-sandbox-manager

• Supports the E2B mainstream protocol, providing core capabilities such as Agent sandbox creation, routing, and management.
• Extend the E2B protocol to support in-place update image and dynamic mounting of NAS/OSS within the sandbox.

support set timeout while resuming

Signed-off-by: AiRanthem <[email protected]>