extensions: propagate claim identity labels to Sandboxes and backing Pods by noeljackson · Pull Request #455 · kubernetes-sigs/agent-sandbox

noeljackson · 2026-03-21T14:29:52Z

Summary

add universal claim identity labels to claimed Sandboxes and backing Pods
stamp the labels in both cold-start and warm-pool adoption paths
document the labels and cover propagation in controller tests

This adds two generic labels:

agents.x-k8s.io/claim-name
agents.x-k8s.io/claim-uid

They provide a consumer-agnostic way to locate the Sandbox and Pod associated with a SandboxClaim, including after warm-pool adoption.

Testing

GOTMPDIR=/home/noel/src/codewire/isol8/.tmp/go-build GOCACHE=/home/noel/src/codewire/isol8/.tmp/go-cache go test ./extensions/controllers -count=1
GOTMPDIR=/home/noel/src/codewire/isol8/.tmp/go-build GOCACHE=/home/noel/src/codewire/isol8/.tmp/go-cache go test ./controllers -count=1

netlify · 2026-03-21T14:29:59Z

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	`0bbf49b`
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/69cfb253d6b9520008c37454

k8s-ci-robot · 2026-03-21T14:29:59Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: noeljackson
Once this PR has been reviewed and has the lgtm label, please assign janetkuo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2026-03-21T14:30:03Z

Hi @noeljackson. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

SHRUTI6991 · 2026-03-24T16:33:57Z

extensions/api/v1alpha1/sandboxclaim_types.go

+
+	// ClaimNameLabel is propagated to Sandboxes and backing Pods so consumers can
+	// locate the workload associated with a SandboxClaim.
+	ClaimNameLabel = "agents.x-k8s.io/claim-name"


How about we just keep the claim-uid?

What if the user deletes and recreates the claim with the same name? What happens to the labels of the underlying Pod?

uid is a better strategy for labelling as it has fixed character of 36 conforming to label limits.

Agreed. We use the claim UID (not name) for exactly those reasons. The label key is agents.x-k8s.io/claim-uid and the value is the claim's .metadata.uid, which changes on delete/recreate. No duplicate constant -- we use SandboxIDLabel directly.

codebot-robot

Overall, the implementation correctly propagates the claim UID labels to both Sandboxes and their backing Pods, which is beneficial for tracking and discovery. The test coverage effectively validates this behavior across both cold-start and warm-pool adoption paths.

However, there is a notable issue: the newly introduced ClaimUIDLabel constant has the exact same string value (agents.x-k8s.io/claim-uid) as the already existing SandboxIDLabel constant. This duplication results in redundant map assignments in the controllers and overlapping assertions in the tests.

Please see the inline comments for specific suggestions on consolidating these constants and cleaning up the redundant code.

(This review was generated by Overseer)

codebot-robot · 2026-03-26T06:01:22Z

extensions/api/v1alpha1/sandboxclaim_types.go

+
+	// ClaimUIDLabel is propagated to Sandboxes and backing Pods as a stable,
+	// immutable identity that survives delete/recreate of identically-named claims.
+	ClaimUIDLabel = "agents.x-k8s.io/claim-uid"


This constant has the exact same string value (agents.x-k8s.io/claim-uid) as SandboxIDLabel defined in sandboxtemplate_types.go. Defining two distinct constants for the exact same label key can be confusing and lead to redundant assignments. I recommend either reusing SandboxIDLabel directly or replacing SandboxIDLabel globally with ClaimUIDLabel if you feel it's a more accurate name.

The current version uses SandboxIDLabel directly. No duplicate constant.

codebot-robot · 2026-03-26T06:01:22Z

extensions/controllers/sandboxclaim_controller.go

-			adopted.Spec.PodTemplate.ObjectMeta.Labels = make(map[string]string)
-		}
+		adopted.Labels = ensureClaimIdentityLabels(adopted.Labels, claim)
+		adopted.Spec.PodTemplate.ObjectMeta.Labels = ensureClaimIdentityLabels(adopted.Spec.PodTemplate.ObjectMeta.Labels, claim)


Because ClaimUIDLabel (set inside ensureClaimIdentityLabels) and SandboxIDLabel share the exact same string value, this code ends up writing the exact same map key twice to adopted.Spec.PodTemplate.ObjectMeta.Labels. Consolidating the constants will resolve this duplication.

Resolved. Using SandboxIDLabel only, no duplicate writes.

codebot-robot · 2026-03-26T06:01:22Z

extensions/controllers/sandboxclaim_controller.go

 		sandbox.Spec.PodTemplate.ObjectMeta.Labels = make(map[string]string)
 	}
+	sandbox.Labels = ensureClaimIdentityLabels(sandbox.Labels, claim)
+	sandbox.Spec.PodTemplate.ObjectMeta.Labels = ensureClaimIdentityLabels(sandbox.Spec.PodTemplate.ObjectMeta.Labels, claim)


The manual nil check for sandbox.Spec.PodTemplate.ObjectMeta.Labels on the preceding lines (508-510) is now redundant since ensureClaimIdentityLabels already securely handles nil map initialization.

Removed the redundant nil check. ensureClaimIdentityLabels handles nil initialization.

codebot-robot · 2026-03-26T06:01:22Z

extensions/controllers/sandboxclaim_controller_test.go

+				}
+
+				// 2. Verify pod template claim-uid label was added
+				if val := adoptedSandbox.Spec.PodTemplate.ObjectMeta.Labels[extensionsv1alpha1.ClaimUIDLabel]; val != string(claim.UID) {


These two tests (step 2 and step 3) are asserting the exact same label key (agents.x-k8s.io/claim-uid) in PodTemplate.ObjectMeta.Labels, just using two different constants. If you consolidate the constants as suggested, one of these assertions can be removed.

Already consolidated. Tests use SandboxIDLabel only.

codebot-robot · 2026-03-26T06:01:22Z

controllers/sandbox_controller_test.go

 					PodTemplate: sandboxv1alpha1.PodTemplate{
+						ObjectMeta: sandboxv1alpha1.PodMetadata{
+							Labels: map[string]string{
+								extensionsv1alpha1.ClaimUIDLabel: "claim-uid-1",


If ClaimUIDLabel is removed in favor of SandboxIDLabel to prevent duplicate constants, ensure this test uses the correct constant to verify label propagation.

Already consolidated. Tests use SandboxIDLabel only.

codebot-robot · 2026-03-26T06:01:22Z

extensions/controllers/sandboxclaim_controller_test.go

 				if err != nil {
 					t.Fatalf("expected sandbox to be created but got error: %v", err)
 				}
+				if val := sandbox.Labels[extensionsv1alpha1.ClaimUIDLabel]; val != string(claim.UID) {


Like the adoption tests above, if the duplicate constants are consolidated, these assertions will need to be updated to use the single unified constant.

Already consolidated. Tests use SandboxIDLabel only.

noeljackson · 2026-03-31T18:59:01Z

Friendly bump. All review comments addressed, tests pass. Could a maintainer run /ok-to-test when convenient?

aditya-shantanu · 2026-04-02T22:54:56Z

/ok-to-test

When a SandboxClaim creates or adopts a Sandbox, the controller now propagates agents.x-k8s.io/claim-uid (via the existing SandboxIDLabel constant) to both the Sandbox CR and its Pod template labels. This consolidates with SandboxIDLabel rather than introducing a duplicate constant — both represent the claim UID for discovery and NetworkPolicy targeting.

noeljackson · 2026-04-03T12:28:04Z

/retest

k8s-ci-robot requested review from janetkuo and justinsb March 21, 2026 14:29

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Mar 21, 2026

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 21, 2026

SHRUTI6991 reviewed Mar 24, 2026

View reviewed changes

noeljackson force-pushed the claim-identity-labels branch from 8015eb6 to 9ed6899 Compare March 25, 2026 21:32

codebot-robot reviewed Mar 26, 2026

View reviewed changes

noeljackson force-pushed the claim-identity-labels branch from 9ed6899 to cc62407 Compare March 26, 2026 10:00

noeljackson mentioned this pull request Mar 26, 2026

feat: support workspace resource overrides on SandboxClaims #459

Open

noeljackson force-pushed the claim-identity-labels branch from cc62407 to 9546055 Compare March 31, 2026 08:36

noeljackson force-pushed the claim-identity-labels branch from 9546055 to 6bb656a Compare April 2, 2026 13:09

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Apr 2, 2026

justinsb added the area:extensions label Apr 3, 2026

noeljackson force-pushed the claim-identity-labels branch from 6bb656a to 0bbf49b Compare April 3, 2026 12:28

Conversation

noeljackson commented Mar 21, 2026

Summary

Testing

Uh oh!

netlify bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for agent-sandbox canceled.

Uh oh!

k8s-ci-robot commented Mar 21, 2026

Uh oh!

k8s-ci-robot commented Mar 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codebot-robot left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

noeljackson commented Mar 31, 2026

Uh oh!

aditya-shantanu commented Apr 2, 2026

Uh oh!

noeljackson commented Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

netlify bot commented Mar 21, 2026 •

edited

Loading