kubernetes-sigs/agent-sandbox v0.2.1 on GitHub

🚀 Announcing Agent Sandbox v0.2.1!

We are excited to announce the release of Agent Sandbox v0.2.1!

This release introduces a major shift to a "Secure by Default" networking architecture, enforcing strict isolation for AI agents while providing a highly scalable shared policy model. Alongside these security and architectural advancements, this version strengthens observability with new telemetry metrics, enhances controller stability through a migration to the Deployment model, and expands the Python SDK capabilities with Pod Snapshots and native Kubernetes client support.

⚠️ Breaking Changes

Controller Migration (StatefulSet to Deployment): The core controller has been migrated from a StatefulSet to a Deployment, and leader election is now enabled by default. Action Required: You must delete the existing StatefulSet before deploying the new version to avoid conflicts by running kubectl delete statefulset agent-sandbox-controller -n agent-sandbox-system (#191).
Metrics Service Port Update: The metrics Service port has been changed from 80 to 8080 to align with standard practices and avoid traffic conflicts. Action Required: Update any custom ServiceMonitor resources or Prometheus scraping configurations to target port 8080 (#366).
Secure-by-Default Network Isolation: SandboxTemplates that do not explicitly define a network policy now default to a strict isolation posture. This blocks access to internal cluster IPs, VPC subnets, and the node metadata server. Action Required: If your agents require access to internal services, you must explicitly define these rules in your SandboxTemplate or opt out by setting the SandboxTemplate's spec.networkPolicyManagement field to Unmanaged (#287).

Key Highlights

Secure by Default Networking & Scalability: Implemented a strict security baseline for all sandboxes. If no policy is specified, the controller automatically blocks access to internal cluster IPs, VPC subnets, and the node metadata server. To ensure scalability, a single shared NetworkPolicy is now managed per SandboxTemplate rather than per individual sandbox, enabling instant fleet-wide updates with minimal API overhead.
Multi-Language SDK Advancements:
- Typed Go Client: Introduced a native Kubernetes Go client generated via client-gen, allowing Go developers to interact with Agent Sandbox resources using standard, type-safe Kubernetes patterns.
- Python SDK Advancements: Added support for GKE Pod Snapshots, enabling users to capture the state of running sandboxes. The SDK now features native Kubernetes client generation and new file management methods (list and exists).
Improved Observability & Metrics: Introduced new metrics to track sandbox lifecycles, including agent_sandbox_claim_startup_latency_ms and agent_sandbox_claim_creation_total. Metrics and healthz container ports are now explicitly defined for better networking transparency.
Controller Stability & Scaling: The core controller has been migrated from a StatefulSet to a Deployment for better lifecycle management. It now supports controller concurrency, configurable router timeouts, and enhanced leader election settings.
Robust Testing Infrastructure: The test suite now uses a watch-based mechanism instead of polling for more accurate results and captures detailed logs (including kubelet and containerd) into artifacts for easier debugging. A new load test using clusterloader2 has been added to simulate high-density sandbox environments.

Installation

Core & Extensions

# To install only the core components:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.2.1/manifest.yaml

# To install the extensions components:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.2.1/extensions.yaml

Python SDK

pip install k8s-agent-sandbox==0.2.1

Contributors

A huge thank you to all the contributors who made this release possible!

@antonipp, @mastersingh24, @SHRUTI6991, @igooch, @shrutiyam-glitch, @jkallogjeri, @justinsb, @runzhliu, @janetkuo, @vicentefb, @acsoto, @Oneimu, @sabre1041, @e-minguez, @Aliexe-code, @tp953704, @aditya-shantanu, @dongjiang1989, @tomergee, @shreyas-badiger, @esposem, @yongruilin

👋 New Contributors

@e-minguez made their first contribution in #302
@sabre1041 made their first contribution in #301
@runzhliu made their first contribution in #281
@jkallogjeri made their first contribution in #259
@Aliexe-code made their first contribution in #332
@tp953704 made their first contribution in #333
@Oneimu made their first contribution in #298
@dongjiang1989 made their first contribution in #364
@mastersingh24 made their first contribution in #233
@esposem made their first contribution in #377
@shreyas-badiger made their first contribution in #374
@yongruilin made their first contribution in #389

Full Changelog: v0.1.1...v0.2.1