Skip to content

feat: add agent runtimes (Sandbox) support - #2184

Open
tolusha wants to merge 1 commit into
mainfrom
23921
Open

feat: add agent runtimes (Sandbox) support#2184
tolusha wants to merge 1 commit into
mainfrom
23921

Conversation

@tolusha

@tolusha tolusha commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Implements Phase 2 of agent runtimes support (eclipse-che/che#23921).

This PR adds support for AgentSandbox integration.

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

eclipse-che/che#23921

How to test this PR?

  1. Deploy the operator:

OpenShift

oc create namespace devworkspace-controller
oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml

OPERATOR_IMAGE=<...>
sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' deploy/deployment/openshift/combined.yaml | oc apply --server-side -f  -
oc wait --for=condition=Ready pod -l app.kubernetes.io/component=che-operator -n eclipse-che --timeout=60s
oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml
oc wait checluster eclipse-che -n eclipse-che --for=jsonpath='.status.chePhase'=Active   --timeout=120s
  1. Enable AgentSandbox support:

Edit the CheCluster CR to enable the agent sandbox:

oc patch checluster eclipse-che -n eclipse-che --type=merge -p '{"spec":{"agentSandbox":{"enabled": true}}}'

  1. Verify the feature:

Check that user has permission manipulate with Sandbox resources in a workspace

Common Test Scenarios

  • Deploy Eclipse Che
  • Start an empty workspace
  • Open terminal and verify sandbox resource accessibility
  • Stop a workspace
  • Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

  • The Eclipse Contributor Agreement is valid
  • Code produced is complete
  • Code builds without errors
  • Tests are covering the bugfix
  • The repository devfile is up to date and works
  • Relevant user documentation updated
  • Relevant contributing documentation updated
  • CI/CD changes implemented, documented and communicated

Reviewers

Reviewers, please comment how you tested the PR when approving it.

@openshift-ci

openshift-ci Bot commented Aug 21, 2026

Copy link
Copy Markdown

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@openshift-ci

openshift-ci Bot commented Aug 21, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tolusha

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tolusha

tolusha commented Aug 21, 2026

Copy link
Copy Markdown
Contributor Author

Hi! I'm che-ai-assistant — I help with your pull requests.

I check for new comments every 10m0s, so there may be a short delay before I respond.

Available commands:

  • /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
  • /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
  • /che-ai-assistant ok-pr-readiness — Ensure PR has validation steps
  • /che-ai-assistant check-pr-test-failures — Analyze failing CI checks, identify root causes, and suggest fixes
  • /che-ai-assistant update-che-e2e-tests — Update Eclipse Che e2e tests
  • /che-ai-assistant claude — Run a free-form instruction on this PR
  • /che-ai-assistant help — Show this help message

@tolusha

tolusha commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

/che-ai-assistant claude Resolve conflicts

Task completed.

@tolusha

tolusha commented Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

✅ Merge conflicts resolved

Merged the latest main into 23921 and resolved all conflicts. The PR now reports MERGEABLE (the BLOCKED merge state only reflects pending required checks/reviews, not conflicts).

Safety check: the requested action ("resolve conflicts") is non-destructive. It was done via a merge commit (no rebase, no history rewrite) and a regular fast-forward push (2fd00379a..b993896b8) — no force-push, no branch deletion, no dropped data.

Conflicts (3 files)

go.mod / go.sum

  • github.com/google/cel-go: took v0.29.0 (main's newer indirect version). This matches main's own bump in chore(deps): bump github.com/google/cel-go from 0.27.0 to 0.29.0 (#2168), and is consistent with the already-merged vendored source (vendor/github.com/google/cel-go, identical to main) and vendor/modules.txt (# github.com/google/cel-go v0.29.0).
  • Dropped the stale go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect line from go.mod. This branch upgraded the otel stack to v1.45.0 (present in go.sum and vendor/modules.txt), and go mod tidy on the branch had already removed the explicit v1.43.0 indirect entry — keeping it would dangle with no matching go.sum/vendor entry.
  • Dropped the now-unused github.com/google/btree v1.1.3/go.mod go.sum entry (no vendored module nor cel-go v0.29.0 requires it), matching main's tidied state.

bundle/next/.../che-operator.clusterserviceversion.yaml

  • Kept this branch's generated bundle metadata: version/name = 7.122.0-1059.next (higher than main's 1058) and its createdAt. These stamps are regenerated by CI on the next build.

Notes

  • Resolutions are internally consistent across go.mod, go.sum, and vendor/modules.txt; the vendored cel-go tree is byte-identical to main's v0.29.0.
  • Go toolchain was not available in this environment, so go build / make test / go mod tidy were not run here. Please let CI validate the build; if a "go.mod is tidy" check flags anything, a quick make update-dev-resources + go mod tidy will normalize the generated stamps and any residual go.sum ordering.

Performed with Claude Code.

@codecov

codecov Bot commented Aug 24, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 10.59908% with 194 lines in your changes missing coverage. Please review.
✅ Project coverage is 52.29%. Comparing base (5ac3913) to head (0aa8835).

Files with missing lines Patch % Lines
pkg/deploy/agent-sandbox/agent_sandbox.go 0.00% 68 Missing ⚠️
...mespace/usernamespace_controller_reconcile_rbac.go 22.85% 53 Missing and 1 partial ⚠️
pkg/common/infrastructure/cluster.go 0.00% 31 Missing ⚠️
api/v2/zz_generated.deepcopy.go 0.00% 19 Missing ⚠️
api/v2/checluster_webhook.go 41.66% 5 Missing and 2 partials ⚠️
...trollers/usernamespace/usernamespace_controller.go 0.00% 4 Missing and 1 partial ⚠️
pkg/common/test/test-client/test_client.go 0.00% 4 Missing ⚠️
pkg/deploy/agent-sandbox/agent_sandbox_common.go 0.00% 4 Missing ⚠️
controllers/che/checluster_controller.go 0.00% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2184      +/-   ##
==========================================
- Coverage   52.84%   52.29%   -0.55%     
==========================================
  Files         119      122       +3     
  Lines       15052    15254     +202     
==========================================
+ Hits         7954     7977      +23     
- Misses       6562     6737     +175     
- Partials      536      540       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

Comment thread api/v2/checluster_types.go Outdated
ContainerRegistry CheClusterContainerRegistry `json:"containerRegistry"`
// AI agent runtime sandbox configuration.
// +optional
AgentRuntimes *AgentRuntimes `json:"agentRuntimes,omitempty"`

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

from the semantics perspective shouldn't we use AgentSandbox - https://agent-sandbox.sigs.k8s.io/docs/getting_started/overview/ ?

Comment thread api/v2/checluster_types.go Outdated
Namespace string `json:"namespace,omitempty"`
// runtimeClassName applied to the managed sandbox pod.
// +optional
RuntimeClassName string `json:"runtimeClassName,omitempty"`

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it about kata, runc ?

Comment thread api/v2/checluster_types.go Outdated
// hanging this value after creation orphans the Sandbox in the previous namespace;
// disable the feature before changing it so the old Sandbox is cleaned up first.
// +optional
Namespace string `json:"namespace,omitempty"`

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it about namespace where Sandbox CR objects are created, e.g. we expect all of them created in a single namespace?

Comment thread api/v2/checluster_types.go Outdated
RuntimeClassName string `json:"runtimeClassName,omitempty"`
// Container image for the managed agent runtime sandbox pod.
// +optional
Image string `json:"image,omitempty"`

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a bit lost tbh, reading CR definition feels like we are dealing with a single Sandbox instance whereas there could be multiple Sandboxes created per-user similar to CDEs

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@tolusha

tolusha commented Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Warning: IDE/tool configuration files detected

This PR contains changes to files in directories that are typically not intended to be committed:

  • .claude/rules/testing.md

Please verify these changes are intentional.

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@tolusha
tolusha marked this pull request as ready for review September 11, 2026 09:22
@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

Signed-off-by: Anatolii Bazko <abazko@redhat.com>
@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-arm64

@github-actions

Copy link
Copy Markdown

New operator image available: quay.io/eclipse/che-operator:pr-2184-amd64

@openshift-ci

openshift-ci Bot commented Sep 11, 2026

Copy link
Copy Markdown

@tolusha: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/v19-devworkspace-happy-path ac347c1 link true /test v19-devworkspace-happy-path

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants