Skip to content

fix: handle NotFound and add ownerReferences in BarePodManager#322

Open
tremes wants to merge 2 commits into
openshift:mainfrom
tremes:issue-301
Open

fix: handle NotFound and add ownerReferences in BarePodManager#322
tremes wants to merge 2 commits into
openshift:mainfrom
tremes:issue-301

Conversation

@tremes

@tremes tremes commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

WaitReady now treats NotFound as a terminal error instead of polling until timeout. It also checks DeletionTimestamp after a successful Get to fail fast on terminating pods.

Sandbox pods created by Claim now carry ownerReferences back to the AgenticRun via the new SandboxOwnerSetter optional interface, enabling garbage collection on AgenticRun deletion.

Closes: #301

Assisted-by: Claude Code:claude-opus-4-6

@openshift-ci
openshift-ci Bot requested review from raptorsun and xrajesh July 13, 2026 08:44
@openshift-ci

openshift-ci Bot commented Jul 13, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xrajesh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 91b88d80-dbfd-41d1-80a6-e70a40fe1dfa

📥 Commits

Reviewing files that changed from the base of the PR and between 983e009 and b771834.

📒 Files selected for processing (8)
  • .ai/spec/how/reconciler.md
  • .ai/spec/what/sandbox-execution.md
  • controller/agenticrun/bare_pod_manager.go
  • controller/agenticrun/bare_pod_manager_test.go
  • controller/agenticrun/sandbox.go
  • controller/agenticrun/sandbox_agent.go
  • controller/agenticrun/sandbox_agent_test.go
  • controller/agenticrun/sandbox_test.go
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift/lightspeed-agentic-sandbox (manual)
🚧 Files skipped from review as they are similar to previous changes (1)
  • .ai/spec/what/sandbox-execution.md

📝 Walkthrough

Summary by CodeRabbit

  • New Features
    • In bare-pod sandbox mode (default), step Pods are automatically linked to their owning run via controller owner references.
  • Bug Fixes
    • Pod readiness now fails promptly when the Pod is missing or terminating, avoiding unnecessary retries.
    • Pod recreation properly treats deleted/terminating Pods to prevent incorrect retry behavior.
  • Documentation
    • Updated sandbox lifecycle and reconciler docs to reflect the new bare-pod ownership and provider/agent call ordering.
  • Tests
    • Expanded coverage for owner-reference correctness and terminal readiness failure cases.

Walkthrough

Changes

Bare-pod sandbox lifecycle

Layer / File(s) Summary
Claim contract and call wiring
controller/agenticrun/sandbox.go, controller/agenticrun/sandbox_agent.go, controller/agenticrun/sandbox*_test.go
Sandbox claiming now receives an AgenticRun object, derives claim names from run.Name, and passes the run through provider implementations and test mocks.
Pod ownership and readiness handling
controller/agenticrun/bare_pod_manager.go, .ai/spec/what/sandbox-execution.md
Claimed Pods receive controller and block-owner-deletion references to the AgenticRun; missing and terminating Pods now produce terminal readiness errors.
Lifecycle validation and documentation
controller/agenticrun/bare_pod_manager_test.go, .ai/spec/how/reconciler.md
Tests cover owner-reference identity and flags plus missing and terminating Pod behavior; reconciler documentation describes the updated claim and readiness flow.

Sequence Diagram(s)

sequenceDiagram
  participant SandboxAgentCaller
  participant BarePodManager
  participant KubernetesAPI
  SandboxAgentCaller->>BarePodManager: Claim(ctx, run, step, "")
  BarePodManager->>KubernetesAPI: Create Pod with AgenticRun ownerReference
  SandboxAgentCaller->>BarePodManager: WaitReady()
  BarePodManager->>KubernetesAPI: Get Pod
  KubernetesAPI-->>BarePodManager: Ready or terminal lifecycle state
  BarePodManager-->>SandboxAgentCaller: Ready or error
Loading
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 22.22% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title matches the main fix: NotFound handling and ownerReferences in BarePodManager.
Description check ✅ Passed The description directly describes the lifecycle fixes and ownerReferences change in this PR.
Linked Issues check ✅ Passed The changes address all #301 requirements: terminating-pod adoption, NotFound terminal handling, and ownerReferences on sandbox pods.
Out of Scope Changes check ✅ Passed No clearly unrelated code changes are evident; the API, tests, and docs all support the bare-pod lifecycle fix.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@controller/agenticrun/bare_pod_manager.go`:
- Around line 63-67: Remove mutable owner state from BarePodManager by
eliminating SetOwner and the m.run dependency; change Claim to accept the owning
AgenticRun explicitly and use that argument when constructing the pod
ownerReference. Update all Claim callers, including SandboxAgentCaller, to pass
the reconcile-specific run so concurrent reconciles cannot attach pods to the
wrong owner.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 439a5b81-0f6a-4beb-8a84-4643f83f599a

📥 Commits

Reviewing files that changed from the base of the PR and between 3ebecc6 and 983e009.

📒 Files selected for processing (6)
  • .ai/spec/how/reconciler.md
  • .ai/spec/what/sandbox-execution.md
  • controller/agenticrun/bare_pod_manager.go
  • controller/agenticrun/bare_pod_manager_test.go
  • controller/agenticrun/sandbox.go
  • controller/agenticrun/sandbox_agent.go
🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

  • openshift/lightspeed-agentic-sandbox (manual)

Comment thread controller/agenticrun/bare_pod_manager.go Outdated
tremes added 2 commits July 17, 2026 15:57
WaitReady now treats NotFound as a terminal error instead of
polling until timeout. It also checks DeletionTimestamp after a
successful Get to fail fast on terminating pods.

Sandbox pods created by Claim now carry ownerReferences back to
the AgenticRun via the new SandboxOwnerSetter optional interface,
enabling garbage collection on AgenticRun deletion.

Closes: openshift#301

Signed-off-by: Tomáš Remeš <tremes@redhat.com>
Assisted-by: Claude Code:claude-opus-4-6
Remove SetOwner/SandboxOwnerSetter and pass *AgenticRun directly
to SandboxProvider.Claim. The shared BarePodManager instance stored
mutable owner state via SetOwner, so concurrent reconciles could
attach a pod's ownerReference to the wrong AgenticRun.

Claim now always sets ownerReferences from the passed-in run
argument, eliminating the race window entirely.

Signed-off-by: Tomáš Remeš <tremes@redhat.com>
Assisted-by: Claude Code:claude-opus-4-6
@openshift-ci

openshift-ci Bot commented Jul 17, 2026

Copy link
Copy Markdown

@tremes: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bare-pod sandbox lifecycle: Terminating pods adopted on create, WaitReady spins on NotFound, and pods lack ownerReferences (leaks)

1 participant