📦 技術調査 - GKE Agent Sandbox

export PROJECT_ID=YOUR_PROJECT_ID
export CLUSTER_NAME=agent-sandbox-cluster
export LOCATION=us-central1
export CLUSTER_VERSION=1.35.2-gke.1269000
export NODE_POOL_NAME=gvisor-pool
export MACHINE_TYPE=n2-standard-4

gcloud beta container clusters create-auto ${CLUSTER_NAME} \
  --location=${LOCATION} \
  --cluster-version=${CLUSTER_VERSION} \
  --enable-agent-sandbox

# Step 1: クラスタ作成
gcloud beta container clusters create ${CLUSTER_NAME} \
  --location=${LOCATION} \
  --num-nodes=1 \
  --cluster-version=${CLUSTER_VERSION}

# Step 2: gVisor 対応ノードプールを追加
gcloud container node-pools create ${NODE_POOL_NAME} \
  --cluster=${CLUSTER_NAME} \
  --machine-type=${MACHINE_TYPE} \
  --location=${LOCATION} \
  --num-nodes=1 \
  --image-type=cos_containerd \
  --sandbox=type=gvisor

# Step 3: Agent Sandbox アドオン有効化
gcloud beta container clusters update ${CLUSTER_NAME} \
  --location=${LOCATION} \
  --enable-agent-sandbox

gcloud beta container clusters update ${CLUSTER_NAME} \
  --location=${LOCATION} \
  --enable-agent-sandbox

gcloud container clusters describe ${CLUSTER_NAME} \
  --location=${LOCATION} \
  --format="value(currentMasterVersion, addonsConfig.agentSandboxConfig.enabled)"

kubectl get runtimeclass
kubectl get crd | grep agents.x-k8s.io

NAME         HANDLER   AGE
gvisor       runsc     5m

sandboxclaims.extensions.agents.x-k8s.io
sandboxtemplates.extensions.agents.x-k8s.io
sandboxwarmpools.extensions.agents.x-k8s.io
sandboxes.agents.x-k8s.io

apiVersion: extensions.agents.x-k8s.io/v1beta1
kind: SandboxTemplate
metadata:
  name: python-runtime-template
  namespace: default
spec:
  podTemplate:
    metadata:
      labels:
        sandbox: python-sandbox-example
    spec:
      runtimeClassName: gvisor
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
      nodeSelector:
        sandbox.gke.io/runtime: gvisor
      tolerations:
      - key: "sandbox.gke.io/runtime"
        value: "gvisor"
        effect: "NoSchedule"
      containers:
      - name: python-runtime
        image: registry.k8s.io/agent-sandbox/python-runtime-sandbox:v0.1.0
        ports:
        - containerPort: 8888
        readinessProbe:
          httpGet:
            path: "/"
            port: 8888
        resources:
          requests:
            cpu: "250m"
            memory: "512Mi"
          limits:
            cpu: "500m"
            memory: "1Gi"
        securityContext:
          capabilities:
            drop: ["ALL"]
      restartPolicy: "OnFailure"

apiVersion: extensions.agents.x-k8s.io/v1beta1
kind: SandboxClaim
metadata:
  name: my-sandbox-claim
  namespace: default
spec:
  sandboxTemplateRef:
    name: python-runtime-template
  lifecycle:
    shutdownPolicy: DeleteForeground
  warmpool: default
  env:
  - name: USER_SESSION
    value: "abc123"

kubectl get sandboxclaim my-sandbox-claim -n default -o yaml
kubectl get sandbox -n default

apiVersion: extensions.agents.x-k8s.io/v1beta1
kind: SandboxWarmPool
metadata:
  name: python-sdk-warmpool
  namespace: default
spec:
  replicas: 10
  sandboxTemplateRef:
    name: python-runtime-template
  updateStrategy:
    type: OnReplenish

kubectl autoscale sandboxwarmpool python-sdk-warmpool \
  --min=5 --max=50 --cpu-percent=60

gcloud storage buckets create gs://agent-sandbox-snapshots-${PROJECT_ID} \
  --location=${LOCATION} \
  --enable-hierarchical-namespace \
  --uniform-bucket-level-access \
  --soft-delete-duration=0d

apiVersion: podsnapshot.gke.io/v1
kind: PodSnapshotStorageConfig
metadata:
  name: cpu-pssc-gcs
  namespace: default
spec:
  snapshotStorageConfig:
    gcs:
      bucket: "agent-sandbox-snapshots-${PROJECT_ID}"
      path: "my-snapshots"
---
apiVersion: podsnapshot.gke.io/v1
kind: PodSnapshotPolicy
metadata:
  name: cpu-psp
  namespace: default
spec:
  storageConfigName: cpu-pssc-gcs
  selector:
    matchLabels:
      sandbox: python-sandbox-example
  triggerConfig:
    type: manual
    postCheckpoint: resume

apiVersion: podsnapshot.gke.io/v1
kind: PodSnapshotManualTrigger
metadata:
  name: cpu-snapshot-trigger
  namespace: default
spec:
  targetPod: python-sandbox-example-abc123  # 実 Pod 名を指定する（label `sandbox: python-sandbox-example` から `kubectl get pods -l sandbox=python-sandbox-example` で取得）

apiVersion: autoscaling.x-k8s.io/v1beta1
kind: CapacityBuffer
metadata:
  name: customized-standby-buffer
  namespace: default
  annotations:
    buffer.gke.io/standby-capacity-init-time: "15m"
    buffer.gke.io/standby-capacity-refresh-frequency: "12h"
spec:
  podTemplateRef:
    name: buffer-unit-template
  replicas: 3
  provisioningStrategy: "buffer.gke.io/standby-capacity"

kubectl get crd | grep agents.x-k8s.io
kubectl get runtimeclass
kubectl get sandboxtemplate -A
kubectl get sandboxwarmpool -A
kubectl get sandbox -A
kubectl get sandboxclaim -A
kubectl describe sandbox <sandbox-name> -n <namespace>
kubectl get podsnapshot -A

kubectl get sandbox -n <namespace>
kubectl describe sandbox <name> -n <namespace>
kubectl wait --for=condition=Ready sandbox <name> -n <namespace> --timeout=120s

watch -n 5 "kubectl get sandboxwarmpool -n <namespace> \
  -o custom-columns=NAME:.metadata.name,REPLICAS:.spec.replicas,READY:.status.readyReplicas"

kubectl describe hpa <hpa-name> -n <namespace>

kubectl apply -f - <<EOF
apiVersion: podsnapshot.gke.io/v1
kind: PodSnapshotManualTrigger
metadata:
  name: session-end-snapshot-$(date +%s)
  namespace: <namespace>
spec:
  targetPod: <sandbox-pod-name>
EOF

kubectl delete pod <sandbox-pod-name> -n <namespace>
kubectl wait --for=condition=Ready pod/<new-pod-name> -n <namespace> --timeout=60s

gsutil lifecycle set lifecycle.json gs://<snapshot-bucket>

{
  "lifecycle": {
    "rule": [
      {
        "action": {"type": "Delete"},
        "condition": {"age": 30}
      }
    ]
  }
}

# 一時停止（replicas=0、PVC 保持）
kubectl patch sandbox <name> -n <namespace> \
  --type='merge' -p '{"spec":{"replicas":0}}'

# 再開
kubectl patch sandbox <name> -n <namespace> \
  --type='merge' -p '{"spec":{"replicas":1}}'

# 完全削除
kubectl delete sandbox <name> -n <namespace>

gcloud container clusters update <cluster-name> \
  --location=<location> \
  --release-channel=rapid

gcloud container clusters upgrade <cluster-name> \
  --location=<location> --master

gcloud container node-pools upgrade <pool-name> \
  --cluster=<cluster-name> --location=<location>

gcloud logging read \
  'resource.type="k8s_container" AND resource.labels.container_name="agent-sandbox-controller"' \
  --limit=50 --format=json

kubectl get events -n <namespace> \
  --field-selector=reason=PodSnapshotTaken \
  --sort-by='.lastTimestamp'

gcloud logging read \
  'logName="projects/<project>/logs/cloudaudit.googleapis.com%2Factivity" \
   AND protoPayload.resourceName=~"sandboxclaims"' \
  --limit=20

gsutil du -sh gs://<snapshot-bucket>

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: warmpool-hpa
  namespace: <namespace>
spec:
  scaleTargetRef:
    apiVersion: extensions.agents.x-k8s.io/v1beta1
    kind: SandboxWarmPool
    name: <pool-name>
  minReplicas: 10
  maxReplicas: 100
  metrics:
  - type: External
    external:
      metric:
        name: custom.googleapis.com|agent_sandbox_claim_creation_total
      target:
        type: AverageValue
        averageValue: "5"

apiVersion: cloud.google.com/v1
kind: ComputeClass
metadata:
  name: sandbox-compute-class
spec:
  priorities:
  - machineFamily: n2
  - machineFamily: c3

strace -c -e trace=all python -c "import <new_library>; <basic_test>"
docker run --runtime=runsc <your-image> python -c "import <new_library>"

gcloud iam service-accounts create agent-sandbox-sa --project=<project-id>

gcloud projects add-iam-policy-binding <project-id> \
  --member="serviceAccount:agent-sandbox-sa@<project-id>.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"  # 読み取り権限のみ。Snapshot 書き込みが必要な KSA には objectAdmin 相当を別途付与

gcloud iam service-accounts add-iam-policy-binding \
  agent-sandbox-sa@<project-id>.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="serviceAccount:<project-id>.svc.id.goog[<namespace>/agent-ksa]"