[github-actions]

kagent-dev/kagent#3357 — Add a helm configuration option for SandboxConfig ref

Docs versions: 1.x (first shipped in v1.0.0-rc1)

What changes for users: Operators can set substrateWorkerPool.sandboxConfigRef to name a custom SandboxConfig for the selected WorkerPool sandbox class. If they omit the value or leave it empty, the chart still uses gvisor-default for gvisor and microvm for microvm.

What the docs now say: The Tune Agent Substrate guide now shows the optional Helm value beside sandboxClass and workerImage. The Sandboxing concept page now scopes the built-in SandboxConfig names to the default behavior.

Not verified: No cluster was configured; the configuration and commands are unrun, and internal links are unchecked.

How kagent-3357 was drafted, and what was not verified

• Code PR: Add a helm configuration option for SandboxConfig ref kagent#3357
• Code issue: none linked
• Product: kagent (upstream) → kagent-dev/website
• Docs version: 1.x; first shipped in v1.0.0-rc1. This product publishes one rolling tree, so the release confirms that the change is out rather than choosing a version.
• Category: scoped-edit / pr

Plan, and what changed it

• Planned: Add substrateWorkerPool.sandboxConfigRef to the WorkerPool sandbox-class guidance in operations/tune-agent-substrate.md.
• Learned: Grepping the target docs showed about/substrate-runtime/sandboxing.md also stated the built-in SandboxConfig names unconditionally.
• Did: Documented the Helm value in the task guide and corrected the concept-page default claim.

Why a documentation change is necessary

The pull request adds substrateWorkerPool.sandboxConfigRef to the kagent Helm values and uses that value as the WorkerPool SandboxConfig reference when it is set. The Tune Agent Substrate guide already tells readers how to set substrateWorkerPool.sandboxClass and how to confirm the required SandboxConfig, so a reader with custom runtime asset URLs would not know that the chart can point at a custom SandboxConfig. The sandboxing concept page also said that gvisor and microvm templates always name the built-in SandboxConfig resources, which is no longer true when the new value is set.

What changed on disk

• docs-site/content/kagent/1.x/operations/tune-agent-substrate.md: Adds the optional sandboxConfigRef Helm value, its default behavior, and the corresponding SandboxConfig check.
• docs-site/content/kagent/1.x/about/substrate-runtime/sandboxing.md: Updates the SandboxConfig naming note so the built-in names are described as defaults.

How to verify this change

1. Confirm that the custom SandboxConfig exists and serves the selected class.

   kubectl get sandboxconfig custom-gvisor-config -o jsonpath='{.spec.sandboxClass}'

   The command shows gvisor.

2. Upgrade kagent with a values file that sets the custom reference.

   substrateWorkerPool:
     sandboxClass: gvisor
     sandboxConfigRef: custom-gvisor-config

3. Check the rendered WorkerPool.

   kubectl get workerpool kagent-default -n kagent -o jsonpath='{.spec.sandboxClasses[0].configRef.name}'

   The command shows custom-gvisor-config.

Proposed release note

No proposed-release-note.md: markers.notes_placeable is false for this product. Suggested text: The kagent Helm chart now accepts substrateWorkerPool.sandboxConfigRef, so operators can point a WorkerPool at a custom SandboxConfig for the selected sandbox class. Omit the value to keep gvisor-default for gvisor and microvm for microvm.

What was not verified

• Commands in the documentation are unrun.
• Internal links are unchecked because Hugo was not run.

How the pages were chosen (triage report)

Feature clusters

Kept apart on purpose. Merging wrongly produces a guide that documents two things and explains neither, so these are reported for a person to merge rather than grouped automatically:

• an internal repository#630 and Add a helm configuration option for SandboxConfig ref kagent#3357 both have docs-site/content/kagent/1.x/setup/installation.md as a candidate, but for one of them it is one page among more than 3, so they are kept apart; merge them if both drafts do land there

Draft a documentation change

kagent-dev/kagent#3357 — Add a helm configuration option for SandboxConfig ref

• Product: kagent (upstream) → kagent-dev/website
• Docs version: 1.x
• Summary (read from the body): Using a user-defined SandboxConfig could be useful in some environments (ex. changing gvisor asset URLs, etc.). This adds a sandboxConfigRef field under substrateWorkerPool in the helm chart to allows overriding the default behavior if set.
• Not tested: no cluster was available, so every command in this diff is unrun

Draft branch: pr-tracker-draft-kagent-3357

[Rachael-Graham]

Covered by #652 (v1.0.0-rc1 docs update).