Skip to main content

Installation

Overview​

Sandbox Controller and Sandbox Manager are two core components in the OpenKruise ecosystem:

  • Sandbox Controller: Manages CRD resources related to Sandbox, including lifecycle management of SandboxSet, Sandbox, SandboxClaim, and SandboxTemplate.
  • Sandbox Manager: Provides API services for Sandbox, containing controllers and Envoy proxies, supporting E2B protocol access.

Version Compatibility​

ComponentVersionKubernetes Compatibility
Sandbox Controllerv0.1.0>= 1.24
Sandbox Managerv0.1.0>= 1.24

Prerequisites​

  1. Kubernetes cluster version >= 1.24
  2. Helm v3.5+ installed
  3. OpenKruise installed (Sandbox Controller depends on some features of Kruise)
  4. Namespace created manually

Install via Helm​

1. Add OpenKruise Charts Repository​

helm repo add openkruise https://openkruise.github.io/charts/
helm repo update

2. Install Sandbox Controller​

Manually Create Namespace

kubectl create ns <namespace>

Installation Order: Sandbox Controller must be installed before Sandbox Manager, as it provides the CRD resources required by Sandbox Manager.

helm install agents-sandbox-controller openkruise/kruise-agents-sandbox-controller -n <namespace> --version 0.1.0

3. Install Sandbox Manager​

helm install agents-sandbox-manager openkruise/kruise-agents-sandbox-manager -n <namespace> --version 0.1.0

Upgrade via Helm​

Upgrade Sandbox Controller​

helm upgrade agents-sandbox-controller openkruise/kruise-agents-sandbox-controller -n <namespace> --version 0.1.0

Upgrade Sandbox Manager​

helm upgrade agents-sandbox-manager openkruise/kruise-agents-sandbox-manager -n <namespace> --version 0.1.0

Note:

  1. Before upgrading, you must read the Change Log to ensure you understand the incompatible changes in the new version.
  2. If you want to reset parameters used in previous versions or configure new parameters, it is recommended to add --reset-values to the helm upgrade command.

Manual Chart Download​

If you cannot connect to https://openkruise.github.io/charts/ in your production environment, you can manually download the chart package from GitHub Releases and then install or upgrade it to your cluster.

helm install/upgrade agents-sandbox-controller /PATH/TO/CONTROLLER/CHART -n <namespace> helm install/upgrade agents-sandbox-manager /PATH/TO/MANAGER/CHART -n <namespace>

Options​

Sandbox Controller Installation Parameters​

The following table shows all configurable parameters for the Sandbox Controller chart and their default values:

ParameterDescriptionDefault
replicaCountController replica count2
image.repositoryController image repositoryopenkruise/agent-sandbox-controller
image.tagController image versionv0.1.0
image.pullPolicyImage pull policyIfNotPresent
webhook.portWebhook service port9443
metrics.portMetrics service port8443
healthProbe.portHealth check port8081
resources.limits.cpuCPU resource limit2
resources.limits.memoryMemory resource limit4Gi
resources.requests.cpuCPU resource request2
resources.requests.memoryMemory resource request4Gi
namespace.nameDeployment namespacesandbox-system
serviceAccount.createWhether to create ServiceAccounttrue
serviceAccount.automountWhether to auto-mount ServiceAccount Tokentrue
serviceAccount.annotationsServiceAccount annotations{}
serviceAccount.nameServiceAccount name to use""
rbac.createWhether to create RBAC resourcestrue
imagePullSecretsImage pull secrets list[]
nameOverrideOverride Chart name""
fullnameOverrideOverride full name""
podAnnotationsPod annotations{}
podLabelsPod labels{}
podSecurityContextPod security context{runAsNonRoot: true, seccompProfile: {type: RuntimeDefault}}
securityContextContainer security context{allowPrivilegeEscalation: false, capabilities: {drop: [ALL], add: [NET_BIND_SERVICE]}, readOnlyRootFilesystem: true}
nodeSelectorNode selector for Pod scheduling{}
tolerationsTolerations for Pod scheduling[]
affinityAffinity for Pod scheduling{}

Sandbox Manager Installation Parameters​

The following table shows all configurable parameters for the Sandbox Manager chart and their default values:

Controller Parameters​

ParameterDescriptionDefault
replicaCountManager replica count2
controller.repositoryController image repositoryopenkruise/sandbox-manager
controller.tagController image versionv0.1.0
controller.pullPolicyImage pull policyIfNotPresent
controller.logLevelLog level3
controller.infraSandbox infrastructure typesandbox-cr
controller.hostNetworkWhether to use Host Networkfalse
controller.maxClaimWorkersMaximum Claim worker threads100
controller.maxCreateQPSMaximum QPS for creating Sandbox200
controller.extProcMaxConcurrencyExternal processor max concurrency3000
controller.resources.cpuController CPU resource limit2
controller.resources.memoryController memory resource limit4Gi

Proxy (Envoy) Parameters​

ParameterDescriptionDefault
proxy.repositoryEnvoy proxy image repositoryenvoyproxy/envoy
proxy.tagEnvoy proxy image versionv1.33-latest
proxy.pullPolicyImage pull policyIfNotPresent
proxy.resources.cpuEnvoy CPU resources2
proxy.resources.memoryEnvoy memory resources4Gi

E2B Protocol Parameters​

ParameterDescriptionDefault
e2b.domainE2B protocol domainyour.domain.com
e2b.enableAuthWhether to enable E2B authenticationtrue
e2b.adminApiKeyE2B admin API Keyadmin-987654321
e2b.maxTimeoutE2B max timeout (seconds)2592000

Service and Ingress Parameters​

ParameterDescriptionDefault
service.typeService typeClusterIP
service.portEnvoy proxy service port7788
ingress.classNameIngress class namenginx
ingress.annotationsIngress annotations{}
ingress.certSecretNameIngress TLS certificate Secret namesandbox-manager-tls

Other Parameters​

ParameterDescriptionDefault
imagePullSecretsImage pull secrets{}
nameOverrideOverride Chart name""
fullnameOverrideOverride full name""
serviceAccount.automountWhether to auto-mount ServiceAccount Tokentrue
serviceAccount.annotationsServiceAccount annotations{}
serviceAccount.nameServiceAccount name""
podAnnotationsPod annotations{}
podLabelsPod labels{}
podSecurityContextPod security context{fsGroup: 2000, seccompProfile: {type: RuntimeDefault}}
podSecurityContextAllowPrivilegeEscalationWhether to allow privilege escalationfalse
securityContextContainer security context{capabilities: {drop: [ALL], add: [NET_BIND_SERVICE]}, readOnlyRootFilesystem: true, allowPrivilegeEscalation: false, runAsNonRoot: true, runAsUser: 65532}
nodeSelectorNode selector{}
tolerationsTolerations[]
affinityAffinityPrefer Pod anti-affinity

These parameters can be set via --set key=value[,key=value] in the helm install or helm upgrade commands.

Best Practices​

Custom Resource Configuration​

Based on your cluster scale, it is recommended to adjust the following resource parameters:

Sandbox Controller resource adjustment

$ helm install agents-sandbox-controller openkruise/kruise-agents-sandbox-controller \
--set resources.limits.cpu=4 \
--set resources.limits.memory=8Gi \
--set resources.requests.cpu=2 \
--set resources.requests.memory=4Gi

Sandbox Manager resource adjustment

helm install agents-sandbox-manager openkruise/kruise-agents-sandbox-manager \
--set controller.resources.cpu=4 \
--set controller.resources.memory=8Gi

Configure E2B Domain and Authentication​

helm install agents-sandbox-manager openkruise/kruise-agents-sandbox-manager \
--set e2b.domain=sandbox.example.com \
--set e2b.enableAuth=true \
--set e2b.adminApiKey=your-secure-api-key

Expose Service via Ingress​

helm install agents-sandbox-manager openkruise/kruise-agents-sandbox-manager \
--set ingress.className=nginx \
--set ingress.annotations."cert-manager.io/cluster-issuer"=letsencrypt-prod \
--set ingress.certSecretName=sandbox-manager-tls

Uninstall​

Note: Uninstalling will delete all Sandbox-related resources, including webhook configurations, services, namespace, instances, and all Pods under Sandbox. Please proceed with caution! (CRDs and namespace will not be deleted) CRD Cleanup: CRD resources and Namespace will not be automatically cleaned up during upgrade and uninstallation. Please perform manual operations if you need to uninstall or upgrade.

Uninstall Sandbox Manager​

helm uninstall agents-sandbox-manager

Uninstall Sandbox Controller​

helm uninstall agents-sandbox-controller
Last updated on by ZhaoQing7892