v0.5.1

> [!WARNING]
> **Upgrade Advisory (Warm-Started Claims Only):**  
> Releases `v0.5.0` and `v0.5.1` contain a status-wiping race condition during controller reconciliation that affects **warm-started `SandboxClaim`s** (`spec.warmPoolRef`).  
>   
> When upgrading from `v0.4.x` to `v0.5.0`/`v0.5.1`, initial bulk reconciliation of active warm claims can cause transient errors that wipe `status.sandbox.name`, forcing an unnecessary pod cold restart or re-adoption.  
>   
> **Scope:**  
> * **Fresh installations & Cold-start claims (`v1beta1`):** Not impacted during initial setup.  
> * **Upgrading from `v0.4.x` with active warm claims:** Please upgrade to **`v0.5.2`**.

# 🚀 Announcing Agent Sandbox v0.5.1!

We're excited to announce the release of **Agent Sandbox v0.5.1**! This patch release brings significant reconciler performance optimizations, core stability improvements, new Go and Python SDK capabilities, expanded example workloads, and dependency upgrades including `controller-runtime` v0.24.0 (supporting Kubernetes 1.36).

---

### Key Highlights

#### Core Stability & Reconciler Optimizations

* **Pod Cache Label Indexing (#1099):** Indexed pod cache by `sandbox` label to eliminate $O(N)$ pod listing during `reconcilePod`, significantly reducing CPU overhead during high-scale reconciles.
* **Adoption-Completion Requeue (#1108):** Implemented bounded requeue logic for `SandboxClaim` adoption completion to handle cache lag gracefully without falling back to exponential backoff.
* **Namespace Queue Partitioning (#813):** Partitioned `SimpleSandboxQueue` by namespace to improve isolation and concurrency under heavy multi-tenant load.
* **Webhook Certificate Management Flag (#1093):** Introduced `--manage-webhook-certs` to allow disabling in-binary certificate management and CRD patching for external cert-manager setups.
* **CRD Printer Columns & Status Updates (#964, #990, #1053):** Added `Desired` printer column to `SandboxWarmPool` and updated `computeReadyCondition` for `Sandbox` CRD.
* **Shared Blueprint & Policy Injection (#995, #991):** Introduced inlined `SandboxBlueprint` shared by `Sandbox` and `SandboxTemplate`, and fixed claim env injection rejection when templates specify `EnvFrom`.
* **NetworkPolicy Ownership (#828):** Ensured `SandboxTemplate` controller explicitly verifies ownership of `NetworkPolicy` resources.

#### Go & Python SDK Enhancements

* **Go Sandbox-Router (#838, #1066):** Introduced a high-performance Go implementation of `sandbox-router` as a drop-in replacement for the Python router, along with configurable `MAX_KEEPALIVE_CONNECTIONS`.
* **Python SDK Network & Gateway Improvements (#917, #1014, #756, #1035):** Implemented Pod IP prioritization and normalization, RFC 3986 compliant IPv6 URL bracketing, enabled `AsyncSandboxClient` cleanup by default, and fixed gateway status address validation.
* **VolumeClaimTemplates in Claims (#961):** Updated SDK to accept `VolumeClaimTemplates` directly via `SandboxClaim`.
* **Go Client Tagged Releases (#537):** Established repository-tag-based release definitions for the Go client.

#### Examples, Load Testing & Workloads

* **GKE High-Density & Scale-to-Zero (#1005, #1048, #1023):** Added GKE Swap example for high-density agent deployments, KEDA scale-to-zero example, and GKE late-binding user guide.
* **New Sandbox Workload Examples (#1068, #1043, #1040, #1049):** Added `nullclaw-sandbox`, Playwright sandbox, Cilium identity-based egress e2e example, and RL instant-claim sizing.
* **Chrome Sandbox Stability (#1062, #1096):** Cross-compiled `chrome-sandbox` entrypoint to prevent QEMU Go crashes and updated base images and readiness probes.

#### Infrastructure & Dependencies

* **Kubernetes 1.36 & Controller-Runtime (#779):** Upgraded `controller-runtime` to v0.24.0 and Kubernetes dependencies to support Kubernetes 1.36.
* **Site & Docs (#1026, #785, #1075, #747):** Upgraded Hugo to v0.163.3, documented agent skills in `AGENTS.md`, and added KEP for standardizing sandbox runtime interfaces.

---

### Installation

#### Core & Extensions
```bash
# To install only the core components:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.5.1/manifest.yaml

# To install the extensions components:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.5.1/extensions.yaml
```

#### Python SDK
```bash
pip install k8s-agent-sandbox==0.5.1
```

---
### Contributors

We extend our sincere thanks to all contributors to this release:
@Oneimu, @SHRUTI6991, @XbaoWu, @aditya-shantanu, @alexatakvelon, @amacaskill, @barney-s, @chw120, @dependabot, @dongjiang1989, @drogovozDP, @igooch, @janetkuo, @justinsb, @lauragalbraith, @lunarwhite, @mastersingh24, @moficodes, @mvanhorn, @prash2512, @pwoelfle-unique, @rayowang, @sairajp-rewind, @shrutiyam-glitch, @sudhanshu456, @tomergee, @volatilemolotov, @yuanwang04

## New Contributors
* @lunarwhite made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/975
* @prash2512 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1053
* @amacaskill made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1023
* @sudhanshu456 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1026
* @XbaoWu made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1084
* @yuanwang04 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1005
* @pwoelfle-unique made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/1066
* @alexatakvelon made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/716

**Full Changelog**: https://github.com/kubernetes-sigs/agent-sandbox/compare/v0.5.0...v0.5.1