v0.2.1

## 🚀 Announcing Agent Sandbox v0.2.1!

We are excited to announce the release of **Agent Sandbox v0.2.1**!

This release introduces a major shift to a **"Secure by Default"** networking architecture, enforcing strict isolation for AI agents while providing a **highly scalable** shared policy model. Alongside these security and architectural advancements, this version strengthens **observability** with new telemetry metrics, enhances **controller stability** through a migration to the Deployment model, and expands the **Python SDK** capabilities with Pod Snapshots and native Kubernetes client support.

### ⚠️ Breaking Changes

*   **Controller Migration (StatefulSet to Deployment)**: The core controller has been migrated from a StatefulSet to a Deployment, and leader election is now enabled by default. **Action Required**: You must delete the existing StatefulSet before deploying the new version to avoid conflicts by running `kubectl delete statefulset agent-sandbox-controller -n agent-sandbox-system` (https://github.com/kubernetes-sigs/agent-sandbox/pull/191).
*   **Metrics Service Port Update**: The metrics Service port has been changed from `80` to `8080` to align with standard practices and avoid traffic conflicts. **Action Required**: Update any custom `ServiceMonitor` resources or Prometheus scraping configurations to target port `8080` (https://github.com/kubernetes-sigs/agent-sandbox/pull/366).
*   **Secure-by-Default Network Isolation**: SandboxTemplates that do not explicitly define a network policy now default to a strict isolation posture. This blocks access to internal cluster IPs, VPC subnets, and the node metadata server. **Action Required**: If your agents require access to internal services, you must explicitly define these rules in your `SandboxTemplate` or opt out by setting the `SandboxTemplate`'s `spec.networkPolicyManagement` field to `Unmanaged` (https://github.com/kubernetes-sigs/agent-sandbox/pull/287).

### Key Highlights

*   **Secure by Default Networking & Scalability**: Implemented a strict security baseline for all sandboxes. If no policy is specified, the controller automatically blocks access to internal cluster IPs, VPC subnets, and the node metadata server. To ensure scalability, a single **shared NetworkPolicy** is now managed per `SandboxTemplate` rather than per individual sandbox, enabling instant fleet-wide updates with minimal API overhead.
*   **Multi-Language SDK Advancements**:
     * **Typed Go Client**: Introduced a native [Kubernetes Go client](https://github.com/kubernetes-sigs/agent-sandbox/tree/v0.2.1/clients/k8s) generated via `client-gen`, allowing Go developers to interact with Agent Sandbox resources using standard, type-safe Kubernetes patterns.
     *   **Python SDK Advancements**: Added support for **GKE Pod Snapshots**, enabling users to capture the state of running sandboxes. The SDK now features native Kubernetes client generation and new file management methods (`list` and `exists`).
*   **Improved Observability & Metrics**: Introduced new metrics to track sandbox lifecycles, including `agent_sandbox_claim_startup_latency_ms` and `agent_sandbox_claim_creation_total`. Metrics and healthz container ports are now explicitly defined for better networking transparency.
*   **Controller Stability & Scaling**: The core controller has been migrated from a StatefulSet to a **Deployment** for better lifecycle management. It now supports [controller concurrency](https://github.com/kubernetes-sigs/agent-sandbox/blob/v0.2.1/docs/configuration.md), configurable router timeouts, and enhanced leader election settings.
*   **Robust Testing Infrastructure**: The test suite now uses a **watch-based mechanism** instead of polling for more accurate results and captures detailed logs (including kubelet and containerd) into artifacts for easier debugging. A new load test using `clusterloader2` has been added to simulate high-density sandbox environments.

### Installation

#### Core & Extensions
```bash
# To install only the core components:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.2.1/manifest.yaml

# To install the extensions components:
kubectl apply -f https://github.com/kubernetes-sigs/agent-sandbox/releases/download/v0.2.1/extensions.yaml
```

#### Python SDK
```bash
pip install k8s-agent-sandbox==0.2.1
```

## Contributors

A huge thank you to all the contributors who made this release possible!

[@antonipp](https://github.com/antonipp), [@mastersingh24](https://github.com/mastersingh24), [@SHRUTI6991](https://github.com/SHRUTI6991), [@igooch](https://github.com/igooch), [@shrutiyam-glitch](https://github.com/shrutiyam-glitch), [@jkallogjeri](https://github.com/jkallogjeri), [@justinsb](https://github.com/justinsb), [@runzhliu](https://github.com/runzhliu), [@janetkuo](https://github.com/janetkuo), [@vicentefb](https://github.com/vicentefb), [@acsoto](https://github.com/acsoto), [@Oneimu](https://github.com/Oneimu), [@sabre1041](https://github.com/sabre1041), [@e-minguez](https://github.com/e-minguez), [@Aliexe-code](https://github.com/Aliexe-code), [@tp953704](https://github.com/tp953704), [@aditya-shantanu](https://github.com/aditya-shantanu), [@dongjiang1989](https://github.com/dongjiang1989), [@tomergee](https://github.com/tomergee), [@shreyas-badiger](https://github.com/shreyas-badiger), [@esposem](https://github.com/esposem), [@yongruilin](https://github.com/yongruilin)

## 👋 New Contributors
* @e-minguez made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/302
* @sabre1041 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/301
* @runzhliu made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/281
* @jkallogjeri made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/259
* @Aliexe-code made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/332
* @tp953704 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/333
* @Oneimu made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/298
* @dongjiang1989 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/364
* @mastersingh24 made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/233
* @esposem made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/377
* @shreyas-badiger made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/374
* @yongruilin made their first contribution in https://github.com/kubernetes-sigs/agent-sandbox/pull/389

**Full Changelog**: https://github.com/kubernetes-sigs/agent-sandbox/compare/v0.1.1...v0.2.1