feat(scheduling): add spec.scheduling.runtimeClassName - #123
Merged
Conversation
Lets a HermesInstance pod run under a sandboxed container runtime (gVisor runsc, Kata) instead of the cluster default. The agent executes untrusted, model-driven code via its exec/shell/filesystem tools, so on multi-tenant clusters a sandboxed runtime on dedicated capacity is a meaningful boundary beyond namespaces and seccomp. spec.scheduling previously exposed only affinity, nodeSelector, priorityClassName and tolerations, with no pod-template escape hatch, so this was unreachable through the CRD. Unset renders nil rather than a pointer to the empty string: "" is not the cluster default, it names a RuntimeClass with an empty name, which the API server rejects. Validated as a DNS subdomain (the RuntimeClass name format) so a malformed value is rejected at admission rather than leaving the pod silently unschedulable. The named RuntimeClass must already exist in the cluster — the operator deliberately does not create or verify it, since RuntimeClasses are cluster-scoped infrastructure. Refs #115 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
stubbi
pushed a commit
that referenced
this pull request
Jul 28, 2026
🤖 I have created a release *beep* *boop* --- ## [0.1.19](v0.1.18...v0.1.19) (2026-07-28) ### Features * **scheduling:** add spec.scheduling.runtimeClassName ([#123](#123)) ([4462cb7](4462cb7)) ### Bug Fixes * **chart:** render pullable default image tags ([#122](#122)) ([88445b1](88445b1)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: paperclip-release-bot[bot] <288053502+paperclip-release-bot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #115 (the minimal ask: a single
runtimeClassNamefield rather than a general pod-template override).What
Passed straight through to the instance pod template, so the agent can be placed on a sandboxed runtime (gVisor
runsc, Kata) on dedicated capacity.Two details worth calling out
Unset must be
nil, not&"". An emptyRuntimeClassNamedoes not mean "cluster default" — it names a RuntimeClass whose name is empty, which the API server rejects.runtimeClassName()maps""tonil, andTestBuildStatefulSet_RuntimeClassNameUnsetIsNilpins that, since it's the kind of thing a later refactor silently breaks.Validated as a DNS subdomain (
MaxLength=253+ the standard pattern). A malformed name is rejected at admission instead of leaving the pod permanently unschedulable with no obvious cause.The operator deliberately does not create or verify the RuntimeClass — those are cluster-scoped infrastructure owned by the cluster admin. As the issue notes, an unknown name leaves the pod unschedulable; that's the expected failure mode.
Chose the narrow field over
podOverridesThe issue offered either. A general pod-template escape hatch would also cover this, but it's a much wider contract to support and makes the operator's rendered pod non-deterministic. Going with the minimal field; if a broader override is wanted later it can subsume this.
Verification
make manifests generate sync-chart-crds sync-bundle-crds api-docs— CRD, chart CRD, OLM bundle and generated API reference all regenerated and committed.make testgreen,make lint0 issues.test/conformancefails locally, but identically on a cleanmaincheckout — it needs a live cluster and is the known pre-existing gap, unrelated to this change.@ilazaridis you offered to test a build — this branch builds an image on CI, happy to point you at a tag once it lands if that's useful.