{"slug": "show-hn-kubernetes-operator-for-the-openai-managed-agents-api", "title": "Show HN: Kubernetes Operator for the OpenAI Managed Agents API", "summary": "Softcane released an alpha Kubernetes operator, codex-session-operator, that runs OpenAI coding agents against Git repositories inside a cluster, with OpenAI handling the agent loop and model inference while Kubernetes Agent Sandbox executes commands and PostgreSQL stores messages, results and approvals. The operator and CLI install from published release manifests (pinned via a vX.Y.Z tag) without a source checkout, Go or Make, and real tasks require OpenAI Agents API access and incur API charges. The project is alpha, and the gateway uses HTTP by default.", "body_md": "Run OpenAI coding agents against Git repositories in Kubernetes. Give an agent a task, let it work in an isolated workspace, and read the results through an HTTP API or CLI. Continue the conversation to keep working in the same workspace.\n\nOpenAI runs the agent loop and model inference. Your cluster runs the commands and stores repository files through [Kubernetes Agent Sandbox](https://agent-sandbox.sigs.k8s.io/). The gateway saves messages, results and approvals in PostgreSQL.\n\nThe project is alpha. Real tasks require OpenAI Agents API access and incur API charges.\n\nRelease downloads install the operator and CLI without a source checkout, Go or Make. The commands below require a published release; replace `vX.Y.Z` with a tag from [Releases](https://github.com/softcane/codex-session-operator/releases).\n\n```\n# Latest stable release: CRDs, controller and gateway.\nkubectl apply -f https://github.com/softcane/codex-session-operator/releases/latest/download/install.yaml\n\n# Or pin a release for production and GitOps.\nexport VERSION=vX.Y.Z\nkubectl apply -f \"https://github.com/softcane/codex-session-operator/releases/download/${VERSION}/install.yaml\"\n```\n\nInstall Agent Sandbox separately at the tested version, then supply PostgreSQL and Secrets using the [installation guide](https://github.com/softcane/codex-session-operator/blob/main/docs/deployment.md). The gateway uses HTTP by default.\n\nFor the CLI, download the archive for your machine. For example, on macOS with Apple Silicon:\n\n```\ncurl -fsSLO https://github.com/softcane/codex-session-operator/releases/latest/download/gateway-client_darwin_arm64.tar.gz\ntar -xzf gateway-client_darwin_arm64.tar.gz gateway-client\nsudo install -m 0755 gateway-client /usr/local/bin/gateway-client\n```\n\nArchives are also available for `darwin_amd64`, `linux_amd64` and `linux_arm64`. To pin the CLI, replace `latest/download` with `download/${VERSION}`. Each release includes `SHA256SUMS`.\n\nFollow [Run your first repository task](https://github.com/softcane/codex-session-operator/blob/main/docs/getting-started.md) to download the matching example manifest, configure a workspace and send a task. Source builds are covered in [Contributing](https://github.com/softcane/codex-session-operator/blob/main/CONTRIBUTING.md).\n\n1. **Choose a Profile.** It selects the agent, workspace configuration and spending policy.\n2. **Send a task.** The gateway saves your message and returns a conversation ID.\n3. **Prepare the workspace.** The operator creates a Session. Agent Sandbox starts the executor and prepares the repository on persistent storage.\n4. **Run the agent.** OpenAI directs the work;`codex exec-server` executes commands in your cluster.\n5. **Read the result.** Inspect the saved turn, assistant output and command results. HTTP`202` means your message was accepted; completion comes later.\n6. **Continue or close.** Follow-ups use the same workspace. Closing requests cleanup; the workspace policy controls whether files are deleted or retained. Saved conversation history remains in PostgreSQL.\n\nCreate a `SandboxTemplate` and a `SandboxWarmPool`, then define an `Agent`, an `Environment` and a `Profile` in the same namespace. These examples use `sandbox-v1` for the workspace setup and are available together in [examples/repository-task.yaml](https://github.com/softcane/codex-session-operator/blob/main/examples/repository-task.yaml).\n\nAfter [installation](https://github.com/softcane/codex-session-operator/blob/main/docs/deployment.md), include `sandbox-v1` in the controller's `SANDBOX_POOLS` setting. Use the `codex-executor` Secret from the [Secret setup](https://github.com/softcane/codex-session-operator/blob/main/docs/deployment.md#2-create-the-secrets) for the restricted environment key.\n\nThe template below prepares the public `google/uuid` repository and configures a Go executor for that checkout. Before applying it, replace the example image digest, select your node architecture and set a working StorageClass. The image must contain `codex exec-server`, `/workspace-bootstrap` and Go; the [application executor Dockerfile](https://github.com/softcane/codex-session-operator/blob/main/examples/my-go-project/sandbox/Dockerfile.executor) builds that layer. The YAML image anchor lets both containers use the same image reference.\n\n## SandboxTemplate CR: sandbox-v1\n\n```\napiVersion: extensions.agents.x-k8s.io/v1beta1\nkind: SandboxTemplate\nmetadata:\n  name: sandbox-v1\n  namespace: codex-session-operator-system\n  labels:\n    agents.softcane.io/managed: \"true\"\nspec:\n  envVarsInjectionPolicy: Allowed\n  service: false\n  podTemplate:\n    spec:\n      automountServiceAccountToken: false\n      restartPolicy: Always\n      terminationGracePeriodSeconds: 10\n      nodeSelector:\n        kubernetes.io/arch: arm64\n      securityContext:\n        runAsNonRoot: true\n        runAsUser: 1000\n        runAsGroup: 1000\n        fsGroup: 1000\n        seccompProfile: {type: RuntimeDefault}\n      initContainers:\n        - name: repository-prepare\n          image: &executor_image registry.example/executor@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n          imagePullPolicy: IfNotPresent\n          command: [/workspace-bootstrap]\n          args:\n            - --storage-root\n            - /workspace-storage\n            - --session-uid\n            - $(SESSION_UID)\n            - --url\n            - https://github.com/google/uuid.git\n            - --commit\n            - 0f11ee6918f41a04c201eceeadf612a377bc7fbc\n          env:\n            - name: TMPDIR\n              value: /tmp\n          securityContext: &restricted\n            allowPrivilegeEscalation: false\n            readOnlyRootFilesystem: true\n            capabilities: {drop: [ALL]}\n          resources:\n            requests: {cpu: 100m, memory: 128Mi}\n            limits: {cpu: \"1\", memory: 512Mi}\n          volumeMounts:\n            - {name: workspace, mountPath: /workspace-storage}\n            - {name: tmp, mountPath: /tmp}\n      containers:\n        - name: executor\n          image: *executor_image\n          imagePullPolicy: IfNotPresent\n          workingDir: /workspace\n          command: [codex, exec-server]\n          args: [--remote, $(CODEX_REMOTE_URL), --environment-id, $(CODEX_ENVIRONMENT_ID)]\n          env:\n            - name: CODEX_API_KEY\n              valueFrom:\n                secretKeyRef:\n                  name: codex-executor\n                  key: CODEX_API_KEY\n          securityContext: *restricted\n          resources:\n            requests: {cpu: 250m, memory: 256Mi}\n            limits: {cpu: \"2\", memory: 2Gi}\n          volumeMounts:\n            - {name: workspace, mountPath: /workspace, subPath: project}\n            - {name: home, mountPath: /home/node}\n            - {name: tmp, mountPath: /tmp}\n      volumes:\n        - name: home\n          emptyDir: {sizeLimit: 128Mi}\n        - name: tmp\n          emptyDir: {sizeLimit: 1Gi}\n  volumeClaimTemplates:\n    - metadata:\n        name: workspace\n      spec:\n        accessModes: [ReadWriteOnce]\n        storageClassName: standard\n        resources:\n          requests: {storage: 1Gi}\n```\n\nThe pool selects that template. With `replicas: 0`, Agent Sandbox allocates a workspace when a Session requests one.\n\n```\napiVersion: extensions.agents.x-k8s.io/v1beta1\nkind: SandboxWarmPool\nmetadata:\n  name: sandbox-v1\n  namespace: codex-session-operator-system\n  labels:\n    agents.softcane.io/managed: \"true\"\nspec:\n  replicas: 0\n  sandboxTemplateRef:\n    name: sandbox-v1\n```\n\nManaged template and pool specifications are immutable. To change an installed recipe, create a new versioned pair and approve the new pool.\n\nThe Environment selects `sandbox-v1`; the Profile combines it with the Agent and spending policy.\n\n```\napiVersion: agents.softcane.io/v1alpha1\nkind: Agent\nmetadata:\n  name: sandbox-agent\n  namespace: codex-session-operator-system\nspec:\n  model: gpt-6-luna\n  instructions: Use the prepared repository and report actual commands and results.\n  deletionPolicy: Delete\n---\napiVersion: agents.softcane.io/v1alpha1\nkind: Environment\nmetadata:\n  name: sandbox-environment\n  namespace: codex-session-operator-system\nspec:\n  mode: SelfHosted\n  deletionPolicy: Delete\n  selfHosted:\n    sandboxPoolRef:\n      name: sandbox-v1\n    workspace:\n      directory: /workspace\n      deletionPolicy: Delete\n---\napiVersion: agents.softcane.io/v1alpha1\nkind: Profile\nmetadata:\n  name: sandbox\n  namespace: codex-session-operator-system\nspec:\n  agentRef:\n    name: sandbox-agent\n  environmentRef:\n    name: sandbox-environment\n  spendControl:\n    mode: Unlimited\n```\n\n`Unlimited` permits paid inference without a per-Session dollar cap. To request a cap, use `mode: Limited` and `limitCents: 500` for US$5; this requires provider-project support.\n\nSelect the `sandbox` Profile when [sending a task](https://github.com/softcane/codex-session-operator/blob/main/docs/getting-started.md#4-send-a-task). The gateway creates the `Session`; applying these CRs alone starts no task Pod. Follow-ups keep that Session and workspace. With the shown `Delete` policy, closing removes the workspace, so retrieve any changes first.\n\nOptional `Vault` and `VaultCredential` CRs supply credentials for connected provider tools. See the [resource reference](https://github.com/softcane/codex-session-operator/blob/main/docs/resources.md) for all six CRs, other execution modes and update rules.\n\n- [Getting started](https://github.com/softcane/codex-session-operator/blob/main/docs/getting-started.md) — install locally and run a real task.\n- [Deployment](https://github.com/softcane/codex-session-operator/blob/main/docs/deployment.md) — install and operate in your own cluster.\n- [Conversations](https://github.com/softcane/codex-session-operator/blob/main/docs/conversations.md) — CLI, HTTP API, retries and approvals.\n- [Resources](https://github.com/softcane/codex-session-operator/blob/main/docs/resources.md) — configuration fields and update rules.\n- [Architecture](https://github.com/softcane/codex-session-operator/blob/main/docs/architecture.md) — components, state and recovery.\n- [Contributing](https://github.com/softcane/codex-session-operator/blob/main/CONTRIBUTING.md) — builds, tests, simulated demo and releases.\n\nReport vulnerabilities through [SECURITY.md](https://github.com/softcane/codex-session-operator/blob/main/SECURITY.md). Licensed under [Apache 2.0](https://github.com/softcane/codex-session-operator/blob/main/LICENSE).", "url": "https://wpnews.pro/news/show-hn-kubernetes-operator-for-the-openai-managed-agents-api", "canonical_source": "https://github.com/softcane/codex-session-operator", "published_at": "2026-11-02 21:01:54+00:00", "updated_at": "2026-11-02 21:21:23.388320+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["OpenAI", "Softcane", "codex-session-operator", "Kubernetes Agent Sandbox", "PostgreSQL", "codex exec-server", "google/uuid"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-kubernetes-operator-for-the-openai-managed-agents-api", "markdown": "https://wpnews.pro/news/show-hn-kubernetes-operator-for-the-openai-managed-agents-api.md", "text": "https://wpnews.pro/news/show-hn-kubernetes-operator-for-the-openai-managed-agents-api.txt", "jsonld": "https://wpnews.pro/news/show-hn-kubernetes-operator-for-the-openai-managed-agents-api.jsonld"}}