[agent-sandbox] guard device-plugin priorityClassName (fix null opt-out)

[JatinNanda]

Bug

charts/retool/templates/agent_sandbox_device_plugin.yaml:42 renders the device-plugin DaemonSet's priorityClassName unconditionally:

priorityClassName: {{ $as.devicePlugin.priorityClassName }}

The documented GKE opt-out (in values.yaml and the customer guide) is to set:

rr:
  agentSandbox:
    devicePlugin:
      priorityClassName: null

…because GKE rejects system-node-critical in user namespaces. But a bare {{ ... }} on a nil value renders the literal string <no value>, so the DaemonSet is submitted with priorityClassName: <no value> — a class that doesn't exist. The kubelet rejects it, which blocks the entire agent sandbox from scheduling.

Every other workload already guards this ({{- if .Values.priorityClassName }}); the device-plugin DaemonSet was the one that didn't.

Fix

+      {{- if $as.devicePlugin.priorityClassName }}
       priorityClassName: {{ $as.devicePlugin.priorityClassName }}
+      {{- end }}

Test

New ci/test-agent-sandbox-deviceplugin-no-priorityclass-option.yaml — device-plugin DaemonSet with priorityClassName: null. kubeconform rejects <no value>, so this guards the regression directly.

Verified:

• priorityClassName: null → field omitted, zero <no value>
• default → priorityClassName: system-node-critical still renders
• helm lint clean

Targets r2 (consumers pin ref=r2); folds into the r2→main merge (#326).

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR adds a nil guard around priorityClassName in the agent-sandbox device-plugin DaemonSet template, preventing the literal string <no value> from being emitted when operators set the field to null to opt out of the system-node-critical priority class (required on GKE). A corresponding CI values fixture exercises the null path.

• agent_sandbox_device_plugin.yaml: wraps priorityClassName in {{- if ... }} / {{- end }} so the field is omitted entirely when the value is nil or empty, matching the guard pattern already used by every other workload template.
• test-agent-sandbox-deviceplugin-no-priorityclass-option.yaml: new Helm CI fixture that sets priorityClassName: null, giving kubeconform a direct regression test for the invalid <no value> output.

Confidence Score: 5/5

Safe to merge — the change is a two-line guard that makes a previously always-emitted field conditional, directly fixing the documented GKE breakage with no side effects on the default path.

The template fix is minimal and surgically correct: wrapping priorityClassName in an if block is exactly what every other workload already does. The default value (system-node-critical) continues to render unchanged, and the null path now cleanly omits the field. The new CI fixture closes the regression loop by exercising the null case through kubeconform.

No files require special attention.

Important Files Changed

Filename	Overview
charts/retool/templates/agent_sandbox_device_plugin.yaml	One-line fix: adds {{- if $as.devicePlugin.priorityClassName }} / {{- end }} guard so a null/empty value omits the field rather than emitting <no value>; fix is correct and consistent with the rest of the codebase.
charts/retool/ci/test-agent-sandbox-deviceplugin-no-priorityclass-option.yaml	New CI values fixture that sets priorityClassName: null to validate the GKE opt-out path; follows existing CI fixture conventions and is well-commented.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["Helm template render\nagent_sandbox_device_plugin.yaml"] --> B{"$as.devicePlugin.priorityClassName\nis set?"}
    B -- "Yes (e.g. system-node-critical)" --> C["emit: priorityClassName: system-node-critical"]
    B -- "No (null / empty string)" --> D["field omitted entirely"]
    C --> E["Valid DaemonSet manifest"]
    D --> E
    E --> F["kubeconform / kubelet accepts manifest"]

Loading

_{Reviews (1): Last reviewed commit: "[agent-sandbox] guard device-plugin prio..." | Re-trigger Greptile}