Fix watch mapping for Sandboxes with adopted pods

[antonipp]

Description

When a Sandbox was adopting a pod from a WarmPool, the Sandbox controller was not properly watching the pod because its name didn't match the Sandbox name. Here is an example:

1. WarmPool creates a pod: test-warmpool-5dqwk
2. I create a SandboxClaim called test-claim-sandbox which in turn creates a new Sandbox called test-claim-sandbox as well
3. This Sandbox adopted the pod test-warmpool-5dqwk
4. Pod gets deleted but the Sandbox doesn't notice, its Status.Conditions are not being updated properly, it still says Pod is Ready

The controller logs keep showing this message:

2025-11-26T15:57:21Z	INFO	sandbox resource not found. Ignoring since object must be deleted	
{"controller": "sandbox", "controllerGroup": "agents.x-k8s.io", "controllerKind": "Sandbox", "Sandbox": {"name":"test-warmpool-5dqwk","namespace":"warmpool-test-ns"}, "namespace": "warmpool-test-ns", "name": "test-warmpool-5dqwk", "reconcileID": "701d78e2-fd80-4c4b-8cd7-75793ffba2ab"}

The problem comes from this line:

agent-sandbox/controllers/sandbox_controller.go

Line 543 in 36c411a

Watches(&corev1.Pod{}, &handler.EnqueueRequestForObject{}, builder.WithPredicates(labelSelectorPredicate)).

EnqueueRequestForObject creates reconcile requests using the Pod's name (test-warmpool-5dqwk), not the Sandbox's name (test-claim-sandbox)

This PR fixes the issue by making sure that the reconciliation logic actually looks at the OwnerRef of the pod instead of using the pod name, because it doesn't necessarily match the Sandbox name.

I think a real longer-term fix should be something like this #162 btw.

Testing

I think the only way to actually test this requires a real Kube cluster (this behavior is really hard to mock), so I wrote an E2E test which replicates the issue by deleting an adopted pod and checking that the status got propagated to the owner Sandbox. As expected, the test fails before my commit and succeeds afterwards.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: antonipp
Once this PR has been reviewed and has the lgtm label, please assign janetkuo for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for agent-sandbox canceled.

Name	Link
🔨 Latest commit	39226c1
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/69281a5eaf62b000086f4b1e

[k8s-ci-robot]

Hi @antonipp. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.