From 55f26a603f506232fc8da0cdb0cf3fcf19668b4c Mon Sep 17 00:00:00 2001 From: Thanh Nguyen Date: Mon, 24 Aug 2026 12:09:00 +0700 Subject: [PATCH 1/2] feat(helm): add support for image digest in controller deployment and values --image-digest has no build-time equivalent today: scripts/controller-digest-ldflags.sh, which would stamp AgentImageDigest via ldflags, is never invoked by `make build-controller` or any CI workflow -- confirmed true for upstream's own official build too, not just a fork-specific gap. Until that's wired in, expose --image-digest as a Helm-configurable controller arg so Declarative SandboxAgent compilation can succeed at all. Signed-off-by: Thanh Nguyen --- .../templates/controller-deployment.yaml | 8 +++++++ .../tests/controller-deployment_test.yaml | 21 +++++++++++++++++++ helm/kagent/values.yaml | 12 +++++++++++ 3 files changed, 41 insertions(+) diff --git a/helm/kagent/templates/controller-deployment.yaml b/helm/kagent/templates/controller-deployment.yaml index 7e74c9437..664af8533 100644 --- a/helm/kagent/templates/controller-deployment.yaml +++ b/helm/kagent/templates/controller-deployment.yaml @@ -82,6 +82,14 @@ spec: - name: controller image: "{{ .Values.controller.image.registry | default .Values.registry }}/{{ .Values.controller.image.repository }}:{{ coalesce .Values.tag .Values.controller.image.tag .Chart.Version }}" imagePullPolicy: {{ .Values.controller.image.pullPolicy | default .Values.imagePullPolicy }} + {{- if .Values.controller.imageDigest }} + # --image-digest has no build-time equivalent today: scripts/controller-digest-ldflags.sh, + # which would stamp AgentImageDigest via ldflags, is never invoked by `make build-controller` + # or any CI workflow. Until that's wired in, set this value explicitly (the digest of the + # pushed golang-adk image) or SandboxAgent compilation fails with "agent image digest is not set". + args: + - --image-digest={{ .Values.controller.imageDigest }} + {{- end }} env: - name: KAGENT_NAMESPACE valueFrom: diff --git a/helm/kagent/tests/controller-deployment_test.yaml b/helm/kagent/tests/controller-deployment_test.yaml index a30e1619c..6a52c94d0 100644 --- a/helm/kagent/tests/controller-deployment_test.yaml +++ b/helm/kagent/tests/controller-deployment_test.yaml @@ -813,6 +813,27 @@ tests: content: name: metrics + # ============================================================================= + # Agent Image Digest Override Tests + # ============================================================================= + + - it: should not set args when imageDigest is unset + template: controller-deployment.yaml + asserts: + - notExists: + path: spec.template.spec.containers[0].args + + - it: should set only --image-digest when controller.imageDigest is set + template: controller-deployment.yaml + set: + controller: + imageDigest: "sha256:deadbeef1234" + asserts: + - equal: + path: spec.template.spec.containers[0].args + value: + - "--image-digest=sha256:deadbeef1234" + - it: should let controller.env override the chart-supplied metrics env template: controller-deployment.yaml set: diff --git a/helm/kagent/values.yaml b/helm/kagent/values.yaml index 1e2264585..e539020e2 100644 --- a/helm/kagent/values.yaml +++ b/helm/kagent/values.yaml @@ -269,6 +269,18 @@ controller: repository: kagent-dev/kagent/controller tag: "" # Will default to global, then Chart version pullPolicy: "" + + # -- Manifest digest (sha256:...) of the golang-adk image, passed to the + # controller as --image-digest. Required for SandboxAgent compilation to + # succeed against a self-built controller image: the intended build-time + # stamping (scripts/controller-digest-ldflags.sh) is not wired into + # `make build-controller` or any CI workflow, so it's always empty unless + # set here. Resolve it with: + # docker buildx imagetools inspect | grep Digest + # @default -- "" (no --image-digest arg passed; fails at SandboxAgent compile time + # unless the controller image was built with the digest already stamped) + imageDigest: "" + resources: requests: cpu: 100m From 52188e8d46f005bb8ffc05ee2bf79fa9047f787d Mon Sep 17 00:00:00 2001 From: Thanh Nguyen Date: Mon, 24 Aug 2026 12:09:43 +0700 Subject: [PATCH 2/2] feat(helm): add support for custom agent image registry and repository in controller configuration agentImageRegistry/agentImageRepository let the golang-adk runtime image (used for every declarative SandboxAgent) be pointed at a build other than the compiled-in default (ghcr.io/kagent-dev/kagent/golang-adk) -- e.g. a fork's own release -- via the controller's --image-registry/--image-repository flags. Signed-off-by: Thanh Nguyen --- .../templates/controller-deployment.yaml | 13 ++++++++++++- .../tests/controller-deployment_test.yaml | 19 +++++++++++++++++-- helm/kagent/values.yaml | 13 +++++++++++++ 3 files changed, 42 insertions(+), 3 deletions(-) diff --git a/helm/kagent/templates/controller-deployment.yaml b/helm/kagent/templates/controller-deployment.yaml index 664af8533..f406afa9e 100644 --- a/helm/kagent/templates/controller-deployment.yaml +++ b/helm/kagent/templates/controller-deployment.yaml @@ -82,14 +82,25 @@ spec: - name: controller image: "{{ .Values.controller.image.registry | default .Values.registry }}/{{ .Values.controller.image.repository }}:{{ coalesce .Values.tag .Values.controller.image.tag .Chart.Version }}" imagePullPolicy: {{ .Values.controller.image.pullPolicy | default .Values.imagePullPolicy }} - {{- if .Values.controller.imageDigest }} + {{- if or .Values.controller.imageDigest .Values.controller.agentImageRegistry .Values.controller.agentImageRepository }} # --image-digest has no build-time equivalent today: scripts/controller-digest-ldflags.sh, # which would stamp AgentImageDigest via ldflags, is never invoked by `make build-controller` # or any CI workflow. Until that's wired in, set this value explicitly (the digest of the # pushed golang-adk image) or SandboxAgent compilation fails with "agent image digest is not set". + # agentImageRegistry/agentImageRepository point the golang-adk runtime image (used for + # every declarative SandboxAgent) at a different build than the compiled-in default + # (ghcr.io/kagent-dev/kagent/golang-adk) — e.g. your own fork's release. args: + {{- if .Values.controller.imageDigest }} - --image-digest={{ .Values.controller.imageDigest }} {{- end }} + {{- if .Values.controller.agentImageRegistry }} + - --image-registry={{ .Values.controller.agentImageRegistry }} + {{- end }} + {{- if .Values.controller.agentImageRepository }} + - --image-repository={{ .Values.controller.agentImageRepository }} + {{- end }} + {{- end }} env: - name: KAGENT_NAMESPACE valueFrom: diff --git a/helm/kagent/tests/controller-deployment_test.yaml b/helm/kagent/tests/controller-deployment_test.yaml index 6a52c94d0..b6b7170c7 100644 --- a/helm/kagent/tests/controller-deployment_test.yaml +++ b/helm/kagent/tests/controller-deployment_test.yaml @@ -814,10 +814,10 @@ tests: name: metrics # ============================================================================= - # Agent Image Digest Override Tests + # Agent Image Digest / Registry / Repository Override Tests # ============================================================================= - - it: should not set args when imageDigest is unset + - it: should not set args when imageDigest, agentImageRegistry, and agentImageRepository are unset template: controller-deployment.yaml asserts: - notExists: @@ -834,6 +834,21 @@ tests: value: - "--image-digest=sha256:deadbeef1234" + - it: should set all three flags when imageDigest, agentImageRegistry, and agentImageRepository are set + template: controller-deployment.yaml + set: + controller: + imageDigest: "sha256:deadbeef1234" + agentImageRegistry: "myregistry.io" + agentImageRepository: "myorg/golang-adk" + asserts: + - equal: + path: spec.template.spec.containers[0].args + value: + - "--image-digest=sha256:deadbeef1234" + - "--image-registry=myregistry.io" + - "--image-repository=myorg/golang-adk" + - it: should let controller.env override the chart-supplied metrics env template: controller-deployment.yaml set: diff --git a/helm/kagent/values.yaml b/helm/kagent/values.yaml index e539020e2..56cac7635 100644 --- a/helm/kagent/values.yaml +++ b/helm/kagent/values.yaml @@ -281,6 +281,19 @@ controller: # unless the controller image was built with the digest already stamped) imageDigest: "" + # -- Registry for the golang-adk runtime image (--image-registry). Compiled-in + # default is "ghcr.io". Set this together with agentImageRepository and + # imageDigest to point every declarative SandboxAgent at your own build + # instead of upstream's. + # @default -- "" (uses the compiled-in default, ghcr.io) + agentImageRegistry: "" + + # -- Repository for the golang-adk runtime image (--image-repository). + # Compiled-in default is "kagent-dev/kagent/golang-adk". e.g. set to + # "yourfork/kagent/golang-adk" to test against your own fork's release. + # @default -- "" (uses the compiled-in default) + agentImageRepository: "" + resources: requests: cpu: 100m