feat(helm): add support for custom agent image registry and repository in controller configuration

helm/kagent/templates/controller-deployment.yaml

@@ -82,6 +82,25 @@ spec:
         - name: controller
           image: "{{ .Values.controller.image.registry | default .Values.registry  }}/{{ .Values.controller.image.repository }}:{{ coalesce .Values.tag .Values.controller.image.tag .Chart.Version }}"
           imagePullPolicy: {{ .Values.controller.image.pullPolicy | default .Values.imagePullPolicy }}
+          {{- if or .Values.controller.imageDigest .Values.controller.agentImageRegistry .Values.controller.agentImageRepository }}
+          # --image-digest has no build-time equivalent today: scripts/controller-digest-ldflags.sh,
+          # which would stamp AgentImageDigest via ldflags, is never invoked by `make build-controller`
+          # or any CI workflow. Until that's wired in, set this value explicitly (the digest of the
+          # pushed golang-adk image) or SandboxAgent compilation fails with "agent image digest is not set".
+          # agentImageRegistry/agentImageRepository point the golang-adk runtime image (used for
+          # every declarative SandboxAgent) at a different build than the compiled-in default
+          # (ghcr.io/kagent-dev/kagent/golang-adk) — e.g. your own fork's release.
+          args:
+          {{- if .Values.controller.imageDigest }}
+          - --image-digest={{ .Values.controller.imageDigest }}
+          {{- end }}
+          {{- if .Values.controller.agentImageRegistry }}
+          - --image-registry={{ .Values.controller.agentImageRegistry }}
+          {{- end }}
+          {{- if .Values.controller.agentImageRepository }}
+          - --image-repository={{ .Values.controller.agentImageRepository }}
+          {{- end }}
+          {{- end }}
           env:
             - name: KAGENT_NAMESPACE
               valueFrom:

helm/kagent/tests/controller-deployment_test.yaml

@@ -813,6 +813,42 @@ tests:
           content:
             name: metrics
 
+  # =============================================================================
+  # Agent Image Digest / Registry / Repository Override Tests
+  # =============================================================================
+
+  - it: should not set args when imageDigest, agentImageRegistry, and agentImageRepository are unset
+    template: controller-deployment.yaml
+    asserts:
+      - notExists:
+          path: spec.template.spec.containers[0].args
+
+  - it: should set only --image-digest when controller.imageDigest is set
+    template: controller-deployment.yaml
+    set:
+      controller:
+        imageDigest: "sha256:deadbeef1234"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].args
+          value:
+            - "--image-digest=sha256:deadbeef1234"
+
+  - it: should set all three flags when imageDigest, agentImageRegistry, and agentImageRepository are set
+    template: controller-deployment.yaml
+    set:
+      controller:
+        imageDigest: "sha256:deadbeef1234"
+        agentImageRegistry: "myregistry.io"
+        agentImageRepository: "myorg/golang-adk"
+    asserts:
+      - equal:
+          path: spec.template.spec.containers[0].args
+          value:
+            - "--image-digest=sha256:deadbeef1234"
+            - "--image-registry=myregistry.io"
+            - "--image-repository=myorg/golang-adk"
+
   - it: should let controller.env override the chart-supplied metrics env
     template: controller-deployment.yaml
     set:

helm/kagent/values.yaml

@@ -269,6 +269,31 @@ controller:
     repository: kagent-dev/kagent/controller
     tag: "" # Will default to global, then Chart version
     pullPolicy: ""
+
+  # -- Manifest digest (sha256:...) of the golang-adk image, passed to the
+  # controller as --image-digest. Required for SandboxAgent compilation to
+  # succeed against a self-built controller image: the intended build-time
+  # stamping (scripts/controller-digest-ldflags.sh) is not wired into
+  # `make build-controller` or any CI workflow, so it's always empty unless
+  # set here. Resolve it with:
+  #   docker buildx imagetools inspect <golang-adk-image-ref> | grep Digest
+  # @default -- "" (no --image-digest arg passed; fails at SandboxAgent compile time
+  # unless the controller image was built with the digest already stamped)
+  imageDigest: ""
+
+  # -- Registry for the golang-adk runtime image (--image-registry). Compiled-in
+  # default is "ghcr.io". Set this together with agentImageRepository and
+  # imageDigest to point every declarative SandboxAgent at your own build
+  # instead of upstream's.
+  # @default -- "" (uses the compiled-in default, ghcr.io)
+  agentImageRegistry: ""
+
+  # -- Repository for the golang-adk runtime image (--image-repository).
+  # Compiled-in default is "kagent-dev/kagent/golang-adk". e.g. set to
+  # "yourfork/kagent/golang-adk" to test against your own fork's release.
+  # @default -- "" (uses the compiled-in default)
+  agentImageRepository: ""
+
   resources:
     requests:
       cpu: 100m