feat(a2a): image + Helm chart (enabled-gated) + Argo Application - #85
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
izzywdev
added a commit
that referenced
this pull request
Jul 22, 2026
Resolves Semgrep OSS dockerfile.security.missing-user finding on PR #85. Non-root uid 10001 in the image + matching runAsNonRoot/drop-ALL-caps in the Deployment. Re-validated: helm lint clean, kubeconform 4/4, docker build green. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session-Id: 17fb89fd-3579-433b-a6c4-9c9e7f3ec549
izzywdev
added a commit
that referenced
this pull request
Jul 22, 2026
Resolves Semgrep OSS dockerfile.security.missing-user finding on PR #85. Non-root uid 10001 in the image + matching runAsNonRoot/drop-ALL-caps in the Deployment. Re-validated: helm lint clean, kubeconform 4/4, docker build green. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session-Id: 17fb89fd-3579-433b-a6c4-9c9e7f3ec549
izzywdev
force-pushed
the
feat/a2a-deploy
branch
from
July 22, 2026 17:40
4295d2d to
213a587
Compare
…e wiring [skip ci]
Validated locally: - helm lint clean on default/prod/ci overlays (helm v4.2.1) - helm template renders Deployment/Service/ConfigMap + per-external-tenant Ingress - default+prod overlays render empty (enabled:false gate) - kubeconform -strict -ignore-missing-schemas: 4/4 valid (k8s 1.29.0) - docker build of agent-templates/a2a/Dockerfile succeeds Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session-Id: 17fb89fd-3579-433b-a6c4-9c9e7f3ec549
Resolves Semgrep OSS dockerfile.security.missing-user finding on PR #85. Non-root uid 10001 in the image + matching runAsNonRoot/drop-ALL-caps in the Deployment. Re-validated: helm lint clean, kubeconform 4/4, docker build green. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session-Id: 17fb89fd-3579-433b-a6c4-9c9e7f3ec549
…t, values doc) Rebased onto main (server PR #87 + mcp #86 merged). Reconciled the deploy slice with the now-real server (agent-templates/a2a/): - requirements.txt: took main's canonical (server-owned) set; ADDED cryptography (runtime._build_verifier decodes RS256/ES256 JWKS tokens; PyJWT needs it). - Dockerfile: entrypoint python -m a2a.runtime (was a2a.server); vendor providers/ + sync/ (runtime imports 'providers'; anthropic adapter delegates to sync/); env = the 4 vars runtime.build_from_env actually reads (A2A_VALUES_FILE, A2A_REPOS_DIR, AGENT_PROVIDER, HOST) + FUZE_STATE_DIR; drop unread PORT/OIDC/ card-signing envs. - chart: replace tenants.yaml ConfigMap with values.json (the whole a2a block via toJson) that the server reads via A2A_VALUES_FILE; add repo-sync init container cloning each enabled tenant's repo at its ref into /repos (LocalRepoResolver); optional ANTHROPIC_API_KEY / git token / id-state ConfigMap wiring; probes now hit the server's real GET /healthz. Verified: - helm lint clean (default/prod/ci); kubeconform 4/4 valid (k8s 1.29.0). - gated overlays render empty (enabled:false). - rendered values.json parses through the MERGED server's a2a.config.load_config (both tenants, auth, keyId resolved). - docker build green; in-image import of a2a.*/providers/fuze_a2a_client + cryptography; build_from_env() composes the Starlette app (routes /rpc, /.well-known/agent-card.json, /extendedAgentCard, /healthz) from the chart's values.json. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session-Id: 17fb89fd-3579-433b-a6c4-9c9e7f3ec549
izzywdev
force-pushed
the
feat/a2a-deploy
branch
from
July 22, 2026 17:43
213a587 to
81a72be
Compare
izzywdev
marked this pull request as ready for review
July 22, 2026 17:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DevOps delivery slice for A2A Phase 2 (contract v1 frozen). Draft.
Scope delivered
agent-templates/a2a/Dockerfile(context =agent-templates/, packages the server + the frozenfuze_a2a_client, runs as non-root uid 10001) + starterrequirements.txt; wired intorelease.yml(build/pushghcr.io/izzywdev/fuzeagent-a2a+ SHA tag-bump into the a2a overlay).deploy/helm/a2a-shared/— dedicated,a2a.enabled-gated, one shared server (tenants are DATA, not a chart-per-repo).a2a:block is byte-conformant tocontracts/a2a/v1/schema/values-interface.schema.json; deploy mechanics kept in a separatedeploy:block. Service hardcodeda2a-sharedClusterIP:8080 (the frozen in-cluster URL); tenant routing ConfigMap; per-external-tenant Ingress (a2a.<slug>.prod.fuzefront.com); OIDC/card-signing/mTLS from secretRefs; non-root securityContext.deploy/argocd/applications/a2a-shared.yaml(hybrid-Argo, own app,prune+selfHeal).helm-validate.ymlextended to lint + kubeconform the new chart (viaci/enabled-values.yaml, since prod/default render empty while gated off).Verified
helm lintclean (default/prod/ci);kubeconform -strict -ignore-missing-schemask8s 1.29.0 → 4/4 valid; gated overlays render empty;docker buildgreen; helm-validate + Semgrep OSS pass on PR head.Ships DISABLED — go-live preconditions (out of scope for this PR)
Server image (backend-engineer),
providesTobackfill (authz.md §3fail-closed), card-signing SealedSecret. Seedeploy/helm/a2a-shared/README.md.Follow-up (not blocking this PR)
gate-localupA2A stand-up for live-integration tests: the test-engineer's live acceptance tier expectsA2A_SERVER_BASE_URL+A2A_TEST_OIDC_TOKEN/A2A_TEST_UNAUTH_TOKEN. Standing up the shared A2A server in the local/kind stack (so those tests can go green) is a natural fit for this chart + CI once the server image lands. Tracked as a devops follow-up; it depends on backend-engineer'sagent-templates/a2a/*.pyentrypoint (see theTODO(server-entrypoint)markers) and a local OIDC issuer/token mint. Will wiregate-localuptohelm install a2a-sharedwith an enabled local overlay + export those env vars for the live tier in a subsequent PR.OUT OF SCOPE — NOT DONE
A2A server code, contract/acceptance tests, handoff-MCP client, onboarding docs — owned by their agents.
🤖 Generated with Claude Code