Skip to content

fix: authentication fails with custom sa#1264

Merged
EItanya merged 3 commits intokagent-dev:mainfrom
supreme-gg-gg:fix/custom-sa
Feb 4, 2026
Merged

fix: authentication fails with custom sa#1264
EItanya merged 3 commits intokagent-dev:mainfrom
supreme-gg-gg:fix/custom-sa

Conversation

@supreme-gg-gg
Copy link
Contributor

@supreme-gg-gg supreme-gg-gg commented Feb 3, 2026

When using custom service account, the KAGENT_NAME env var will be set as the name of the service account which is not the agent name, and causes issue when used as the X-Agent-Name header for authentication.

Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
Copilot AI review requested due to automatic review settings February 3, 2026 19:46
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes an authentication bug where agents using custom service accounts would fail to authenticate. The issue was that the KAGENT_NAME environment variable was incorrectly set to the service account name instead of the agent name, causing identity mismatches in the agent runtime.

Changes:

  • Changed KAGENT_NAME environment variable from a field reference to spec.serviceAccountName to a direct value assignment using agent.Name
  • Added test coverage to verify KAGENT_NAME always matches the agent name, regardless of service account configuration

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
go/internal/controller/translator/agent/adk_api_translator.go Fixed KAGENT_NAME to use agent.Name directly instead of spec.serviceAccountName field reference
go/internal/controller/translator/agent/adk_api_translator_test.go Added assertions to verify KAGENT_NAME environment variable is set to agent name in all test cases

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +354 to +355
Name: "KAGENT_NAME",
Value: agent.Name,
Copy link

Copilot AI Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All golden test files in 'testdata/outputs/' need to be regenerated to reflect this change. The KAGENT_NAME environment variable structure has changed from using a fieldRef (valueFrom.fieldRef.fieldPath: spec.serviceAccountName) to a direct value assignment. Most critically, the 'agent_with_custom_sa.json' file demonstrates the bug fix where KAGENT_NAME should be set to the agent name "agent-with-custom-sa" rather than the custom service account name "custom-sa". Run the golden tests with update mode to regenerate these files.

Copilot uses AI. Check for mistakes.
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
@EItanya EItanya merged commit a8ba3e5 into kagent-dev:main Feb 4, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants