fix: authentication fails with custom sa#1264
Conversation
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
There was a problem hiding this comment.
Pull request overview
This PR fixes an authentication bug where agents using custom service accounts would fail to authenticate. The issue was that the KAGENT_NAME environment variable was incorrectly set to the service account name instead of the agent name, causing identity mismatches in the agent runtime.
Changes:
- Changed
KAGENT_NAMEenvironment variable from a field reference tospec.serviceAccountNameto a direct value assignment usingagent.Name - Added test coverage to verify
KAGENT_NAMEalways matches the agent name, regardless of service account configuration
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go/internal/controller/translator/agent/adk_api_translator.go | Fixed KAGENT_NAME to use agent.Name directly instead of spec.serviceAccountName field reference |
| go/internal/controller/translator/agent/adk_api_translator_test.go | Added assertions to verify KAGENT_NAME environment variable is set to agent name in all test cases |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Name: "KAGENT_NAME", | ||
| Value: agent.Name, |
There was a problem hiding this comment.
All golden test files in 'testdata/outputs/' need to be regenerated to reflect this change. The KAGENT_NAME environment variable structure has changed from using a fieldRef (valueFrom.fieldRef.fieldPath: spec.serviceAccountName) to a direct value assignment. Most critically, the 'agent_with_custom_sa.json' file demonstrates the bug fix where KAGENT_NAME should be set to the agent name "agent-with-custom-sa" rather than the custom service account name "custom-sa". Run the golden tests with update mode to regenerate these files.
Signed-off-by: Jet Chiang <pokyuen.jetchiang-ext@solo.io>
When using custom service account, the
KAGENT_NAMEenv var will be set as the name of the service account which is not the agent name, and causes issue when used as theX-Agent-Nameheader for authentication.