Chart `openab-0.3.3` references non-existent image path after agent-broker → openab rename

[a7351220]

Summary

Helm chart openab-0.3.3 (latest stable) cannot be installed because it references an image path that doesn't exist publicly. The image actually lives at the pre-rename path under thepagent/agent-broker-*.

Repro

helm repo add openab https://openabdev.github.io/openab
helm repo update
helm install openab openab/openab \
  --set discord.botToken=... \
  --set-string discord.allowedChannels[0]=... \
  --set agent.preset=claude

Pod ends up in ImagePullBackOff:

Failed to pull image "ghcr.io/openabdev/openab-claude:dd7e1ca":
failed to authorize: failed to fetch anonymous token:
unexpected status from GET request to
https://ghcr.io/token?scope=repository%3Aopenabdev%2Fopenab-claude%3Apull&service=ghcr.io:
401 Unauthorized

Same failure for preset=codex, preset=gemini, and the default kiro-cli preset (all four image paths under ghcr.io/openabdev/openab* return authentication required from the anonymous token endpoint).

Root cause

Chart 0.3.3 was packaged after PR #96 (rename agent-broker → openab), which updated charts/openab/values.yaml to point at ghcr.io/openabdev/openab and the deployment template's volumeMounts to /etc/openab. But its appVersion is dd7e1ca, which is the commit before the rename. At that commit:

• The CI workflow pushed images to ghcr.io/thepagent/agent-broker*, so no image with tag dd7e1ca was ever published under ghcr.io/openabdev/openab*.
• The binary inside that image is named agent-broker and reads its config from /etc/agent-broker/config.toml (Dockerfile CMD).

Net effect: chart openab-0.3.3 is misaligned with its own appVersion in two independent ways — image path and config mount path.

The pre-rename images are still publicly accessible:

$ curl -s "https://ghcr.io/token?scope=repository:thepagent/agent-broker-claude:pull&service=ghcr.io"
{"token":"djE6dGhlcGFnZW50L2FnZW50LWJyb2tlci1jbGF1ZGU6..."}

$ curl -s "https://ghcr.io/token?scope=repository:openabdev/openab-claude:pull&service=ghcr.io"
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required"}]}

Workaround

Just overriding image.repository on openab-0.3.3 is not enough — the pre-rename binary still tries to read /etc/agent-broker/config.toml, which openab-0.3.3's deployment doesn't mount, so the pod ends up in CrashLoopBackOff with:

Error: failed to read /etc/agent-broker/config.toml: No such file or directory

What actually works is installing the pre-rename chart that's still in the same Helm index — it ships with both the matching image path and the matching mount path:

helm install openab openab/agent-broker --version 0.3.3 \
  --set discord.botToken=... \
  --set-string discord.allowedChannels[0]=... \
  --set agent.preset=claude

(Note: this leaves the deployment named openab-agent-broker, not openab, so adjust any follow-up kubectl exec / rollout restart commands accordingly.)

Suggested fix

Either:

1. Cut a new stable chart release whose appVersion matches a commit built and pushed by the post-rename workflow, and verify the resulting ghcr.io/openabdev/openab* packages are public, or
2. Make the existing ghcr.io/openabdev/openab* packages public if they were already pushed by the post-rename CI run — and double-check that the image at the published tag actually contains the renamed binary reading /etc/openab/config.toml, not the old agent-broker binary.

[neilkuan]

This issue has been resolved in v0.5.1.
⚠️ Breaking Change: The Helm chart has been renamed in this release, which causes the associated ConfigMap and PVC to be recreated under new names. Existing data will not be migrated automatically.
Please back up your data before upgrading. We apologize for the disruption.

[chaodu-agent]

Issue at a Glance

helm install openab openab/openab (chart 0.3.3)
         │
         ▼
   image: ghcr.io/openabdev/openab-claude:dd7e1ca
   → 401 Unauthorized ❌ (tag never pushed under new path)

Latest chart now:
   appVersion: 78f8d2c
   image: ghcr.io/openabdev/openab-claude:78f8d2c
   → 200 OK ✅ (tag exists, token accessible)

Hi @a7351220,

This has been resolved. The latest chart (appVersion: 78f8d2c) now references images that exist and are publicly accessible under ghcr.io/openabdev/openab*. Verified all four presets have the 78f8d2c tag published.

Closing as fixed.