feat: add extraContainers to SharedDeploymentSpec for sidecar support

go/api/v1alpha2/agent_types.go

@@ -379,6 +379,10 @@ type SharedDeploymentSpec struct {
 	// is created, and this config will be applied to it.
 	// +optional
 	ServiceAccountConfig *ServiceAccountConfig `json:"serviceAccountConfig,omitempty"`
+	// ExtraContainers is a list of additional containers to run alongside the main agent container.
+	// Useful for sidecars such as token proxies, log shippers, or security agents.
+	// +optional
+	ExtraContainers []corev1.Container `json:"extraContainers,omitempty"`
 }
 
 type ServiceAccountConfig struct {

go/core/internal/controller/translator/agent/deployments.go

@@ -46,6 +46,7 @@ type resolvedDeployment struct {
 	PodSecurityContext   *corev1.PodSecurityContext
 	ServiceAccountName   *string
 	ServiceAccountConfig *v1alpha2.ServiceAccountConfig
+	ExtraContainers      []corev1.Container
 }
 
 // getDefaultResources sets default resource requirements if not specified
@@ -105,6 +106,22 @@ func getRuntimeImageRepository(runtime v1alpha2.DeclarativeRuntime) string {
 	}
 }
 
+// validateExtraContainers checks that none of the extra containers use the
+// reserved name "kagent" and that no two containers share the same name.
+func validateExtraContainers(containers []corev1.Container) error {
+	seen := make(map[string]bool)
+	for _, c := range containers {
+		if c.Name == "kagent" {
+			return fmt.Errorf("extraContainers: %q is a reserved container name", c.Name)
+		}
+		if seen[c.Name] {
+			return fmt.Errorf("extraContainers: duplicate container name %q", c.Name)
+		}
+		seen[c.Name] = true
+	}
+	return nil
+}
+
 func resolveInlineDeployment(agent v1alpha2.AgentObject, mdd *modelDeploymentData) (*resolvedDeployment, error) {
 	specRef := agent.GetAgentSpec()
 	// Defaults
@@ -161,6 +178,10 @@ func resolveInlineDeployment(agent v1alpha2.AgentObject, mdd *modelDeploymentDat
 		}
 	}
 
+	if err := validateExtraContainers(spec.ExtraContainers); err != nil {
+		return nil, err
+	}
+
 	dep := &resolvedDeployment{
 		Image:                image,
 		Args:                 args,
@@ -181,6 +202,7 @@ func resolveInlineDeployment(agent v1alpha2.AgentObject, mdd *modelDeploymentDat
 		PodSecurityContext:   spec.PodSecurityContext,
 		ServiceAccountName:   spec.ServiceAccountName,
 		ServiceAccountConfig: spec.ServiceAccountConfig,
+		ExtraContainers:      slices.Clone(spec.ExtraContainers),
 	}
 
 	// Precedence: agent-level serviceAccountName > global default > auto-created SA (agent name)
@@ -241,6 +263,10 @@ func resolveByoDeployment(agent v1alpha2.AgentObject) (*resolvedDeployment, erro
 		replicas = new(int32(1))
 	}
 
+	if err := validateExtraContainers(spec.ExtraContainers); err != nil {
+		return nil, err
+	}
+
 	dep := &resolvedDeployment{
 		Image:                image,
 		Cmd:                  cmd,
@@ -262,6 +288,7 @@ func resolveByoDeployment(agent v1alpha2.AgentObject) (*resolvedDeployment, erro
 		PodSecurityContext:   spec.PodSecurityContext,
 		ServiceAccountName:   spec.ServiceAccountName,
 		ServiceAccountConfig: spec.ServiceAccountConfig,
+		ExtraContainers:      slices.Clone(spec.ExtraContainers),
 	}
 
 	// Precedence: agent-level serviceAccountName > global default > auto-created SA (agent name)

go/core/internal/controller/translator/agent/deployments_test.go

@@ -0,0 +1,64 @@
+package agent
+
+import (
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+func TestValidateExtraContainers(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		containers []corev1.Container
+		wantErr    bool
+	}{
+		{
+			name:       "empty list is fine",
+			containers: nil,
+			wantErr:    false,
+		},
+		{
+			name: "normal sidecar names are fine",
+			containers: []corev1.Container{
+				{Name: "envoy"},
+				{Name: "log-shipper"},
+			},
+			wantErr: false,
+		},
+		{
+			name: "reserved name kagent is rejected",
+			containers: []corev1.Container{
+				{Name: "kagent"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "duplicate sidecar names are rejected",
+			containers: []corev1.Container{
+				{Name: "proxy"},
+				{Name: "proxy"},
+			},
+			wantErr: true,
+		},
+		{
+			name: "kagent mixed with other containers is still rejected",
+			containers: []corev1.Container{
+				{Name: "envoy"},
+				{Name: "kagent"},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			err := validateExtraContainers(tt.containers)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateExtraContainers() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

go/core/internal/controller/translator/agent/manifest_builder.go

@@ -460,7 +460,7 @@ func buildPodTemplate(
 			ImagePullSecrets:   dep.ImagePullSecrets,
 			SecurityContext:    dep.PodSecurityContext,
 			InitContainers:     runtimeInputs.initContainers,
-			Containers: []corev1.Container{{
+			Containers: append([]corev1.Container{{
 				Name:            "kagent",
 				Image:           dep.Image,
 				ImagePullPolicy: dep.ImagePullPolicy,
@@ -482,7 +482,7 @@ func buildPodTemplate(
 				},
 				SecurityContext: runtimeInputs.securityContext,
 				VolumeMounts:    runtimeInputs.volumeMounts,
-			}},
+			}}, dep.ExtraContainers...),
 			Volumes:      runtimeInputs.volumes,
 			Tolerations:  dep.Tolerations,
 			Affinity:     dep.Affinity,

go/core/internal/controller/translator/agent/testdata/inputs/agent_with_extra_containers.yaml

@@ -0,0 +1,50 @@
+operation: translateAgent
+targetObject: agent-with-extra-containers
+namespace: test
+objects:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      name: openai-secret
+      namespace: test
+    data:
+      api-key: c2stdGVzdC1hcGkta2V5  # base64 encoded "sk-test-api-key"
+  - apiVersion: kagent.dev/v1alpha2
+    kind: ModelConfig
+    metadata:
+      name: basic-model
+      namespace: test
+    spec:
+      provider: OpenAI
+      model: gpt-4o
+      apiKeySecret: openai-secret
+      apiKeySecretKey: api-key
+  - apiVersion: kagent.dev/v1alpha2
+    kind: Agent
+    metadata:
+      name: agent-with-extra-containers
+      namespace: test
+    spec:
+      type: Declarative
+      declarative:
+        description: A test agent with a sidecar container
+        systemMessage: You are a helpful assistant.
+        modelConfig: basic-model
+        deployment:
+          extraContainers:
+            - name: token-proxy
+              image: envoyproxy/envoy:v1.30.0
+              args:
+                - -c
+                - /etc/envoy/envoy.yaml
+              ports:
+                - containerPort: 9901
+                  name: admin
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 64Mi
+                limits:
+                  cpu: 200m
+                  memory: 128Mi
+        tools: []