epic: end-to-end demo validation for GitHub Issue Agent with AuthBridge

[mrsabath]

Overview

This epic tracks all the issues, PRs, and fixes discovered during end-to-end validation
of the GitHub Issue Agent demo with AuthBridge, following the migration from the demo
Keycloak realm to the kagenti realm.

The validation effort started after kagenti/kagenti#764
(migrate UI to kagenti realm) was merged and revealed multiple gaps across three
repositories that prevented the full demo flow from working end-to-end — from the
Kagenti UI through AuthBridge to the GitHub tool and back.

Status: COMPLETED

All PRs have been merged and E2E testing passed successfully on 2026-03-06.

Issues Discovered and Resolved

Nr	Issue	Status	Fix
1	Installer authbridge-config hardcoded demo realm	Merged	kagenti/kagenti#851
2	Installer envoy-config had 30s timeouts (too short for LLM)	Merged	kagenti/kagenti#851
3	Installer envoy-config inbound header injection ineffective	Merged	kagenti/kagenti#851
4	Demo ConfigMaps duplicated installer defaults unnecessarily	Merged	#149
5	Demo docs referenced demo realm throughout	Merged	#149
6	GitHub tool .env.authbridge used outdated demo realm	Merged	kagenti/agent-examples#151
7	UI tokens missing agent audience scope — "invalid audience"	Merged	#169 — #172
8	Agent outbound calls lack Authorization header — tool 401	Merged	#170 — #171

PRs and Issues by Repository

kagenti-extensions (this repo)

Type	Number	Title	State
PR	#149	feat: migrate demo-ui.md from demo realm to kagenti realm	Merged
PR	#171	feat: add client_credentials fallback for outbound requests without Authorization header	Merged
PR	#172	feat: add agent audience scope to platform clients during registration	Merged
Issue	#169	feat: client-registration should add agent audience scope to UI client	Closed (by #172)
Issue	#170	feat: go-processor should fall back to client_credentials grant	Closed (by #171)
Issue	#174	feat: investigate agent-side token propagation for per-user authorization at tools	Open (follow-up)
Issue	#175	fix: harden go-processor logging and tokenURL validation	Open (follow-up)

kagenti/kagenti

Type	Number	Title	State
PR	#764	feat: migrate UI from Keycloak master realm to dedicated kagenti realm	Merged
PR	#851	fix: templatize authbridge-config realm and fix envoy-config defaults	Merged

kagenti/agent-examples

Type	Number	Title	State
PR	#151	fix: update github-tool .env.authbridge from demo to kagenti realm	Merged

Follow-up Issues (Non-blocking)

These remain open for future work and are not required for the demo to function:

1. #174 — investigate agent-side token propagation for per-user authorization at tools
2. #175 — harden go-processor logging and tokenURL validation

Acceptance Criteria

• Installer ConfigMap defaults fixed (fix: templatize authbridge-config realm and fix envoy-config defaults rossoctl#851 — merged)
• Demo docs migrated to kagenti realm (feat: migrate demo-ui.md from demo realm to kagenti realm #149 — merged)
• Go-processor client_credentials fallback for outbound calls (feat: add client_credentials fallback for outbound requests without Authorization header #171 — merged)
• GitHub tool .env.authbridge updated (agent-examples#151 — merged)
• UI realm migration (feat: migrate UI from Keycloak master realm to dedicated kagenti realm rossoctl#764 — merged)
• Client-registration auto-adds audience scope to UI client (feat: add agent audience scope to platform clients during registration #172 — merged)
• Fresh Kagenti install + demo deployment works end-to-end without manual Keycloak steps
• UI chat with AuthBridge-protected agent works (no "invalid audience" error)
• CLI test with test-client pod works (agent responds with GitHub data)
• envoy-proxy logs show [Client Credentials] grant on outbound calls
• Demo docs (demo-ui.md, demo-manual.md) accurately reflect the working flow

[mrsabath]

Adding #174 (investigate agent-side token propagation) to this epic — filed as a follow-up from Hai's review on #171.

[mrsabath]

E2E Testing Complete

All 7 PRs across 3 repositories have been merged and the GitHub Issue Agent demo with AuthBridge has been validated end-to-end on a fresh Kagenti install (v0.5.0-alpha.10):

Verified:

• Fresh Kagenti install creates correct ConfigMaps (kagenti realm, 300s timeouts, Lua filter for inbound direction)
• Agent deploys with 4/4 containers (agent + spiffe-helper + client-registration + envoy-proxy)
• Client-registration sidecar automatically creates audience scope and adds it to the UI client
• UI chat works without manual Keycloak configuration
• CLI test works with valid token
• Outbound requests use client_credentials fallback (envoy-proxy logs confirm [Client Credentials] Successfully obtained token)
• Inbound JWT validation active via Lua filter

Follow-up issues remain open (non-blocking):

• feat: investigate agent-side token propagation for per-user authorization at tools #174 — agent-side token propagation for per-user authorization
• fix: harden go-processor logging and tokenURL validation #175 — go-processor logging and HTTPS hardening

Closing this epic as all acceptance criteria are met.