Docs: update demos to use AgentRuntime to enroll agents/tools instead of manual labeling#494
Conversation
📝 WalkthroughWalkthroughAcross all AuthBridge demo manifests, the ChangesAgentRuntime Enrollment Migration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-project-automation
Bot
moved this to New /:ToDo
in Rossoctl Issue Prioritization
285924f to
2748613
Compare
2748613 to
730ec2f
Compare
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
authbridge/demos/mtls/Makefile (1)
13-28: Use bracket notation for jsonpath keys with dots.Lines 19 and 24 use escaped-dot syntax to access the
kagenti.io/typelabel. While the escaped-dot form (kagenti\.io/type) is valid and functional in kubectl, Kubernetes best practices recommend using bracket notation with quotes (['kagenti.io/type']) for keys containing dots. This approach is more explicit, more reliable across kubectl versions, and is the officially recommended syntax.Suggested changes
jsonpath='{.spec.template.metadata.labels.kagenti\.io/type}'to:
jsonpath="{.spec.template.metadata.labels['kagenti.io/type']}"Apply this change at both lines 19 and 24.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@authbridge/demos/mtls/Makefile` around lines 13 - 28, In the wait-operator-labels target in the Makefile, the jsonpath expressions used in the kubectl commands on lines 19 and 24 are using escaped-dot syntax (kagenti\.io/type) to access the label key. Replace this with the officially recommended bracket notation with quotes (['kagenti.io/type']) in both locations where the jsonpath argument appears in the `-o jsonpath='{.spec.template.metadata.labels.kagenti\.io/type}'` expressions. This provides more explicit, reliable, and standard syntax for accessing keys containing dots.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@authbridge/demos/mtls/Makefile`:
- Around line 13-28: In the wait-operator-labels target in the Makefile, the
jsonpath expressions used in the kubectl commands on lines 19 and 24 are using
escaped-dot syntax (kagenti\.io/type) to access the label key. Replace this with
the officially recommended bracket notation with quotes (['kagenti.io/type']) in
both locations where the jsonpath argument appears in the `-o
jsonpath='{.spec.template.metadata.labels.kagenti\.io/type}'` expressions. This
provides more explicit, reliable, and standard syntax for accessing keys
containing dots.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: e95c495f-1c28-4437-9b41-d4998cd8019c
📒 Files selected for processing (12)
authbridge/demos/echo/k8s/agent.yamlauthbridge/demos/finance-sparc/k8s/agent.yamlauthbridge/demos/github-issue/k8s/git-issue-agent-deployment.yamlauthbridge/demos/github-issue/k8s/github-tool-deployment.yamlauthbridge/demos/ibac/k8s/agent.yamlauthbridge/demos/mtls/Makefileauthbridge/demos/mtls/README.mdauthbridge/demos/mtls/k8s/callee.yamlauthbridge/demos/mtls/k8s/caller.yamlauthbridge/demos/weather-agent/demo-ui-advanced.mdauthbridge/demos/weather-agent/k8s/weather-service-advanced.yamlauthbridge/demos/weather-agent/k8s/weather-tool-advanced.yaml
💤 Files with no reviewable changes (1)
- authbridge/demos/weather-agent/k8s/weather-service-advanced.yaml
dc35a4e to
dd21dc9
Compare
pdettori
left a comment
pdettori
left a comment
There was a problem hiding this comment.
Summary
This PR cleanly migrates the AuthBridge demos away from manually-applied kagenti.io/type: agent labels toward operator-applied labels via AgentRuntime CRs, ahead of the operator's Validating Admission Policy (kagenti-operator#418).
The inline-CR conversions are all correct — echo, finance-sparc, ibac, github-issue, and mtls caller/callee each have an AgentRuntime whose name / namespace: team1 / targetRef matches its Deployment, and the CR is appended to the same manifest file that gets applied, so a single kubectl apply -f <file> covers both. The mtls Makefile's new wait-operator-labels gate is a nice touch, and the github tool correctly keeps no CR (intentionally not injected).
One blocking gap: the weather-advanced demo's AgentRuntime CRs live in separate agentruntime-*.yaml files that the documented raw-manifest apply path never applies — so removing the inline labels breaks that path silently. Details inline.
Areas reviewed: K8s/YAML manifests, Makefile, Docs
Agent/IDE config (.claude/.vscode): none touched
Commits: 1, signed-off (DCO passing)
CI: all passing
Note: the PR's own testing checklist leaves both Weather boxes unchecked, consistent with the finding below.
Assisted-By: Claude Code
3cffaf1 to
13d7353
Compare
… of manual labeling Remove kagenti.io/type labels in deployment files and include AgentRuntime where necessary. Add a step to mTLS makefile to wait for labels to apply to workload deployment. Update documentation and comments to reflect the new behavior. Signed-off-by: Daniels Nagornuks <dnagornu@redhat.com>
13d7353 to
d8176da
Compare
|
@pdettori I applied the requested changes. Could you please re-review my PR when convenient? |
pdettori
left a comment
pdettori
left a comment
There was a problem hiding this comment.
Re-review
My earlier must-fix is fully addressed in d8176da:
- The kubectl-only ("skip the UI") apply block now applies both
agentruntime-weather-tool-advanced.yamlandagentruntime-weather-service-advanced.yaml, each before itsrollout statuswait — so the raw-manifest path now triggers operator labeling / sidecar injection instead of silently skipping it. - The misleading "deploy script applies AgentRuntime CRs too" inline comment has been removed.
- Both referenced CR files exist at HEAD.
LGTM. Approving.
Assisted-By: Claude Code
github-project-automation
Bot
moved this from New/ToDo
to Done
in Rossoctl Issue Prioritization
3 participants
Summary
Many demos deploy agents and tools with a
kagenti.io/typelabel manually applied instead of using AgentRuntime CR to enroll the workload and inject sidecars. AgentRuntime will become mandatory to enroll workloads and manually labeling will become impossible once rossoctl/operator#418 merged as Validating Admission Policy will only allow the controller (via AgentRuntime) and UI backend (as a temporary measure, but eventually the UI backend should use AgentRuntime to create workloads) to apply the label.Changes
Testing
The following demos are able to be completed without any issues:
Summary by CodeRabbit
Release Notes
New Features
Chores