From 750b5e260880d08445143b532acbd993a3fbb3d0 Mon Sep 17 00:00:00 2001 From: Ed Snible Date: Wed, 13 May 2026 11:14:59 -0400 Subject: [PATCH 1/2] docs: provide text for 'oc explain' on operator CRDs Signed-off-by: Ed Snible --- .../api/v1alpha1/agentcard_types.go | 4 +++- .../api/v1alpha1/agentruntime_types.go | 4 +++- .../bases/agent.kagenti.dev_agentcards.yaml | 5 +++- .../agent.kagenti.dev_agentruntimes.yaml | 5 +++- .../config/webhook/manifests.yaml | 23 ------------------- 5 files changed, 14 insertions(+), 27 deletions(-) diff --git a/kagenti-operator/api/v1alpha1/agentcard_types.go b/kagenti-operator/api/v1alpha1/agentcard_types.go index a7306ea1..13020e4e 100644 --- a/kagenti-operator/api/v1alpha1/agentcard_types.go +++ b/kagenti-operator/api/v1alpha1/agentcard_types.go @@ -345,7 +345,9 @@ type SkillParameter struct { // +kubebuilder:printcolumn:name="LastSync",type="date",JSONPath=".status.lastSyncTime",description="Last Sync Time" // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp" -// AgentCard is the Schema for the agentcards API. +// AgentCard binds an A2A agent card to a backing workload. The controller periodically +// fetches the card from the referenced workload, verifies its JWS signature and SPIFFE +// identity against the configured trust domain, and caches the result in status. type AgentCard struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` diff --git a/kagenti-operator/api/v1alpha1/agentruntime_types.go b/kagenti-operator/api/v1alpha1/agentruntime_types.go index e5b8c722..69bc1a9d 100644 --- a/kagenti-operator/api/v1alpha1/agentruntime_types.go +++ b/kagenti-operator/api/v1alpha1/agentruntime_types.go @@ -124,7 +124,9 @@ type AgentRuntimeStatus struct { // +kubebuilder:printcolumn:name="Phase",type="string",JSONPath=".status.phase",description="Runtime Phase" // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp" -// AgentRuntime is the Schema for the agentruntimes API. +// AgentRuntime attaches runtime configuration to a backing workload classified as an +// agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry +// tracing. The controller reports pod configuration coverage and phase in status. type AgentRuntime struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` diff --git a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentcards.yaml b/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentcards.yaml index 11f366d7..ae9c9ff9 100644 --- a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentcards.yaml +++ b/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentcards.yaml @@ -56,7 +56,10 @@ spec: name: v1alpha1 schema: openAPIV3Schema: - description: AgentCard is the Schema for the agentcards API. + description: |- + AgentCard binds an A2A agent card to a backing workload. The controller periodically + fetches the card from the referenced workload, verifies its JWS signature and SPIFFE + identity against the configured trust domain, and caches the result in status. properties: apiVersion: description: |- diff --git a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml b/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml index 77e63922..97f3b0f1 100644 --- a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml +++ b/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml @@ -36,7 +36,10 @@ spec: name: v1alpha1 schema: openAPIV3Schema: - description: AgentRuntime is the Schema for the agentruntimes API. + description: |- + AgentRuntime attaches runtime configuration to a backing workload classified as an + agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry + tracing. The controller reports pod configuration coverage and phase in status. properties: apiVersion: description: |- diff --git a/kagenti-operator/config/webhook/manifests.yaml b/kagenti-operator/config/webhook/manifests.yaml index 41c04ade..434c7a5c 100644 --- a/kagenti-operator/config/webhook/manifests.yaml +++ b/kagenti-operator/config/webhook/manifests.yaml @@ -13,28 +13,6 @@ webhooks: path: /mutate-workloads-authbridge failurePolicy: Fail name: inject.kagenti.io - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: NotIn - values: - - kube-system - - kube-public - - kube-node-lease - - kagenti-operator-system - matchLabels: - kagenti-enabled: "true" - objectSelector: - matchExpressions: - - key: kagenti.io/type - operator: In - values: - - agent - - tool - - key: kagenti.io/inject - operator: NotIn - values: - - disabled reinvocationPolicy: IfNeeded rules: - apiGroups: @@ -46,7 +24,6 @@ webhooks: resources: - pods sideEffects: None - timeoutSeconds: 10 --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration From afe62a95022b9f2a33434a6726f43e1ccf016a8c Mon Sep 17 00:00:00 2001 From: Ed Snible Date: Wed, 13 May 2026 11:28:39 -0400 Subject: [PATCH 2/2] Restore manual override of webhook manifests Signed-off-by: Ed Snible --- .../config/webhook/manifests.yaml | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/kagenti-operator/config/webhook/manifests.yaml b/kagenti-operator/config/webhook/manifests.yaml index 434c7a5c..41c04ade 100644 --- a/kagenti-operator/config/webhook/manifests.yaml +++ b/kagenti-operator/config/webhook/manifests.yaml @@ -13,6 +13,28 @@ webhooks: path: /mutate-workloads-authbridge failurePolicy: Fail name: inject.kagenti.io + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: NotIn + values: + - kube-system + - kube-public + - kube-node-lease + - kagenti-operator-system + matchLabels: + kagenti-enabled: "true" + objectSelector: + matchExpressions: + - key: kagenti.io/type + operator: In + values: + - agent + - tool + - key: kagenti.io/inject + operator: NotIn + values: + - disabled reinvocationPolicy: IfNeeded rules: - apiGroups: @@ -24,6 +46,7 @@ webhooks: resources: - pods sideEffects: None + timeoutSeconds: 10 --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration