From b2a1c00e75c7309651d8a3ae4f94960bcd283f1f Mon Sep 17 00:00:00 2001 From: David Nicholas Date: Fri, 7 Aug 2026 11:02:35 -0700 Subject: [PATCH] Release the chart as 0.4.0, and let it express the engine token MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Temporal engine landed across #196-#199 without the umbrella chart's version moving off 0.3.0. Charts publish under that version and OCI tags are mutable, so every one of those merges overwrote 0.3.0 in place — an installed "pin" silently became a different chart. #199's publish then failed on a transient GHCR error, which is the only reason the enable-by-default values are not already live for anyone tracking 0.3.0. Bump to 0.4.0 so the engine ships under a version of its own, and add the temporal-engine subchart to Chart.lock, which never recorded it. ## AGENT_ENGINE had a chart path; the token did not #199 fixed exactly the gap it described, but only half of it. The engine gateway resolves the CALLER's roles from a bearer token and re-resolves every skill/agent target under them, so a deployment that sets AGENT_ENGINE and nothing else reaches a gateway that fails closed to zero capabilities and denies every turn. There was no values path to AGENT_TEMPORAL_ENGINE_TOKEN at all. secrets.temporalEngineTokenKey follows the convention the neighbouring keys already use — a key name into secrets.existingSecret, rendered only when config.agentEngine is set. It is optional: true, because the alternative to a token is the gateway's own defaultSubject/defaultRoles rather than a broken pod. One of the two has to be configured for a turn to resolve anything, and the values comments now say so on both sides. With config.agentEngine unset, `helm template` output is byte-identical to before this change — verified by diffing the rendered manifests. Co-Authored-By: Claude Opus 5 --- charts/agent-controller/Chart.lock | 7 +++++-- charts/agent-controller/Chart.yaml | 14 +++++++------- .../templates/deployment.yaml | 17 +++++++++++++++++ .../charts/agent-orchestrator/values.yaml | 8 ++++++++ .../charts/temporal-engine/Chart.yaml | 10 +++++----- 5 files changed, 42 insertions(+), 14 deletions(-) diff --git a/charts/agent-controller/Chart.lock b/charts/agent-controller/Chart.lock index 6219bff..21bd2b1 100644 --- a/charts/agent-controller/Chart.lock +++ b/charts/agent-controller/Chart.lock @@ -5,6 +5,9 @@ dependencies: - name: core-controller repository: file://charts/core-controller version: 0.1.0 +- name: temporal-engine + repository: file://charts/temporal-engine + version: 0.1.1 - name: integration-gateway repository: file://charts/integration-gateway version: 0.1.0 @@ -14,5 +17,5 @@ dependencies: - name: nats repository: https://nats-io.github.io/k8s/helm/charts/ version: 2.14.2 -digest: sha256:328c0678a640e98589cf6f96b28bc82931dffab1dbe78185e078d686dd2dbfc5 -generated: "2026-07-20T06:08:05.149497-07:00" +digest: sha256:571058ff9cac13b57a9e36b07e9a866cca84904a0411bffde4b556f3ea1cea7b +generated: "2026-08-06T18:08:32.066566-07:00" diff --git a/charts/agent-controller/Chart.yaml b/charts/agent-controller/Chart.yaml index 70976a8..3aedcab 100644 --- a/charts/agent-controller/Chart.yaml +++ b/charts/agent-controller/Chart.yaml @@ -9,7 +9,7 @@ description: >- one release. Install the community-components chart afterward to populate the catalog with Tool/Skill/Agent CRs. type: application -version: 0.3.0 +version: 0.4.0 appVersion: "0.1.0" home: https://github.com/imaustink/agent-controller sources: @@ -38,13 +38,13 @@ dependencies: version: "0.1.0" repository: "file://charts/core-controller" condition: core-controller.enabled - # The Temporal-workflow agent engine (engines/temporal), docs/adr/0036. OFF - # by default: agent-orchestrator runs its in-process LangGraph loop unless - # AGENT_ENGINE=temporal selects this instead, so enabling the subchart alone - # changes no behaviour. Takes a Temporal address rather than bundling a - # server, so it adds no stateful component. + # The Temporal-workflow agent engine (engines/temporal), docs/adr/0036. ON, + # and paired with agent-orchestrator.config.agentEngine=temporal in values -- + # deploying the subchart is only half the switch, since the orchestrator + # picks its loop independently. Takes a Temporal address rather than bundling + # a server, so it adds no stateful component. - name: temporal-engine - version: "0.1.0" + version: "0.1.1" repository: "file://charts/temporal-engine" condition: temporal-engine.enabled # GitHub Issues adapter (apps/integration-gateway) -- phase 1 of diff --git a/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml b/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml index e4dcf7d..2622df9 100644 --- a/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml +++ b/charts/agent-controller/charts/agent-orchestrator/templates/deployment.yaml @@ -78,6 +78,23 @@ spec: - name: AGENT_TEMPORAL_ENGINE_URL value: {{ .Values.config.temporalEngineUrl | quote }} {{- end }} + {{- if and .Values.config.agentEngine .Values.secrets.temporalEngineTokenKey }} + # Bearer token presented to the engine gateway, which resolves it + # to a subject and ROLES against its own static identity map. The + # engine re-resolves every skill/agent target under those roles, so + # without a token that the gateway recognises it falls closed to + # zero capabilities and every turn is denied. + # + # Optional, because the alternative to a token is the gateway's + # defaultSubject/defaultRoles rather than a broken pod — but one of + # the two has to be configured for a turn to resolve anything. + - name: AGENT_TEMPORAL_ENGINE_TOKEN + valueFrom: + secretKeyRef: + name: {{ .Values.secrets.existingSecret | default (include "agent-orchestrator.fullname" .) }} + key: {{ .Values.secrets.temporalEngineTokenKey }} + optional: true + {{- end }} {{- if .Values.config.callerToolTtlSeconds }} - name: AGENT_CALLER_TOOL_TTL_SECONDS value: {{ .Values.config.callerToolTtlSeconds | quote }} diff --git a/charts/agent-controller/charts/agent-orchestrator/values.yaml b/charts/agent-controller/charts/agent-orchestrator/values.yaml index b8b25d5..ff418e3 100644 --- a/charts/agent-controller/charts/agent-orchestrator/values.yaml +++ b/charts/agent-controller/charts/agent-orchestrator/values.yaml @@ -205,6 +205,14 @@ secrets: # absent from the Secret the orchestrator falls back to trusting the # unsigned request-body login and warns at startup. senderAssertionSecretKey: AGENT_SENDER_ASSERTION_SECRET + # Only used when config.agentEngine is set above. The engine gateway maps + # this token to a subject and ROLES, and re-resolves every skill/agent target + # under them, so an unrecognised or absent token leaves a turn with no + # capabilities. Must match an entry in that gateway's + # identity.staticIdentities — or be left out in favour of its + # defaultSubject/defaultRoles, which is the other way to give the hop an + # identity. + temporalEngineTokenKey: AGENT_TEMPORAL_ENGINE_TOKEN # Only read when secrets.create=true. openaiApiKey: "" callbackSecret: "" diff --git a/charts/agent-controller/charts/temporal-engine/Chart.yaml b/charts/agent-controller/charts/temporal-engine/Chart.yaml index 209ab52..fad74fa 100644 --- a/charts/agent-controller/charts/temporal-engine/Chart.yaml +++ b/charts/agent-controller/charts/temporal-engine/Chart.yaml @@ -2,12 +2,12 @@ apiVersion: v2 name: temporal-engine description: >- The Temporal-workflow agent engine (engines/temporal) — worker, gateway and - catalog-sync. Off by default: agent-orchestrator runs its in-process - LangGraph loop unless AGENT_ENGINE=temporal selects this instead - (docs/adr/0036). Assumes a Temporal cluster is already reachable and takes - its address, so enabling this adds no stateful component. + catalog-sync. Runs a turn only when agent-orchestrator is also told to use it + with AGENT_ENGINE=temporal (docs/adr/0036); deploying this alone leaves the + in-process LangGraph loop serving every turn. Assumes a Temporal cluster is + already reachable and takes its address, so this adds no stateful component. type: application -version: 0.1.0 +version: 0.1.1 appVersion: "0.1.0" home: https://github.com/imaustink/agent-controller sources: