Backport(0.9.x): reference declarative agents by tag; digests only for sandbox agents (#2242) by iplay88keys · Pull Request #2266 · kagent-dev/kagent

iplay88keys · 2026-07-15T20:35:30Z

Description

Backport of #2242 (807c5689) to release/v0.9.x.

Fixes #2055 on 0.9.x (mirrored registries that re-assign manifest digests could not resolve the link-time digest refs).

Differences from #2242

release/v0.9.x predates the Python -full runtime variant (PythonADKFullImageDigest / APP_FULL_IMAGE_TAG do not exist on this branch), so:

resolvePythonRuntimeImage gains only the pinDigest parameter — no full parameter. The full := runtime == Go && needsSRTSettings(...) computation stays Go-only, as on this branch.
Three digest-override flags added instead of main's four: --app-image-digest, --golang-adk-image-digest, --golang-adk-full-image-digest (env: APP_IMAGE_DIGEST, etc.). --app-full-image-digest is dropped with the variant it targets.
New unit tests adapted to the two-arg Python signature and this branch's default registry (cr.kagent.dev; main's tests use ghcr.io).
The golden files were regenerated with UPDATE_GOLDEN=true rather than hand-merged: each changes app@sha256:test-app → app:dev, matching the shape of the change on main.

Additionally, digest pinning is gated on the substrate platform rather than on sandbox workload mode. On main every SandboxAgent is a substrate agent (no spec.platform field), so the workload-mode gate is equivalent there; this branch also has the agent-sandbox platform, which accepts tag refs. Pinning those by digest would have kept the mirrored-registry breakage for them. Sandbox agents on the agent-sandbox platform now get tag refs like regular agents; only substrate sandbox agents pin by digest.

…r sandbox agents (#2242) Signed-off-by: Jeremy Alvis <[email protected]>

Copilot

Pull request overview

Backports the image-reference behavior from #2242 onto release/v0.9.x so declarative agents use tag-based image references (honoring --image-tag) while keeping digest pinning only where required, with new controller flags to override baked-in digests for mirrored registries.

Changes:

Add controller flags to override link-time sandbox runtime image digests (--app-image-digest, --golang-adk-image-digest, --golang-adk-full-image-digest).
Update declarative runtime image resolution to emit registry/repo:tag for regular agents and registry/repo@sha256:... only when digest pinning is required.
Update unit tests and regenerate golden outputs to reflect tag-based references for regular agents.

Reviewed changes

Copilot reviewed 40 out of 40 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
go/core/pkg/app/app.go	Adds new CLI flags to override sandbox runtime image digests at runtime.
go/core/internal/controller/translator/agent/deployments.go	Switches regular agents to tag-based image refs; keeps digest pinning behind a `pinDigest` decision path.
go/core/internal/controller/translator/agent/adk_api_translator.go	Updates documentation for link-time digests and the new runtime override flags.
go/core/internal/controller/translator/agent/runtime_test.go	Updates assertions to expect tag references for regular agents and no `@sha256:`.
go/core/internal/controller/translator/agent/imageconfig_test.go	Updates digest-pinning tests and adds coverage for tag-based resolution and sandbox vs regular pinning.
go/core/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/ollama_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/basic_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_require_approval.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_prompt_template.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_passthrough.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_memory.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_git_skills.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_embedding_provider.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_default_sa.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_context_config.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_code.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json	Golden output updated from digest-pinned app image to tag-based app image.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_a2a_config.json	Golden output updated from digest-pinned app image to tag-based app image.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Signed-off-by: Jeremy Alvis <[email protected]>

@iplay88keys

kagent 0.9.12 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre> ## What's Changed ### Other Changes * Backport(0.9.x): reference declarative agents by tag; digests only for sandbox agents (#2242) by @iplay88keys in kagent-dev/kagent#2266 **Full Changelog**: https://github.com/kagent-dev/kagent/compare/v0.9.11...v0.9.12</pre> <p>View the full release notes at <a href="https://github.com/kagent-dev/kagent/releases/tag/v0.9.12">https://github.com/kagent-dev/kagent/releases/tag/v0.9.12</a>.</p> </details> <hr> See merge request: Harmonybrew/homebrew-core!14696

Backport(0.9.x): reference declarative agents by tag; digests only fo…

1979f29

…r sandbox agents (#2242) Signed-off-by: Jeremy Alvis <[email protected]>

iplay88keys marked this pull request as ready for review July 15, 2026 20:35

iplay88keys requested review from jmhbh and supreme-gg-gg as code owners July 15, 2026 20:35

Copilot AI review requested due to automatic review settings July 15, 2026 20:35

Copilot started reviewing on behalf of iplay88keys July 15, 2026 20:36

View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

Comment thread go/core/internal/controller/translator/agent/deployments.go Resolved

Gate sandbox digest pinning on the substrate platform

6d0a0d3

Signed-off-by: Jeremy Alvis <[email protected]>

iplay88keys requested a review from EItanya July 15, 2026 22:16

iplay88keys mentioned this pull request Jul 20, 2026

Force-flush trace spans before the A2A response completes for substrate #2176

Merged

EItanya merged commit b459905 into release/v0.9.x Jul 20, 2026
25 checks passed

EItanya deleted the iplay88keys/backport-2242-v0.9.x branch July 20, 2026 18:26

BrewTestBot mentioned this pull request Jul 20, 2026

kagent 0.9.12 Homebrew/homebrew-core#294222

Merged

maazghani mentioned this pull request Jul 23, 2026

[BUG] Agent Pod continues using old image digest after image tag is updated in registry #2276

Closed

5 of 6 tasks

marcofranssen mentioned this pull request Aug 24, 2026

[BUG] golang-adk runtime image missing from cr.kagent.dev on v0.9.12 — ImagePullBackOff for all runtime: go agents #2531

Closed

4 of 5 tasks

Navigation Menu

Repository navigation

Backport(0.9.x): reference declarative agents by tag; digests only for sandbox agents (#2242) - #2266

Backport(0.9.x): reference declarative agents by tag; digests only for sandbox agents (#2242)#2266
EItanya merged 2 commits into
release/v0.9.xfrom
iplay88keys/backport-2242-v0.9.x

iplay88keys commented Jul 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

iplay88keys commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Differences from #2242

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

iplay88keys commented Jul 15, 2026 •

edited

Loading