Repository navigation
fix(controller): derive full runtime image from the tag name - #2640
Merged
EItanya merged 9 commits intoSep 28, 2026
Merged
Conversation
Digest-pinned IMAGE_TAG values produced an invalid OCI reference when skills agents appended -full after @sha256. Parse tag vs digest, suffix only the tag, and pin the full variant only with a dedicated digest. Signed-off-by: Ricardo Temperini <[email protected]>
iplay88keys
reviewed
Aug 31, 2026
Released builds always bake APP full digests via ldflags. Treat that value as sandbox fallback only. Declarative skills agents pin the full variant only when Helm fullDigest or the matching flag/env is set. Signed-off-by: Ricardo Temperini <[email protected]>
github-actions
Bot
added
bug
EItanya
previously approved these changes
Sep 4, 2026
github-actions
Bot
added
bug
When IMAGE_TAG embeds a slim digest and the operator has not set an explicit full-variant digest, reconciliation now returns a clear error instead of silently downgrading skills agents to a mutable tag-full ref. Signed-off-by: rtemperini <[email protected]>
Go skills agents already fail closed without --golang-adk-full-image-digest, but the parenthetical still pointed at the Python Helm path and env. Point operators at controller.goAgentImage.fullDigest / GOLANG_ADK_FULL_IMAGE_DIGEST. Signed-off-by: rtemperini <[email protected]>
rtemperini
force-pushed
the
fix/full-image-tag-digest
branch
from
September 14, 2026 14:20
e5c14d1 to
7dd0f71
Compare
iplay88keys
reviewed
Sep 21, 2026
Bare tags still resolve to tag-full. tag@digest without an explicit fullDigest fails reconcile, so the values comments no longer say declarative agents default to a tag-only image. Signed-off-by: rtemperini <[email protected]>
EItanya
approved these changes
Sep 24, 2026
Author
|
thanks for the approval @EItanya, there is anything pending to merge this? |
teemow
added a commit
to teemow/kagent
that referenced
this pull request
Oct 2, 2026
* upstream/release/v0.10.x: fix(controller): derive full runtime image from the tag name (kagent-dev#2640) Bump `kagent-tools` to `0.3.0` (backport to release/v0.10.x) (kagent-dev#2931) fix(ui): copy to the clipboard outside a secure context (kagent-dev#2866) fix(ui): resync the lockfile, and clear every fixable CVE (kagent-dev#2867) Signed-off-by: Timo Derstappen <[email protected]>
teemow
added a commit
to teemow/kagent
that referenced
this pull request
Oct 2, 2026
* upstream/release/v0.10.x: fix(controller): derive full runtime image from the tag name (kagent-dev#2640) Bump `kagent-tools` to `0.3.0` (backport to release/v0.10.x) (kagent-dev#2931) fix(ui): copy to the clipboard outside a secure context (kagent-dev#2866) fix(ui): resync the lockfile, and clear every fixable CVE (kagent-dev#2867) Signed-off-by: Timo Derstappen <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2586.
Declarative skills agents built the full runtime image by appending
-fulltoIMAGE_TAG. A digest-pinned tag such as0.10.0-rc3@sha256:…became…@sha256:…-full, which is not a valid OCI reference. The slim and full tags are also different images, so reusing the slim digest would be wrong even if the syntax were valid.What changed
The controller parses
IMAGE_TAGas a tag, atag@digest, or a digest-only value. The-fullsuffix is applied only to the tag name (0.10.0-rc3becomes0.10.0-rc3-full). The slim digest is never reused on the full image.Released builds always bake an upstream full digest (ldflags). That value is sandbox fallback only. Declarative skills agents pin the full variant only when the operator sets an explicit runtime full digest.
What operators should set
0.10.0-rc3): the full image isapp:0.10.0-rc3-full. Nothing extra to set.0.10.0-rc3@sha256:…): reconcile fails unless an explicit full digest is set. Python:controller.agentImage.fullDigest(APP_FULL_IMAGE_DIGEST). Go:controller.goAgentImage.fullDigest(GOLANG_ADK_FULL_IMAGE_DIGEST). The baked upstream digest is not used here.IMAGE_TAG: fail closed unless that runtime full digest is set.Why this branch
maindeleted the Agent translator (26732e86). The append lives only onrelease/v0.10.x.Tests
go test -raceon./core/internal/controller/translator/agent/, including the0.10.0-rc3@sha256:deadbeef…regression (must not produce…deadbeef…-full) and fail-closed errors that cite the matching Python or Go fullDigest / env flags.