fix: authentication fails with custom sa (#1264)

supreme-gg-gg · web-flow · commit a8ba3e5f5f9b · 2026-02-04T08:27:29.000-05:00
When using custom service account, the `KAGENT_NAME` env var will be set
as the name of the service account which is not the agent name, and
causes issue when used as the `X-Agent-Name` header for authentication.

---------

Signed-off-by: Jet Chiang &lt;pokyuen.jetchiang-ext@solo.io&gt;
diff --git a/go/internal/controller/translator/agent/adk_api_translator.go b/go/internal/controller/translator/agent/adk_api_translator.go
@@ -351,10 +351,8 @@ func (a *adkApiTranslator) buildManifest(
 			},
 		},
 		corev1.EnvVar{
-			Name: "KAGENT_NAME",
-			ValueFrom: &corev1.EnvVarSource{
-				FieldRef: &corev1.ObjectFieldSelector{FieldPath: "spec.serviceAccountName"},
-			},
+			Name:  "KAGENT_NAME",
+			Value: agent.Name,
 		},
 		corev1.EnvVar{
 			Name:  "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/adk_api_translator_test.go b/go/internal/controller/translator/agent/adk_api_translator_test.go
@@ -580,6 +580,19 @@ func Test_AdkApiTranslator_ServiceAccountNameOverride(t *testing.T) {
 			} else {
 				assert.Nil(t, serviceAccount, "ServiceAccount should NOT be created when using custom override")
 			}
+
+			// Verify KAGENT_NAME env var
+			var kagentNameEnv string
+			for _, env := range deployment.Spec.Template.Spec.Containers[0].Env {
+				if env.Name == "KAGENT_NAME" {
+					if env.Value != "" {
+						kagentNameEnv = env.Value
+					} else if env.ValueFrom != nil && env.ValueFrom.FieldRef != nil {
+						kagentNameEnv = "Ref:" + env.ValueFrom.FieldRef.FieldPath
+					}
+				}
+			}
+			assert.Equal(t, tt.agent.Name, kagentNameEnv, "KAGENT_NAME env var should be the agent name")
 		})
 	}
 }
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_allowed_headers.json
@@ -182,11 +182,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_code.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_code.json
@@ -174,11 +174,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-code"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_cross_namespace_tools.json
@@ -187,11 +187,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "source-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_custom_sa.json
@@ -142,11 +142,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-custom-sa"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_http_toolserver.json
@@ -181,11 +181,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_mcp_service.json
@@ -177,11 +177,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_nested_agent.json
@@ -175,11 +175,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "parent-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json
@@ -187,11 +187,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-proxy"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_external_remotemcp.json
@@ -177,11 +177,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-proxy-external"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json
@@ -179,11 +179,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-proxy-mcpserver"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json
@@ -179,11 +179,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-proxy-service"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_scheduling_attributes.json
@@ -193,11 +193,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-scheduling-attributes"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_security_context.json
@@ -174,11 +174,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-security-context"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_skills.json
@@ -174,11 +174,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "skills-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_streaming.json
@@ -174,11 +174,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "basic-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_configmap.json
@@ -167,11 +167,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-configmap-system-message"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json b/go/internal/controller/translator/agent/testdata/outputs/agent_with_system_message_from_secret.json
@@ -167,11 +167,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "agent-with-secret-system-message"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json b/go/internal/controller/translator/agent/testdata/outputs/anthropic_agent.json
@@ -168,11 +168,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "anthropic-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/basic_agent.json b/go/internal/controller/translator/agent/testdata/outputs/basic_agent.json
@@ -174,11 +174,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "basic-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json b/go/internal/controller/translator/agent/testdata/outputs/bedrock_agent.json
@@ -181,11 +181,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "bedrock-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/ollama_agent.json b/go/internal/controller/translator/agent/testdata/outputs/ollama_agent.json
@@ -169,11 +169,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "ollama-agent"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json b/go/internal/controller/translator/agent/testdata/outputs/tls-with-custom-ca.json
@@ -172,11 +172,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "tls-agent-with-custom-ca"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json b/go/internal/controller/translator/agent/testdata/outputs/tls-with-disabled-verify.json
@@ -171,11 +171,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "tls-agent-with-disabled-verify"
                   },
                   {
                     "name": "KAGENT_URL",
diff --git a/go/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json b/go/internal/controller/translator/agent/testdata/outputs/tls-with-system-cas-disabled.json
@@ -172,11 +172,7 @@
                   },
                   {
                     "name": "KAGENT_NAME",
-                    "valueFrom": {
-                      "fieldRef": {
-                        "fieldPath": "spec.serviceAccountName"
-                      }
-                    }
+                    "value": "tls-agent-with-system-cas-disabled"
                   },
                   {
                     "name": "KAGENT_URL",

Original file line number	Diff line number	Diff line change
`@@ -182,11 +182,7 @@`
`182`	`182`	`},`
`183`	`183`	`{`
`184`	`184`	`"name": "KAGENT_NAME",`
`185`		`- "valueFrom": {`
`186`		`- "fieldRef": {`
`187`		`- "fieldPath": "spec.serviceAccountName"`
`188`		`- }`
`189`		`- }`
	`185`	`+ "value": "agent"`
`190`	`186`	`},`
`191`	`187`	`{`
`192`	`188`	`"name": "KAGENT_URL",`
Original file line number	Diff line number	Diff line change
`@@ -174,11 +174,7 @@`
`174`	`174`	`},`
`175`	`175`	`{`
`176`	`176`	`"name": "KAGENT_NAME",`
`177`		`- "valueFrom": {`
`178`		`- "fieldRef": {`
`179`		`- "fieldPath": "spec.serviceAccountName"`
`180`		`- }`
`181`		`- }`
	`177`	`+ "value": "agent-with-code"`
`182`	`178`	`},`
`183`	`179`	`{`
`184`	`180`	`"name": "KAGENT_URL",`
Original file line number	Diff line number	Diff line change
`@@ -187,11 +187,7 @@`
`187`	`187`	`},`
`188`	`188`	`{`
`189`	`189`	`"name": "KAGENT_NAME",`
`190`		`- "valueFrom": {`
`191`		`- "fieldRef": {`
`192`		`- "fieldPath": "spec.serviceAccountName"`
`193`		`- }`
`194`		`- }`
	`190`	`+ "value": "source-agent"`
`195`	`191`	`},`
`196`	`192`	`{`
`197`	`193`	`"name": "KAGENT_URL",`
Original file line number	Diff line number	Diff line change
`@@ -142,11 +142,7 @@`
`142`	`142`	`},`
`143`	`143`	`{`
`144`	`144`	`"name": "KAGENT_NAME",`
`145`		`- "valueFrom": {`
`146`		`- "fieldRef": {`
`147`		`- "fieldPath": "spec.serviceAccountName"`
`148`		`- }`
`149`		`- }`
	`145`	`+ "value": "agent-with-custom-sa"`
`150`	`146`	`},`
`151`	`147`	`{`
`152`	`148`	`"name": "KAGENT_URL",`
Original file line number	Diff line number	Diff line change
`@@ -181,11 +181,7 @@`
`181`	`181`	`},`
`182`	`182`	`{`
`183`	`183`	`"name": "KAGENT_NAME",`
`184`		`- "valueFrom": {`
`185`		`- "fieldRef": {`
`186`		`- "fieldPath": "spec.serviceAccountName"`
`187`		`- }`
`188`		`- }`
	`184`	`+ "value": "agent"`
`189`	`185`	`},`
`190`	`186`	`{`
`191`	`187`	`"name": "KAGENT_URL",`
Original file line number	Diff line number	Diff line change
`@@ -177,11 +177,7 @@`
`177`	`177`	`},`
`178`	`178`	`{`
`179`	`179`	`"name": "KAGENT_NAME",`
`180`		`- "valueFrom": {`
`181`		`- "fieldRef": {`
`182`		`- "fieldPath": "spec.serviceAccountName"`
`183`		`- }`
`184`		`- }`
	`180`	`+ "value": "agent"`
`185`	`181`	`},`
`186`	`182`	`{`
`187`	`183`	`"name": "KAGENT_URL",`
Original file line number	Diff line number	Diff line change
`@@ -175,11 +175,7 @@`
`175`	`175`	`},`
`176`	`176`	`{`
`177`	`177`	`"name": "KAGENT_NAME",`
`178`		`- "valueFrom": {`
`179`		`- "fieldRef": {`
`180`		`- "fieldPath": "spec.serviceAccountName"`
`181`		`- }`
`182`		`- }`
	`178`	`+ "value": "parent-agent"`
`183`	`179`	`},`
`184`	`180`	`{`
`185`	`181`	`"name": "KAGENT_URL",`