Skip to content

Commit 7dbb539

Browse files
antigenius0910chaodu-agent
antigenius0910
and
chaodu-agent
authored
feat(chart): add configToml pass-through as alternative to Helm rende… (#1276)
* feat(chart): add configToml pass-through as alternative to Helm rendering Adds a new `configToml` field that accepts a raw TOML string and mounts it verbatim into the ConfigMap, bypassing the Helm-to-TOML rendering template entirely. When `configToml` is set: - The content is mounted as-is into config.toml - All adapter fields (slack.*, discord.*, pool.*, etc.) are ignored - agentsMd continues to work alongside it - configUrl behaviour is unchanged (ConfigMap skipped entirely) When `configToml` is absent, the existing Helm rendering path is used unchanged — no behaviour change for current users. This gives operators a zero-indirection path: what you write is what gets deployed. Secrets are still injected via secretEnv and referenced as ${VAR} placeholders in the TOML string. * fix: address review findings — migration doc, version ref, --set-file docs Addresses review findings on this PR: - F1 (broken doc link): docs/migrate-to-configtoml.md now ships in this PR instead of only existing on the stacked #1277 branch. Reworded intro to reflect deprecation (not yet removal) status, and to point at configUrl as the platform-agnostic alternative. - F3 (hardcoded version promise): NOTES.txt no longer hardcodes 'v0.10.0' for the legacy-rendering removal. Points to tracking issue #1278 instead, so the message doesn't go stale if the timeline shifts. - Document --set-file agents.<name>.configToml=./config.toml as a first-class way to keep config.toml as a standalone, WYSIWYG-editable file (values.yaml comment + new README section), mirroring the existing --set-file agentsMd pattern. F2 (unreconciled with #1271) is addressed on the #1271 side: the ADR now explicitly documents configToml (inline or --set-file) as the Kubernetes-only secondary path alongside configUrl as the platform-agnostic primary path, and the PR title reflects both. * fix(docs): convert plain-text doc references to proper markdown links - README.md: use relative links for migrate-to-configtoml.md and ADR - migrate-to-configtoml.md: use relative link for ADR doc --------- Co-authored-by: chaodu-agent <chaodu-agent@users.noreply.github.com>
1 parent 1231294 commit 7dbb539

6 files changed

Lines changed: 281 additions & 0 deletions

File tree

‎charts/openab/README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,22 @@ helm install openab openab/openab \
9696
--set-file agents.kiro.agentsMd=./AGENTS.md
9797
```
9898

99+
### Provide `config.toml` as-is with `--set-file`
100+
101+
`configToml` accepts a raw TOML string, which can be pasted inline into `values.yaml`
102+
or loaded verbatim from a standalone file. Keeping `config.toml` as a real file gives
103+
you full IDE syntax highlighting and TOML schema validation, instead of an indented
104+
YAML block scalar:
105+
106+
```bash
107+
helm upgrade openab openab/openab \
108+
--set-file agents.kiro.configToml=./config.toml
109+
```
110+
111+
See [`docs/migrate-to-configtoml.md`](../../docs/migrate-to-configtoml.md) for a full before/after guide, and
112+
[`docs/adr/configurl-over-helm-rendering.md`](../../docs/adr/configurl-over-helm-rendering.md) for when to prefer `configUrl` instead
113+
(platform-agnostic — works identically on Kubernetes, ECS, Zeabur, and AgentCore).
114+
99115
### Discord ID precision warning
100116

101117
Discord IDs must be set with `--set-string`, not `--set`. Otherwise Helm may coerce them into numbers and lose precision.

‎charts/openab/templates/NOTES.txt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,25 @@ Agents deployed:
7171
⚠️ SECURITY: The agent subprocess only receives HOME, PATH, and explicitly configured [agent].env vars.
7272
Any env var passed via [agent].env is accessible to the agent and could be exfiltrated via prompt injection.
7373
All supported backends use OAuth/file-based auth — avoid passing API keys via env vars when possible.
74+
75+
{{- $legacyAgents := list }}
76+
{{- range $name, $cfg := .Values.agents }}
77+
{{- if ne (include "openab.agentEnabled" $cfg) "false" }}
78+
{{- if and (not $cfg.configToml) (not $cfg.configUrl) }}
79+
{{- $legacyAgents = append $legacyAgents $name }}
80+
{{- end }}
81+
{{- end }}
82+
{{- end }}
83+
{{- if $legacyAgents }}
84+
85+
⚠️ DEPRECATION NOTICE:
86+
The following agents use Helm-rendered config (slack.*, discord.*, pool.*, etc.):
87+
{{- range $legacyAgents }}
88+
• {{ . }}
89+
{{- end }}
90+
This rendering path is deprecated and will be removed in a future release.
91+
Track the removal timeline: https://github.com/openabdev/openab/issues/1278
92+
Migrate to configToml (or configUrl for a platform-agnostic setup) to write
93+
config.toml directly instead of relying on Helm's rendering.
94+
See: https://github.com/openabdev/openab/blob/main/docs/migrate-to-configtoml.md
95+
{{- end }}

‎charts/openab/templates/configmap.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ metadata:
1010
labels:
1111
{{- include "openab.labels" $d | nindent 4 }}
1212
data:
13+
{{- if $cfg.configToml }}
14+
config.toml: |
15+
{{ $cfg.configToml | indent 4 }}
16+
{{- else }}
1317
config.toml: |
1418
{{- if ($cfg.discord).enabled }}
1519
[discord]
@@ -342,6 +346,7 @@ data:
342346
{{ $alias | toJson }} = {{ $path | toJson }}
343347
{{- end }}
344348
{{- end }}
349+
{{- end }}
345350
{{- if $cfg.agentsMd }}
346351
AGENTS.md: |
347352
{{- $cfg.agentsMd | nindent 4 }}

‎charts/openab/tests/configtoml-passthrough_test.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
suite: configToml pass-through
2+
templates:
3+
- templates/configmap.yaml
4+
5+
tests:
6+
- it: renders configToml verbatim when set
7+
set:
8+
agents.kiro.configToml: |
9+
[slack]
10+
bot_token = "${SLACK_BOT_TOKEN}"
11+
allowed_channels = ["C01234567"]
12+
asserts:
13+
- matchRegex:
14+
path: data["config.toml"]
15+
pattern: '\[slack\]'
16+
- matchRegex:
17+
path: data["config.toml"]
18+
pattern: 'allowed_channels = \["C01234567"\]'
19+
20+
- it: does not render Helm-templated fields when configToml is set
21+
set:
22+
agents.kiro.configToml: |
23+
[slack]
24+
bot_token = "${SLACK_BOT_TOKEN}"
25+
agents.kiro.slack.enabled: true
26+
agents.kiro.pool.maxSessions: 5
27+
asserts:
28+
- notMatchRegex:
29+
path: data["config.toml"]
30+
pattern: '\[pool\]'
31+
32+
- it: still renders agentsMd alongside configToml
33+
set:
34+
agents.kiro.configToml: |
35+
[slack]
36+
bot_token = "${SLACK_BOT_TOKEN}"
37+
agents.kiro.agentsMd: "# My Agent\nDo things."
38+
asserts:
39+
- isNotNull:
40+
path: data["AGENTS.md"]
41+
- matchRegex:
42+
path: data["config.toml"]
43+
pattern: '\[slack\]'
44+
45+
- it: skips ConfigMap entirely when configUrl is set
46+
set:
47+
agents.kiro.configUrl: "s3://my-bucket/config.toml"
48+
asserts:
49+
- hasDocuments:
50+
count: 0
51+
52+
- it: falls back to Helm rendering when configToml is absent
53+
asserts:
54+
- matchRegex:
55+
path: data["config.toml"]
56+
pattern: '\[agent\]'

‎charts/openab/values.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,28 @@ agents:
8888
# existingClaim: "" # set to reuse an existing PVC (skips PVC creation)
8989
# storageClass: ""
9090
# size: 1Gi
91+
# # configToml: provide a raw config.toml string instead of using the Helm-rendered template.
92+
# # The content is mounted verbatim — no field mapping, no validation. Secrets must still be
93+
# # injected via secretEnv (they render as env vars and are referenced as ${VAR} in the TOML).
94+
# # When set, all adapter fields (slack.*, discord.*, pool.*, etc.) are ignored for rendering.
95+
# # Can be set inline (below) or loaded as-is from a standalone file (WYSIWYG editing, full
96+
# # TOML syntax highlighting/schema validation in your editor) via:
97+
# # helm upgrade ... --set-file agents.<name>.configToml=./config.toml
98+
# # Example:
99+
# # configToml: |
100+
# # [slack]
101+
# # bot_token = "${SLACK_BOT_TOKEN}"
102+
# # allowed_channels = ["C01234567"]
103+
# # allow_user_messages = "mentions"
104+
# #
105+
# # [agent]
106+
# # command = "claude-agent-acp"
107+
# # inherit_env = ["ANTHROPIC_API_KEY"]
108+
# #
109+
# # [pool]
110+
# # max_sessions = 10
111+
# # session_ttl_hours = 24
112+
# configToml: ""
91113
# # ⚠️ When set, this ConfigMap mount shadows any file at the same path on the PVC.
92114
# # The PVC file is NOT deleted but becomes invisible to the agent. Remove agentsMd to restore.
93115
# agentsMd: ""

‎docs/migrate-to-configtoml.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
# Migrating to `configToml`
2+
3+
`configToml` lets you write `config.toml` directly instead of relying on the
4+
Helm-rendered path (`slack.*`, `discord.*`, `pool.*`, etc. in `values.yaml`).
5+
The Helm-rendered path is deprecated and unmaintained — see the tracking
6+
issue for its removal timeline: https://github.com/openabdev/openab/issues/1278
7+
8+
For the platform-agnostic option (works identically on Kubernetes, ECS,
9+
Zeabur, and AgentCore Runtime — no chart required), see `configUrl` instead:
10+
[`docs/adr/configurl-over-helm-rendering.md`](adr/configurl-over-helm-rendering.md). `configToml` is the
11+
Kubernetes/Helm-only convenience for users not yet on external config storage.
12+
13+
## Why
14+
15+
The old path was a ~350-line TOML serializer written in Helm template language.
16+
Every new config field required a chart release. The rendered output was invisible
17+
to users without running `helm template`. `configToml` is a direct pass-through —
18+
what you write is what gets deployed.
19+
20+
## Two ways to set `configToml`
21+
22+
**Inline** — paste TOML directly into `values.yaml`:
23+
24+
```yaml
25+
agents:
26+
kiro:
27+
configToml: |
28+
[discord]
29+
bot_token = "${DISCORD_BOT_TOKEN}"
30+
```
31+
32+
**As-is from a standalone file** — keep `config.toml` as a real file (full IDE
33+
syntax highlighting / TOML schema validation) and load it verbatim with Helm's
34+
built-in `--set-file`:
35+
36+
```bash
37+
helm upgrade openab openab/openab \
38+
--set-file agents.kiro.configToml=./config.toml
39+
```
40+
41+
`--set-file` reads the file's raw content and assigns it as a string to
42+
`agents.kiro.configToml`, merging the same way `--set` does. No chart changes
43+
needed — this is the recommended way to keep `config.toml` WYSIWYG-editable.
44+
45+
## Before → After
46+
47+
### Slack
48+
49+
**Before:**
50+
```yaml
51+
agents:
52+
claude:
53+
slack:
54+
enabled: true
55+
existingSecret: openab
56+
assistantMode: true
57+
allowUserMessages: "mentions"
58+
allowedChannels:
59+
- "C01234567"
60+
allowedUsers:
61+
- "U01234567"
62+
pool:
63+
maxSessions: 10
64+
sessionTtlHours: 24
65+
reactions:
66+
enabled: true
67+
removeAfterReply: false
68+
command: claude-agent-acp
69+
workingDir: /home/node
70+
secretEnv:
71+
- name: ANTHROPIC_API_KEY
72+
secretName: openab
73+
secretKey: ANTHROPIC_API_KEY
74+
```
75+
76+
**After:**
77+
```yaml
78+
agents:
79+
claude:
80+
secretEnv:
81+
- name: ANTHROPIC_API_KEY
82+
secretName: openab
83+
secretKey: ANTHROPIC_API_KEY
84+
- name: SLACK_BOT_TOKEN
85+
secretName: openab
86+
secretKey: slack-bot-token
87+
- name: SLACK_APP_TOKEN
88+
secretName: openab
89+
secretKey: slack-app-token
90+
configToml: |
91+
[slack]
92+
bot_token = "${SLACK_BOT_TOKEN}"
93+
app_token = "${SLACK_APP_TOKEN}"
94+
allowed_channels = ["C01234567"]
95+
allowed_users = ["U01234567"]
96+
allow_user_messages = "mentions"
97+
assistant_mode = true
98+
99+
[agent]
100+
command = "claude-agent-acp"
101+
working_dir = "/home/node"
102+
inherit_env = ["ANTHROPIC_API_KEY"]
103+
104+
[pool]
105+
max_sessions = 10
106+
session_ttl_hours = 24
107+
108+
[reactions]
109+
enabled = true
110+
remove_after_reply = false
111+
```
112+
113+
### Discord
114+
115+
**Before:**
116+
```yaml
117+
agents:
118+
kiro:
119+
discord:
120+
botToken: "${DISCORD_BOT_TOKEN}"
121+
allowedChannels:
122+
- "123456789012345678"
123+
allowedUsers:
124+
- "987654321098765432"
125+
command: kiro-cli
126+
```
127+
128+
**After:**
129+
```yaml
130+
agents:
131+
kiro:
132+
secretEnv:
133+
- name: DISCORD_BOT_TOKEN
134+
secretName: my-secret
135+
secretKey: discord-bot-token
136+
configToml: |
137+
[discord]
138+
bot_token = "${DISCORD_BOT_TOKEN}"
139+
allowed_channels = ["123456789012345678"]
140+
allowed_users = ["987654321098765432"]
141+
142+
[agent]
143+
command = "kiro-cli"
144+
```
145+
146+
## Secrets
147+
148+
Secrets must still be injected via `secretEnv` — they render as `valueFrom.secretKeyRef`
149+
in the Deployment and are available as environment variables. Reference them in
150+
`configToml` as `${VAR_NAME}` placeholders exactly as before.
151+
152+
## Tip: see your current rendered config
153+
154+
Before migrating, check what your current `config.toml` looks like:
155+
156+
```bash
157+
kubectl exec -it deployment/<your-agent> -- cat /etc/openab/config.toml
158+
```
159+
160+
Use that output as the starting point for your `configToml` value.

0 commit comments

Comments
 (0)