feat(agentic-rag): add native OpenShift ServiceAccount token auth

[Wojciech-Rebisz]

Summary

• Add opt-in ServiceAccount token authentication to the agentic_rag agent,
  matching the existing pattern in react_agent
• Auth is disabled by default — no behavioral change for existing deployments

Changes

• main.py — add SATokenAuthMiddleware integration; hide playground UI when auth is enabled
• pyproject.toml — add [auth] optional dependency with agent-auth
• Dockerfile — install components/auth package alongside the agent
• Makefile — copy components/auth into the build context for both local and OpenShift builds
• README.md — add step-by-step Authentication section (enable, test, disable)
• uv.lock — updated to include agent-auth and its dependencies

Test plan

• uv sync --extra auth installs successfully
• make run-app works with auth disabled (backward compatibility)
• make build-openshift + make deploy succeeds
• Without token → 401 on /chat/completions
• With valid SA token → 200 on /chat/completions
• /health accessible without token
• Disable auth → agent works without tokens (backward compatibility)

[coderabbitai]

📝 Walkthrough

Walkthrough

The agentic RAG template adds optional OpenShift ServiceAccount token authentication, local auth dependency and image-build wiring, Helm configuration for auth settings, protected unauthenticated routes, environment examples, and deployment documentation.

Changes

Agentic RAG authentication

Layer / File(s)	Summary
Auth dependency and deployment wiring agents/langgraph/templates/agentic_rag/pyproject.toml, agents/langgraph/templates/agentic_rag/.env.example, agents/langgraph/templates/agentic_rag/Makefile, agents/langgraph/templates/agentic_rag/Dockerfile	The optional agent-auth dependency, auth environment settings, local build-context staging, two-phase image installation, and Helm auth parameters are added for deploy and dry-run flows.
Runtime middleware and route protection agents/langgraph/templates/agentic_rag/main.py	AUTH_ENABLED conditionally registers SATokenAuthMiddleware; the playground and image-serving routes return 404 when auth is enabled.
OpenShift authentication workflow agents/langgraph/templates/agentic_rag/README.md	Deployment, ServiceAccount setup, Helm configuration, enforcement checks, disabling auth, configuration values, and local-development constraints are documented.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant FastAPIApp
  participant SATokenAuthMiddleware
  participant KubernetesTokenReview
  Client->>FastAPIApp: Request /chat/completions
  FastAPIApp->>SATokenAuthMiddleware: Process bearer token
  SATokenAuthMiddleware->>KubernetesTokenReview: Submit TokenReview
  KubernetesTokenReview-->>SATokenAuthMiddleware: Return token status
  SATokenAuthMiddleware-->>FastAPIApp: Allow or reject request
  FastAPIApp-->>Client: Return response

Loading

Suggested reviewers: mpk-droid

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	It clearly summarizes the main change: adding native OpenShift ServiceAccount token authentication to agentic_rag.
Description check	✅ Passed	It accurately describes the auth feature, file changes, and test plan, and is fully aligned with the PR.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-native-auth-to-agentic-rag

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@agents/langgraph/templates/agentic_rag/Makefile`:
- Around line 110-112: Update both staging recipes in
agents/langgraph/templates/agentic_rag/Makefile: lines 110-112 and 98-100.
Remove existing ./images and ./components/auth staging directories before
copying, and register the EXIT cleanup trap before either staging command so
failed and repeated builds cannot retain stale content; preserve the existing
cleanup behavior after successful builds.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: cfbc7feb-1b1e-4990-b1db-5e46438f538c

📥 Commits

Reviewing files that changed from the base of the PR and between ffc8532 and 3610476.

⛔ Files ignored due to path filters (1)

• agents/langgraph/templates/agentic_rag/uv.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• agents/langgraph/templates/agentic_rag/Dockerfile
• agents/langgraph/templates/agentic_rag/Makefile
• agents/langgraph/templates/agentic_rag/README.md
• agents/langgraph/templates/agentic_rag/main.py
• agents/langgraph/templates/agentic_rag/pyproject.toml

[andrewdonheiser]

PR Review

Important (2)

1. Missing auth env vars in .env.example

The react_agent .env.example includes commented-out auth vars for discoverability:

# Auth (local default off; comma-separate multiple allowlist entries)
# AUTH_ENABLED=false
# AUTH_AUDIENCE=langgraph-react-agent
# AUTH_ALLOWED_SERVICEACCOUNTS=ci-testing:langgraph-react-agent-caller

The agentic_rag .env.example has none of these. Developers using make init get no hint auth exists without reading the README.

Fix: Add equivalent commented-out auth vars to .env.example.

---

2. Missing auth passthrough in Makefile deploy / dry-run targets

The react_agent deploy target includes ~15 lines of auth handling:

• Parsing AUTH_ALLOWED_SERVICEACCOUNTS into proper Helm array indices (--set-string auth.allowedServiceAccounts[N]=...)
• Passing AUTH_ENABLED, serviceAccount.create, and AUTH_AUDIENCE as Helm flags

The agentic_rag deploy and dry-run targets have none of this. Setting AUTH_ENABLED=true in .env and running make deploy silently ignores all auth config. The README works around this by documenting a separate helm upgrade --reuse-values command, but this is a significant gap vs. the react_agent pattern the PR claims to match.

Fix: Port the auth allowlist parsing block and AUTH_ENABLED / AUTH_AUDIENCE / serviceAccount.create flags from react_agent's deploy and dry-run targets. [Makefile:126-159]

Suggestions (1)

README uses --set string syntax for an array-typed Helm value

The README suggests:

--set auth.allowedServiceAccounts="<namespace>:my-caller"

But values.yaml defines allowedServiceAccounts: [] (an array), and the template uses join "," .Values.auth.allowedServiceAccounts. Setting it as a string happens to work for a single SA due to Sprig's lenient join, but breaks for multiple SAs. The react_agent Makefile uses the correct array index syntax: --set-string auth.allowedServiceAccounts[0]=....

Fix: Use --set-string "auth.allowedServiceAccounts[0]=<namespace>:my-caller" in the README.

Strengths

• main.py auth code is byte-for-byte identical to react_agent — zero pattern drift
• Makefile build targets have better cleanup ordering than react_agent (rm before copy + early trap)
• Comprehensive README with step-by-step enable/disable flows and Helm values table
• Defense-in-depth: auth gated at main.py level and inside middleware
• Clean pyproject.toml with [auth] optional dep and [tool.uv.sources] for local dev