git-issue-agent-deployment.yaml

# GitHub Issue Agent Deployment with AuthBridge
#
# This deployment uses the operator webhook to automatically inject
# a single combined AuthBridge sidecar (post-cortex#411). The exact
# container shape depends on the resolved AuthBridge mode:
# - proxy-sidecar (default): one container "authbridge-proxy" from the
#   "authbridge" image. spiffe-helper is bundled inside; gated per-workload
#   by SPIRE_ENABLED.
# - envoy-sidecar: a "proxy-init" init container (iptables) plus one
#   container "envoy-proxy" from the "authbridge-envoy" image (Envoy +
#   ext_proc + bundled spiffe-helper).
# Either way the sidecar handles inbound JWT validation, outbound token
# exchange (HTTP), and HTTPS passthrough.
#
# Keycloak client registration is operator-managed (no in-pod sidecar);
# the operator creates a rossoctl-keycloak-client-credentials-<hash> Secret
# and the webhook mounts it at /shared/client-{id,secret}.txt.
#
# The agent container:
#   - Runs the A2A GitHub Issue Agent on port 8000
#   - Calls the GitHub MCP tool via HTTP
#   - Token exchange to the tool is handled transparently by the AuthBridge sidecar
#
# Labels (on Pod template):
#   rossoctl.io/inject: enabled  - Enables AuthBridge sidecar injection
#   rossoctl.io/spire: enabled   - Enables SPIRE-based identity (set to "disabled" if no SPIRE)
#
# rossoctl.io/type is applied automatically by the operator when the
# AgentRuntime CR (at the end of this file) is created.
#
# Usage:
#   kubectl apply -f git-issue-agent-deployment.yaml

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: git-issue-agent
  namespace: team1

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: git-issue-agent
  namespace: team1
  labels:
    app.kubernetes.io/name: git-issue-agent
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: git-issue-agent
  template:
    metadata:
      labels:
        app.kubernetes.io/name: git-issue-agent
        rossoctl.io/inject: enabled
        rossoctl.io/spire: enabled
    spec:
      serviceAccountName: git-issue-agent
      containers:
        - name: agent
          image: ghcr.io/rossoctl/examples/git-issue-agent:latest
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
              name: http
          env:
            # LLM configuration - Ollama (local LLM)
            # Matches upstream .env.ollama from agent-examples repo
            - name: TASK_MODEL_ID
              value: "ollama/ibm/granite4:latest"
            # Ollama API base URL. Required by litellm (used by crewai >=1.10).
            # For Docker Desktop / Kind: http://host.docker.internal:11434
            # For in-cluster Ollama:     http://ollama.ollama.svc:11434
            - name: LLM_API_BASE
              value: "http://host.docker.internal:11434"
            - name: OLLAMA_API_BASE
              value: "http://host.docker.internal:11434"
            - name: LLM_API_KEY
              value: "ollama"
            - name: MODEL_TEMPERATURE
              value: "0"
            # For OpenAI (uncomment and set your key):
            # - name: TASK_MODEL_ID
            #   value: "gpt-4.1-nano"
            # - name: LLM_API_KEY
            #   valueFrom:
            #     secretKeyRef:
            #       name: openai-secret
            #       key: apikey
            # - name: OPENAI_API_KEY
            #   valueFrom:
            #     secretKeyRef:
            #       name: openai-secret
            #       key: apikey

            # Agent service settings
            # PORT tells the agent where to listen for A2A traffic.
            # The rossoctl operator may override this via proxy-sidecar
            # port-stealing to relocate the agent to a free port.
            - name: PORT
              value: "8000"
            - name: LOG_LEVEL
              value: "DEBUG"

            # MCP Tool endpoint - the GitHub tool service
            # AuthBridge will exchange the token when the agent calls this URL
            - name: MCP_URL
              value: "http://github-tool-mcp:9090/mcp"

            # JWKS URI for validating incoming tokens from Keycloak
            - name: JWKS_URI
              value: "http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/certs"
          resources:
            limits:
              cpu: 500m
              memory: 512Mi
            requests:
              cpu: 100m
              memory: 128Mi
          volumeMounts:
            - name: shared-data
              mountPath: /shared
      volumes:
        - name: shared-data
          emptyDir: {}

---
apiVersion: v1
kind: Service
metadata:
  name: git-issue-agent
  namespace: team1
spec:
  selector:
    app.kubernetes.io/name: git-issue-agent
  ports:
    - port: 8080
      targetPort: 8000
      protocol: TCP
  type: ClusterIP

---
# AgentRuntime triggers operator-managed Keycloak client registration
# (creates rossoctl-keycloak-client-credentials-<hash> Secret with
# client-id.txt and client-secret.txt that the authbridge sidecar
# mounts at /shared/). The operator also applies rossoctl.io/type=agent
# to the Deployment and Pod template, enabling webhook sidecar injection.
apiVersion: agent.rossoctl.dev/v1alpha1
kind: AgentRuntime
metadata:
  name: git-issue-agent
  namespace: team1
spec:
  type: agent
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: git-issue-agent