Adding sidecar image param to the k8 worker

[ianhodge]

Add sidecar_image config override to Kubernetes backend

Problem

Customers running EKS in restricted network zones cannot pull the sidecar image (docker.io/warpdotdev/warp-agent:latest) directly from Docker Hub. The sidecar image reference is sent by the server in each task assignment and injected as an init container in the Kubernetes Job. There is currently no way to override this to point at an internal mirror (e.g. an ECR pull-through cache).

Solution

Add a new sidecar_image config field to the Kubernetes backend. When set, it replaces the server-provided sidecar image reference for the warp-agent sidecar (mounted at /agent).

Precedence: config sidecar_image > server-provided image (same pattern as preflight_image).

Changes

• Config layer: Added sidecar_image field to KubernetesConfig and KubernetesBackendConfig with no_whitespace validation
• Override logic: prepareTaskParams in worker.go uses the config override when set, with an info log noting the substitution
• Helm chart: Added kubernetesBackend.sidecarImage value and conditional configmap emission
• Tests: Config parsing tests (valid, empty, whitespace rejection) + prepareTaskParams override tests (override wins, server fallback, no sidecar when server sends empty)
• README: Documented the field with two callouts:
  • Tag pinning risk: Customer is responsible for keeping their mirror in sync
  • Scope: Only overrides the warp-agent sidecar, not additional sidecars

Example config

backend:
  kubernetes:
    sidecar_image: "123456789012.dkr.ecr.us-east-1.amazonaws.com/docker-hub/warpdotdev/warp-agent:latest"

---

Oz conversation | Plan

Co-Authored-By: Oz oz-agent@warp.dev

[ianhodge]

• Adding sidecar image param to the k8 worker  #45 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[bnavetta]

Not blocking, but should we support this for the Docker backend as well?