Support HTTPS for agent card fetching (AgentCard sync fails for TLS-only agents)

[rrbanda]

Problem

The operator always uses http:// when fetching /.well-known/agent-card.json from agent workloads. When an agent only serves HTTPS (e.g., port 8443 with TLS termination at the pod), the fetch fails with:

unexpected status code 400: Client sent an HTTP request to an HTTPS server.

The AgentCard status shows Synced: False, reason: FetchFailed and the error repeats every sync period (default 30s).

Root Cause

In agentcard_controller.go:230, the fetch URL is constructed with http:// hardcoded. The operator picks the first service port and always prepends http://, regardless of the port name or protocol.

Current Workaround

Adding a Python HTTP reverse proxy sidecar to the agent deployment that listens on HTTP port 8080 and proxies to HTTPS port 8443. This works but adds operational complexity.

Proposed Fix

One or more of:

1. Infer scheme from port name: If the service port is named https or the port number is 443/8443, use https:// instead of http://
2. Annotation override: Support kagenti.io/agent-card-url annotation on the deployment/service to override the auto-discovered URL entirely
3. Scheme annotation: Support kagenti.io/agent-card-scheme: https to override just the scheme

Option 2 (annotation override) is the most flexible and covers edge cases.

Affected Version

• Operator: ghcr.io/kagenti/kagenti-operator/kagenti-operator:0.2.0-alpha.36
• CRD: agentcards.agent.kagenti.dev/v1alpha1

Reproduction

Deploy any agent that serves its A2A agent card exclusively over HTTPS (no HTTP fallback). The operator will fail to sync the AgentCard.