Docs: update SPIRE signing demo for Kind and OpenShift - #334
Conversation
|
/hold |
cc683eb to
9058c74
Compare
9058c74 to
d9e36d7
Compare
rh-dnagornuks
changed the title
|
@rh-dnagornuks CI has been fixed - please rebase from upstream main and force push so we can check now with full CI |
Document Kind/SPIRE setup and Helm-based signature verification configuration, including an optional configMapKey override for the OpenShift trust bundle format. Remove the static AgentCard manifest and rely on the operator-generated AgentCard (weather-agent-deployment-card). Update demo and teardown scripts, and add troubleshooting guidance for image pull rate limits and building the agentcard-signer image. Signed-off-by: Daniels Nagornuks <dnagornu@redhat.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Add an explicit AgentRuntime CR for the weather-agent Deployment as the forward-compatible way to register agents with the operator, in preparation for AgentRuntime becoming mandatory for Agent enrollment. Remove the kagenti.io/type=agent label from the Deployment metadata now that the AgentRuntime CR is the authoritative enrollment mechanism. Signed-off-by: Daniels Nagornuks <dnagornu@redhat.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
…demo Update demo scripts to use the correct AgentCard variable name generated by the controller. Remove agentcard auto discovery demo in preparation for DefaultsConfigReconciler. Signed-off-by: Daniels Nagornuks <dnagornu@redhat.com>
d9e36d7 to
a79f1f2
Compare
pdettori
left a comment
pdettori
left a comment
There was a problem hiding this comment.
LGTM — clean docs/demo PR. All 16 CI checks pass (including E2E), commits signed-off, naming updates consistent across all affected scripts.
Re /hold: The hold from @akram (May 21) about spiffe-helper sidecar behavior appears orthogonal to this PR since it's docs-only and doesn't modify operator or sidecar code. No blocking label was applied.
Areas reviewed: Docs/Markdown, YAML/K8s manifests, Shell scripts
Commits: 3, all DCO signed-off
CI: All passing
| @@ -27,61 +27,62 @@ The operator verifies the JWS signature using the x5c certificate chain embedded | |||
|
|
|||
There was a problem hiding this comment.
suggestion (non-blocking): Consider adding a brief note explaining that the operator auto-generates the AgentCard from the AgentRuntime CR — users familiar with the previous manual agentcard.yaml step may wonder where it went.
github-project-automation
Bot
moved this from New /:ToDo
to Done
in Rossoctl Issue Prioritization
|
The /hold from Akram was when this PR originally provided OpenShift-specific workarounds as well as doc changes for issues described in #252, but after testing 3 weeks ago (as well as now) those issues don't occur anymore, but I thought the demos could still be refined. That issue can be closed I believe. |
4 participants
Summary
AgentCardmanifest and rely on operator-generatedAgentCardresources insteadweather-agent-deployment-cardagentcard-signerimage locally/OpenShiftagentcard-auto-discoverydemo in preparation for DefaultConfigReconciler removalContext
The previous SPIRE signing demo assumed a static
AgentCardresource and focused primarily on a generic Kubernetes/SPIRE setup.This PR updates the demo to align with the current operator behavior where
AgentCardresources are generated automatically by the operator. It also improves the onboarding experience for both Kind and OpenShift users by documenting:setup-kagenti.sh --with-spireThe PR also removes the demo for auto agent card discovery as the reconciler responsible for reading the deployment label
kagenti.io/typeand generating an agent card will be removed as part of enforcing the AgentRuntime enrollment path.Tests
Made with Cursor