Docs: update SPIRE signing demo for Kind and OpenShift

kagenti-operator/demos/agentcard-enforcement/run-demo-commands.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 NAMESPACE="${NAMESPACE:-agents}"
-AGENTCARD="${AGENTCARD:-weather-agent-card}"
+AGENTCARD="${AGENTCARD:-weather-agent-deployment-card}"
 DEPLOYMENT="${DEPLOYMENT:-weather-agent}"
 
 get_status() {

kagenti-operator/demos/agentcard-enforcement/teardown-demo.sh

@@ -7,7 +7,7 @@
 set -euo pipefail
 
 NAMESPACE="${NAMESPACE:-agents}"
-AGENTCARD="${AGENTCARD:-weather-agent-card}"
+AGENTCARD="${AGENTCARD:-weather-agent-deployment-card}"
 
 echo "=== AgentCard Enforcement Demo Teardown ==="
 echo ""

kagenti-operator/demos/agentcard-proactive-restart/run-demo-commands.sh

@@ -10,7 +10,7 @@
 set -euo pipefail
 
 NAMESPACE="${NAMESPACE:-agents}"
-AGENTCARD="${AGENTCARD:-weather-agent-card}"
+AGENTCARD="${AGENTCARD:-weather-agent-deployment-card}"
 DEPLOYMENT="${DEPLOYMENT:-weather-agent}"
 OPERATOR_NS="${OPERATOR_NS:-kagenti-system}"
 OPERATOR_DEPLOY="${OPERATOR_DEPLOY:-kagenti-controller-manager}"

kagenti-operator/demos/agentcard-spire-signing/demo.md

@@ -27,61 +27,62 @@ The operator verifies the JWS signature using the x5c certificate chain embedded
 
 ## Prerequisites
 
-- Kubernetes cluster with SPIRE installed (e.g. `kagenti/deployments/run_install.sh --env dev`)
-- `spire-controller-manager` running (for ClusterSPIFFEID support)
-- SPIFFE CSI driver available (`csi.spiffe.io`)
-- Trust bundle ConfigMap in the cluster (e.g. `spire-bundle` in `spire-system`)
-- kagenti-operator deployed with signature verification flags (see step 2 below)
+- Kubernetes cluster with SPIRE installed (e.g. `kagenti/scripts/kind/setup-kagenti.sh --with-spire`)
+- kagenti-operator deployed with the following signature verification flags:
 
-## Setup
-
-### 1. Build Images
+```bash
+--require-a2a-signature=true
+--enforce-network-policies=true
+--spire-trust-domain=<your-trust-domain> # 'localtest.me' in Kind by default
+--spire-trust-bundle-configmap=spire-bundle
+--spire-trust-bundle-configmap-namespace=<spire-bundle-namespace> # 'spire-system' in Kind, 'zero-trust-workload-identity-manager' in OpenShift by default
+```
 
-Build the agentcard-signer init-container image and load it into Kind:
+If SPIRE was installed alongside Kagenti with the script above or similar, you can run the following helm command to apply the required flags:
 
 ```bash
-cd kagenti-operator/
-
-# Build the signer image
-make build-signer
+KAGENTI_REPO=<path-to-your-kagenti-repo>
+helm upgrade kagenti "$KAGENTI_REPO/charts/kagenti/" \
+  -n kagenti-system \
+  --reuse-values \
+  -f "$KAGENTI_REPO/charts/kagenti/.secrets.yaml" \
+  --set kagenti-operator-chart.signatureVerification.enabled=true \
+  --set kagenti-operator-chart.signatureVerification.enforceNetworkPolicies=true \
+  --set kagenti-operator-chart.signatureVerification.spireTrustDomain=<your-trust-domain> \
+  --set kagenti-operator-chart.signatureVerification.spireTrustBundle.configMapName=spire-bundle \
+  --set kagenti-operator-chart.signatureVerification.spireTrustBundle.configMapNamespace=<spire-bundle-namespace>
+```
 
-# Load into Kind (default cluster name is "kagenti")
-make load-signer-image
+If you are using OpenShift, include the following flag to use the correct bundle data field:
 
-# Or specify a different cluster name
-make load-signer-image KIND_CLUSTER_NAME=<your-cluster-name>
+```bash
+  --set kagenti-operator-chart.signatureVerification.spireTrustBundle.configMapKey=bundle.crt
 ```
 
-### 2. Configure the Operator
-
-The operator must be started with these flags for signature verification:
+You can check the name of the spire domain with the following command:
 
-```
---require-a2a-signature=true
---spire-trust-domain=<your-trust-domain>
---spire-trust-bundle-configmap=spire-bundle
---spire-trust-bundle-configmap-namespace=spire-system
---enforce-network-policies=true
+```bash
+kubectl get configmap spire-server -n zero-trust-workload-identity-manager -o jsonpath='{.data.server\.conf}{"\n"}' | grep trust_domain
 ```
 
-If using the Helm chart, set these in your values override.
+## Setup
 
-### 3. Deploy the Demo
+### 1. Deploy the Demo
 
 ```bash
+cd <path-to-your-kagenti-operator-repo>/kagenti-operator
 kubectl apply -f demos/agentcard-spire-signing/k8s/namespace.yaml
 kubectl apply -f demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
 kubectl apply -f demos/agentcard-spire-signing/k8s/agent-deployment.yaml
-kubectl apply -f demos/agentcard-spire-signing/k8s/agentcard.yaml
 ```
 
-### 4. Wait for Pods
+### 2. Wait for Pods
 
 ```bash
 kubectl wait --for=condition=available --timeout=120s deployment/weather-agent -n agents
 ```
 
-## Test the Flow
+### 3. Test the Flow
 
 Run the demo script to see signing and verification in action:
 
@@ -123,7 +124,7 @@ Expected output:
 
 === 7. AgentCard Summary ===
 NAME                PROTOCOL   KIND         TARGET          AGENT            VERIFIED   BOUND   SYNCED   ...
-weather-agent-card  a2a        Deployment   weather-agent   Weather Agent    true       true    True     ...
+weather-agent-deployment-card  a2a        Deployment   weather-agent   Weather Agent    true       true    True     ...
 ```
 
 ## How It Works
@@ -148,8 +149,35 @@ Use the teardown script to delete all demo resources:
 Or manually:
 
 ```bash
-kubectl delete -f demos/agentcard-spire-signing/k8s/agentcard.yaml
 kubectl delete -f demos/agentcard-spire-signing/k8s/agent-deployment.yaml
 kubectl delete -f demos/agentcard-spire-signing/k8s/clusterspiffeid.yaml
 kubectl delete -f demos/agentcard-spire-signing/k8s/namespace.yaml
 ```
+
+## Troubleshooting
+
+### Pull rate limit error for `docker.io/python:3.11-slim`
+
+If you run into image pull rate limit on OpenShift, you can patch the deployment to use a Red Hat UBI Python image:
+
+```bash
+oc patch deployment weather-agent -n agents --type=json -p='[{"op":"replace","path":"/spec/template/spec/containers/0/image","value":"registry.redhat.io/ubi9/python-311:latest"}]'
+```
+
+### Error pulling `agentcard-signer` image for `ghcr.io`
+
+You can build your own image and upload it to Kind/OpenShift internal registry with the following commands:
+
+```bash
+cd kagenti-operator/
+
+# Kind
+make build-signer # Build the signer image
+make load-signer-image KIND_CLUSTER_NAME=kagenti # Load the signer image into the default "kagenti" cluster
+
+# OpenShift
+oc new-build -n agents --name agentcard-signer --binary --strategy docker --to=agentcard-signer # Create a binary BuildConfig that outputs the signer image
+oc patch bc/agentcard-signer -n agents --type=json -p='[{"op":"add","path":"/spec/strategy/dockerStrategy/dockerfilePath","value":"cmd/agentcard-signer/Dockerfile"}]' # Point the BuildConfig to the signer Dockerfile path in this repo
+oc start-build agentcard-signer -n agents --from-dir=. # Upload the current directory as build context and start the image build
+oc patch deployment weather-agent -n agents --type=json -p='[{"op":"replace","path":"/spec/template/spec/initContainers/0/image","value":"image-registry.openshift-image-registry.svc:5000/agents/agentcard-signer:latest"}]' # Use the newly built signer image from the OpenShift internal registry
+```

kagenti-operator/demos/agentcard-spire-signing/k8s/agent-deployment.yaml

@@ -62,7 +62,6 @@ metadata:
   name: weather-agent
   namespace: agents
   labels:
-    kagenti.io/type: agent
     protocol.kagenti.io/a2a: ""
     app.kubernetes.io/name: weather-agent
 spec:
@@ -158,3 +157,17 @@ spec:
   ports:
     - port: 8080
       targetPort: 8080
+---
+apiVersion: agent.kagenti.dev/v1alpha1
+kind: AgentRuntime
+metadata:
+  name: weather-agent-runtime
+  namespace: agents
+  labels:
+    app.kubernetes.io/name: weather-agent
+spec:
+  type: agent
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: weather-agent