From df7385db403bcba28a0992711291c2e4db4c5944 Mon Sep 17 00:00:00 2001 From: Rachael-Graham <29711887+Rachael-Graham@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:03:40 +0000 Subject: [PATCH 1/2] docs: Update kagent 0.x reference docs at v0.10.3 Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .../assets/kagent-docs/versions/kagent.md | 2 +- .../content/kagent/0.x/resources/helm.md | 28 ++++++++++--------- 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/docs-site/assets/kagent-docs/versions/kagent.md b/docs-site/assets/kagent-docs/versions/kagent.md index 3399c9ac..33792af2 100644 --- a/docs-site/assets/kagent-docs/versions/kagent.md +++ b/docs-site/assets/kagent-docs/versions/kagent.md @@ -1 +1 @@ -{{< version include-if="0.x" >}}0.10.2{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha12{{< /version >}} \ No newline at end of file +{{< version include-if="0.x" >}}0.10.3{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha12{{< /version >}} \ No newline at end of file diff --git a/docs-site/content/kagent/0.x/resources/helm.md b/docs-site/content/kagent/0.x/resources/helm.md index cd739075..5efbe7dd 100644 --- a/docs-site/content/kagent/0.x/resources/helm.md +++ b/docs-site/content/kagent/0.x/resources/helm.md @@ -13,20 +13,20 @@ A Helm chart for kagent, built with Google ADK | Repository | Name | Version | |------------|------|---------| | `${SUBSTRATE_REPO}` | substrate | `${SUBSTRATE_VERSION}` | -| file://../agents/argo-rollouts | argo-rollouts-agent | 0.10.2 | -| file://../agents/cilium-debug | cilium-debug-agent | 0.10.2 | -| file://../agents/cilium-manager | cilium-manager-agent | 0.10.2 | -| file://../agents/cilium-policy | cilium-policy-agent | 0.10.2 | -| file://../agents/helm | helm-agent | 0.10.2 | -| file://../agents/istio | istio-agent | 0.10.2 | -| file://../agents/k8s | k8s-agent | 0.10.2 | -| file://../agents/kgateway | kgateway-agent | 0.10.2 | -| file://../agents/observability | observability-agent | 0.10.2 | -| file://../agents/promql | promql-agent | 0.10.2 | -| file://../tools/grafana-mcp | grafana-mcp | 0.10.2 | +| file://../agents/argo-rollouts | argo-rollouts-agent | 0.10.3 | +| file://../agents/cilium-debug | cilium-debug-agent | 0.10.3 | +| file://../agents/cilium-manager | cilium-manager-agent | 0.10.3 | +| file://../agents/cilium-policy | cilium-policy-agent | 0.10.3 | +| file://../agents/helm | helm-agent | 0.10.3 | +| file://../agents/istio | istio-agent | 0.10.3 | +| file://../agents/k8s | k8s-agent | 0.10.3 | +| file://../agents/kgateway | kgateway-agent | 0.10.3 | +| file://../agents/observability | observability-agent | 0.10.3 | +| file://../agents/promql | promql-agent | 0.10.3 | +| file://../tools/grafana-mcp | grafana-mcp | 0.10.3 | | https://oauth2-proxy.github.io/manifests | oauth2-proxy | ~10.7.0 | | oci://ghcr.io/kagent-dev/kmcp/helm | kmcp | `${KMCP_VERSION}` | -| oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.2.1 | +| oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.3.0 | ## Values @@ -73,6 +73,7 @@ A Helm chart for kagent, built with Google ADK | controller.agentDeployment.nodeSelector | object | {} (no default nodeSelector) | Default nodeSelector applied to all agent deployments. Useful when admission policies require a nodeSelector on every Deployment, since wizard-created Agents carry none. A per-agent nodeSelector in the Agent CRD takes precedence over these defaults. | | controller.agentDeployment.podLabels | object | {} (no extra labels) | Default labels applied to all agent pod templates. Per-agent labels in the Agent CRD take precedence over these defaults. | | controller.agentDeployment.serviceAccountName | string | "" (auto-create per-agent ServiceAccount) | Default ServiceAccount name for agent pods. When set, agent pods that don't specify an explicit serviceAccountName will use this ServiceAccount instead of creating a per-agent one. Useful for Workload Identity (GCP, AWS IRSA, Azure Workload Identity). Precedence: agent-level serviceAccountName > this default > auto-created SA. | +| controller.agentImage.fullDigest | string | "" (bare tag: tag-full; tag@digest without this: reconcile error; sandbox: link-time digest) | Explicit manifest digest (sha256:...) of the full (skills/SRT) Python agent image. Forwarded as APP_FULL_IMAGE_DIGEST. When agentImage.tag is a bare tag, declarative skills agents use the tag-full image and this may be omitted. When agentImage.tag embeds a digest (tag@sha256:...), this value is required or reconciliation fails. The controller's link-time digest is not used for declarative skills agents. Sandbox agents use this when set, otherwise the link-time digest. | | controller.agentImage.pullPolicy | string | `""` | | | controller.agentImage.pullSecret | string | `""` | Image pull secret name set on agent pods created by the controller | | controller.agentImage.registry | string | `""` | | @@ -83,7 +84,8 @@ A Helm chart for kagent, built with Google ADK | controller.auth.userIdClaim | string | `""` | | | controller.env | list | `[]` | | | controller.envFrom | list | `[]` | | -| controller.goAgentImage | object | `{"pullPolicy":"","registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for the Go (ADK) runtime agent. | +| controller.goAgentImage | object | `{"fullDigest":"","pullPolicy":"","registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for the Go (ADK) runtime agent. | +| controller.goAgentImage.fullDigest | string | "" (bare tag: tag-full; tag@digest without this: reconcile error; sandbox: link-time digest) | Explicit manifest digest (sha256:...) of the full (skills/SRT) Go agent image. Forwarded as GOLANG_ADK_FULL_IMAGE_DIGEST. Same rules as agentImage.fullDigest: required when goAgentImage.tag embeds a digest, optional on a bare tag. | | controller.image.pullPolicy | string | `""` | | | controller.image.registry | string | `""` | | | controller.image.repository | string | `"kagent-dev/kagent/controller"` | | From 24c67b6c92773e2cab77817045f081f50562a42b Mon Sep 17 00:00:00 2001 From: Rachael Graham Date: Tue, 13 Oct 2026 18:15:53 -0500 Subject: [PATCH 2/2] 0.10.3 updates Signed-off-by: Rachael Graham --- .../kagent/0.x/introduction/installation.md | 22 +++++++++++++++++++ .../kagent/0.x/resources/tools-ecosystem.md | 1 + .../kagent/1.x/reference/tools-ecosystem.md | 8 ++++--- 3 files changed, 28 insertions(+), 3 deletions(-) diff --git a/docs-site/content/kagent/0.x/introduction/installation.md b/docs-site/content/kagent/0.x/introduction/installation.md index e7d9f6e5..9a8329b4 100644 --- a/docs-site/content/kagent/0.x/introduction/installation.md +++ b/docs-site/content/kagent/0.x/introduction/installation.md @@ -468,6 +468,28 @@ When unset, the `registry` and `pullPolicy` fields of `agentImage` and `goAgentI > **Note**: If you set only `agentImage` without also setting `controller.goAgentImage`, Go declarative agents still try to pull the Go ADK image from its default location, `ghcr.io`. The controller logs a startup warning when the two image registries differ. +#### Digest-pinned image tags + +Agents that declare skills, agents that set `declarative.executeCodeBlocks: true`, and BYO agents that run in a sandbox pull the full runtime image instead of the slim one. The controller derives the full image by appending `-full` to the tag name, because the slim and full images have separate manifests and cannot share a digest. + +When `agentImage.tag` or `goAgentImage.tag` embeds a digest, such as `0.10.3@sha256:...`, you must also set the matching `fullDigest` value. Without it, the controller fails reconciliation for every agent that needs the full image rather than falling back to a mutable tag. + +```yaml +controller: + agentImage: + registry: my-registry.example.com + repository: kagent/app + tag: 0.10.3@sha256: + fullDigest: sha256: + goAgentImage: + registry: my-registry.example.com + repository: kagent/golang-adk + tag: 0.10.3@sha256: + fullDigest: sha256: +``` + +When the tag is a bare tag, you can omit `fullDigest`, and the controller uses the published `-full` image. + ## Uninstallation Refer to the [Uninstall]({{< link path="operations/uninstall" >}}) guide. diff --git a/docs-site/content/kagent/0.x/resources/tools-ecosystem.md b/docs-site/content/kagent/0.x/resources/tools-ecosystem.md index 21b2751c..56c2f823 100644 --- a/docs-site/content/kagent/0.x/resources/tools-ecosystem.md +++ b/docs-site/content/kagent/0.x/resources/tools-ecosystem.md @@ -36,6 +36,7 @@ The following tools provide comprehensive cluster management. | `k8s_generate_resource` | Generate YAML for Istio, Gateway API, or Argo resources. | | `k8s_rollout` | Manage rollouts (restart, status, history). | | `k8s_scale` | Scale a resource (deployment, statefulset, etc.). | +| `k8s_wait` | Wait for a condition on resources, and block until the condition is met or the timeout elapses. | ### Helm diff --git a/docs-site/content/kagent/1.x/reference/tools-ecosystem.md b/docs-site/content/kagent/1.x/reference/tools-ecosystem.md index 15133ea9..1813ee54 100644 --- a/docs-site/content/kagent/1.x/reference/tools-ecosystem.md +++ b/docs-site/content/kagent/1.x/reference/tools-ecosystem.md @@ -13,7 +13,7 @@ Both servers arrive as subcharts of the kagent chart, and each one creates its o | RemoteMCPServer | Helm value | Serves | | --------------- | ---------- | ------ | -| [`kagent-tool-server`](#kagent-tool-server) | `kagent-tools.enabled` | 124 tools for Kubernetes, Helm, Istio, Cilium, Argo Rollouts, Prometheus, and Kubescape. | +| [`kagent-tool-server`](#kagent-tool-server) | `kagent-tools.enabled` | 126 tools for Kubernetes, Helm, Istio, Cilium, Argo Rollouts, Prometheus, and Kubescape. | | [`kagent-grafana-mcp`](#kagent-grafana-mcp) | `grafana-mcp.enabled` | Grafana's own MCP server, for dashboards, data sources, alerts, Loki logs, and incidents. | The kagent release pins the `kagent-tool-server` version, which is currently {{< reuse "kagent-docs/versions/kagent-tools.md" >}}. For the full set of pinned component versions, see [Version support]({{< link path="reference/versions#what-a-kagent-release-includes" >}}). @@ -73,6 +73,7 @@ Agents use the Kubernetes provider the most, and it covers both inspection and m | `k8s_get_available_api_resources` | Get available Kubernetes API resources. | | `k8s_get_cluster_configuration` | Get cluster configuration details. | | `k8s_generate_resource` | Generate a Kubernetes resource YAML from a description. | +| `k8s_wait` | Wait for a condition on Kubernetes resources (kubectl wait). Blocks until the condition is met or the timeout elapses. | | `k8s_apply_manifest` * | Apply a YAML manifest to the Kubernetes cluster. | | `k8s_create_resource` * | Create a Kubernetes resource from YAML content. | | `k8s_create_resource_from_url` * | Create a Kubernetes resource from a URL that points to a YAML manifest. | @@ -232,16 +233,17 @@ Kubescape's tools read scan results that the Kubescape operator has already prod ### Utilities -Two tools sit outside any product. `shell` runs an arbitrary command in the server's container with the server's ServiceAccount, so treat it as the widest permission that this server grants. +Three tools sit outside any product. `shell` runs an arbitrary command in the server's container with the server's ServiceAccount, so treat it as the widest permission that this server grants. | Tool | Description | | ---- | ----------- | | `datetime_get_current_time` | Return the current date and time in ISO 8601 format. | +| `mcp_inspect` | Echo input and return all HTTP headers received with the MCP request for debugging. | | `shell` * | Execute shell commands. | ## Narrow what kagent-tool-server serves -Serving all 124 tools costs an agent context on every turn, and it grants the server broad authority over your cluster. Two independent settings narrow it, and each one acts at a different layer. +Serving all 126 tools costs an agent context on every turn, and it grants the server broad authority over your cluster. Two independent settings narrow it, and each one acts at a different layer. ```yaml kagent-tools: