Skip to content

feat(skills-init): add securityContext + resources configuration to i… #1539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
EItanya merged 3 commits into from
Apr 6, 2026
Merged

feat(skills-init): add securityContext + resources configuration to i… #1539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
abd031b
feat(skills-init): add securityContext + resources configuration to i…
jholt96 Mar 25, 2026
4377b3d
remove SecurityContext Changes and add env + resource Configuration f…
jholt96 Apr 5, 2026
e3327bd
formatting
jholt96 Apr 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
223 changes: 223 additions & 0 deletions go/api/config/crd/bases/kagent.dev_agents.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10217,6 +10217,229 @@ spec:
maxItems: 20
minItems: 1
type: array
initContainer:
description: Configuration for the skills-init init container.
properties:
env:
description: Additional environment variables for the skills-init
init container.
items:
description: EnvVar represents an environment variable present
in a Container.
properties:
name:
description: |-
Name of the environment variable.
May consist of any printable ASCII characters except '='.
type: string
value:
description: |-
Variable references $(VAR_NAME) are expanded
using the previously defined environment variables in the container and
any service environment variables. If a variable cannot be resolved,
the reference in the input string will be unchanged. Double $$ are reduced
to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e.
"$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)".
Escaped references will never be expanded, regardless of whether the variable
exists or not.
Defaults to "".
type: string
valueFrom:
description: Source for the environment variable's value.
Cannot be used if value is not empty.
properties:
configMapKeyRef:
description: Selects a key of a ConfigMap.
properties:
key:
description: The key to select.
type: string
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
optional:
description: Specify whether the ConfigMap or
its key must be defined
type: boolean
required:
- key
type: object
x-kubernetes-map-type: atomic
fieldRef:
description: |-
Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['<KEY>']`, `metadata.annotations['<KEY>']`,
spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs.
properties:
apiVersion:
description: Version of the schema the FieldPath
is written in terms of, defaults to "v1".
type: string
fieldPath:
description: Path of the field to select in
the specified API version.
type: string
required:
- fieldPath
type: object
x-kubernetes-map-type: atomic
fileKeyRef:
description: |-
FileKeyRef selects a key of the env file.
Requires the EnvFiles feature gate to be enabled.
properties:
key:
description: |-
The key within the env file. An invalid key will prevent the pod from starting.
The keys defined within a source may consist of any printable ASCII characters except '='.
During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters.
type: string
optional:
default: false
description: |-
Specify whether the file or its key must be defined. If the file or key
does not exist, then the env var is not published.
If optional is set to true and the specified key does not exist,
the environment variable will not be set in the Pod's containers.

If optional is set to false and the specified key does not exist,
an error will be returned during Pod creation.
type: boolean
path:
description: |-
The path within the volume from which to select the file.
Must be relative and may not contain the '..' path or start with '..'.
type: string
volumeName:
description: The name of the volume mount containing
the env file.
type: string
required:
- key
- path
- volumeName
type: object
x-kubernetes-map-type: atomic
resourceFieldRef:
description: |-
Selects a resource of the container: only resources limits and requests
(limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported.
properties:
containerName:
description: 'Container name: required for volumes,
optional for env vars'
type: string
divisor:
anyOf:
- type: integer
- type: string
description: Specifies the output format of
the exposed resources, defaults to "1"
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
resource:
description: 'Required: resource to select'
type: string
required:
- resource
type: object
x-kubernetes-map-type: atomic
secretKeyRef:
description: Selects a key of a secret in the pod's
namespace
properties:
key:
description: The key of the secret to select
from. Must be a valid secret key.
type: string
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
optional:
description: Specify whether the Secret or its
key must be defined
type: boolean
required:
- key
type: object
x-kubernetes-map-type: atomic
type: object
required:
- name
type: object
type: array
resources:
description: Resource requirements for the skills-init init
container.
properties:
claims:
description: |-
Claims lists the names of resources, defined in spec.resourceClaims,
that are used by this container.

This field depends on the
DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.
items:
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
properties:
name:
description: |-
Name must match the name of one entry in pod.spec.resourceClaims of
the Pod where this field is used. It makes that resource available
inside a container.
type: string
request:
description: |-
Request is the name chosen for a request in the referenced claim.
If empty, everything from the claim is made available, otherwise
only the result of this request.
type: string
required:
- name
type: object
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
limits:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Limits describes the maximum amount of compute resources allowed.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
requests:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Requests describes the minimum amount of compute resources required.
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
otherwise to an implementation-defined value. Requests cannot exceed Limits.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
type: object
insecureSkipVerify:
description: |-
Fetch images insecurely from registries (allowing HTTP and skipping TLS verification).
Expand Down
15 changes: 15 additions & 0 deletions go/api/v1alpha2/agent_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,21 @@ type SkillForAgent struct {
// +kubebuilder:validation:MinItems=1
// +optional
GitRefs []GitRepo `json:"gitRefs,omitempty"`

// Configuration for the skills-init init container.
// +optional
InitContainer *SkillsInitContainer `json:"initContainer,omitempty"`
}

// SkillsInitContainer configures the skills-init init container.
type SkillsInitContainer struct {
// Resource requirements for the skills-init init container.
// +optional
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

// Additional environment variables for the skills-init init container.
// +optional
Env []corev1.EnvVar `json:"env,omitempty"`
}

// GitRepo specifies a single Git repository to fetch skills from.
Expand Down
32 changes: 32 additions & 0 deletions go/api/v1alpha2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

17 changes: 15 additions & 2 deletions go/core/internal/controller/translator/agent/adk_api_translator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -471,7 +471,17 @@ func (a *adkApiTranslator) buildManifest(
sharedEnv = append(sharedEnv, skillsEnv)

insecure := agent.Spec.Skills != nil && agent.Spec.Skills.InsecureSkipVerify
container, skillsVolumes, err := buildSkillsInitContainer(gitRefs, gitAuthSecretRef, skills, insecure, dep.SecurityContext)

var initResources *corev1.ResourceRequirements
var initEnv []corev1.EnvVar
if agent.Spec.Skills.InitContainer != nil {
if agent.Spec.Skills.InitContainer.Resources != nil {
initResources = agent.Spec.Skills.InitContainer.Resources.DeepCopy()
}
initEnv = append(initEnv, agent.Spec.Skills.InitContainer.Env...)
}

container, skillsVolumes, err := buildSkillsInitContainer(gitRefs, gitAuthSecretRef, skills, insecure, dep.SecurityContext, initEnv, getDefaultResources(initResources))
if err != nil {
return nil, fmt.Errorf("failed to build skills init container: %w", err)
}
Expand Down Expand Up @@ -1752,6 +1762,8 @@ func buildSkillsInitContainer(
ociRefs []string,
insecureOCI bool,
securityContext *corev1.SecurityContext,
env []corev1.EnvVar,
resources corev1.ResourceRequirements,
) (container corev1.Container, volumes []corev1.Volume, err error) {
data, err := prepareSkillsInitData(gitRefs, authSecretRef, ociRefs, insecureOCI)
if err != nil {
Expand All @@ -1761,7 +1773,6 @@ func buildSkillsInitContainer(
if err != nil {
return corev1.Container{}, nil, err
}

initSecCtx := securityContext
if initSecCtx != nil {
initSecCtx = initSecCtx.DeepCopy()
Expand Down Expand Up @@ -1794,6 +1805,8 @@ func buildSkillsInitContainer(
Command: []string{"/bin/sh", "-c", script},
VolumeMounts: volumeMounts,
SecurityContext: initSecCtx,
Env: env,
Resources: resources,
}

return container, volumes, nil
Expand Down
Loading
Loading