From ec985e0553e5557a4288de95fb950ca31d6b4e63 Mon Sep 17 00:00:00 2001 From: Benjamin Borbe Date: Thu, 9 Jul 2026 13:39:46 +0200 Subject: [PATCH 1/4] feat(helm): pass JOB_KAFKA_*_CERT_SECRET to executor so spawned Jobs get mTLS certs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When executor.kafkaUser.enabled, hand the executor its own client-cert + CA secret names via JOB_KAFKA_CLIENT_CERT_SECRET / JOB_KAFKA_CA_CERT_SECRET so it mounts mTLS Kafka certs into the per-task agent Jobs it spawns. Default off → no env, spawned Jobs byte-identical. Chart 0.4.1 -> 0.5.0. --- CHANGELOG.md | 4 ++++ helm/Chart.yaml | 2 +- helm/templates/executor-deployment.yaml | 12 ++++++++++++ 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index d8e1c3c..15a2f8c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ Please choose versions by [Semantic Versioning](http://semver.org/). * MINOR version when you add functionality in a backwards-compatible manner, and * PATCH version when you make backwards-compatible bug fixes. +## Unreleased + +- helm: when `executor.kafkaUser.enabled`, pass the executor's own client-cert + CA secret names to the executor as `JOB_KAFKA_CLIENT_CERT_SECRET` / `JOB_KAFKA_CA_CERT_SECRET` env, so it mounts mTLS Kafka certs into the per-task agent Jobs it spawns (agent-task-executor ≥ v0.4.0). Fixes spawned agent Jobs (pr-reviewer, github-releaser) crashing on `open /client-cert/file: no such file` against mTLS Kafka. Default off (`kafkaUser` disabled) → no env, spawned Jobs unchanged. Chart 0.4.1 → 0.5.0. + ## v0.76.1 - helm: harden mTLS cert volume `defaultMode` `420` (0644) → `288` (0440) — drops world-read on the mounted client key while keeping group-read so a non-root pod (`runAsUser`+`fsGroup`) can still read it (`0400` would deny it). Chart 0.4.0 → 0.4.1. Matches the `bborbe/maintainer` chart fix. diff --git a/helm/Chart.yaml b/helm/Chart.yaml index 7b3f1e3..de100cc 100644 --- a/helm/Chart.yaml +++ b/helm/Chart.yaml @@ -3,7 +3,7 @@ name: agent description: bborbe agent framework — event-driven, Kafka-based, K8s-native task platform (controller, executor, and example agents) type: application # Chart version — bumped on chart changes, independent of appVersion. -version: 0.4.1 +version: 0.5.0 # Default image tag for the framework components when values don't override. appVersion: "0.3.1" home: https://github.com/bborbe/agent diff --git a/helm/templates/executor-deployment.yaml b/helm/templates/executor-deployment.yaml index bfe8eba..7f0314d 100644 --- a/helm/templates/executor-deployment.yaml +++ b/helm/templates/executor-deployment.yaml @@ -77,6 +77,18 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace + {{- if .Values.executor.kafkaUser.enabled }} + {{- $ku := .Values.executor.kafkaUser }} + {{- $userName := $ku.userName | default (printf "%s-agent-task-executor" (include "agent.namespace" .)) }} + # mTLS Kafka: the spawned agent Jobs also connect Kafka, so hand the + # executor its own client-cert + CA secret names to mount into each Job + # (agent-task-executor >= v0.4.0 JOB_KAFKA_* support). Empty when kafkaUser + # is disabled → plaintext, spawned Jobs unchanged. + - name: JOB_KAFKA_CLIENT_CERT_SECRET + value: {{ $ku.clientSecret | default $userName | quote }} + - name: JOB_KAFKA_CA_CERT_SECRET + value: {{ $ku.caCertSecret | default "my-cluster-cluster-ca-cert" | quote }} + {{- end }} ports: - containerPort: 9090 name: http From 561b05e2c751f08d12bccce5f68238496422486a Mon Sep 17 00:00:00 2001 From: Benjamin Borbe Date: Thu, 9 Jul 2026 13:49:53 +0200 Subject: [PATCH 2/4] chore: bump Go 1.26.4->1.26.5 (clear stdlib advisory GO-2026-5856 blocking CI) --- CHANGELOG.md | 1 + go.mod | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 15a2f8c..31aafd5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ Please choose versions by [Semantic Versioning](http://semver.org/). ## Unreleased - helm: when `executor.kafkaUser.enabled`, pass the executor's own client-cert + CA secret names to the executor as `JOB_KAFKA_CLIENT_CERT_SECRET` / `JOB_KAFKA_CA_CERT_SECRET` env, so it mounts mTLS Kafka certs into the per-task agent Jobs it spawns (agent-task-executor ≥ v0.4.0). Fixes spawned agent Jobs (pr-reviewer, github-releaser) crashing on `open /client-cert/file: no such file` against mTLS Kafka. Default off (`kafkaUser` disabled) → no env, spawned Jobs unchanged. Chart 0.4.1 → 0.5.0. +- chore: bump Go 1.26.4 → 1.26.5 to clear stdlib advisory GO-2026-5856 (blocks precommit/CI). ## v0.76.1 diff --git a/go.mod b/go.mod index 1638a3b..9c88b4f 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/bborbe/agent -go 1.26.4 +go 1.26.5 require ( github.com/bborbe/collection v1.20.17 From 1ced155340bcb3fe1a1abd410549d526d6251960 Mon Sep 17 00:00:00 2001 From: Benjamin Borbe Date: Thu, 9 Jul 2026 14:01:11 +0200 Subject: [PATCH 3/4] chore: trivy-ignore unmaintained-openpgp advisory GO-2026-5932 (indirect, no fix) --- .trivyignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.trivyignore b/.trivyignore index 31440c6..fb206e0 100644 --- a/.trivyignore +++ b/.trivyignore @@ -7,3 +7,6 @@ CVE-2026-41568 # go.etcd.io/bbolt v1.4.3 dep, no fix available CVE-2026-33817 + +# golang.org/x/crypto/openpgp unmaintained, no fix (indirect, unreachable) +GO-2026-5932 From 19e3579e8ea4cb62984429a8861135d2ed6ed1f4 Mon Sep 17 00:00:00 2001 From: Benjamin Borbe Date: Thu, 9 Jul 2026 14:15:13 +0200 Subject: [PATCH 4/4] helm: JOB_KAFKA_CA_CERT_SECRET falls through to values default (drop duplicated literal) Address PR review: values.yaml already defaults executor.kafkaUser.caCertSecret to my-cluster-cluster-ca-cert, so the inline template default was redundant. --- helm/templates/executor-deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/helm/templates/executor-deployment.yaml b/helm/templates/executor-deployment.yaml index 7f0314d..0de4fb4 100644 --- a/helm/templates/executor-deployment.yaml +++ b/helm/templates/executor-deployment.yaml @@ -87,7 +87,7 @@ spec: - name: JOB_KAFKA_CLIENT_CERT_SECRET value: {{ $ku.clientSecret | default $userName | quote }} - name: JOB_KAFKA_CA_CERT_SECRET - value: {{ $ku.caCertSecret | default "my-cluster-cluster-ca-cert" | quote }} + value: {{ $ku.caCertSecret | quote }} {{- end }} ports: - containerPort: 9090