Review comments kagent-dev#941

Signed-off-by: Dmytro Rashko <dmitriy.rashko@amdocs.com>

Author: dimetron

go/config/rbac/role.yaml

@@ -4,6 +4,20 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -12,6 +26,18 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - kagent.dev
   resources:

go/internal/controller/agent_controller.go

@@ -54,6 +54,10 @@ type AgentController struct {
 // +kubebuilder:rbac:groups=kagent.dev,resources=agents,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=kagent.dev,resources=agents/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=kagent.dev,resources=agents/finalizers,verbs=update
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
 
 func (r *AgentController) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	_ = log.FromContext(ctx)

go/internal/controller/modelconfig_controller.go

@@ -50,6 +50,7 @@ type ModelConfigController struct {
 // +kubebuilder:rbac:groups=kagent.dev,resources=modelconfigs,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=kagent.dev,resources=modelconfigs/status,verbs=get;update;patch
 // +kubebuilder:rbac:groups=kagent.dev,resources=modelconfigs/finalizers,verbs=update
+// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch
 
 func (r *ModelConfigController) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	_ = log.FromContext(ctx)

helm/kagent/templates/controller-deployment.yaml

@@ -73,8 +73,10 @@ spec:
             - {{ coalesce .Values.controller.agentImage.tag .Values.tag .Chart.Version  }}
             - -image-pull-policy
             - {{ .Values.controller.agentImage.pullPolicy | default .Values.imagePullPolicy }}
+            {{- if and .Values.controller.agentImage.pullSecret (not (eq .Values.controller.agentImage.pullSecret "")) }}
             - -image-pull-secret
             - {{ .Values.controller.agentImage.pullSecret | default "" }}
+            {{- end }}
           securityContext:
             {{- toYaml .Values.controller.securityContext | nindent 12 }}
           image: "{{ .Values.controller.image.registry | default .Values.registry  }}/{{ .Values.controller.image.repository }}:{{ coalesce .Values.tag .Values.controller.image.tag .Chart.Version }}"

helm/kagent/tests/controller-deployment_test.yaml

@@ -84,6 +84,32 @@ tests:
       - contains:
           path: spec.template.spec.containers[0].args
           content: "debug"
+  - it: should use controller.agentImage.pullSecret when set
+    template: controller-deployment.yaml
+    set:
+      controller:
+        agentImage:
+          pullSecret: "pull-secret"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "-image-pull-secret"
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "pull-secret"
+  - it: should not use controller.agentImage.pullSecret when not set
+    template: controller-deployment.yaml
+    set:
+      controller:
+        agentImage:
+          pullSecret: ""
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: "-image-pull-secret"
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: "pull-secret"
 
   - it: should configure watch namespaces
     template: controller-deployment.yaml