reference agents in other namespaces

[rinormaloku]

Summary

It is not possible to reference agents or tools in another namespace via the spec.declarative.tools.agent field in the Agent CRD. There is no namespace field, so cross-namespace tool sharing or delegation does not work.

Steps to Reproduce

1. Create Agent and tools in separate namespaces.
2. Attempt to have an agent reference a tool/agent in another namespace via the declarative tools.agent field.
3. Observe agent cannot access tools in other namespaces.

Configuration Example

apiVersion: kagent.dev/v1alpha2
kind: Agent
metadata:
  name: platform-support-agent
  namespace: platform-support-agent
spec:
  declarative:
    tools:
      - agent:
          apiGroup: kagent.dev
          kind: Agent
          name: k8s-agent  # no namespace option available

[peterj]

just adding a note here that we might want to filter out agents from other namespaces when configuring the agent (in the select tools & agents dialog)

[onematchfox]

Hey @peterj / @EItanya,

I'm thinking of looking into this in the close-ish future. I.e. I want to enable cross-namespace tool/agent references.

Has there been any prior discussion on the subject that I should be aware of? I seem to remember the CRDs previously supporting an object ref ${namespace}/${name} but can't remember why that was removed. - it might just be because we'd prefer separate fields for namespace/name, but I can also imagine there may have been security concerns regarding cross-namespace sharing of resources.

[EItanya]

Hey @peterj / @EItanya,

I'm thinking of looking into this in the close-ish future. I.e. I want to enable cross-namespace tool/agent references.

Has there been any prior discussion on the subject that I should be aware of? I seem to remember the CRDs previously supporting an object ref ${namespace}/${name} but can't remember why that was removed. - it might just be because we'd prefer separate fields for namespace/name, but I can also imagine there may have been security concerns regarding cross-namespace sharing of resources.

In terms of cross namespace references. As you noted in #1136, we don't do ${namespace}/${name} anymore, but we use explicit structs with name+namespace. Cross namespace sharing of Agents should be safe to do as there are no secrets involved.