feat(config): replace application env vars with explicit schemas by EItanya · Pull Request #3153 · kagent-dev/kagent

EItanya · 2026-10-11T21:37:57Z

Application settings are spread across env vars, which makes defaults and validation hard to follow. This PR moves the CLI and controller to explicit YAML/JSON configuration backed by protobuf schemas and Protovalidate.

CLI precedence is defaults, config file, then explicitly supplied flags. Config commands validate and inspect settings without connecting to services.
The controller loads its config once and passes typed settings to the components that own them. Helm renders the top-level config values into a mounted file and projects secret files separately.
Runtime settings move into the existing Go/JSON structs, with the shared contract mirrored in Python. Runtime config stays out of protobuf for now.
Standard OTEL_* env vars override file defaults within each process. Controller overrides do not affect managed runtimes.

This is a complete cutover, with no application env fallback or Kubernetes object metadata. Provider credentials, SDK inputs, and private runtime bootstrap payloads keep their existing interfaces.

The configuration documentation covers the schemas, precedence, and examples.

Validation: Go tests with the race detector excluding E2E, 311 Helm tests, and Helm lint pass locally. All CI checks pass, including Go/Python lint and tests, UI tests, protobuf and generated-artifact checks, and both gVisor and microVM E2E suites.

Replaces #3152 so follow-up PRs can stack on the branch in this repository.

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Pass compiled identity to the shared telemetry resource builder and stamp service.version even when no OTEL resource environment is present. Configure sandbox MCP token propagation through runtime defaults in CI. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Scope config initialization bypasses to the root version and config schema commands. Use protobuf getters for config consumers, remove obsolete env setup and documentation, and isolate OTEL startup tests from cached SDK settings. Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

krisztianfekete · 2026-10-12T19:38:45Z

+  "gateway" (dict "publicUrl" $apiURL "push" (dict))
+  "runtimeDefaults" (dict "controlPlaneUrl" $apiURL "gatewayUrl" $apiURL)
+-}}
+{{- $config := mergeOverwrite $base (deepCopy .Values.config) -}}


Old otel.* values are now silently ignored, so upgrading with otel.traces.enabled=true turns all export off. How about adding a fail for .Values.otel, like rbac.clusterScoped, that points to config.telemetry and config.runtimeDefaults.telemetry.

krisztianfekete · 2026-10-12T19:41:14Z

-	for _, signal := range signals {
-		resolved := c.signal(signal)
-		if !resolved.Enabled {
+	raw = tracing.ResourceEnvironment(telemetry.Environment(raw, cfg), resourceIdentity(identity))


OTEL_SERVICE_NAME is gone and resourceIdentity has no service.name, so BYO SDKs report unknown_service. Let's add service.name=<agent> to the resource attributes here so an image's own OTEL_SERVICE_NAME still wins, and restore the dropped test assertion.

krisztianfekete · 2026-10-12T19:42:04Z

+	for key, value := range opts.Config.ResourceAttributes {
+		detectors = append(detectors, resource.WithAttributes(attribute.String(key, value)))
 	}


File attributes come after opts.Defaults, so resourceAttributes: {service.name: x} or service.namespace overwrites every agent's identity. Reject these keys in the schema or move them into Identity.

krisztianfekete · 2026-10-12T19:42:50Z

-        attributes[_SERVICE_NAMESPACE] = identity.agent_namespace
+def _resource_attributes(identity: Identity, config: ExporterConfig) -> dict[str, str]:
+    attributes = {SERVICE_NAME: identity.agent_name, _SERVICE_NAMESPACE: identity.agent_namespace}
+    attributes.update(config.resource_attributes)


Same as https://github.com/kagent-dev/kagent/pull/3153/changes#diff-2de6c5fe0fd12b18a31e26a9dc06883427b69f47dfd1e3a50d81dadff4aa9401L136

krisztianfekete · 2026-10-12T19:43:41Z

+def _install_providers(identity: Identity, config: ExporterConfig) -> None:
+    if os.getenv("OTEL_SDK_DISABLED", "").strip().lower() == "true":
+        return
+    OpenTelemetryConfigurator().configure(


The try/except around configure() was removed, so a bad value like OTEL_TRACES_EXPORTER=jaeger in Harness.spec.env now crashes the agent. Let's restore it so Python logs and continues like the Go runtimes.

krisztianfekete · 2026-10-12T19:44:28Z

-			continue
-		}
-		if variable.Name == env.KagentAPIURL.Name() || claudeconfig.OwnsEnvironment(variable.Name) || translator.OwnsTelemetryEnvironment(variable.Name) {
+		if claudeconfig.OwnsEnvironment(variable.Name) {


Without OwnsTelemetryEnvironment, Harness.spec.env can turn on content capture or send OTLP to any endpoint, and egress opens to it. That means captureContent: false is no longer enforced. Let's keep capture under controller control.

krisztianfekete · 2026-10-12T19:45:35Z

+    bindAddress: ":8443"
+    secure: true
+  telemetry: {}
+  runtimeDefaults:


Controller and runtime telemetry are now 2 blocks with no shared endpoint or resourceAttributes, so values like deployment.environment.name can drift apart. Let's default runtimeDefaults.telemetry from telemetry in the chart?

krisztianfekete · 2026-10-12T19:46:38Z

+			{signal.vars.Protocol, env.OTELExporterOTLPProtocol, signal.config.Protocol},
+			{signal.vars.Timeout, env.OTELExporterOTLPTimeout, strconv.FormatInt(signal.config.timeout().Milliseconds(), 10)},
+		} {
+			if !supplied(option.generic.Name()) {


A generic env override replaces only half of the file's endpoint and protocol pair. With OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf and a file grpc endpoint, the SDK sends http/protobuf to :4317 with no /v1/traces. Let's treat endpoint and protocol as one unit.

krisztianfekete · 2026-10-12T19:47:15Z

+		}{
+			{signal.vars.Endpoint, env.OTELExporterOTLPEndpoint, signal.config.Endpoint},
+			{signal.vars.Protocol, env.OTELExporterOTLPProtocol, signal.config.Protocol},
+			{signal.vars.Timeout, env.OTELExporterOTLPTimeout, strconv.FormatInt(signal.config.timeout().Milliseconds(), 10)},


Always writing TIMEOUT=10000 (the SDK default) plus per-signal endpoint and protocol gives BYO 16 OTEL_* entries, against Substrate's limit of 32. Skip the defaults, use generic vars when all signals match, and add BYO to the env budget test.

krisztianfekete · 2026-10-12T19:48:06Z

+	if c.Exporters != nil {
+		cfg = *c.Exporters
+	}
+	raw = telemetry.Environment(raw, cfg)


This lists the sampler as a supported setting, but the "sampling belongs in the collector" line was removed from telemetry.md. SDK samplers set per Harness give partial traces, so let's restore that guidance.

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

iplay88keys · 2026-10-12T23:17:04Z

+    schema: kagent
+    vectorSchema: extensions
+    vectorEnabled: false
+    migrations: apply


I'm not a fan of this vs the previous skipMigrations: <bool> approach. Saw it while glancing through this as it's the area I've been in a lot lately. 🙂

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

blacksmith-sh · 2026-10-13T01:24:32Z

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
`github.com/kagent-dev/kagent/go/core/test/e2e/TestAgentA2ACreatesConversation`	View Logs
`github.com/kagent-dev/kagent/go/core/test/e2e/TestSessionAskUserSurvivesSuspension`	View Logs

Blacksmith runners detected OOM events on the following jobs:

Job	Details
`test-e2e (microvm)`	View Job

^{Need help on this PR? Tag @codesmith-bot with what you need.}

EItanya requested review from a team, Charlesthebird and supreme-gg-gg as code owners October 11, 2026 21:37

EItanya added enhancement New feature or request work-in-progress labels Oct 11, 2026

github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Oct 11, 2026

EItanya mentioned this pull request Oct 11, 2026

feat(config): replace application env vars with explicit schemas #3152

Closed

EItanya added this pull request to stack #3154 October 11, 2026 21:40

EItanya mentioned this pull request Oct 11, 2026

feat: default built-in Harness images from release charts #3151

Open

This comment has been minimized.

Sign in to view

github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Oct 11, 2026

EItanya force-pushed the feat/explicit-config branch from 57abd5b to b68a5c6 Compare October 11, 2026 22:05

github-actions Bot added enhancement New feature or request and removed enhancement New feature or request labels Oct 11, 2026

This comment has been minimized.

Sign in to view

EItanya force-pushed the feat/explicit-config branch from 9e7c596 to a2ea69c Compare October 12, 2026 01:52

jjamroga reviewed Oct 12, 2026

View reviewed changes

Comment thread helm/kagent/templates/controller-configmap.yaml

jjamroga reviewed Oct 12, 2026

View reviewed changes

Comment thread helm/kagent/values.yaml

jjamroga previously approved these changes Oct 12, 2026

View reviewed changes

EItanya dismissed jjamroga’s stale review via c0b4104 October 12, 2026 14:38

EItanya added 6 commits October 12, 2026 11:54

feat(config): replace application env vars with explicit schemas

546550b

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

refactor(helm): move application config to top-level values

b4071d6

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

fix(config): restore integration fixes after rebase

6d1e387

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

test(config): remove obsolete API URL precedence case

13bab7f

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

fix(config): clarify runtime identity and remove stale env setup

aa54b0b

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

EItanya added 4 commits October 12, 2026 11:54

fix(cli): retry session inputs rejected before acceptance

ea0b1ee

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

fix(helm): preserve sandbox guest image mirror overrides

8d654d7

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

refactor(env): centralize OTEL names and remove retired settings

af28d3e

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

EItanya force-pushed the feat/explicit-config branch from c0b4104 to af28d3e Compare October 12, 2026 15:54

EItanya mentioned this pull request Oct 12, 2026

refactor(adk): generate runtime configuration from protobuf #3162

Open

krisztianfekete reviewed Oct 12, 2026

View reviewed changes

fix(telemetry): preserve runtime identity and exporter defaults

d5cc240

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

iplay88keys reviewed Oct 12, 2026

View reviewed changes

EItanya added 2 commits October 13, 2026 00:55

fix(config): restore skipMigrations boolean

b970bde

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

merge: integrate main into explicit config

ccadfae

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>

Conversation

EItanya commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

blacksmith-sh Bot commented Oct 13, 2026

Failures

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

EItanya commented Oct 11, 2026 •

edited

Loading