feat(a2a): add optional Bearer auth support for JWT-protected agents - #78
Open
nemerna wants to merge 5 commits into
Open
feat(a2a): add optional Bearer auth support for JWT-protected agents#78nemerna wants to merge 5 commits into
nemerna wants to merge 5 commits into
Conversation
A2AAgent accepts auth_token kwargs and AGENT_AUTH_TOKEN env, sending Authorization: Bearer on JSON-RPC requests. Backward compatible when unset. Adds unit tests and declares aiohttp as a runtime dependency (already used by the adapter). Harbor is listed under dev deps for test BaseAgent wiring.
Three related fixes surfaced while running A2AAgent against a real
JWT-protected, self-signed-cert A2A server (google-lightspeed-agent):
- message/send requests omitted configuration.blocking. Some A2A
servers return before the agent has finished processing when this
is unset, so the caller gets back an empty/partial result even
though the agent later completes successfully. Now sent as
configuration.blocking, defaulting to True (synchronous), and
overridable via the new `blocking` kwarg.
- Text message parts were sent as {"text": instruction}, omitting the
"kind" discriminator from the A2A Part schema. Now sent as
{"kind": "text", "text": instruction}.
- TLS verification was hardcoded to ssl=False (always skipped) in
_send_request. This is now configurable via a `verify_ssl` kwarg
(default True, i.e. secure by default), so users only opt out of
verification for endpoints with self-signed/internal certificates
instead of it being silently disabled for everyone.
…auth into pipeline verify_ssl now defaults to False again (matching the previously hardcoded ssl=False), since most internal OpenShift/Kubernetes Routes use self-signed certs and the earlier default of True would have broken existing external A2A endpoints with no way to opt back out. Also wires the new auth_token kwarg into the Konflux and monitoring Tekton tasks via an optional agent-auth-token-secret secretKeyRef (default name a2a-agent-credentials), so JWT-protected agents can be evaluated through the pipeline, not just via direct Harbor CLI usage. When the secret doesn't exist, no Authorization header is sent, so existing no-auth pipeline runs are unaffected.
The harbor package (added as a dev dependency for A2A adapter tests) requires Python >=3.12 on every published release, but CI was pinned to 3.11, causing `pip install -e ".[dev]"` to fail with no matching distribution found. Bumps CI, requires-python, ruff target-version, and docs/README badges to 3.12 for consistency.
CI runs both ruff check and ruff format --check; this file only satisfied the former.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds optional Bearer auth support to the A2A Harbor adapter for JWT-protected agents, plus TLS/blocking config fixes and pipeline wiring — all backward compatible with existing no-auth agents.
Changes
A2AAgent: new optionalauth_token(+AGENT_AUTH_TOKENenv fallback),blocking, andverify_sslkwargs;verify_ssldefaults toFalseto match prior hardcoded behaviormessage/sendpayload now sendsconfiguration.blockingand explicit"kind": "text"partsagent-auth-token-secretparam (defaulta2a-agent-credentials) sourced viasecretKeyRef, forwarded into the generated Harbor config only when setTest plan
pytest tests/test_a2a_adapter_auth.py tests/test_a2a_adapter_config.py— 15/15 passruff check— cleanyaml.safe_loadRelated