Add subagent related files by bigfluffycookie · Pull Request #25 · openops-cloud/helm-chart

bigfluffycookie · 2026-03-05T13:09:37Z

linear · 2026-03-05T13:09:40Z

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Resolve conflict in values.yaml: keep subagent configuration and new openopsEnvSecrets section. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-06T21:46:59Z

chart/templates/role-app-subagents.yaml

+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "openops.fullname" . }}-subagent-manager
+  namespace: {{ .Values.subagents.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "openops.componentLabels" (dict "root" . "component" "app") | nindent 4 }}
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.global.commonAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+rules:
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["create", "get", "list", "delete"]
+- apiGroups: [""]
+  resources: ["pods/log"]
+  verbs: ["get"]


The Role and RoleBinding for subagents are always created, even when subagents are disabled (OPS_SUBAGENTS_ENABLED: "false"). Other optional features in this chart (e.g., externalSecrets, serviceMonitor, limitRange, networkPolicy) are wrapped in a conditional guard like {{- if .Values.<feature>.enabled }}. These templates should be similarly guarded — for example, wrap the entire file content with {{- if eq (index .Values.openopsEnv "OPS_SUBAGENTS_ENABLED") "true" }} ... {{- end }}, or better yet, add an enabled field to the subagents section in values.yaml and use it here. Without this, every installation gets RBAC resources for a feature they may not use.

Copilot · 2026-03-06T21:46:59Z

chart/values.yaml

+  # Subagent configuration
+  OPS_SUBAGENTS_ENABLED: "false"
+  OPS_SUBAGENT_EXECUTOR_TYPE: "k8s"
+  OPS_SUBAGENT_K8S_NAMESPACE: "{{ .Release.Namespace }}"


OPS_SUBAGENT_K8S_NAMESPACE is hardcoded to {{ .Release.Namespace }}, but the RBAC resources (Role/RoleBinding) in role-app-subagents.yaml and rolebinding-app-subagents.yaml use {{ .Values.subagents.namespace | default .Release.Namespace }}. If a user sets subagents.namespace to a different namespace, the app will still try to create pods in .Release.Namespace (per this env var), but the RBAC permissions will be granted in the custom namespace — a mismatch that will cause permission errors. This should use the same logic, e.g., '{{ .Values.subagents.namespace | default .Release.Namespace }}' to stay consistent with the RBAC templates.

Suggested change

OPS_SUBAGENT_K8S_NAMESPACE: "{{ .Release.Namespace }}"

OPS_SUBAGENT_K8S_NAMESPACE: '{{ .Values.subagents.namespace | default .Release.Namespace }}'

Copilot · 2026-03-06T21:46:59Z

chart/values.yaml

+  OPS_SUBAGENT_S3_BUCKET: ""
+  OPS_SUBAGENT_S3_REGION: ""
+  OPS_SUBAGENT_S3_ENDPOINT: ""
+  OPS_SUBAGENT_RUNNER_IMAGE: "535002847982.dkr.ecr.us-east-2.amazonaws.com/openops/subagent-runner:main"


Two issues with this default image reference:

Private ECR registry: The image URL 535002847982.dkr.ecr.us-east-2.amazonaws.com is a private AWS ECR registry. Other images in this chart use the configurable image.repository (defaulting to public.ecr.aws/openops) or component-level repository overrides. External users won't be able to pull this image without ECR credentials. Consider following the chart's image repository convention or using the public registry as default.

Mutable :main tag: All other component images in this chart use pinned, immutable version tags (e.g., "0.2.17", "0.14.6", "18.1", or global.version). The chart's schema describes its purpose as ensuring "deterministic upgrades." Using :main means the image can change between deployments without any chart version change, leading to non-reproducible behavior. Consider pinning to a specific version tag.

Suggested change

OPS_SUBAGENT_RUNNER_IMAGE: "535002847982.dkr.ecr.us-east-2.amazonaws.com/openops/subagent-runner:main"

OPS_SUBAGENT_RUNNER_IMAGE: "public.ecr.aws/openops/subagent-runner:0.0.1-dev"

Copilot · 2026-03-06T21:47:00Z

chart/templates/rolebinding-app-subagents.yaml

+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "openops.fullname" . }}-subagent-manager
+  namespace: {{ .Values.subagents.namespace | default .Release.Namespace }}
+  labels:
+    {{- include "openops.componentLabels" (dict "root" . "component" "app") | nindent 4 }}
+    {{- with .Values.global.commonLabels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.global.commonAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "openops.fullname" . }}-subagent-manager
+subjects:
+- kind: ServiceAccount
+  name: {{ include "openops.serviceAccountName" (dict "root" . "component" "app") }}
+  namespace: {{ .Release.Namespace }}


Same as the Role template: this RoleBinding is always created regardless of whether subagents are enabled. It should be wrapped in a conditional guard (e.g., {{- if eq (index .Values.openopsEnv "OPS_SUBAGENTS_ENABLED") "true" }}) consistent with how other optional features in this chart gate their resources.

Copilot · 2026-03-06T21:47:00Z

chart/values.yaml

+  # Namespace where subagent pods run (defaults to same namespace as app)
+  namespace: ""


There are now two separate configuration points for the subagent namespace: subagents.namespace (used by RBAC templates) and OPS_SUBAGENT_K8S_NAMESPACE (used as an env var by the application). Having two independent settings for the same concept is error-prone — users could set one and forget the other, leading to mismatched RBAC permissions and application behavior. Consider deriving OPS_SUBAGENT_K8S_NAMESPACE from subagents.namespace (e.g., '{{ .Values.subagents.namespace | default .Release.Namespace }}') to have a single source of truth.

Suggested change

# Namespace where subagent pods run (defaults to same namespace as app)

namespace: ""

# Namespace where subagent pods run (defaults to the Helm release namespace)

namespace: "{{ .Release.Namespace }}"

bigfluffycookie added 2 commits March 5, 2026 13:55

Add subagent related files

d7cf53f

fix

722d922

Copilot AI review requested due to automatic review settings March 5, 2026 13:09

Copilot started reviewing on behalf of bigfluffycookie March 5, 2026 13:10 View session

bigfluffycookie and others added 3 commits March 5, 2026 14:29

fix

5b5f44a

clean

22f719c

Merge branch 'main' into lb/subagent

029b338

Copilot AI reviewed Mar 6, 2026

View reviewed changes

maor-rozenfeld and others added 2 commits March 6, 2026 22:39

Merge origin/main into lb/subagent

f9ad169

Resolve conflict in values.yaml: keep subagent configuration and new openopsEnvSecrets section. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Move S3 creds to the secrets

8e876a4

Copilot AI review requested due to automatic review settings March 6, 2026 21:41

Copilot started reviewing on behalf of maor-rozenfeld March 6, 2026 21:42 View session

Copilot AI reviewed Mar 6, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add subagent related files #25

Add subagent related files #25
bigfluffycookie wants to merge 7 commits intomainfrom
lb/subagent

bigfluffycookie commented Mar 5, 2026

Uh oh!

linear bot commented Mar 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Copilot AI Mar 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	OPS_SUBAGENT_K8S_NAMESPACE: "{{ .Release.Namespace }}"
	OPS_SUBAGENT_K8S_NAMESPACE: '{{ .Values.subagents.namespace \| default .Release.Namespace }}'

	OPS_SUBAGENT_RUNNER_IMAGE: "535002847982.dkr.ecr.us-east-2.amazonaws.com/openops/subagent-runner:main"
	OPS_SUBAGENT_RUNNER_IMAGE: "public.ecr.aws/openops/subagent-runner:0.0.1-dev"

		# Namespace where subagent pods run (defaults to same namespace as app)
		namespace: ""

Conversation

bigfluffycookie commented Mar 5, 2026

Uh oh!

linear bot commented Mar 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants