coderabbit review fixes

Signed-off-by: Ankit Kr. Chowdhury <rakesh856100@gmail.com>

Author: gitcommitankit

.agents/skills/agentrax-context/SKILL.md

@@ -21,7 +21,7 @@ description: Project context and settled architecture decisions for the Agentrax
 - **Autoscaling**: native `HorizontalPodAutoscaler` pointed at Prometheus Adapter custom metrics (`queueDepth` or `gpuUtilization`). No custom scaling loop. During active canary, the stable HPA is paused (deleted) and no canary HPA is created — autoscaling resumes only after promotion or rollback.
 - **Traffic splitting**: Gateway API `HTTPRoute` weighted backends. Not Istio, not ingress annotations.
 - **Network Isolation**: Two-tier Kubernetes `NetworkPolicy` (`allow-metrics-traffic` in `agentrax-system` allowing operator metrics on TCP 8443; `tenant-agent-isolation` rendered into every `tenant-*` namespace selecting agent pods with `agentrax.io/agent: "true"` for scraping on TCP 8080 and egress to API server/CoreDNS in `kube-system`). No service mesh.
-- **Cloud Workload Identity**: No static cloud credentials ever. Azure deployments use AKS Workload Identity (`azure.workload.identity/client-id` + `/tenant-id` ServiceAccount annotations; `azure.workload.identity/use: "true"` pod label). AWS deployments use IRSA (`eks.amazonaws.com/role-arn` annotation). Both are opt-in via `workloadIdentity.enabled` in `charts/agentrax/values.yaml`; disabled by default for on-premises portability.
+- **Cloud Workload Identity**: No static cloud credentials ever. Azure deployments use AKS Workload Identity (`azure.workload.identity/client-id` + `/tenant-id` ServiceAccount annotations; `azure.workload.identity/use: "true"` pod label). AWS deployments use IRSA (`eks.amazonaws.com/role-arn` annotation). In Helm deployments, both are opt-in via `workloadIdentity.enabled` in `charts/agentrax/values.yaml` (disabled by default for portability); in Kustomize deployments, AWS IRSA is activated via the `config/workload-identity/irsa-serviceaccount.yaml` strategic-merge patch.
 - **MCP registry**: embedded HTTP handler inside the operator process, backed by a `ConfigMap`. Not a separate Deployment, not a new database — HA storage is a v2 item.
 - **Non-goals**: no model training/fine-tuning, no general-purpose workload management, no service mesh, no UI in v1. Flag any drift toward these rather than quietly implementing them.
 

charts/agentrax/templates/serviceaccount.yaml

@@ -1,3 +1,21 @@
+{{- if .Values.workloadIdentity.enabled }}
+  {{- if not .Values.serviceAccount.create }}
+    {{- fail "workloadIdentity.enabled requires serviceAccount.create to be true so the required cloud identity annotations can be attached" }}
+  {{- end }}
+  {{- if not (has .Values.workloadIdentity.provider (list "azure" "aws")) }}
+    {{- fail (printf "workloadIdentity.provider must be either 'azure' or 'aws', got '%s'" .Values.workloadIdentity.provider) }}
+  {{- end }}
+  {{- if eq .Values.workloadIdentity.provider "azure" }}
+    {{- if or (not .Values.workloadIdentity.azureClientId) (not .Values.workloadIdentity.azureTenantId) }}
+      {{- fail "workloadIdentity.azureClientId and workloadIdentity.azureTenantId must be non-empty when provider is 'azure'" }}
+    {{- end }}
+  {{- end }}
+  {{- if eq .Values.workloadIdentity.provider "aws" }}
+    {{- if not .Values.workloadIdentity.awsRoleArn }}
+      {{- fail "workloadIdentity.awsRoleArn must be non-empty when provider is 'aws'" }}
+    {{- end }}
+  {{- end }}
+{{- end }}
 {{- if .Values.serviceAccount.create -}}
 apiVersion: v1
 kind: ServiceAccount

config/workload-identity/irsa-serviceaccount.yaml

@@ -25,7 +25,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: agentrax-controller-manager  # must match the name rendered by the Helm chart
+  name: agentrax-controller-manager  # Kustomize ServiceAccount name (Helm chart uses "agentrax" by default via workloadIdentity.awsRoleArn)
   namespace: agentrax-system
   annotations:
     # Replace this placeholder with the actual IAM role ARN before applying.

docs/ARCHITECTURE.md

@@ -340,9 +340,9 @@ Agentrax maintains a **two-tier network policy model**:
 
 ### 4.7 Keyless Cloud IAM — Workload Identity
 
-Agentrax requires cloud API access (e.g., Azure Container Registry pulls, AWS Secrets Manager reads) in production. Static credentials baked into `Secret` objects rotate manually, are visible in etcd, and create a long-lived blast radius if leaked.
+Agentrax and managed agent pods often require cloud API access (e.g., Azure Key Vault, Azure OpenAI, AWS Secrets Manager) in production. Note that private container image pulls (such as ACR) are handled independently at the node layer via AKS Kubelet Managed Identity (with the `AcrPull` role) or Kubernetes `imagePullSecrets`, while Workload Identity specifically covers runtime cloud SDK calls originating from running pods.
 
-The operator is instead bound to a cloud-managed identity at the pod level:
+Static credentials baked into `Secret` objects rotate manually, are visible in etcd, and create a long-lived blast radius if leaked. The operator and tenant agents are instead bound to a cloud-managed identity at the pod level:
 
 | Cloud   | Mechanism                       | How it works                                                                                                                           |
 | :------ | :------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------- |