[braghettos]

Security priority. On a failed kubectl call the per-user tool path returned the user's JWT in the tool result ([kagent-dev/tools#107]). All 98 stored tokens were already expired; its owner redacts the session store separately.

What changes

• kagent 0.1.20 → 0.1.22. The per-user tool server now comes from a private krateo-agentiko package pinned by digest only — ghcr.io/krateo-agentiko/kagent-tools@sha256:6308035d…230c — under the new key perUserRbac.toolImage. There is no tag field at all, so no stale tag can win over the digest, which is the trap that defeated the ClickHouse digest pin.
• inst.privateImageComponents gains {name: kagent, path: [perUserRbac, toolImagePullSecrets]}, so the existing registryAuth-derived dockerconfigjson pulls the private image with no manual ServiceAccount patch.

repository and digest are deliberately not set in componentValues: the chart default is the pin, and a second source would recreate the stale-value hazard this design removes.

Why 0.1.21 is skipped — the point of this commit

0.1.21 carried the pull secret inside toolImage, whose schema requires [repository, digest]. crdgen preserves chart required into the composition CRD — verified with krateo-audit-worm as a control, whose 5 chart-level blocks appear verbatim as .spec.* required in both served versions — and the image-pull injection creates each parent object while setting only the leaf:

{{- range $seg := (initial $ip.path) }} ... set $cur $seg (index $cur $seg | default dict) ...
{{- if not (hasKey $cur $leaf) }}{{- $_ := set $cur $leaf (list (dict "name" $ipsName)) }}

So the installer would have written toolImage: {pullSecrets: [...]} with neither required sibling, and the apiserver would have rejected the Kagent CR outright on any cluster with registryAuth enabled — which includes 057. Its owner moved the key to the sibling toolImagePullSecrets in 0.1.22 so the injection never touches toolImage.

Checked before pinning

check	result
injected shape vs 0.1.22's schema	{enabled: true, toolImagePullSecrets: [{name: krateo-registry-image-pull}]} — no unknown keys, satisfies item required: [name], does not construct toolImage
root required / perUserRbac required	none / none — cannot wedge the umbrella
credential coverage	057's krateo-registry-image-pull already covers host ghcr.io, the same host as the new package; inst.imagePullAuths dedupes one auths entry per host
componentValues widening	not needed — the injection writes onto the composition spec after the merge, validated by the component's own crdgen CRD
0.1.22 present at the registry	yes (0.1.21 present as control, 9.9.9 absent as negative)
other pins	85 asserted byte-identical
privateImageComponents	parses to exactly 8 entries, every pre-existing path unchanged

One mistake worth recording: the first attempt at the helper edit matched a prefix of the agentgateway-policies uiTokenHop entry and spliced the new block in front of its - image/- pullSecrets lines, orphaning them onto kagent and corrupting both entries. Caught by parsing the rendered YAML rather than trusting the diff, then re-anchored on the following entry.

🤖 Generated with Claude Code

https://claude.ai/code/session_016RAxvmbdtWAFW9j2vWsv7a