[github-actions]

kagent-dev/kagent#3443 — fix: include image pull secrets in substrate worker pool service account

Docs versions: 1.x (first shipped in v1.0.0-rc1)

What changes for users: A chart-created Worker ServiceAccount now receives imagePullSecrets and global.imagePullSecrets, so Worker pods that use substrateWorkerPool.workerImage can pull from private or mirrored registries through the ServiceAccount. The chart merges duplicate Secret names, and an externally managed Worker ServiceAccount is unchanged.

What the docs now say: The Tune Agent Substrate page now explains how imagePullSecrets and global.imagePullSecrets apply to the Worker ServiceAccount, and warns readers to add pull secrets themselves when substrateWorkerPool.serviceAccount.create is false.

Not verified: No cluster API, Helm, or Hugo command was run in this sandbox; the configuration is unrun and internal links are unchecked.

How kagent-3443 was drafted, and what was not verified

• Code PR: fix: include image pull secrets in substrate worker pool service account kagent#3443
• Code issue: none linked
• Product: kagent (upstream) → kagent-dev/website
• Docs version: 1.x, first shipped in v1.0.0-rc1
• Category: scoped-edit / pr

Plan, and what changed it

• Planned: Add the Worker ServiceAccount image pull secret behavior to the page that already documents substrateWorkerPool.serviceAccount.
• Learned: The chart test in the code diff shows merged chart and global pull secrets, duplicate removal, and no change for externally managed Worker ServiceAccounts.
• Did: Documented the behavior in docs-site/content/kagent/1.x/operations/tune-agent-substrate.md.

Why a documentation change is necessary

The pull request adds the chart's imagePullSecrets helper to the Worker ServiceAccount template. The Tune Agent Substrate page already explains how the chart creates or references that ServiceAccount, but did not say how image pull secrets reach Workers or what happens when the ServiceAccount is external. A reader who mirrors the Worker image or uses a private registry needs to know whether to set chart values or update the external ServiceAccount.

What changed on disk

docs-site/content/kagent/1.x/operations/tune-agent-substrate.md — Added the image pull secret behavior to the Worker ServiceAccount section.

How to verify this change

1. Render the Worker ServiceAccount with a global image pull secret.

   helm template kagent ./helm/kagent \
     --namespace kagent \
     --set controller.serviceAccount.create=false \
     --set substrateWorkerPool.create=true \
     --set substrateWorkerPool.name=selected-pool \
     --set global.imagePullSecrets[0].name=mirror-auth \
     --show-only templates/controller-serviceaccount.yaml

   The rendered ServiceAccount named selected-pool shows imagePullSecrets with name: mirror-auth.
2. Render the Worker ServiceAccount with both chart-level and global pull secrets.

   helm template kagent ./helm/kagent \
     --namespace kagent \
     --set controller.serviceAccount.create=false \
     --set substrateWorkerPool.create=true \
     --set substrateWorkerPool.name=selected-pool \
     --set imagePullSecrets[0].name=local-auth \
     --set imagePullSecrets[1].name=shared-auth \
     --set global.imagePullSecrets[0].name=shared-auth \
     --set global.imagePullSecrets[1].name=mirror-auth \
     --show-only templates/controller-serviceaccount.yaml

   The rendered ServiceAccount shows local-auth, shared-auth, and mirror-auth once each.
3. Render with --set substrateWorkerPool.serviceAccount.create=false. The Worker ServiceAccount template renders no document, because the chart does not update the external ServiceAccount.

Proposed release note

Fixes the kagent Helm chart so a chart-created Agent Substrate Worker ServiceAccount receives chart-level and global image pull secrets. If you manage the Worker ServiceAccount outside the chart, add the pull secrets to that account.

What was not verified

• The configuration was not applied to a cluster, so every command in this diff is unrun.
• cluster-facts.md was used only as an API surface; nothing was applied to the provisioned cluster.
• Internal links are unchecked because Hugo was not run.

How the pages were chosen (triage report)

Draft a documentation change

kagent-dev/kagent#3443 — fix: include image pull secrets in substrate worker pool service account

• Product: kagent (upstream) → kagent-dev/website
• Docs version: 1.x
• Summary (read from the body): include kagent.imagePullSecrets in the substrateWorkerPool service account
• Not tested: a cluster was used only to dry-run the YAML manifests the draft added; prose, inline field paths and commands are unrun

Draft branch: pr-tracker-draft-kagent-3443

[Rachael-Graham]

Closing as folded into #652. The substrateWorkerPool.serviceAccount.create row on tune-agent-substrate.md now covers image pull secrets: a chart-created Worker ServiceAccount gets imagePullSecrets and global.imagePullSecrets with duplicates removed, and an externally managed account needs them added by hand. Checked against the chart at v1.0.0-rc1.