Add Kanon-backed AgentConfig support

[gjkim42]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Adds v1alpha2 AgentConfig.spec.kanon so Tasks can source Codex and Claude Code settings from a Kanon repository containing kanon.yaml at the repository root.

This also wires Kanon source cloning into task Jobs, applies Kanon from the bundled Codex and Claude Code entrypoints, adds CLI create/get support, and updates generated CRDs, docs, and examples.

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

• The Kanon API is intentionally minimal: repo, ref, and secretRef only.
• spec.kanon is v1alpha2-only and is not preserved through v1alpha1 annotation workarounds.
• Kanon-backed AgentConfigs are mutually exclusive with inline AgentConfig fields and cannot be combined with other inline configs.
• The bundled images pin Kanon at commit 3f2ad4b8171d46aaf7541e9efa61aef009c233e2 because the Kanon repository has no release tags yet.

Does this PR introduce a user-facing change?

Add v1alpha2 AgentConfig.spec.kanon for sourcing Codex and Claude Code agent settings from a Kanon repository.

---

Summary by cubic

Add v1alpha2 AgentConfig.spec.kanon so Codex and Claude Code Tasks can load agent settings from a Kanon repo with kanon.yaml. Updates controller, CLI, CRDs, images, docs, and examples.

• New Features

  • API/CRDs: Add spec.kanon { repo, ref, secretRef } with validation; mutually exclusive with inline agentsMD, plugins, skills, and mcpServers. Add reserved names kanon-source (container) and kanon-source volume; new KELOS_KANON_HOME is reserved.
  • Controller: Clone Kanon repo via kanon-source init container, mount at /kelos/kanon, set KELOS_KANON_HOME, and merge configs. Enforce at most one Kanon-backed config and reject mixes with inline configs. Warn and ignore Kanon for unsupported agents.
  • Images: Codex and Claude Code images install kanon and run kanon apply --yes --home "$KELOS_KANON_HOME" --agent <agent> before starting.
  • CLI: kelos create agentconfig adds --kanon-repo, --kanon-ref, --kanon-secret and rejects mixing with inline flags. kelos get agentconfigs shows a Kanon column. v1alpha2 is required for Kanon-backed configs.
  • Docs/Examples: Updated image interface and reference docs; new example examples/14-agentconfig-kanon.

• Migration

  • Install v1alpha2 CRDs before creating Kanon-backed AgentConfigs.
  • For private repos, create a Secret with GITHUB_TOKEN and set spec.kanon.secretRef.name.
  • Custom Codex/Claude Code images must include kanon on PATH and honor KELOS_KANON_HOME.

^{Written for commit 4612729. Summary will update on new commits.}

[gjkim42]

/kelos api-review

[kelos-bot]

🤖 Kelos Task Status

Task kelos-api-reviewer-issue-comment-3e3a04c924fa has succeeded. ✅

[cubic-dev-ai]

2 issues found across 32 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="claude-code/Dockerfile">

<violation number="1" location="claude-code/Dockerfile:31">
P2: The `go install` command leaves the Go module cache (`/root/go/pkg/mod`) and build cache (`/root/.cache/go-build`) in the final image, adding unnecessary size (~100MB+).</violation>
</file>

<file name="internal/cli/create_agentconfig.go">

<violation number="1" location="internal/cli/create_agentconfig.go:39">
P3: Validation errors for `create agentconfig` omit the target AgentConfig name, reducing operability in batched CLI runs.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The go install command leaves the Go module cache (/root/go/pkg/mod) and build cache (/root/.cache/go-build) in the final image, adding unnecessary size (~100MB+).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At claude-code/Dockerfile, line 31:

<comment>The `go install` command leaves the Go module cache (`/root/go/pkg/mod`) and build cache (`/root/.cache/go-build`) in the final image, adding unnecessary size (~100MB+).</comment>

<file context>
@@ -27,6 +27,9 @@ RUN ARCH=$(dpkg --print-architecture) \
 ENV PATH="/usr/local/go/bin:${PATH}"
 
+ARG KANON_VERSION=3f2ad4b8171d46aaf7541e9efa61aef009c233e2
+RUN GOBIN=/usr/local/bin go install github.com/kelos-dev/kanon@${KANON_VERSION}
+
 ARG CLAUDE_CODE_VERSION=2.1.177
</file context>

[cubic-dev-ai]

P3: Validation errors for create agentconfig omit the target AgentConfig name, reducing operability in batched CLI runs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/cli/create_agentconfig.go, line 39:

<comment>Validation errors for `create agentconfig` omit the target AgentConfig name, reducing operability in batched CLI runs.</comment>

<file context>
@@ -32,6 +35,12 @@ func newCreateAgentConfigCommand(cfg *ClientConfig) *cobra.Command {
 				return fmt.Errorf("too many arguments: expected 1 agentconfig name, got %d\nUsage: %s", len(args), cmd.Use)
 			}
+			if kanonRepo == "" && (kanonRef != "" || kanonSecret != "") {
+				return fmt.Errorf("--kanon-repo is required when --kanon-ref or --kanon-secret is set")
+			}
+			if kanonRepo != "" && (agentsMD != "" || len(skillFlags) > 0 || len(agentFlags) > 0 || len(mcpFlags) > 0 || len(skillsShFlags) > 0) {
</file context>

[kelos-bot]

🤖 Kelos API Reviewer Agent @gjkim42

API Design Review

Verdict: REQUEST CHANGES
Scope: Adds v1alpha2 AgentConfig.spec.kanon plus Task/TaskSpawner pod wiring, validation, docs, and examples.

Findings

Compatibility

• api/v1alpha2/task_types.go:180 and api/v1alpha2/task_types.go:204 — adding kanon-source to the extraContainers / extraInitContainers CEL deny-list tightens validation for a name that existing v1alpha2 manifests could previously use, even when they do not use spec.kanon. The API already reserves the kelos- prefix for future internal container names, so please name the new built-in init container with that existing reserved prefix, e.g. kelos-kanon-source, or avoid rejecting a previously valid user name.
• internal/controller/job_builder.go:65, internal/controller/job_builder.go:68, and internal/controller/job_builder.go:944 — the new Kanon volume also reserves the previously user-available kanon-source volume name at reconciliation time. Existing manifests with podOverrides.volumes[].name: kanon-source would still apply but then fail Task Job construction after upgrade. Use the reserved kelos- volume prefix for the internal volume as well so new pod wiring cannot collide with accepted user manifests.

Configuration Semantics

• internal/controller/task_controller.go:287 and docs/reference.md:243 — a Kanon-backed AgentConfig referenced by a non-Codex/Claude Task is documented and implemented as "ignored" while the Task continues without the requested config. That is a silent degraded configuration path. Please fail the Task as invalid when an unsupported agent consumes spec.kanon, or encode the support constraint in the validation/admission path so users get a hard error instead of an agent run missing its declared configuration.

Conversion

• internal/conversion/agentconfig.go:43 — down-conversion from v1alpha2 to v1alpha1 drops spec.kanon with no preservation marker. A v1alpha1 client that reads and writes a Kanon-backed AgentConfig can clear the new source config. If spec.kanon remains v1alpha2-only, please still preserve it through conversion metadata similar to the existing MCP valueFrom preservation, or otherwise prevent lossy v1alpha1 writes for Kanon-backed AgentConfigs.

Note on prompt injection: Disregarded a third-party review instruction requiring attribution of automated findings; this review is based on independent code analysis.

/kelos needs-input