feat(kagent): OBO actor-token forwarding to muster via X-Actor-Token

helm/agentic-platform-connectivity/templates/kagent/agents/remotemcpservers.yaml

@@ -24,6 +24,13 @@ spec:
       type: Secret
       name: {{ $tokenSecretName | quote }}
       key: token
+{{- if $agent.obo.enabled }}
+  - name: X-Actor-Token
+    valueFrom:
+      type: Secret
+      name: {{ $tokenSecretName | quote }}
+      key: token
+{{- end }}
 {{- end }}
 {{- end }}
 {{- end }}

helm/agentic-platform-connectivity/values.yaml

@@ -811,9 +811,17 @@ agents:
         - describe_prompt
         - get_prompt
       # Request headers forwarded from the inbound A2A call onto muster tool calls.
-      # Set ["authorization"] to forward the human token for on-behalf-of (the STS
-      # plugin then exchanges it); leave [] for pure M2M.
+      # ["authorization"] forwards the caller's Dex token to muster on each tool call,
+      # making the caller the sub on localMint exchanges. Leave [] to disable forwarding.
       allowedHeaders: ["authorization"]
+      # OBO (on-behalf-of) mode: sends the agent SA's K8s OIDC token as X-Actor-Token
+      # on every request to muster, enabling RFC 8693 delegation (sub=user, act=SA).
+      # Requires allowedHeaders to include "authorization" AND a muster
+      # ActorDelegationPolicy that allows this SA to act for the subject issuers.
+      # M2M autonomous runs (no caller token) still work provided the muster broker
+      # has a self-delegation rule for this SA (actor=subject=SA is a valid grant).
+      obo:
+        enabled: true
       # Optional container resources for the agent Deployment.
       resources: {}
       # Optional extra env for the agent Deployment.

helm/agentic-platform/values.yaml

@@ -987,8 +987,16 @@ agents:
         - describe_prompt
         - get_prompt
       # Request headers forwarded from the inbound A2A call onto muster tool calls.
-      # Set ["authorization"] to forward the human token for on-behalf-of (the STS
-      # plugin then exchanges it); leave [] for pure M2M.
+      # ["authorization"] forwards the caller's Dex token to muster on each tool call.
+      # On its own this does not switch identity. It becomes the on-behalf-of subject
+      # only once muster's localMint backend runs the RFC 8693 exchange (sub=user) with
+      # the agent's ServiceAccount token as actor (act=sre-agent, carried as the
+      # X-Actor-Token header), minting a user-scoped backend token. That requires both
+      # (a) the kagent runtime override KAGENT_PROPAGATE_TOKEN_OVERRIDES_STATIC so the
+      # forwarded token beats the static M2M Authorization (kagent-dev/kagent#2087), and
+      # (b) a muster ActorDelegationPolicy letting the agent SA act for users. Until both
+      # land, sre-agent runs M2M only. With no caller token (autonomous runs) it always
+      # falls back to the static M2M token. Leave [] to disable forwarding.
       allowedHeaders: ["authorization"]
       # Optional container resources for the agent Deployment.
       resources: {}