Merge branch 'main' into fix/azure-openai-config-params

Author: mesutoezdil

go/.dockerignore

@@ -1,6 +1,8 @@
 # Build artifacts
 ./bin/
 bin/
+.cache/
+**/.cache/
 
 # Test files
 *_test.go
@@ -45,4 +47,4 @@ PROJECT
 hack/
 
 # Makefiles
-Makefile
+Makefile

go/core/internal/controller/reconciler/reconciler.go

@@ -1127,8 +1127,9 @@ func (a *kagentReconciler) createMcpTransport(ctx context.Context, s *v1alpha2.R
 		}, nil
 	default:
 		return &mcp.StreamableClientTransport{
-			Endpoint:   endpoint,
-			HTTPClient: httpClient,
+			Endpoint:             endpoint,
+			HTTPClient:           httpClient,
+			DisableStandaloneSSE: true,
 		}, nil
 	}
 }
@@ -1187,7 +1188,11 @@ func (a *kagentReconciler) buildRemoteMCPServerTLSConfig(ctx context.Context, s
 // so we need to create a custom HTTP client that adds headers to all
 // requests. When tlsConfig is non-nil it's installed on a cloned
 // transport so tool discovery honors RemoteMCPServer.spec.tls.
-func newHTTPClient(headers map[string]string, timeout time.Duration, tlsConfig *tls.Config) *http.Client {
+func newHTTPClient(
+	headers map[string]string,
+	timeout time.Duration,
+	tlsConfig *tls.Config,
+) *http.Client {
 	var base = http.DefaultTransport
 	if tlsConfig != nil {
 		// Clone the default transport to preserve its dial/keepalive

go/core/test/e2e/remotemcpserver_tls_test.go

@@ -26,6 +26,7 @@ import (
 	"encoding/json"
 	"encoding/pem"
 	"fmt"
+	"io"
 	"math/big"
 	"net"
 	"net/http"
@@ -544,6 +545,76 @@ func TestE2E_API_ToolServerCompanionSecrets(t *testing.T) {
 	assert.Equal(t, v1alpha2.GroupVersion.Identifier(), or.APIVersion)
 }
 
+// TestE2E_RemoteMCPServer_STREAMABLE_HTTP_WITH_STANDALONE_SSE reproduces
+// github.com/kagent-dev/kagent/issues/1955: a Streamable HTTP server that
+// holds the GET (standalone SSE) channel open without responding causes the
+// reconciler's tool discovery to fail when http.Client.Timeout fires and
+// marks the connection failed before tools/list can complete.
+func TestE2E_RemoteMCPServer_STREAMABLE_HTTP_WITH_STANDALONE_SSE(t *testing.T) {
+	cli := setupK8sClient(t, false)
+	mcp := setupMockMCP(t, false, mockmcp.Options{})
+
+	// mockmcp.Start() returns the bind address (e.g. http://[::]:PORT) which
+	// is not dialable from the proxy process itself. Extract the port and
+	// forward to 127.0.0.1 so the proxy can reach mockmcp locally.
+	_, mcpPort, err := net.SplitHostPort(mcp.server.Addr().String())
+	require.NoError(t, err)
+	localMCPURL := "http://127.0.0.1:" + mcpPort + mockmcp.MCPPath
+
+	// Start a server that accepts GET but never responds — simulating a
+	// spec-compliant MCP server that holds the standalone SSE channel open
+	// without sending events. POST requests are forwarded to mockmcp so
+	// initialize/tools-list work normally.
+	ln, err := net.Listen("tcp", ":0")
+	require.NoError(t, err)
+	hangingServer := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.Method == http.MethodGet {
+				// Block without writing anything back. client.Do in connectSSE
+				// blocks here until http.Client.Timeout fires, marking the
+				// connection failed and causing tools/list to fail.
+				<-r.Context().Done()
+				return
+			}
+			proxyReq, err := http.NewRequestWithContext(r.Context(), r.Method, localMCPURL, r.Body)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusBadGateway)
+				return
+			}
+			proxyReq.Header = r.Header.Clone()
+			resp, err := http.DefaultTransport.RoundTrip(proxyReq)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusBadGateway)
+				return
+			}
+			defer resp.Body.Close()
+			for k, vs := range resp.Header {
+				for _, v := range vs {
+					w.Header().Add(k, v)
+				}
+			}
+			w.WriteHeader(resp.StatusCode)
+			io.Copy(w, resp.Body)
+		}),
+	}
+	go hangingServer.Serve(ln)
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		_ = hangingServer.Shutdown(ctx)
+	})
+
+	timeout := metav1.Duration{Duration: 5 * time.Second}
+	rms := createRMS(t, cli, v1alpha2.RemoteMCPServerSpec{
+		URL:      buildK8sURL("http://" + ln.Addr().String()),
+		Protocol: v1alpha2.RemoteMCPServerProtocolStreamableHttp,
+		Timeout:  &timeout,
+	})
+
+	assert.NotEmpty(t, rms.Status.DiscoveredTools,
+		"tool discovery must succeed even when the server holds the GET SSE channel open")
+}
+
 // recordedPaths is a small helper for assertion failure messages — turns
 // the request recorder's snapshot into a human-readable list of paths
 // when an expected request doesn't show up.

helm/kagent/templates/_helpers.tpl

@@ -143,6 +143,33 @@ Check if leader election should be enabled (more than 1 replica)
 {{- gt (.Values.controller.replicas | int) 1 -}}
 {{- end -}}
 
+{{/*
+Extract the TCP port from controller.metrics.bindAddress.
+
+Anchors the digit run to the end of the string so every Go-style
+address form the controller binary accepts is handled correctly: bare
+":port", host-qualified "host:port", and bracketed IPv6 "[::1]:port"
+all yield the trailing port. Returns "0" or "" when the binary's
+disable sentinel is in use; callers must consult
+`kagent.controller.metricsEnabled` before rendering manifests.
+*/}}
+{{- define "kagent.controller.metricsPort" -}}
+{{- regexFind "[0-9]+$" (.Values.controller.metrics.bindAddress | toString) -}}
+{{- end -}}
+
+{{/*
+Returns "1" when the controller metrics resources (Service, RBAC,
+container port, env vars) should render, empty otherwise. Honours both
+disable signals: `controller.metrics.enabled=false` and the binary's
+own `--metrics-bind-address=0` sentinel reached through `bindAddress`.
+The two are equivalent so the field name keeps faith with the binary's
+documented contract (see go/core/pkg/app/app.go).
+*/}}
+{{- define "kagent.controller.metricsEnabled" -}}
+{{- $port := include "kagent.controller.metricsPort" . -}}
+{{- if and .Values.controller.metrics.enabled $port (ne $port "0") -}}1{{- end -}}
+{{- end -}}
+
 {{/*
 PostgreSQL service name for the bundled postgres instance
 */}}

helm/kagent/templates/controller-deployment.yaml

@@ -84,6 +84,12 @@ spec:
             {{- else }}
             {{ fail "No database connection configured. Set database.postgres.url, database.postgres.urlFile, or enable database.postgres.bundled." }}
             {{- end }}
+            {{- if include "kagent.controller.metricsEnabled" . }}
+            - name: METRICS_BIND_ADDRESS
+              value: {{ .Values.controller.metrics.bindAddress | quote }}
+            - name: METRICS_SECURE
+              value: {{ .Values.controller.metrics.secureServing | quote }}
+            {{- end }}
             {{- with .Values.controller.env }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -133,6 +139,11 @@ spec:
             - name: http
               containerPort: {{ .Values.controller.service.ports.targetPort }}
               protocol: TCP
+            {{- if .Values.controller.metrics.enabled }}
+            - name: metrics
+              containerPort: {{ include "kagent.controller.metricsPort" . | int }}
+              protocol: TCP
+            {{- end }}
           resources:
             {{- toYaml .Values.controller.resources | nindent 12 }}
           {{- with (.Values.controller.securityContext | default .Values.securityContext) }}

helm/kagent/templates/controller-metrics-service.yaml

@@ -0,0 +1,18 @@
+{{- if include "kagent.controller.metricsEnabled" . }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "kagent.fullname" . }}-controller-metrics
+  namespace: {{ include "kagent.namespace" . }}
+  labels:
+    {{- include "kagent.controller.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.controller.metrics.service.type }}
+  ports:
+    - name: {{ ternary "https" "http-metrics" .Values.controller.metrics.secureServing }}
+      port: {{ .Values.controller.metrics.service.port }}
+      targetPort: {{ include "kagent.controller.metricsPort" . | int }}
+      protocol: TCP
+  selector:
+    {{- include "kagent.controller.selectorLabels" . | nindent 4 }}
+{{- end }}

helm/kagent/templates/rbac/metrics-auth-clusterrole.yaml

@@ -0,0 +1,21 @@
+{{- if and (include "kagent.controller.metricsEnabled" .) .Values.controller.metrics.secureServing }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "kagent.fullname" . }}-metrics-auth-role
+  labels:
+    {{- include "kagent.controller.labels" . | nindent 4 }}
+rules:
+  - apiGroups:
+      - authentication.k8s.io
+    resources:
+      - tokenreviews
+    verbs:
+      - create
+  - apiGroups:
+      - authorization.k8s.io
+    resources:
+      - subjectaccessreviews
+    verbs:
+      - create
+{{- end }}

helm/kagent/templates/rbac/metrics-auth-clusterrolebinding.yaml

@@ -0,0 +1,16 @@
+{{- if and (include "kagent.controller.metricsEnabled" .) .Values.controller.metrics.secureServing }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "kagent.fullname" . }}-metrics-auth-rolebinding
+  labels:
+    {{- include "kagent.controller.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "kagent.fullname" . }}-metrics-auth-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "kagent.fullname" . }}-controller
+    namespace: {{ include "kagent.namespace" . }}
+{{- end }}

helm/kagent/templates/rbac/metrics-reader-clusterrole.yaml

@@ -0,0 +1,13 @@
+{{- if include "kagent.controller.metricsEnabled" . }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "kagent.fullname" . }}-metrics-reader
+  labels:
+    {{- include "kagent.controller.labels" . | nindent 4 }}
+rules:
+  - nonResourceURLs:
+      - "/metrics"
+    verbs:
+      - get
+{{- end }}