Stream 2: Hub integration (konveyor/tackle2-hub)

[djzager]

Tracking issue for Hub integration work per ADR 0006. Implementation lives in konveyor/tackle2-hub.

Design

Hub follows the established addon pattern (ADR 0006):

• CRUD endpoints under /hub/agent/* for all agent CRDs via controller-runtime client
• Fire-and-forget creation — Hub mints a scoped token, injects HUB_BASE_URL, HUB_APP_ID, and the token Secret into the CR env/envFrom, creates the CR, walks away
• Request-driven reads — client.Get() on demand, no informers
• Cancel handler — revokes token, sets spec.cancel on the CR
• ACP WebSocket proxy — separate deliverable; Hub reads ACP key from status.secretKeyRef, injects X-Secret-Key, proxies to pod:4000/acp; single-writer enforcement required
• konveyor.io/managed=true filtering on Agent and AgentWorkflow list only

Route table

Endpoint	CRD	Operations
/hub/agent/agents	Agent	List, Get, Create, Update, Delete
/hub/agent/skills	SkillCard	List, Get, Create, Update, Delete
/hub/agent/skillcollections	SkillCollection	List, Get, Create, Update, Delete
/hub/agent/providers	LLMProvider	List, Get, Create, Update, Delete
/hub/agent/runs	AgentRun	List, Get, Create, Cancel
/hub/agent/workflows	AgentWorkflow	List, Get, Create, Update, Delete
/hub/agent/workflowruns	AgentWorkflowRun	List, Get, Create, Cancel
/hub/agent/runs/:name/acp	—	WebSocket proxy to pod ACP endpoint

Tasks

• Import CRD types (konveyor/agentic-controller/api/v1alpha1)
• CRUD handlers for all agent resources
• AgentRun/AgentWorkflowRun creation with token minting + env injection
• Cancel handler (token revocation + spec.cancel)
• ACP WebSocket proxy (separate deliverable)
• Token minting endpoint / mechanism for harness auth

Hub-side progress

Jeff has started foundational work:

• tackle2-hub PR #1107: Refactor shared SCM for use outside of addons
• tackle2-hub PR #1105: Add service accounts

Supersedes

• 2.1: Import CRD types into Hub #18 — Import CRD types (closed, superseded by redesign)
• 2.2: Curated REST handlers #19 — Curated REST handlers (closed, superseded by redesign)
• 2.3: AgentRun smart creation (Model B) #20 — AgentRun smart creation (closed, superseded by redesign)
• 2.4: ACP WebSocket proxy #21 — ACP WebSocket proxy (closed, superseded by redesign)
• Stream 2: Hub (konveyor/tackle2-hub) #6 — Original Stream 2 tracking issue

References

• ADR 0006: Hub addon pattern for agent resources
• Enhancement: konveyor/enhancements#295
• Ian's contract proposal: 3.1: API client layer #22 (comment)

[ibolton336]

Two additions to the route table from implementing the same surface in the
hub-shim, both cheap now and awkward later.

1. /hub/agent/runs and /hub/agent/workflowruns need an application
filter. The design bullet above says konveyor.io/managed=true filtering on
Agent and AgentWorkflow list only, which matches ADR 0006 — but it leaves
"which runs belong to application 42?" with no server-side answer, since the
application is carried only in spec.env. The caller ends up listing every
run in the namespace and parsing env. Proposal is ?application=<id> served
as a client.List() selector on a konveyor.io/application label stamped at
create time, additive to HUB_APP_ID/APP_ID rather than replacing it — the
env var is what the pod reads, the label is what the API indexes. ADR
amendment in #105, verified end-to-end in the shim
(ibolton336/agentcontroller-client#3). Stage runs need #107 before the filter
is complete.

2. HUB_APP_ID in the fire-and-forget bullet looks like drift. The
harness requires APP_ID — harness/internal/config/config.go reads it from
the required set, and ADR 0006 says APP_ID too. If Hub injects HUB_APP_ID,
every managed run fails at startup on a missing required var. Worth fixing in
the issue body before someone implements from it.

SHIM HTTP API v1 in ADR 0012 (#106 moves it here — renumbered past #108's 0009-0011) is the closest thing to an
executable version of this route table — same resources, same create
semantics, running against the real controller. Useful as an acceptance
reference rather than a spec to copy, since the paths differ.

[djzager]

Nice. @jortel more good feedback on the Hub api interaction, things I missed.