faroshq
diff --git a/‎.github/workflows/e2e.yaml‎
Lines changed: 6 additions & 0 deletions b/‎.github/workflows/e2e.yaml‎
Lines changed: 6 additions & 0 deletions
diff --git a/‎deploy/charts/kedge-agent/templates/deployment.yaml‎
Lines changed: 1 addition & 1 deletion b/‎deploy/charts/kedge-agent/templates/deployment.yaml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎pkg/cli/cmd/agent.go‎
Lines changed: 17 additions & 3 deletions b/‎pkg/cli/cmd/agent.go‎
Lines changed: 17 additions & 3 deletions
diff --git a/‎pkg/cli/cmd/install.go‎
Lines changed: 21 additions & 4 deletions b/‎pkg/cli/cmd/install.go‎
Lines changed: 21 additions & 4 deletions
diff --git a/‎pkg/virtual/builder/agent_proxy_builder_v2.go‎
Lines changed: 10 additions & 7 deletions b/‎pkg/virtual/builder/agent_proxy_builder_v2.go‎
Lines changed: 10 additions & 7 deletions
@@ -44,11 +44,17 @@ jobs:
       - name: Build hub Docker image
         run: docker build -f deploy/Dockerfile.hub -t ghcr.io/faroshq/kedge-hub:test .
 
+      - name: Build agent Docker image
+        run: docker build -f deploy/Dockerfile.agent -t ghcr.io/faroshq/kedge-agent:test .
+
       - name: Run standalone e2e
         env:
           KEDGE_HUB_IMAGE: ghcr.io/faroshq/kedge-hub
           KEDGE_HUB_IMAGE_PULL_POLICY: Never
           KEDGE_HUB_IMAGE_TAG: test
+          KEDGE_AGENT_IMAGE: ghcr.io/faroshq/kedge-agent
+          KEDGE_AGENT_IMAGE_TAG: test
+          KEDGE_AGENT_IMAGE_PULL_POLICY: Never
         run: make e2e-standalone E2E_TIMEOUT=50m E2E_FLAGS="-ssh-keepalive-duration=30s -keep-clusters"
 
       - name: Collect kind cluster logs
 
@@ -50,7 +50,7 @@ spec:
             - --hub-url={{ .Values.agent.hub.url }}
             {{- end }}
             {{- if .Values.agent.hub.insecureSkipTLSVerify }}
-            - --hub-insecure-skip-tls-verify
+            - --insecure-skip-tls-verify
             {{- end }}
             {{- if .Values.agent.tunnelURL }}
             - --tunnel-url={{ .Values.agent.tunnelURL }}
 
@@ -303,7 +303,19 @@ metadata:
 		return fmt.Errorf("creating ServiceAccount: %w", err)
 	}
 
-	image := "ghcr.io/faroshq/kedge-agent:latest"
+	agentImage := os.Getenv("KEDGE_AGENT_IMAGE")
+	if agentImage == "" {
+		agentImage = "ghcr.io/faroshq/kedge-agent"
+	}
+	agentImageTag := os.Getenv("KEDGE_AGENT_IMAGE_TAG")
+	if agentImageTag == "" {
+		agentImageTag = "latest"
+	}
+	agentImagePullPolicy := os.Getenv("KEDGE_AGENT_IMAGE_PULL_POLICY")
+	if agentImagePullPolicy == "" {
+		agentImagePullPolicy = "IfNotPresent"
+	}
+	image := agentImage + ":" + agentImageTag
 
 	var deployManifest string
 
@@ -348,10 +360,11 @@ spec:
       containers:
       - name: agent
         image: %s
+        imagePullPolicy: %s
         args: [%s]
 `,
 			opts.EdgeName, opts.EdgeName, opts.EdgeName, opts.EdgeName,
-			opts.EdgeName, image,
+			opts.EdgeName, image, agentImagePullPolicy,
 			formatDeployArgs(deployArgs))
 	} else {
 		// Kubeconfig-based: mount a Secret containing the hub kubeconfig.
@@ -409,6 +422,7 @@ spec:
       containers:
       - name: agent
         image: %s
+        imagePullPolicy: %s
         args: [%s]
         volumeMounts:
         - name: hub-kubeconfig
@@ -420,7 +434,7 @@ spec:
           secretName: %s
 `,
 			opts.EdgeName, opts.EdgeName, opts.EdgeName, opts.EdgeName,
-			opts.EdgeName, image,
+			opts.EdgeName, image, agentImagePullPolicy,
 			formatDeployArgs(deployArgs),
 			secretName)
 	}
 
@@ -251,7 +251,8 @@ spec:
       serviceAccountName: kedge-agent-{{ .EdgeName }}
       containers:
         - name: kedge-agent
-          image: ghcr.io/faroshq/kedge-agent:latest
+          image: {{.Image}}:{{.ImageTag}}
+          imagePullPolicy: {{.ImagePullPolicy}}
           args:
             - --hub-url={{ .HubURL }}
             - --edge-name={{ .EdgeName }}
@@ -279,11 +280,27 @@ func installKubernetes(opts *installOptions) error {
 		return fmt.Errorf("parsing manifest template: %w", err)
 	}
 
+	agentImage := os.Getenv("KEDGE_AGENT_IMAGE")
+	if agentImage == "" {
+		agentImage = "ghcr.io/faroshq/kedge-agent"
+	}
+	agentImageTag := os.Getenv("KEDGE_AGENT_IMAGE_TAG")
+	if agentImageTag == "" {
+		agentImageTag = "latest"
+	}
+	agentImagePullPolicy := os.Getenv("KEDGE_AGENT_IMAGE_PULL_POLICY")
+	if agentImagePullPolicy == "" {
+		agentImagePullPolicy = "IfNotPresent"
+	}
+
 	var sb strings.Builder
 	if err := tmpl.Execute(&sb, map[string]string{
-		"HubURL":   opts.hubURL,
-		"EdgeName": opts.edgeName,
-		"Token":    opts.token,
+		"HubURL":          opts.hubURL,
+		"EdgeName":        opts.edgeName,
+		"Token":           opts.token,
+		"Image":           agentImage,
+		"ImageTag":        agentImageTag,
+		"ImagePullPolicy": agentImagePullPolicy,
 	}); err != nil {
 		return fmt.Errorf("rendering manifest: %w", err)
 	}
 
@@ -161,14 +161,17 @@ func (p *virtualWorkspaces) buildEdgeAgentProxyHandler() http.Handler {
 		p.edgeConnManager.Store(key, dialer)
 		p.logger.Info("Edge agent tunnel established", "key", key)
 
-		// In the join-token flow the agent's edge_reporter cannot call the kcp
-		// API directly (the join token is not a valid kcp credential), so the
-		// hub marks the edge Ready here as soon as the tunnel is up.
+		// The hub is authoritative for edge connectivity state regardless of how
+		// the agent authenticated.  In the join-token flow the agent's
+		// edge_reporter cannot reach the kcp API directly (the join token is not
+		// a valid kcp credential).  In the kubeconfig flow (e.g. after an
+		// in-cluster pod restart where the agent loads its saved kubeconfig from
+		// a Secret) the edge_reporter may fail due to RBAC propagation lag.
+		// Marking the edge Ready here on every tunnel open is safe and ensures
+		// the hub view is always up-to-date.
 		// SSH credentials are passed via headers for server-type edges.
-		if authenticatedByJoinToken {
-			sshCreds := extractSSHCredsFromHeaders(r)
-			go p.markEdgeConnected(context.Background(), cluster, name, sshCreds)
-		}
+		sshCreds := extractSSHCredsFromHeaders(r)
+		go p.markEdgeConnected(context.Background(), cluster, name, sshCreds)
 
 		// Block until the tunnel closes, then clean up the entry so stale
 		// look-ups don't succeed.