Architecture

The two directions

Everything reduces to two flows with two identity mechanisms. The control plane reaches into an agent over mTLS; the agent reaches out to its LLM provider and MCP servers directly.

  kubectl / operator ─┐
  A2A client ─────────┤  APIServer · A2A gateway ──mTLS client cert──▶ agent :8443 /mcp
                      │  coordination · scaler   ◀──source-IP attest── agent (claim work fabric)
  control plane ──────┘
                          agent ──AAuth-signed dial (or a mounted token)──▶ LLM provider · MCP servers
                                     (direct — no broker in path · public-HTTPS egress)
                          agent pod: serves mTLS /mcp · dials providers + MCP directly
                                     secret-free with AAuth · restricted-PSS · no hostPath

• Into the agent (Management). The APIServer and A2A gateway dial https://<podIP>:8443/mcp presenting the control-plane client cert. A cert verified against the pinned client CA is Management; an unauthenticated request is refused, never downgraded.
• Out of the agent (direct dial). The agent dials its INTELLIGENCE endpoint and each mcpServers entry directly. With AAuth it signs each request with its own workload identity (RFC 0024), so no provider or tool secret rests on the pod; the fallback is a token mounted from the pool's or server's Secret. No broker sits in the path.

Provisioning & PKI

The operator renders each agent pod to serve mTLS HTTPS and mints its identity through cert-manager: a cluster CA ClusterIssuer, a per-workload serving Certificate (<name>-serving-tls), and a per-namespace agentctl-ca ConfigMap so the agent trusts the control-plane certs it dials (--tls-ca). The control plane holds one client cert that mints Management at the agent's /mcp.

The rendered pod is restricted-PSS — runAsNonRoot, drop ALL caps, readOnlyRootFilesystem, automountServiceAccountToken: false, no hostPath — and carries zero credentials (only a rotatable serving key). cert-manager rotates everything; agentd hot-reloads its serving cert with no restart.

Management

The aggregated APIServer exposes drain / lame-duck / cancel / pause / resume as SAR-gated verbs. Each resolves the Agent to its status.podIP and issues an a2a.* admin JSON-RPC call direct to the pod under the control-plane client cert. Per-verb RBAC and end-user identity survive the aggregation seam; there is no pods/proxy, no per-node agent, no host socket.

Intelligence & tools

The operator resolves the Agent's bound model.pool (a ModelPool) and renders INTELLIGENCE=<the pool's provider endpoint> into the pod; the agent dials that provider itself. With AAuth the dial is secret-free — the agent signs each request with its workload identity (RFC 0024) — and the fallback is an INTELLIGENCE_TOKEN mounted from the pool's credentialSecretRef. Tools work the same way: spec.mcpServers is an inline list of { name, endpoint, auth, tags } the agent dials directly, authenticating with AAuth, a mounted staticToken, or none. No broker or facade sits in the path, and nothing meters a dial. The budgets that survive are harness-tracked: spec.limits.lifetimeTokens (cumulative) and maxTokens (per run), passed to the agent rather than enforced in path.

Because agents dial providers and MCP servers directly, the operator renders an agent-internet-egress NetworkPolicy that grants each agent pod public-HTTPS egress (private, link-local, and CGNAT ranges carved out); lateral movement stays default-denied. The claim work fabric is unchanged — workers reach the coordination server and scaler, attested by source IP.

A2A

The A2A gateway forwards direct to the agent pod /mcp on the contract's A2A wire — bare PascalCase methods (SendMessage, GetTask, …), the {"task"} envelope, and SSE streaming terminated by the terminal task state (no final flag). It builds the signed Agent Card from agent://capabilities and holds the durable task store; push config and version negotiation stay gateway-owned.