feat: add extraContainers to SharedDeploymentSpec for sidecar support

[mesutoezdil]

Closes #1646.

There's currently no way to run a sidecar container alongside the main agent pod. This adds an optional extraContainers field to SharedDeploymentSpec so users can inject things like token proxies, log shippers, or any other helper container.

The field is optional and defaults to empty, so existing agents are unaffected. When set, the extra containers are appended after the primary kagent container in the pod spec.

Changes:

• Added ExtraContainers []corev1.Container to SharedDeploymentSpec in agent_types.go
• Wired it through the internal resolvedDeployment struct in deployments.go for both inline and BYO paths
• Updated manifest_builder.go to append the extra containers to the pod spec
• Added a golden test with an Envoy sidecar

Example:

spec:
  type: Declarative
  declarative:
    deployment:
      extraContainers:
        - name: token-proxy
          image: envoyproxy/envoy:v1.30.0
          ports:
            - containerPort: 9901

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds support for running sidecar containers alongside the main kagent container by introducing an optional extraContainers field on SharedDeploymentSpec, wiring it through deployment resolution, and emitting it into the generated Pod spec.

Changes:

• Extend SharedDeploymentSpec with extraContainers to allow user-defined sidecars.
• Propagate extraContainers through both inline and BYO deployment resolution paths.
• Update manifest building and golden test fixtures to include appended sidecar containers.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
go/api/v1alpha2/agent_types.go	Adds ExtraContainers to the public CRD API type.
go/core/internal/controller/translator/agent/deployments.go	Threads ExtraContainers into the resolved deployment model.
go/core/internal/controller/translator/agent/manifest_builder.go	Appends ExtraContainers after the primary kagent container in the Pod spec.
go/core/internal/controller/translator/agent/testdata/inputs/agent_with_extra_containers.yaml	Adds a new golden input covering sidecar configuration.
go/core/internal/controller/translator/agent/testdata/outputs/agent_with_extra_containers.json	Adds the expected rendered manifests including the sidecar container.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

There is no validation preventing extraContainers from using the reserved name kagent (or causing duplicate container names). If a user sets a sidecar name that duplicates the primary container (or another sidecar), the generated PodSpec will be rejected by Kubernetes and reconciliation will fail. Consider adding validation during resolve (or API validation) to reject ExtraContainers entries with Name == \"kagent\" and to enforce uniqueness across all container names.

[EItanya]

@mesutoezdil this needs to be solved

[mesutoezdil]

Fixed in a71c636. Added validateExtraContainers which returns an error if any extra container uses the reserved name "kagent" or if two extra containers share the same name. The check runs in both resolveInlineDeployment and resolveByoDeployment before the slice is cloned. Five unit tests cover the cases: empty list, normal names, reserved name, duplicates, and mixed.

[Copilot]

Exposing []corev1.Container directly in a CRD can significantly bloat the generated OpenAPI schema and can also prune unknown/newer container fields (apiserver schema-pruning) as Kubernetes evolves. To avoid CRD size/compatibility issues, consider marking this field as schemaless / preserve-unknown-fields (kubebuilder marker) or switching to a slimmer custom sidecar spec / raw JSON representation, depending on how strictly you want to validate user input.

Suggested change

	// Useful for sidecars such as token proxies, log shippers, or security agents.
	// Useful for sidecars such as token proxies, log shippers, or security agents.
	// Preserve unknown/newer container fields in the CRD schema to avoid pruning as Kubernetes evolves.
	// +kubebuilder:validation:Schemaless
	// +kubebuilder:pruning:PreserveUnknownFields