fix(app): add bearer token authentication support for Bedrock

[kkkksu]

summary

The Go controller already injects AWS_BEARER_TOKEN_BEDROCK as an env var into agent pods when the secret contains that key. However, the Python Bedrock runtime (_bedrock.py) only used boto3's standard IAM credential chain, ignoring the bearer token entirely — causing "Invalid API Key format" errors.

The AWS docs imply that boto3 should auto-detect AWS_BEARER_TOKEN_BEDROCK, but in practice it doesn’t. I got
"Invalid API Key format: Must start with pre-defined prefix"

That error happened because boto3 ignored the env var and tried its standard SigV4 credential chain (which failed since no IAM credentials were present).

This PR adds bearer token support to _get_bedrock_client(): when AWS_BEARER_TOKEN_BEDROCK is set, the client uses UNSIGNED signature and a before-sign event handler to inject the Authorization: Bearer <token> header. When the env var is not set, the existing IAM credential chain behavior is unchanged.

changes

• Added _inject_bearer_token() event handler function
• Modified _get_bedrock_client() to detect bearer token and use UNSIGNED + event handler
• Added unit tests for bearer token path, event registration, header injection, and IAM fallback
• Updated module docstring to document both auth methods

ai model disclosure

Used Claude (via Copilot CLI) to assist with implementation and test writing. Self-reviewed the approach against boto3/botocore docs and verified end-to-end on a GKE cluster with a real Bedrock bearer token. Tests verified via:

uv run pytest packages/kagent-adk/tests/unittests/models/test_bedrock.py -v  # 12 passed

[Copilot]

Pull request overview

Adds support in the Python Bedrock runtime for authenticating with an injected bearer token (AWS_BEARER_TOKEN_BEDROCK), aligning runtime behavior with the Go controller’s env var injection so Bedrock API-key auth works correctly.

Changes:

• Added a before-sign event handler to inject Authorization: Bearer … and configured the Bedrock client to use UNSIGNED when the bearer token env var is present.
• Added unit tests covering bearer-token behavior (UNSIGNED config, event registration, header injection) and IAM fallback behavior.
• Updated Bedrock module documentation to describe bearer token vs IAM auth.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
python/packages/kagent-adk/src/kagent/adk/models/_bedrock.py	Add bearer-token-based auth path for Bedrock client creation using UNSIGNED + event hook.
python/packages/kagent-adk/tests/unittests/models/test_bedrock.py	Add unit tests for bearer-token auth path and header injection behavior.
Makefile	Changes default app image name used by build tooling.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The file-level docstring now documents bearer token auth, but the KAgentBedrockLlm class docstring later in this file still states it "Authenticates using the standard AWS credential chain." This is now inaccurate and may mislead readers; please update the class docstring to reflect both supported auth methods (IAM + AWS_BEARER_TOKEN_BEDROCK).

Suggested change

	- **Bearer token**: Set ``AWS_BEARER_TOKEN_BEDROCK`` env var (API key auth).
	- **IAM credentials**: Standard AWS credential chain (env vars, IAM role, etc.).
	- **Bearer token**: Set ``AWS_BEARER_TOKEN_BEDROCK`` to send a Bearer token in
	the ``Authorization`` header.
	- **IAM credentials**: Use the standard AWS credential chain (environment
	variables, shared config, IAM role, etc.).

[kkkksu]

No I might be wrong about this. It turns out I did not set the secret correctly for the first time.