Skip to content

fix: document Producer Portal SA registration for multi-agent deployments#331

Open
luis5tb wants to merge 1 commit into
RHEcosystemAppEng:mainfrom
luis5tb:fix/multi-agent-procurement-api-docs
Open

fix: document Producer Portal SA registration for multi-agent deployments#331
luis5tb wants to merge 1 commit into
RHEcosystemAppEng:mainfrom
luis5tb:fix/multi-agent-procurement-api-docs

Conversation

@luis5tb

@luis5tb luis5tb commented Jul 17, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • When multiple agents share a GCP project, the Procurement API returns 403 if the Cloud Run runtime SA isn't registered in the Producer Portal Technical Integration — causing multi-agent product filtering to silently drop all Pub/Sub events
  • The Technical Integration is provider-level (per GCP project, not per product), so all instance SAs must be registered together
  • This cannot be fixed via IAM roles — the Cloud Commerce Partner Procurement API access is managed exclusively through the Producer Portal

Changes

  • src/lightspeed_agent/marketplace/router.py — upgrade 403 log messages from info to warning with actionable context (Producer Portal registration)
  • deploy/cloudrun/setup.sh — add comment documenting that Procurement API access requires Producer Portal registration, not IAM roles
  • deploy/gitops/README.md — update Step 2 (multi-instance setup) to clarify provider-level Technical Integration and the need to register ALL instance SAs
  • docs/marketplace.md — update Multi-Agent Product Filtering section and add troubleshooting entry for the 403 scenario

Test plan

  • ruff check passes
  • pytest tests/test_dcr.py -k "FetchEntitlementProduct or product_api_403" — all 6 tests pass
  • Shell test coverage check passes
  • Register both SAs in Producer Portal and verify Pub/Sub events are processed correctly

🤖 Generated with Claude Code

…ment API access

The Cloud Commerce Partner Procurement API does not use standard IAM roles.
Access is managed through the GCP Marketplace Producer Portal Technical
Integration, which is provider-level (shared across all products in the
same project). When multiple agents share a project, all runtime SAs must
be registered together — otherwise the Procurement API returns 403 and
multi-agent product filtering silently drops events.

Changes:
- Upgrade 403 log messages from info to warning in router.py so the
  misconfiguration is visible in logs
- Document Producer Portal requirement in setup.sh, GitOps README, and
  marketplace docs
- Add troubleshooting entry for the 403 / silently dropped events scenario

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant