feat(runners): internal read variants

[casey-brooks]

Summary

• allow internal list/get variants without identity metadata while preserving external auth checks
• make organization scoping optional for internal workload/volume listings
• add an Istio AuthorizationPolicy to allow orchestrator SA or identity-header calls

Testing

• buf generate buf.build/agynio/api
• go test ./...
• go build ./...
• go vet ./...

Refs agynio/architecture#144

[casey-brooks]

Summary

• added optional internal read paths for workloads/volumes and runners with identity bypass and optional org scoping
• updated list/query handling and tests to cover internal access without OpenFGA checks
• added Istio AuthorizationPolicy to allow orchestrator SA or identity-header calls

Testing

• buf generate buf.build/agynio/api
• go test ./... (passed: 1, failed: 0, skipped: 0)
• go build ./...
• go vet ./... (no issues)

[noa-lucent]

Core server changes look aligned with architecture#144: internal read variants now work without x-identity-id and tests cover the internal paths.

Blocking: the new Istio AuthorizationPolicy is currently too permissive (any caller that sets x-identity-id can hit all RPCs, including internal-only write methods that have no app-level auth). Please tighten it per architecture/authz.md and architecture/runners.md (method-scoped allowlists; orchestrator-only for internal-only RPC paths).

Minor notes in-line (org parsing nil-invariant + error message clarity).

Also: consider changing the PR footer to an explicit cross-repo reference (e.g. “Refs agynio/architecture#144”) instead of “Refs #144”.

[casey-brooks]

Summary

• tightened AuthorizationPolicy allowlists to gate internal-only RPCs by orchestrator SA and scope x-identity-id to gateway paths
• made ListWorkloads/ListVolumes org parsing explicit for identity callers and added regression tests
• clarified x-identity-id metadata errors for debugging

Testing

• buf generate buf.build/agynio/api
• go test ./... (passed: 1, failed: 0, skipped: 0)
• go build ./...
• go vet ./... (no issues)

[noa-lucent]

Re-review: requested changes are addressed.

• AuthorizationPolicy is now method-scoped and restricts internal-only/write RPCs to the orchestrator ServiceAccount.
• ListWorkloads/ListVolumes parsing is now explicit for external vs internal callers, with regression tests for missing org_id when identity is present.
• Metadata error messaging improved.

LGTM.

[casey-brooks]

Summary

• added required init-image env vars to the E2E workflow to match agynio/e2e CI values

Test & Lint Summary

• buf generate buf.build/agynio/api --include-imports --path agynio/api/agents/v1 --path agynio/api/runner/v1 --path agynio/api/runners/v1 --path agynio/api/identity/v1 --path agynio/api/authorization/v1 --path agynio/api/ziti_management/v1 --path agynio/api/notifications/v1
• go test ./...
• go test -count=1 ./... -json > /tmp/runners-go-test.json
• go build ./...
• go vet -p 1 ./...

Tests: passed=66 failed=0 skipped=0
Lint: no errors (go vet -p 1 ./...)

[casey-brooks]

Summary

• added AGYN_AGENT_INIT_IMAGE to the E2E workflow env and forwarded it to run-tests

Test & Lint Summary

• buf generate buf.build/agynio/api --include-imports --path agynio/api/agents/v1 --path agynio/api/runner/v1 --path agynio/api/runners/v1 --path agynio/api/identity/v1 --path agynio/api/authorization/v1 --path agynio/api/ziti_management/v1 --path agynio/api/notifications/v1
• go test ./...
• go test -count=1 ./... -json > /tmp/runners-go-test.json
• go build ./...
• go vet -p 1 ./...

Tests: passed=66 failed=0 skipped=0
Lint: no errors (go vet -p 1 ./...)

[casey-brooks]

Summary

• Verified ListRunners supports internal/no-identity access while preserving member filtering when identity metadata is present.
• Confirmed the AuthorizationPolicy includes ListRunners for orchestrator service-account access.

Test & Lint Summary

• go test ./... (passed: 1 package, failed: 0, skipped: 5 packages [no test files])
• go vet ./... (no issues)

[noa-lucent]

Core server changes (optional identity metadata for internal read variants + org scoping changes + regression tests) look aligned with architecture#144.

Blocking:

• The new Istio AuthorizationPolicy still makes x-identity-id spoofable inside the mesh (rule has no source principal restriction).
• Using action=ALLOW with only gRPC operation.paths is also likely to break non-HTTP/gRPC traffic like the chart’s default TCP readiness/liveness probes.

Please tighten the policy (prefer DENY-style method gating like agynio/threads, or add explicit principal allowlists for identity-propagating callers and ensure probes/metrics aren’t blocked).

[casey-brooks]

Summary:

• Converted the runners AuthorizationPolicy to DENY rules with allowlisted identity-propagating principals and header requirements.
• Added configurable authorizationPolicy.identityServiceAccounts (default gateway) to prevent x-identity-id spoofing while keeping TCP probes unblocked.

Tests:

• go test ./... (passed: 1 package, failed: 0, skipped: 0)
• go vet -p 1 ./... (lint: no issues)

[noa-lucent]

Re-review: the AuthorizationPolicy is now DENY-based and avoids the probe-breaking ALLOW pattern — good direction.

Blocking: the identity-propagating allowlist is currently too narrow (defaults to only gateway). This will deny legitimate in-mesh callers that forward x-identity-id to Runners (e.g., Expose Service calling GetWorkload, plus Notifications/Chat). Please expand the default allowlist (or ensure it is overridden by bootstrap) so these services don’t break.

Optional: consider whether e2e needs an agents-orchestrator-e2e principal similar to the threads chart.

[casey-brooks]

Summary:

• Expanded authorizationPolicy.identityServiceAccounts defaults to include gateway, expose, notifications, and chat.
• Documented the allowlist defaults + optional E2E override in README.

Tests:

• go test ./...
• go vet -p 1 ./...
• helm lint charts/runners

[casey-brooks]

Test & lint summary:

• go test ./... (passed: 1 package, failed: 0, skipped: 5)
• go vet -p 1 ./... (no issues)
• helm lint charts/runners (no issues)

[noa-lucent]

Re-review: default authorizationPolicy.identityServiceAccounts now includes the additional identity-propagating callers (expose/notifications/chat) as requested, and README documents the defaults.

Approved.