From 77c68a99ab59d3298f7e2b7d0d1af2e42ba21b6e Mon Sep 17 00:00:00 2001 From: Chaitanya Laxman Date: Mon, 7 Sep 2026 21:12:24 +0400 Subject: [PATCH 1/2] fix(cli): consume AGENT_GATEWAY_ROOT_CERTIFICATES in deploy Dockerfile Cloud Build passes the Agent Gateway intercept CA as a build-arg, but the generated Dockerfile never declared it, so TLS interception certs were not installed. Fixes #6427 --- src/google/adk/cli/cli_deploy.py | 8 ++++++++ tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py | 5 +++++ 2 files changed, 13 insertions(+) diff --git a/src/google/adk/cli/cli_deploy.py b/src/google/adk/cli/cli_deploy.py index 2a3e5627247..76fe2c939cb 100644 --- a/src/google/adk/cli/cli_deploy.py +++ b/src/google/adk/cli/cli_deploy.py @@ -182,6 +182,14 @@ def _ensure_agent_engine_dependency(requirements_txt_path: str) -> None: # Create a non-root user RUN adduser --disabled-password --gecos "" myuser +# Optional Agent Gateway intercept CA (Cloud Build build-arg) +ARG AGENT_GATEWAY_ROOT_CERTIFICATES +RUN if [ -n "$AGENT_GATEWAY_ROOT_CERTIFICATES" ]; then \\ + mkdir -p /usr/local/share/ca-certificates && \\ + echo "$AGENT_GATEWAY_ROOT_CERTIFICATES" > /usr/local/share/ca-certificates/agw-ca.crt && \\ + update-ca-certificates; \\ + fi + # Switch to the non-root user USER myuser diff --git a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py index 35ebd636ab7..8552b39e6b0 100644 --- a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py +++ b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py @@ -150,6 +150,11 @@ def test_to_cloud_run_happy_path( 'RUN adduser --disabled-password --gecos "" myuser' in dockerfile_content ) assert "USER myuser" in dockerfile_content + assert "ARG AGENT_GATEWAY_ROOT_CERTIFICATES" in dockerfile_content + assert "update-ca-certificates" in dockerfile_content + assert dockerfile_content.index( + "ARG AGENT_GATEWAY_ROOT_CERTIFICATES" + ) < dockerfile_content.index("USER myuser") assert "ENV GOOGLE_CLOUD_PROJECT=proj" in dockerfile_content assert "ENV GOOGLE_CLOUD_LOCATION=asia-northeast1" in dockerfile_content assert 'RUN pip install "google-adk[a2a]==1.3.0"' in dockerfile_content From 829b528cbbdfd8231bceb1ba369a8dcf8264e5b9 Mon Sep 17 00:00:00 2001 From: Chaitanya Laxman Date: Mon, 7 Sep 2026 22:00:54 +0400 Subject: [PATCH 2/2] fix(cli): credit #6428 for the Agent Gateway CA install This re-lands #6428 by Solaris-star, which the author closed on 2026-08-12 after a maintainer LGTM. Rebased onto main and placed after adduser. Adds a template assertion. Fixes #6427 --- .../cli/utils/test_cli_deploy_to_cloud_run.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py index 8552b39e6b0..8a3f8743ecf 100644 --- a/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py +++ b/tests/unittests/cli/utils/test_cli_deploy_to_cloud_run.py @@ -40,6 +40,16 @@ def __call__(self, *, include_requirements: bool, include_env: bool) -> Path: ... +def test_dockerfile_template_consumes_agent_gateway_root_certificates() -> None: + """The shared deploy template must declare and consume the Cloud Build ARG.""" + content = cli_deploy._DOCKERFILE_TEMPLATE + assert "ARG AGENT_GATEWAY_ROOT_CERTIFICATES" in content + assert "update-ca-certificates" in content + assert content.index("ARG AGENT_GATEWAY_ROOT_CERTIFICATES") < content.index( + "USER myuser" + ) + + # Helpers class _Recorder: """A callable object that records every invocation."""