fix(strands-agent-base): CVE remediation + AccessDenied retry + A2A factory fix - #36
Open
shapirov103 wants to merge 3 commits into
Open
fix(strands-agent-base): CVE remediation + AccessDenied retry + A2A factory fix#36shapirov103 wants to merge 3 commits into
shapirov103 wants to merge 3 commits into
Conversation
ADRs for secretless workload identity (Shape A gateway identity; OAM identity traits; aws-service-identity/XPodIdentity/env-config; per-cluster eks_oidc_provider) and the user-delegated token-exchange roadmap, incl. the pending agentgateway release that ships backend.auth.oauthTokenExchange (v1.1.0 lacks it; PRs #2189/#2458).
…nt resource requests aws-service-identity trait: replace the STS-based init wait with a distroless, digest-pinned Chainguard kubectl 'wait --for=condition=Ready' on the PodIdentity resource, plus a namespaced Role/RoleBinding (get/list/watch podidentities) so the pod ServiceAccount can read it. Control-plane readiness only; the brief IAM data-plane propagation window is handled by app-level retry. example-agent-agentcore-memory: add CPU/memory requests (+ mem limit) so the agent isn't CPU-starved on contended nodes (root cause of the liveness-kill crashloops). Regenerated oam-agent-components templates.
…ctory fix Dependency/base-image hardening: - Pin fastapi==0.139.2, starlette==1.3.1 (fixes CVE-2025-62727, CVE-2026-48818, CVE-2026-54283), pydantic==2.13.4, uvicorn==0.51.0, bedrock-agentcore==1.18.1 (previously unpinned), aws-opentelemetry-distro==0.18.0, strands-agents==1.48.0. - Add tenacity==9.1.4 for retry-with-backoff (replaces hand-rolled loop). - Pin Dockerfile builder (uv:0.9.30-python3.13-bookworm-slim) and final stage (python:3.13-slim-bookworm by digest) for supply-chain immutability. - Remaining OS-layer CVEs (zlib1g, perl, libsqlite3-0, util-linux) are Debian bookworm will_not_fix/fix_deferred/no-dsa - not resolvable via apt upgrade. Resilience: - agent.py: tenacity retry() on _construct_agent, retrying only on botocore AccessDeniedException (first-boot IAM/Pod-Identity propagation race), exponential backoff (multiplier=1, max=16s), capped at 6 attempts. - agent.py: skip AgentCore session-manager attachment for the A2A agent-card placeholder context id (__agent_card__) - that probe agent is never used for real requests, and the placeholder fails AgentCore's sessionId validation regex (must start with alphanumeric). - main.py: switch A2AServer from the deprecated single shared agent param (not multi-tenant-safe, and rejected by strands-agents 1.48's StrandsA2AExecutor when a session_manager is attached) to the agent_factory param, giving each A2A context its own context-scoped agent + session_manager. Verified: rebuilt multi-arch (amd64+arm64), re-scanned with trivy (starlette/ fastapi/tenacity/etc. all 0 vulnerabilities), pushed to public.ecr.aws/z0a4o2j5/strands-agent (:latest, :v1.1.0-security), and confirmed on the hub cluster - all 3 my-agent pods Running 1/1, 0 restarts, Rollout Healthy.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens the
strands-agent-baseimage: dependency/base-image CVE remediation, retry-with-backoff for the first-boot IAM propagation race, and two A2A SDK compatibility fixes discovered while testing on the hub cluster.Also includes an earlier commit hardening the
aws-service-identityOAM trait's init container (control-plane readiness gate onPodIdentityviakubectl wait, replacing an STS-based check that could be fooled by node-role fallback).Changes
Dependency/base-image hardening (
pyproject.toml,Dockerfile):fastapi==0.139.2,starlette==1.3.1— fixes CVE-2025-62727, CVE-2026-48818, CVE-2026-54283pydantic==2.13.4,uvicorn==0.51.0,bedrock-agentcore==1.18.1(previously unpinned),aws-opentelemetry-distro==0.18.0,strands-agents==1.48.0tenacity==9.1.4for retry-with-backoffuv:0.9.30-python3.13-bookworm-slim) and final stage (python:3.13-slim-bookwormby digest) for supply-chain immutabilitywill_not_fix/fix_deferred/no-dsa— not resolvable viaapt upgradeResilience (
app/agent.py):tenacity.retry(...)on_construct_agent, retrying only onbotocore.exceptions.ClientErrorwith codeAccessDeniedException(the first-boot IAM/Pod-Identity propagation race), exponential backoff (multiplier=1, max=16s), capped at 6 attempts__agent_card__) — that probe agent is never used for real requests, and the placeholder fails AgentCore'ssessionIdvalidation regex (must start with alphanumeric)A2A SDK compatibility (
app/main.py):A2AServerfrom the deprecated single sharedagent=(not multi-tenant-safe; rejected outright bystrands-agents1.48'sStrandsA2AExecutorwhen asession_manageris attached) toagent_factory=create_agent, giving each A2A context its own context-scoped agent + session managerTesting
/healthon both archesstarlette,fastapi,tenacity,bedrock_agentcore,pydantic,uvicornall show 0 vulnerabilities post-fixpublic.ecr.aws/z0a4o2j5/strands-agent(:latest,:v1.1.0-security)peeks-hub): all 3my-agentpodsRunning 1/1,0restarts,RolloutphaseHealthy— noAccessDeniedcrashes, noValueError/ValidationExceptioncrashesNot in scope
resources/startupProbefor theagentOAM component (flagged as a follow-up, not applied here beyond the one example)