Skip to content

feat: enhance agent identity roles and clean up deploy.py #721

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eliasecchig merged 2 commits into from
Jan 21, 2026
Merged

feat: enhance agent identity roles and clean up deploy.py #721

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
93165c2
feat: enhance agent identity roles and clean up deploy.py
eliasecchig Jan 21, 2026
78a8552
refactor: consolidate agent identity setup into single function
eliasecchig Jan 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 21 additions & 31 deletions ...ployment_targets/agent_engine/python/{{cookiecutter.agent_directory}}/app_utils/deploy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,22 +141,18 @@ def print_deployment_success(


def grant_agent_identity_roles(agent: Any, project: str) -> None:
"""Grant required IAM roles to the agent identity principal.

Uses get-modify-set pattern with etag for optimistic concurrency control.
The policy object returned by get_iam_policy includes an etag that is
automatically validated by set_iam_policy to prevent race conditions.
"""
"""Grant required IAM roles to the agent identity principal."""
roles = [
"roles/aiplatform.expressUser",
"roles/serviceusage.serviceUsageConsumer",
"roles/browser",
"roles/cloudapiregistry.viewer",
"roles/logging.logWriter",
"roles/monitoring.metricWriter",
]
principal = f"principal://{agent.api_resource.spec.effective_identity}"
click.echo(f"\n🔐 Granting IAM roles to agent identity: {principal}")
proj_client = resourcemanager_v3.ProjectsClient()
# Policy includes etag for optimistic locking - set_iam_policy will fail
# if policy was modified between get and set operations
policy = proj_client.get_iam_policy(
request=iam_policy_pb2.GetIamPolicyRequest(resource=f"projects/{project}")
)
Expand Down Expand Up @@ -317,18 +313,22 @@ def deploy_agent_engine_app(

# Log deployment parameters
click.echo("\n📋 Deployment Parameters:")
click.echo(f" Project: {project}")
click.echo(f" Location: {location}")
click.echo(f" Display Name: {display_name}")
click.echo(f" Min Instances: {min_instances}")
click.echo(f" Max Instances: {max_instances}")
click.echo(f" CPU: {cpu}")
click.echo(f" Memory: {memory}")
click.echo(f" Container Concurrency: {container_concurrency}")
params = [
("Project", project),
("Location", location),
("Display Name", display_name),
("Min Instances", min_instances),
("Max Instances", max_instances),
("CPU", cpu),
("Memory", memory),
("Container Concurrency", container_concurrency),
]
if service_account:
click.echo(f" Service Account: {service_account}")
params.append(("Service Account", service_account))
if agent_identity:
click.echo(" Agent Identity: Enabled (Preview)")
params.append(("Agent Identity", "Enabled (Preview)"))
for name, value in params:
click.echo(f" {name}: {value}")
if env_vars:
click.echo("\n🌍 Environment Variables:")
for key, value in sorted(env_vars.items()):
Expand Down Expand Up @@ -388,11 +388,6 @@ def deploy_agent_engine_app(
resource_limits={"cpu": cpu, "memory": memory},
identity_type=IdentityType.AGENT_IDENTITY if agent_identity else None,
)

agent_config = {
"agent": agent_instance,
"config": config,
}
{%- else %}
# Generate class methods spec from register_operations
class_methods_list = generate_class_methods_from_agent(agent_instance)
Expand Down Expand Up @@ -438,11 +433,10 @@ def deploy_agent_engine_app(
grant_agent_identity_roles(matching_agents[0], project)

# Deploy the agent (create or update)
action = "Updating" if matching_agents else "Creating"
click.echo(f"\n🚀 {action} agent: {display_name} (this can take 3-5 minutes)...")

if matching_agents:
click.echo(f"\n📝 Updating agent: {display_name}")
click.echo(
"🚀 Deploying to Vertex AI Agent Engine (this can take 3-5 minutes)..."
)
{%- if cookiecutter.is_adk_live %}
remote_agent = client.agent_engines.update(
name=matching_agents[0].api_resource.name,
Expand All @@ -455,10 +449,6 @@ def deploy_agent_engine_app(
)
{%- endif %}
else:
click.echo(f"\n🚀 Creating new agent: {display_name}")
click.echo(
"🚀 Deploying to Vertex AI Agent Engine (this can take 3-5 minutes)..."
)
{%- if cookiecutter.is_adk_live %}
remote_agent = client.agent_engines.create(
agent=agent_instance,
Expand Down