fix: remove hardcoded cluster.local and add configurable clusterDomai…

contrib/addons/grafana.yaml

@@ -646,7 +646,7 @@ data:
     destination_workload_namespace=~\\\"$dstns\\\"}[$__rate_interval])) by (destination_workload,
     destination_workload_namespace), 0.001)\",\"format\":\"time_series\",\"intervalFactor\":1,\"legendFormat\":\"{{
     destination_workload }}.{{destination_workload_namespace }}\",\"refId\":\"B\",\"step\":2}],\"title\":\"Bytes
-    Sent to Incoming TCP Connection\",\"type\":\"timeseries\"}],\"refresh\":\"1m\",\"schemaVersion\":38,\"style\":\"dark\",\"tags\":[],\"templating\":{\"list\":[{\"hide\":0,\"includeAll\":false,\"multi\":false,\"name\":\"datasource\",\"options\":[],\"query\":\"prometheus\",\"queryValue\":\"\",\"refresh\":1,\"regex\":\"\",\"skipUrlSync\":false,\"type\":\"datasource\"},{\"current\":{\"selected\":false,\"text\":\"details.default.svc.cluster.local\",\"value\":\"details.default.svc.cluster.local\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"definition\":\"\",\"hide\":0,\"includeAll\":false,\"label\":\"Service\",\"multi\":false,\"name\":\"service\",\"options\":[],\"query\":\"query_result(sum(istio_requests_total{})
+    Sent to Incoming TCP Connection\",\"type\":\"timeseries\"}],\"refresh\":\"1m\",\"schemaVersion\":38,\"style\":\"dark\",\"tags\":[],\"templating\":{\"list\":[{\"hide\":0,\"includeAll\":false,\"multi\":false,\"name\":\"datasource\",\"options\":[],\"query\":\"prometheus\",\"queryValue\":\"\",\"refresh\":1,\"regex\":\"\",\"skipUrlSync\":false,\"type\":\"datasource\"},{\"current\":{\"selected\":false,\"text\":\"details.default.svc\",\"value\":\"details.default.svc\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"definition\":\"\",\"hide\":0,\"includeAll\":false,\"label\":\"Service\",\"multi\":false,\"name\":\"service\",\"options\":[],\"query\":\"query_result(sum(istio_requests_total{})
     by (destination_service) or sum(istio_tcp_sent_bytes_total{}) by (destination_service))\",\"refresh\":1,\"regex\":\"/.*destination_service=\\\"([^\\\"]*).*/\",\"skipUrlSync\":false,\"sort\":0,\"tagValuesQuery\":\"\",\"tagsQuery\":\"\",\"type\":\"query\",\"useTags\":false},{\"current\":{\"selected\":false,\"text\":\"destination\",\"value\":\"destination\"},\"datasource\":\"Prometheus\",\"definition\":\"\",\"hide\":0,\"includeAll\":false,\"label\":\"Reporter\",\"multi\":true,\"name\":\"qrep\",\"options\":[{\"selected\":false,\"text\":\"source\",\"value\":\"source\"},{\"selected\":true,\"text\":\"destination\",\"value\":\"destination\"}],\"query\":\"source,destination\",\"refresh\":1,\"regex\":\"\",\"skipUrlSync\":false,\"sort\":1,\"tagValuesQuery\":\"\",\"tagsQuery\":\"\",\"type\":\"custom\",\"useTags\":false},{\"current\":{\"selected\":false,\"text\":\"All\",\"value\":\"$__all\"},\"datasource\":{\"type\":\"prometheus\",\"uid\":\"${datasource}\"},\"definition\":\"\",\"hide\":0,\"includeAll\":true,\"label\":\"Client
     Cluster\",\"multi\":true,\"name\":\"srccluster\",\"options\":[],\"query\":\"query_result(sum(istio_requests_total{reporter=~\\\"$qrep\\\",
     destination_service=\\\"$service\\\"}) by (source_cluster) or sum(istio_tcp_sent_bytes_total{reporter=~\\\"$qrep\\\",
@@ -1129,4 +1129,4 @@ kind: ConfigMap
 metadata:
   creationTimestamp: null
   name: istio-services-grafana-dashboards
-  namespace: kagent
+  namespace: kagent

contrib/tools/mcp-grafana/templates/toolserver.yaml

@@ -8,6 +8,6 @@ metadata:
 spec:
   config:
     streamableHttp:
-      url: http://{{ include "mcp-grafana.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.service.port }}/mcp
+      url: http://{{ include "mcp-grafana.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.service.port }}/mcp
       timeout: 30s
   description: "Grafana MCP server for monitoring and dashboard management"

contrib/tools/mcp-grafana/tests/toolserver_test.yaml

@@ -19,7 +19,7 @@ tests:
     asserts:
       - equal:
           path: spec.config.sse.url
-          value: http://RELEASE-NAME-mcp-grafana.NAMESPACE.svc.cluster.local:8000
+          value: http://RELEASE-NAME-mcp-grafana.NAMESPACE.svc:8000
       - equal:
           path: spec.config.sse.timeout
           value: 5s
@@ -43,4 +43,4 @@ tests:
           value: RELEASE-NAME
       - equal:
           path: metadata.labels["app.kubernetes.io/managed-by"]
-          value: Helm
+          value: Helm

go/core/internal/controller/translator/agent/adk_api_translator.go

@@ -940,7 +940,7 @@ func (a *adkApiTranslator) translateRemoteMCPServerTarget(ctx context.Context, a
 
 // isInternalK8sURL checks if a URL points to an internal Kubernetes service.
 // Internal k8s URLs follow the pattern: http://{name}.{namespace}:{port} or
-// http://{name}.{namespace}.svc.cluster.local:{port}
+// http://{name}.{namespace}.svc:{port}
 // This method checks if the namespace exists in the cluster to determine if it's internal.
 func (a *adkApiTranslator) isInternalK8sURL(ctx context.Context, urlStr, namespace string) bool {
 	parsedURL, err := url.Parse(urlStr)
@@ -953,8 +953,8 @@ func (a *adkApiTranslator) isInternalK8sURL(ctx context.Context, urlStr, namespa
 		return false
 	}
 
-	// Check if it ends with .svc.cluster.local (definitely internal)
-	if strings.HasSuffix(hostname, ".svc.cluster.local") {
+	// Check if it's an internal FQDN by looking for .svc or .svc.
+	if strings.HasSuffix(hostname, ".svc") || strings.Contains(hostname, ".svc.") {
 		return true
 	}
 

go/core/internal/controller/translator/agent/adk_translator_golden_test.go

@@ -284,14 +284,14 @@ func extractNamespaceFromURL(urlStr string) string {
 		return ""
 	}
 
-	// Split hostname by dots: service.namespace or service.namespace.svc.cluster.local
+	// Split hostname by dots: service.namespace or service.namespace.svc
 	hostname := parsed.Hostname()
 	parts := strings.Split(hostname, ".")
 
 	// Valid patterns:
 	// - service.namespace (2 parts)
 	// - service.namespace.svc (3 parts)
-	// - service.namespace.svc.cluster.local (5 parts)
+	// - service.namespace.svc (5 parts)
 	if len(parts) >= 2 {
 		return parts[1] // namespace is always the second part
 	}

go/core/internal/controller/translator/agent/proxy_test.go

@@ -119,7 +119,7 @@ func TestProxyConfiguration_ThroughTranslateAgent(t *testing.T) {
 			kubeClient,
 			types.NamespacedName{Name: "default-model", Namespace: "test"},
 			nil,
-			"http://proxy.kagent.svc.cluster.local:8080",
+			"http://proxy.kagent.svc:8080",
 			nil,
 		)
 
@@ -131,14 +131,14 @@ func TestProxyConfiguration_ThroughTranslateAgent(t *testing.T) {
 		// Verify agent tool proxy configuration
 		require.Len(t, result.Config.RemoteAgents, 1)
 		remoteAgent := result.Config.RemoteAgents[0]
-		assert.Equal(t, "http://proxy.kagent.svc.cluster.local:8080", remoteAgent.Url)
+		assert.Equal(t, "http://proxy.kagent.svc:8080", remoteAgent.Url)
 		assert.NotNil(t, remoteAgent.Headers)
 		assert.Equal(t, "nested-agent.test", remoteAgent.Headers[agenttranslator.ProxyHostHeader])
 
 		// Verify RemoteMCPServer with internal k8s URL DOES use proxy
 		require.Len(t, result.Config.HttpTools, 1)
 		httpTool := result.Config.HttpTools[0]
-		assert.Equal(t, "http://proxy.kagent.svc.cluster.local:8080/mcp", httpTool.Params.Url)
+		assert.Equal(t, "http://proxy.kagent.svc:8080/mcp", httpTool.Params.Url)
 		// Proxy header should be set for RemoteMCPServer with internal k8s URL (uses proxy)
 		require.NotNil(t, httpTool.Params.Headers)
 		assert.Equal(t, "test-mcp-server.kagent", httpTool.Params.Headers[agenttranslator.ProxyHostHeader])
@@ -254,14 +254,14 @@ func TestProxyConfiguration_RemoteMCPServer_FallsBackToWatchedNamespacesWhenName
 		[]string{"test", "kagent"},
 		types.NamespacedName{Name: "default-model", Namespace: "test"},
 		nil,
-		"http://proxy.kagent.svc.cluster.local:8080",
+		"http://proxy.kagent.svc:8080",
 		nil,
 	)
 
 	result, err := agenttranslator.TranslateAgent(ctx, translator, agent)
 	require.NoError(t, err)
 	require.Len(t, result.Config.HttpTools, 1)
-	assert.Equal(t, "http://proxy.kagent.svc.cluster.local:8080/mcp", result.Config.HttpTools[0].Params.Url)
+	assert.Equal(t, "http://proxy.kagent.svc:8080/mcp", result.Config.HttpTools[0].Params.Url)
 	assert.Equal(t, "test-mcp-server.kagent", result.Config.HttpTools[0].Params.Headers[agenttranslator.ProxyHostHeader])
 }
 
@@ -336,7 +336,7 @@ func TestProxyConfiguration_RemoteMCPServer_ExternalURL(t *testing.T) {
 		kubeClient,
 		types.NamespacedName{Name: "default-model", Namespace: "test"},
 		nil,
-		"http://proxy.kagent.svc.cluster.local:8080",
+		"http://proxy.kagent.svc:8080",
 		nil,
 	)
 
@@ -429,7 +429,7 @@ func TestProxyConfiguration_MCPServer(t *testing.T) {
 		kubeClient,
 		types.NamespacedName{Name: "default-model", Namespace: "test"},
 		nil,
-		"http://proxy.kagent.svc.cluster.local:8080",
+		"http://proxy.kagent.svc:8080",
 		nil,
 	)
 
@@ -441,7 +441,7 @@ func TestProxyConfiguration_MCPServer(t *testing.T) {
 	// Verify MCPServer uses proxy
 	require.Len(t, result.Config.HttpTools, 1)
 	httpTool := result.Config.HttpTools[0]
-	assert.Equal(t, "http://proxy.kagent.svc.cluster.local:8080/mcp", httpTool.Params.Url)
+	assert.Equal(t, "http://proxy.kagent.svc:8080/mcp", httpTool.Params.Url)
 	// Proxy header should be set for MCPServer (uses proxy)
 	require.NotNil(t, httpTool.Params.Headers)
 	assert.Equal(t, "test-mcp-server.test", httpTool.Params.Headers[agenttranslator.ProxyHostHeader])
@@ -527,7 +527,7 @@ func TestProxyConfiguration_Service(t *testing.T) {
 		kubeClient,
 		types.NamespacedName{Name: "default-model", Namespace: "test"},
 		nil,
-		"http://proxy.kagent.svc.cluster.local:8080",
+		"http://proxy.kagent.svc:8080",
 		nil,
 	)
 
@@ -539,7 +539,7 @@ func TestProxyConfiguration_Service(t *testing.T) {
 	// Verify Service uses proxy
 	require.Len(t, result.Config.HttpTools, 1)
 	httpTool := result.Config.HttpTools[0]
-	assert.Equal(t, "http://proxy.kagent.svc.cluster.local:8080/mcp", httpTool.Params.Url)
+	assert.Equal(t, "http://proxy.kagent.svc:8080/mcp", httpTool.Params.Url)
 	// Proxy header should be set for Service (uses proxy)
 	require.NotNil(t, httpTool.Params.Headers)
 	assert.Equal(t, "test-service.test", httpTool.Params.Headers[agenttranslator.ProxyHostHeader])

go/core/internal/controller/translator/agent/testdata/inputs/agent_with_proxy.yaml

@@ -1,7 +1,7 @@
 operation: translateAgent
 targetObject: agent-with-proxy
 namespace: test
-proxyURL: http://proxy.kagent.svc.cluster.local:8080
+proxyURL: http://proxy.kagent.svc:8080
 objects:
   - apiVersion: v1
     kind: Secret

go/core/internal/controller/translator/agent/testdata/inputs/agent_with_proxy_external_remotemcp.yaml

@@ -1,7 +1,7 @@
 operation: translateAgent
 targetObject: agent-with-proxy-external
 namespace: test
-proxyURL: http://proxy.kagent.svc.cluster.local:8080
+proxyURL: http://proxy.kagent.svc:8080
 objects:
   - apiVersion: v1
     kind: Secret

go/core/internal/controller/translator/agent/testdata/inputs/agent_with_proxy_mcpserver.yaml

@@ -1,7 +1,7 @@
 operation: translateAgent
 targetObject: agent-with-proxy-mcpserver
 namespace: test
-proxyURL: http://proxy.kagent.svc.cluster.local:8080
+proxyURL: http://proxy.kagent.svc:8080
 objects:
   - apiVersion: v1
     kind: Secret

go/core/internal/controller/translator/agent/testdata/inputs/agent_with_proxy_mcpserver_custom_timeout.yaml

@@ -1,7 +1,7 @@
 operation: translateAgent
 targetObject: agent-with-proxy-mcpserver-timeout
 namespace: test
-proxyURL: http://proxy.kagent.svc.cluster.local:8080
+proxyURL: http://proxy.kagent.svc:8080
 objects:
   - apiVersion: v1
     kind: Secret

go/core/internal/controller/translator/agent/testdata/inputs/agent_with_proxy_service.yaml

@@ -1,7 +1,7 @@
 operation: translateAgent
 targetObject: agent-with-proxy-service
 namespace: test
-proxyURL: http://proxy.kagent.svc.cluster.local:8080
+proxyURL: http://proxy.kagent.svc:8080
 objects:
   - apiVersion: v1
     kind: Secret

go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy.json

@@ -26,7 +26,7 @@
           "headers": {
             "x-kagent-host": "test-mcp-server.kagent"
           },
-          "url": "http://proxy.kagent.svc.cluster.local:8080/mcp"
+          "url": "http://proxy.kagent.svc:8080/mcp"
         },
         "tools": [
           "test-tool"
@@ -45,7 +45,7 @@
           "x-kagent-host": "nested-agent.test"
         },
         "name": "test__NS__nested_agent",
-        "url": "http://proxy.kagent.svc.cluster.local:8080"
+        "url": "http://proxy.kagent.svc:8080"
       }
     ],
     "stream": false
@@ -77,7 +77,7 @@
       },
       "stringData": {
         "agent-card.json": "{\"name\":\"agent_with_proxy\",\"description\":\"\",\"url\":\"http://agent-with-proxy.test:8080\",\"version\":\"\",\"capabilities\":{\"streaming\":true,\"pushNotifications\":false,\"stateTransitionHistory\":true},\"defaultInputModes\":[\"text\"],\"defaultOutputModes\":[\"text\"],\"skills\":[],\"preferredTransport\":\"JSONRPC\"}",
-        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc.cluster.local:8080/mcp\",\"headers\":{\"x-kagent-host\":\"test-mcp-server.kagent\"}},\"tools\":[\"test-tool\"]}],\"remote_agents\":[{\"name\":\"test__NS__nested_agent\",\"url\":\"http://proxy.kagent.svc.cluster.local:8080\",\"headers\":{\"x-kagent-host\":\"nested-agent.test\"}}],\"stream\":false}"
+        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc:8080/mcp\",\"headers\":{\"x-kagent-host\":\"test-mcp-server.kagent\"}},\"tools\":[\"test-tool\"]}],\"remote_agents\":[{\"name\":\"test__NS__nested_agent\",\"url\":\"http://proxy.kagent.svc:8080\",\"headers\":{\"x-kagent-host\":\"nested-agent.test\"}}],\"stream\":false}"
       }
     },
     {
@@ -305,4 +305,4 @@
       }
     }
   ]
-}
+}

go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver.json

@@ -27,7 +27,7 @@
             "x-kagent-host": "test-mcp-server.test"
           },
           "timeout": 30,
-          "url": "http://proxy.kagent.svc.cluster.local:8080/mcp"
+          "url": "http://proxy.kagent.svc:8080/mcp"
         },
         "tools": [
           "test-tool"
@@ -69,7 +69,7 @@
       },
       "stringData": {
         "agent-card.json": "{\"name\":\"agent_with_proxy_mcpserver\",\"description\":\"\",\"url\":\"http://agent-with-proxy-mcpserver.test:8080\",\"version\":\"\",\"capabilities\":{\"streaming\":true,\"pushNotifications\":false,\"stateTransitionHistory\":true},\"defaultInputModes\":[\"text\"],\"defaultOutputModes\":[\"text\"],\"skills\":[],\"preferredTransport\":\"JSONRPC\"}",
-        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc.cluster.local:8080/mcp\",\"headers\":{\"x-kagent-host\":\"test-mcp-server.test\"},\"timeout\":30},\"tools\":[\"test-tool\"]}],\"stream\":false}"
+        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc:8080/mcp\",\"headers\":{\"x-kagent-host\":\"test-mcp-server.test\"},\"timeout\":30},\"tools\":[\"test-tool\"]}],\"stream\":false}"
       }
     },
     {
@@ -297,4 +297,4 @@
       }
     }
   ]
-}
+}

go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_mcpserver_custom_timeout.json

@@ -27,7 +27,7 @@
             "x-kagent-host": "test-mcp-server.test"
           },
           "timeout": 60,
-          "url": "http://proxy.kagent.svc.cluster.local:8080/mcp"
+          "url": "http://proxy.kagent.svc:8080/mcp"
         },
         "tools": [
           "test-tool"
@@ -69,7 +69,7 @@
       },
       "stringData": {
         "agent-card.json": "{\"name\":\"agent_with_proxy_mcpserver_timeout\",\"description\":\"\",\"url\":\"http://agent-with-proxy-mcpserver-timeout.test:8080\",\"version\":\"\",\"capabilities\":{\"streaming\":true,\"pushNotifications\":false,\"stateTransitionHistory\":true},\"defaultInputModes\":[\"text\"],\"defaultOutputModes\":[\"text\"],\"skills\":[],\"preferredTransport\":\"JSONRPC\"}",
-        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc.cluster.local:8080/mcp\",\"headers\":{\"x-kagent-host\":\"test-mcp-server.test\"},\"timeout\":60},\"tools\":[\"test-tool\"]}],\"stream\":false}"
+        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc:8080/mcp\",\"headers\":{\"x-kagent-host\":\"test-mcp-server.test\"},\"timeout\":60},\"tools\":[\"test-tool\"]}],\"stream\":false}"
       }
     },
     {
@@ -297,4 +297,4 @@
       }
     }
   ]
-}
+}

go/core/internal/controller/translator/agent/testdata/outputs/agent_with_proxy_service.json

@@ -26,7 +26,7 @@
           "headers": {
             "x-kagent-host": "toolserver.test"
           },
-          "url": "http://proxy.kagent.svc.cluster.local:8080/mcp"
+          "url": "http://proxy.kagent.svc:8080/mcp"
         },
         "tools": [
           "k8s_get_resources"
@@ -68,7 +68,7 @@
       },
       "stringData": {
         "agent-card.json": "{\"name\":\"agent_with_proxy_service\",\"description\":\"\",\"url\":\"http://agent-with-proxy-service.test:8080\",\"version\":\"\",\"capabilities\":{\"streaming\":true,\"pushNotifications\":false,\"stateTransitionHistory\":true},\"defaultInputModes\":[\"text\"],\"defaultOutputModes\":[\"text\"],\"skills\":[],\"preferredTransport\":\"JSONRPC\"}",
-        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc.cluster.local:8080/mcp\",\"headers\":{\"x-kagent-host\":\"toolserver.test\"}},\"tools\":[\"k8s_get_resources\"]}],\"stream\":false}"
+        "config.json": "{\"model\":{\"type\":\"openai\",\"model\":\"gpt-4o\",\"base_url\":\"\"},\"description\":\"\",\"instruction\":\"You are an agent that uses proxies.\",\"http_tools\":[{\"params\":{\"url\":\"http://proxy.kagent.svc:8080/mcp\",\"headers\":{\"x-kagent-host\":\"toolserver.test\"}},\"tools\":[\"k8s_get_resources\"]}],\"stream\":false}"
       }
     },
     {
@@ -296,4 +296,4 @@
       }
     }
   ]
-}
+}

go/core/internal/httpserver/auth/proxy_authn_test.go

@@ -171,7 +171,7 @@ func TestProxyAuthenticator_JWTWithAgentHeader(t *testing.T) {
 			name: "extracts agent identity from header when JWT is present",
 			claims: map[string]any{
 				"sub": "system:serviceaccount:kagent:kebab-agent",
-				"iss": "https://kubernetes.default.svc.cluster.local",
+				"iss": "https://kubernetes.default.svc",
 				"aud": []any{"kagent"},
 			},
 			agentName:   "kagent__NS__kebab_agent",