oauth2-proxy + Agent Identity

The problem

The agent sits behind oauth2-proxy. Users authenticate via GitHub SSO. But once authenticated, the agent had no idea who it was talking to — every request looked the same. Fixing that meant reading the identity headers oauth2-proxy injects on every authenticated request.

Headers oauth2-proxy injects

Header	Value
X-Auth-Request-User	GitHub username (e.g. `albegosu`)
X-Auth-Request-Email	Primary email from GitHub
X-Auth-Request-Groups	Org membership groups the user belongs to
X-Forwarded-User	Same as `X-Auth-Request-User`, older name

Make sure pass-user-headers: true is set in the oauth2-proxy config. Without it the headers are stripped before reaching the upstream app.

Reading headers in the agent

Extracting caller identity

func callerFromRequest(r *http.Request) Caller {
    return Caller{
        Username: r.Header.Get("X-Auth-Request-User"),
        Email:    r.Header.Get("X-Auth-Request-Email"),
        Groups:   strings.Split(r.Header.Get("X-Auth-Request-Groups"), ","),
    }
}

The agent now injects caller identity into the system prompt at the start of each conversation: You are talking to {username} ({email}). This changes how the agent personalises responses and which tools it offers.

The NetworkPolicy gap

oauth2-proxy and the agent run in the same namespace but in separate pods. Without a NetworkPolicy, any pod in the cluster could call the agent directly — bypassing auth entirely.

Still pending: a NetworkPolicy that restricts inbound traffic to the agent pod to only come from the oauth2-proxy pod. Until it's in place, direct internal calls skip authentication.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: agent-allow-proxy-only
spec:
  podSelector:
    matchLabels:
      app: agent
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: oauth2-proxy
    ports:
    - port: 8080

The manual chart bug

At some point oauth2-proxy was updated by running helm install directly instead of going through the GitOps pipeline. The new chart defaulted pass-user-headers to false.

Result: all identity headers were stripped. The agent started receiving empty usernames. No error — just empty strings that passed validation silently.

The fix: reconcile through the pipeline, never helm install manually in prod. All values need to live in the GitOps repo — not in your head.

Helm values belong in Git. If a value isn't in the repo, it doesn't exist after the next sync.

Empty ≠ absent. Validate that identity headers are non-empty on startup, not just present. An empty X-Auth-Request-User is a misconfiguration, not a valid caller.

NetworkPolicy before going to production. Auth at the proxy layer only works if nothing can reach the upstream directly.