[FEATURE] Container-based skills image download authentication support

[arnitolog]

📋 Prerequisites

• I have searched the existing issues to avoid creating a duplicate
• By submitting this issue, you agree to follow our Code of Conduct

📝 Feature Summary

support of loading images for container-based skills from private registries

❓ Problem Statement / Motivation

Currently, an init-container cannot pull images for container-based skills from private registries due to the lack of authentication support.

💡 Proposed Solution

Add authentication support to the image pull/download function

🔄 Alternatives Considered

No response

🎯 Affected Service(s)

None

📚 Additional Context

No response

🙋 Are you willing to contribute?

• I am willing to submit a PR for this feature

[s10gopal]

Opened PR #1236

[EItanya]

Closed by #1236

[arnitolog]

It is still an issue. I tried:

• provide ImagePullSecret - doesn't work
• set env var DOCKER_CONFIG - doesn't work either since it sets it for the main container, not for init
• path ServiceAccount - same negative result
  the error I'm getting is:

.kagent/.venv/lib/python3.13/site-packages/google/protobuf/runtime_version.py:98: UserWarning: Protobuf gencode version 5.29.3 is exactly one major version older than the runtime version 6.31.1 at a2a.proto. Please update the gencode to avoid compatibility violations in the next runtime release.
  warnings.warn(
2026-02-07 20:50:25,143 - root - INFO - Logging configured with level: INFO
2026-02-07 20:50:25,472 - kagent.adk.cli - INFO - Starting KAgent
2026-02-07 20:50:25,473 - kagent.adk.cli - INFO - Pulling skills
2026-02-07 20:50:25,474 - kagent.adk.skill_fetcher - INFO - about to fetching skill query-logs-skill from image docker.artifactory.dev.xxxx.com/odl/query-logs-skill:0.0.1 (registry: docker.artifactory.dev.xxxx.com, repo: odl/query-logs-skill, ref: 0.0.1)
2026/02/07 20:50:25 No matching credentials were found for "docker.artifactory.dev.xxxx.com"
Error: pulling docker.artifactory.dev.xxxx.com/odl/query-logs-skill:0.0.1: GET https://docker.artifactory.dev.xxxx.com/artifactory/api/docker/docker/v2/token?scope=repository%2Fodl%2Fquery-logs-skill%3Apull&service=docker.artifactory.dev.xxxx.com: : Authentication is required
╭───────────────────── Traceback (most recent call last) ──────────────────────╮
│ /.kagent/packages/kagent-adk/src/kagent/adk/cli.py:107 in pull_skills        │
│                                                                              │
│   104 │   skill_dir = os.environ.get("KAGENT_SKILLS_FOLDER", ".")            │
│   105 │   logger.info("Pulling skills")                                      │
│   106 │   for skill in skills:                                               │
│ ❱ 107 │   │   fetch_skill(skill, skill_dir, insecure)                        │
│   108                                                                        │
│   109                                                                        │
│   110 def add_to_agent(sts_integration: ADKTokenPropagationPlugin, agent: Ba │
│                                                                              │
│ ╭───────────────────────────────── locals ─────────────────────────────────╮ │
│ │  insecure = False                                                        │ │
│ │     skill = 'docker.artifactory.dev.xxxx.com/odl/query-logs-s… │ │
│ │ skill_dir = '/skills'                                                    │ │
│ │    skills = [                                                            │ │
│ │             │                                                            │ │
│ │             'docker.artifactory.dev.xxxx.com/odl/query-logs-s… │ │
│ │             ]                                                            │ │
│ ╰──────────────────────────────────────────────────────────────────────────╯ │
│                                                                              │
│ /.kagent/packages/kagent-adk/src/kagent/adk/skill_fetcher.py:103 in          │
│ fetch_skill                                                                  │
│                                                                              │
│   100 │   │   f"about to fetching skill {skill_name} from image {skill_image │
│   101 │   )                                                                  │
│   102 │                                                                      │
│ ❱ 103 │   fetch_using_krane_to_dir(skill_image, os.path.join(destination_fol │
│   104                                                                        │
│                                                                              │
│ ╭───────────────────────────────── locals ─────────────────────────────────╮ │
│ │ destination_folder = '/skills'                                           │ │
│ │           insecure = False                                               │ │
│ │                ref = '0.0.1'                                             │ │
│ │           registry = 'docker.artifactory.dev.xxxx.com'                 │ │
│ │               repo = 'iodl/query-logs-skill'                      │ │
│ │         repo_parts = [ 'odl', 'query-logs-skill']              │ │
│ │        skill_image = 'docker.artifactory.dev.xxxx.com/odl/que… │ │
│ │         skill_name = 'query-logs-skill'                                  │ │
│ ╰──────────────────────────────────────────────────────────────────────────╯ │
│                                                                              │
│ /.kagent/packages/kagent-adk/src/kagent/adk/skill_fetcher.py:69 in           │
│ fetch_using_krane_to_dir                                                     │
│                                                                              │
│    66 │   if insecure:                                                       │
│    67 │   │   command.insert(1, "--insecure")                                │
│    68 │   # Use krane to pull the image as a tarball                         │
│ ❱  69 │   subprocess.run(                                                    │
│    70 │   │   command,                                                       │
│    71 │   │   check=True,                                                    │
│    72 │   )                                                                  │
│                                                                              │
│ ╭───────────────────────────────── locals ─────────────────────────────────╮ │
│ │            command = [                                                   │ │
│ │                      │   'krane',                                        │ │
│ │                      │   'export',                                       │ │
│ │                      │                                                   │ │
│ │                      'docker.artifactory.dev.xxxx.com/odl/que… │ │
│ │                      │   '/skills/query-logs-skill/skill.tar'            │ │
│ │                      ]                                                   │ │
│ │ destination_folder = '/skills/query-logs-skill'                          │ │
│ │              image = 'docker.artifactory.dev.xxxx.com/odl/que… │ │
│ │           insecure = False                                               │ │
│ │         subprocess = <module 'subprocess' from                           │ │
│ │                      '/python/cpython-3.13.11-linux-x86_64-gnu/lib/pyth… │ │
│ │           tar_path = '/skills/query-logs-skill/skill.tar'                │ │
│ ╰──────────────────────────────────────────────────────────────────────────╯ │
│                                                                              │
│ /python/cpython-3.13.11-linux-x86_64-gnu/lib/python3.13/subprocess.py:577 in │
│ run                                                                          │
│                                                                              │
│    574 │   │   │   raise                                                     │
│    575 │   │   retcode = process.poll()                                      │
│    576 │   │   if check and retcode:                                         │
│ ❱  577 │   │   │   raise CalledProcessError(retcode, process.args,           │
│    578 │   │   │   │   │   │   │   │   │    output=stdout, stderr=stderr)    │
│    579 │   return CompletedProcess(process.args, retcode, stdout, stderr)    │
│    580                                                                       │
│                                                                              │
│ ╭───────────────────────────────── locals ─────────────────────────────────╮ │
│ │ capture_output = False                                                   │ │
│ │          check = True                                                    │ │
│ │          input = None                                                    │ │
│ │         kwargs = {}                                                      │ │
│ │      popenargs = (                                                       │ │
│ │                  │   [                                                   │ │
│ │                  │   │   'krane',                                        │ │
│ │                  │   │   'export',                                       │ │
│ │                  │   │                                                   │ │
│ │                  'docker.artifactory.dev.xxxx.com/odl/query-l… │ │
│ │                  │   │   '/skills/query-logs-skill/skill.tar'            │ │
│ │                  │   ],                                                  │ │
│ │                  )                                                       │ │
│ │        process = <Popen: returncode: 1 args: ['krane', 'export',         │ │
│ │                  'docker.artifactory.dev.inta...>                        │ │
│ │        retcode = 1                                                       │ │
│ │         stderr = None                                                    │ │
│ │         stdout = None                                                    │ │
│ │        timeout = None                                                    │ │
│ ╰──────────────────────────────────────────────────────────────────────────╯ │
╰──────────────────────────────────────────────────────────────────────────────╯
CalledProcessError: Command '['krane', 'export',
'docker.artifactory.dev.xxxx.com/odl/query-logs-skill:0.0.1',
'/skills/query-logs-skill/skill.tar']' returned non-zero exit status 1.

at the same time pod configured with docker imagePullSercet:

  declarative:
    deployment:
      imagePullSecrets:
      - name: docker

[arnitolog]

@EItanya please reopen

[s10gopal]

@arnitolog , Thanks for the feedback.

I am able to download the skill from ECR using a service account with the configuration below.

apiVersion: kagent.dev/v1alpha2
kind: Agent
metadata:
  name: skill-agent
  namespace: kagent
spec:
  description: skill-agent
  type: Declarative
  skills:
    insecureSkipVerify: false
    refs:
      - xxx.dkr.ecr.eu-central-1.amazonaws.com/skill:0.0.1
  declarative:
    deployment:
      serviceAccountConfig:
        annotations:
          eks.amazonaws.com/role-arn: arn:aws:iam::xxxx:role/ecr-readonly-irsa
    modelConfig: default-model-config
    stream: true
    systemMessage: |
      <<systemMessage>>

@EItanya Could you please assign this issue to me? I can add support for imagePullSecrets, env and volume mount for skill init container.

[EItanya]

@EItanya Could you please assign this issue to me? I can add support for imagePullSecrets, env and volume mount for skill init container.

Done