feat: add read-only mode for GitOps deployments by opspawn · Pull Request #1349 · kagent-dev/kagent

opspawn · 2026-02-20T21:13:26Z

Summary

Implements read-only mode for kagent (#1344), enabling GitOps-compatible deployments where resources are managed declaratively and the UI serves as a view-only dashboard.

Backend (Go)

ReadOnlyAuthorizer in go/internal/httpserver/auth/authz.go — implements the Authorizer interface, allows VerbGet and rejects create/update/delete with a clear error message
Wired via KAGENT_READ_ONLY=true environment variable in go/cmd/controller/main.go
4 unit tests covering allow-get, reject-mutations, error messages, and noop baseline

Frontend (Next.js)

ReadOnlyProvider context + useReadOnly() hook wired via NEXT_PUBLIC_READ_ONLY=true
Header: Hides the "Create" dropdown (desktop + mobile) when read-only
Agent cards: Hides edit/delete overlay buttons
Models page: Hides "New Model" button + per-row edit/delete buttons; shows GitOps message in empty state
MCP Servers page: Hides "Add MCP Server" + per-server delete; shows GitOps message in empty state
Chat sidebar: Hides session delete option
Route guards: /agents/new and /models/new redirect to / when read-only
Onboarding: Wizard is skipped in read-only mode
Empty states: Show "Resources are managed via GitOps" instead of create CTAs

How to test

Backend:

cd go && go test ./internal/httpserver/auth/ -v -run "TestReadOnly|TestNoop"

Frontend (read-only mode):

NEXT_PUBLIC_READ_ONLY=true npm run dev

Then verify:

No "Create" menu in header
No edit/delete buttons on agents, models, servers
/agents/new and /models/new redirect to /
Empty states show "Resources are managed via GitOps"
Onboarding wizard does not appear

Frontend (normal mode):

npm run dev

Verify all create/edit/delete functionality works as before.

Closes #1344

Copilot

Pull request overview

Adds an application-wide “read-only / GitOps mode” that blocks write operations in the backend authorizer and hides/guards write-capable UI paths and controls in the Next.js frontend.

Changes:

Backend: introduce ReadOnlyAuthorizer and wire it via KAGENT_READ_ONLY=true, with unit tests.
Frontend: add ReadOnlyProvider (NEXT_PUBLIC_READ_ONLY=true) and conditionally hide create/edit/delete controls across pages/components.
Frontend: add route guards for create/edit pages and skip onboarding in read-only mode.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
ui/src/components/sidebars/ChatItem.tsx	Hides chat session deletion UI when read-only.
ui/src/components/ReadOnlyProvider.tsx	Adds read-only React context + hook sourced from `NEXT_PUBLIC_READ_ONLY`.
ui/src/components/Header.tsx	Hides “Create” menus when read-only (desktop + mobile).
ui/src/components/AppInitializer.tsx	Skips onboarding wizard in read-only mode.
ui/src/components/AgentList.tsx	Replaces empty-state create CTA with GitOps messaging when read-only.
ui/src/components/AgentCard.tsx	Hides edit/delete overlay actions when read-only.
ui/src/app/servers/page.tsx	Hides add/remove MCP server UI and updates empty state for read-only.
ui/src/app/models/page.tsx	Hides model create/edit/delete UI and shows GitOps messaging when read-only.
ui/src/app/models/new/page.tsx	Adds read-only guard redirect for model create/edit page.
ui/src/app/layout.tsx	Wires `ReadOnlyProvider` at the app root.
ui/src/app/agents/new/page.tsx	Adds read-only guard redirect for agent create/edit page.
go/internal/httpserver/auth/authz_test.go	Adds tests for `NoopAuthorizer` and new `ReadOnlyAuthorizer`.
go/internal/httpserver/auth/authz.go	Implements `ReadOnlyAuthorizer` (allow GET only).
go/cmd/controller/main.go	Selects `ReadOnlyAuthorizer` when `KAGENT_READ_ONLY=true`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-20T21:16:59Z

ui/src/app/agents/new/page.tsx

+  const readOnly = useReadOnly();
  // Determine if in edit mode
  const searchParams = useSearchParams();
  const isEditMode = searchParams.get("edit") === "true";
  const agentName = searchParams.get("name");
  const agentNamespace = searchParams.get("namespace");

+  if (readOnly) {
+    redirect("/");
+  }


redirect() from next/navigation is a server-only API; this page is marked "use client", so calling redirect("/") during render will fail at build/runtime. Use useRouter().replace("/") (typically inside a useEffect) and render null/a small placeholder while navigating, or refactor the guard into a server component wrapper where redirect() is supported.

Copilot · 2026-02-20T21:17:00Z

ui/src/app/models/new/page.tsx

 export default function ModelPage() {
+  const readOnly = useReadOnly();
+
+  if (readOnly) {
+    redirect("/");
+  }


redirect() is not supported in Client Components ("use client"). This guard will throw rather than navigating. Prefer a client-side redirect via useRouter().replace("/") in an effect (and return null while it runs), or move the read-only check to a server component where redirect() can be used.

Copilot · 2026-02-20T21:17:00Z

ui/src/components/Header.tsx

+                      </Link>
+                    </DropdownMenuItem>
+                    <DropdownMenuItem asChild onClick={handleMobileLinkClick}>
+                      <Link href="/servers/new" className="gap-2 cursor-pointer w-full">


The mobile "New MCP Server" link points to /servers/new, but there is no ui/src/app/servers/new route in the app (only /servers). This will 404 on mobile. Update the link to the existing /servers page (or add the missing route) to keep mobile/desktop behavior consistent.

Suggested change

<Link href="/servers/new" className="gap-2 cursor-pointer w-full">

<Link href="/servers" className="gap-2 cursor-pointer w-full">

opspawn · 2026-02-20T22:33:02Z

All 20 CI checks are passing. This PR directly addresses the feature request in #1344. Ready for review whenever you have a chance!

fl-sean03 · 2026-02-21T00:01:30Z

CI is green (18/20, remaining 2 still running). This implements read-only mode for GitOps deployments (addresses #1344). All Copilot review feedback has been addressed. Ready for maintainer review when available.

Add read-only mode to both the Go backend and Next.js frontend, allowing kagent to be deployed in GitOps environments where resources are managed declaratively. Backend: - Add ReadOnlyAuthorizer that allows VerbGet but rejects create/update/delete - Wire via KAGENT_READ_ONLY=true environment variable - Add comprehensive tests for the new authorizer Frontend: - Add ReadOnlyProvider context with useReadOnly() hook - Hide Create dropdown in Header navigation - Hide Edit/Delete overlays on agent cards and model rows - Hide chat session delete option - Hide Add/Remove buttons on MCP servers page - Add route guards redirecting /agents/new and /models/new to / - Skip onboarding wizard in read-only mode - Show 'Resources are managed via GitOps' in empty states - Wire via NEXT_PUBLIC_READ_ONLY=true environment variable Closes kagent-dev#1344 Signed-off-by: opspawn <opspawn@users.noreply.github.com>

- Replace server-only redirect() with client-side useRouter().replace() in agents/new and models/new pages (both marked "use client") - Fix mobile "New MCP Server" link to point to /servers instead of non-existent /servers/new route Signed-off-by: opspawn <opspawn@users.noreply.github.com>

Signed-off-by: opspawn <opspawn@users.noreply.github.com>

opspawn · 2026-02-21T07:42:45Z

Closing in favor of #1346 by frank-bee which implements the same read-only mode for GitOps-managed deployments. Our implementation was parallel but theirs is further along.

opspawn · 2026-02-21T07:42:52Z

Closing in favor of #1346 by frank-bee which covers the same GitOps read-only mode functionality.

Copilot AI review requested due to automatic review settings February 20, 2026 21:13

opspawn requested review from EItanya, ilackarms, peterj and yuval-k as code owners February 20, 2026 21:13

Copilot started reviewing on behalf of opspawn February 20, 2026 21:13 View session

Copilot AI reviewed Feb 20, 2026

View reviewed changes

opspawn added 3 commits February 21, 2026 00:21

ci: retrigger CI to clear flaky e2e failure

5b388f0

Signed-off-by: opspawn <opspawn@users.noreply.github.com>

opspawn force-pushed the feat/read-only-mode branch from 957c410 to 5b388f0 Compare February 21, 2026 00:21

opspawn closed this Feb 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat: add read-only mode for GitOps deployments#1349

feat: add read-only mode for GitOps deployments#1349
opspawn wants to merge 3 commits intokagent-dev:mainfrom
opspawn:feat/read-only-mode

opspawn commented Feb 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

Copilot AI Feb 20, 2026

Uh oh!

opspawn commented Feb 20, 2026

Uh oh!

fl-sean03 commented Feb 21, 2026

Uh oh!

opspawn commented Feb 21, 2026

Uh oh!

opspawn commented Feb 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	<Link href="/servers/new" className="gap-2 cursor-pointer w-full">
	<Link href="/servers" className="gap-2 cursor-pointer w-full">

Comments

Conversation

opspawn commented Feb 20, 2026

Summary

Backend (Go)

Frontend (Next.js)

How to test

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

opspawn commented Feb 20, 2026

Uh oh!

fl-sean03 commented Feb 21, 2026

Uh oh!

opspawn commented Feb 21, 2026

Uh oh!

opspawn commented Feb 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants