[AIWithShrey]

Summary

• Agent runs for gemini/google now fail when spec.config.endpoint is set; the webhook still admits the Agent with a warning. The pinned gemini client ignores it (it takes a base-URL override only from GOOGLE_GEMINI_BASE_URL), so an endpoint on an allowlisted origin was accepted and silently ignored. The error says to set GOOGLE_GEMINI_BASE_URL in the agent-executor process environment (Helm: agentExecutor.env). The refusal comes before the allowlist check.
• The apply-time webhook warning for config.endpoint is reworded. It names the providers that use the field (anthropic, azure-openai) and says google, gemini and nirmata always fail when it is set.
• Docs correction: anthropic does use config.endpoint (the pinned client uses its scheme and host unless ANTHROPIC_BASE_URL is set). The API docs, CRDs (regenerated) and the custom-endpoint sample said otherwise.

Release note

Breaking, but bounded: gemini/google Agents that set config.endpoint with an allowlisted origin (until now a silent no-op) now fail at run time with an error pointing at GOOGLE_GEMINI_BASE_URL. Where the endpoint was already refused (allowlist unset, origin not listed, or endpoint or allowlist entry not origin-only), only the error message changes. No sample, doc or e2e in the repo uses that combination.

Testing

• New spec: a gemini/google endpoint is refused before the allowlist is consulted, with the allowlist unset, invalid, or listing the endpoint's origin. It fails on the pre-fix code and passes with the fix.
• Specs that expect an allowlist or skipVerifySSL error for an endpoint now run only for the other providers, because gemini/google are refused earlier with a different message.
• Webhook test: the endpoint warning must mention google and gemini. It fails on the pre-fix code.
• go test ./internal/agent/..., go test ./internal/webhook/..., build, vet, gofmt and ottoflow validate --workflow-dir samples pass. Local runs used a go build overlay carrying the one-line fix from fix(controller): use Phase.IsTerminal in legacy binding GC #211, which has since merged, where the controller package is needed.

🤖 Generated with Claude Code

[Copilot]

🟢 Approved

No active review issues remain for the provider endpoint changes, though tests and builds were not run during this review.

No open issues 🎉

What changed in this PR

This PR makes OttoFlow reject spec.config.endpoint at runtime for Gemini/Google Agents instead of silently ignoring it, directing operators to GOOGLE_GEMINI_BASE_URL.

Changes:

• Reject Gemini/Google endpoints before checking the operator allowlist, with regression coverage.
• Update admission warnings while continuing to admit affected Agents.
• Correct Anthropic endpoint documentation and synchronize API references, generated CRDs, and sample comments.

Tests and builds were not run during this review.

File	Description
samples/​workflows/​features/​agent-custom-endpoint.yaml	Corrects provider endpoint behavior in sample comments.
internal/​webhook/​agent_validator_test.go	Checks that endpoint warnings mention Google and Gemini.
internal/​webhook/​agent_mcpserver_validators.go	Clarifies provider-specific endpoint warnings.
internal/​agent/​default_executor.go	Rejects Gemini/Google endpoints before allowlist validation.
internal/​agent/​default_executor_test.go	Tests rejection precedence and adjusts other provider assertions.
docs/​user/​reference/​api/​api-docs.md	Updates generated endpoint configuration documentation.
docs/​user/​reference/​api/​agent.md	Documents endpoint support and Gemini/Google migration guidance.
config/​crd/​bases/​ottoflow.nirmata.io_agents.yaml	Synchronizes generated Agent CRD descriptions.
charts/​ottoflow/​crds/​ottoflow.nirmata.io_agents.yaml	Synchronizes Helm’s generated Agent CRD descriptions.
api/​v1alpha1/​agent_types.go	Corrects source API comments describing endpoint behavior.

_{Review effort: Balanced}

[patelrit]

Approved: Copilot 🟢 on head, no open threads, CI green, unit tests, and E2E passed on the head commit (run 41694357706).