Improve runner launching - IAM Bindings, Disable Agent Service, Fix Generated Certificate

[jlewi]

• Create a command to add IAM policy bindings

This can be used in launcher scripts to create suitable IAM bindings e.g.

"${RUNME_BIN}" agent add-iam-policy-binding --member="user:${USER}@acme.com" --role="role/runner.user" --config "${RUNME_CONFIG}"
"${RUNME_BIN}" agent add-iam-policy-binding --member="user:${USER}@acme.com" --role="role/parser.user" --config "${RUNME_CONFIG}"

• Fix the common name on the self generated certificate; it should be Runme not Cloud Assistant

• Add the option to disable the agent service when launching a runner as we don't need it.

[jlewi]

I'll fix DCO.

Test failure looks unrelated. codex says Docker API is pinned; might open a separate PR for that.

--- FAIL: TestDockerCommand (0.01s)
    command_docker_test.go:22: 
        	Error Trace:	/home/runner/work/runme/runme/command/command_docker_test.go:22
        	Error:      	Received unexpected error:
        	            	Error response from daemon: client version 1.43 is too old. Minimum supported API version is 1.44, please upgrade your client to a newer version
        	            	github.com/runmedev/runme/v3/internal/dockerexec.(*Docker).pullImage
        	            		/home/runner/work/runme/runme/internal/dockerexec/docker.go:101
        	            	github.com/runmedev/runme/v3/internal/dockerexec.(*Docker).buildOrPullImage
        	            		/home/runner/work/runme/runme/internal/dockerexec/docker.go:90
        	            	github.com/runmedev/runme/v3/internal/dockerexec.New
        	            		/home/runner/work/runme/runme/internal/dockerexec/docker.go:49
        	            	github.com/runmedev/runme/v3/command.TestDockerCommand
        	            		/home/runner/work/runme/runme/command/command_docker_test.go:21
        	            	testing.tRunner
        	            		/opt/hostedtoolcache/go/1.25.7/x64/src/testing/testing.go:1934
        	            	runtime.goexit
        	            		/opt/hostedtoolcache/go/1.25.7/x64/src/runtime/asm_amd64.s:1693
        	Test:       	TestDockerCommand
FAIL

[jlewi]

Triggered a re-run on main to see if it passes
https://github.com/runmedev/runme/actions/runs/21955632206

[jlewi]

Yup that failed.

[jlewi]

We should merge
#1042

[jlewi]

@sourishkrout PTAL

[Copilot]

Pull request overview

This PR adds support for launching runners without the agent service, improves certificate generation, and adds a command to manage IAM policy bindings. The changes support use cases where only the runner or parser services are needed without the AI agent functionality.

Changes:

• Added add-iam-policy-binding command to configure IAM access for agent services
• Fixed TLS certificate Common Name from "Cloud Assistant" to "Runme" for self-generated certificates
• Added optional agentService configuration flag (defaults to true) to allow disabling the agent service when launching runners
• Improved Docker API version negotiation to avoid hard-coded version mismatches
• Refactored certificate generation logic into reusable ensureTLSCertificate helper

Reviewed changes

Copilot reviewed 16 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/agent/tlsbuilder/tls.go	Updated certificate CommonName and Organization from "Cloud Assistant"/"Acme Inc." to "Runme"
pkg/agent/server/server.go	Added nil check for opts.Server and updated error message to include parser service
pkg/agent/server/agent_service_test.go	Added test verifying assets aren't initialized when agent is nil
pkg/agent/config/iam_policy_test.go	Comprehensive tests for IAM policy binding operations including add, preserve, append, and dedupe
pkg/agent/config/iam_policy.go	Core implementation for adding IAM policy bindings with YAML preservation
pkg/agent/config/config_test.go	Test for GetAgentService() method with default and explicit values
pkg/agent/config/config.go	Added AgentService field and GetAgentService() method with improved GetConfigFile() logic
pkg/agent/cmd/serve.go	Refactored to conditionally initialize agent based on GetAgentService(), extracted TLS setup
pkg/agent/cmd/run.go	Removed unused run command
pkg/agent/cmd/certificate_check_test.go	Tests for TLS certificate generation scenarios
pkg/agent/cmd/certificate_check.go	New command and helper function for checking/generating TLS certificates
pkg/agent/cmd/agent.go	Updated command registration (removed run, added certificate-check and add-iam-policy-binding)
pkg/agent/cmd/add_iam_policy_binding.go	New command implementation for adding IAM policy bindings
pkg/agent/README.md	Added documentation for agentService configuration option
internal/dockerexec/docker.go	Changed from hardcoded API version "1.43" to WithAPIVersionNegotiation()
go.sum	Added checksums for new kyaml and related dependencies
go.mod	Added sigs.k8s.io/kustomize/kyaml v0.20.1 and transitive dependencies
.gitignore	Added pattern to ignore .runme-script-* files in runner directory

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sourishkrout]

✅ LGTM.