From 88be41f564488a85ddbc734a0e9faa542419e8b7 Mon Sep 17 00:00:00 2001
From: Peter Jausovec <peter.jausovec@solo.io>
Date: Mon, 13 Jul 2026 14:11:27 +0200
Subject: [PATCH] fixes empty secretkeyref in azureopenai

Signed-off-by: Peter Jausovec <peter.jausovec@solo.io>
---
 .../translator/agent/adk_api_translator.go    |  2 +-
 .../agent/adk_api_translator_test.go          | 53 +++++++++++++++++++
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/go/core/internal/controller/translator/agent/adk_api_translator.go b/go/core/internal/controller/translator/agent/adk_api_translator.go
index 6a75bb775f..548ea9c5b5 100644
--- a/go/core/internal/controller/translator/agent/adk_api_translator.go
+++ b/go/core/internal/controller/translator/agent/adk_api_translator.go
@@ -552,7 +552,7 @@ func (a *adkApiTranslator) translateModel(ctx context.Context, namespace, modelC
 		if model.Spec.AzureOpenAI == nil {
 			return nil, nil, nil, fmt.Errorf("AzureOpenAI model config is required")
 		}
-		if !model.Spec.APIKeyPassthrough {
+		if !model.Spec.APIKeyPassthrough && model.Spec.APIKeySecret != "" {
 			modelDeploymentData.EnvVars = append(modelDeploymentData.EnvVars, corev1.EnvVar{
 				Name: env.AzureOpenAIAPIKey.Name(),
 				ValueFrom: &corev1.EnvVarSource{
diff --git a/go/core/internal/controller/translator/agent/adk_api_translator_test.go b/go/core/internal/controller/translator/agent/adk_api_translator_test.go
index 8c4202f663..c84e08b751 100644
--- a/go/core/internal/controller/translator/agent/adk_api_translator_test.go
+++ b/go/core/internal/controller/translator/agent/adk_api_translator_test.go
@@ -470,6 +470,59 @@ func Test_AdkApiTranslator_AzureOpenAIParams(t *testing.T) {
 	assert.Equal(t, &maxTokens, m.MaxTokens)
 }
 
+func Test_AdkApiTranslator_AzureOpenAINoAPIKeySecret(t *testing.T) {
+	scheme := schemev1.Scheme
+	require.NoError(t, v1alpha2.AddToScheme(scheme))
+
+	// AzureOpenAI authenticating via azureADToken: no apiKeySecret and no
+	// passthrough. The translator must not inject an AZURE_OPENAI_API_KEY env
+	// var pointing at a Secret with an empty name.
+	modelConfig := &v1alpha2.ModelConfig{
+		ObjectMeta: metav1.ObjectMeta{Name: "m", Namespace: "ns"},
+		Spec: v1alpha2.ModelConfigSpec{
+			Model:    "gpt-4o",
+			Provider: v1alpha2.ModelProviderAzureOpenAI,
+			AzureOpenAI: &v1alpha2.AzureOpenAIConfig{
+				Endpoint:     "https://example.openai.azure.com",
+				AzureADToken: "ad-token",
+			},
+		},
+	}
+	agent := &v1alpha2.Agent{
+		ObjectMeta: metav1.ObjectMeta{Name: "a", Namespace: "ns"},
+		Spec: v1alpha2.AgentSpec{
+			Type: v1alpha2.AgentType_Declarative,
+			Declarative: &v1alpha2.DeclarativeAgentSpec{
+				SystemMessage: "x",
+				ModelConfig:   "m",
+			},
+		},
+	}
+
+	ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "ns"}}
+	kubeClient := fake.NewClientBuilder().WithScheme(scheme).WithObjects(ns, modelConfig, agent).Build()
+	trans := translator.NewAdkApiTranslator(kubeClient, types.NamespacedName{Namespace: "ns", Name: "m"}, nil, "", nil)
+
+	outputs, err := translator.TranslateAgent(context.Background(), trans, agent)
+	require.NoError(t, err)
+
+	var dep *appsv1.Deployment
+	for _, obj := range outputs.Manifest {
+		if d, ok := obj.(*appsv1.Deployment); ok {
+			dep = d
+			break
+		}
+	}
+	require.NotNil(t, dep, "Deployment not found in manifest")
+
+	var envNames []string
+	for _, e := range dep.Spec.Template.Spec.Containers[0].Env {
+		envNames = append(envNames, e.Name)
+	}
+	assert.NotContains(t, envNames, "AZURE_OPENAI_API_KEY", "no API-key secret ref should be injected when apiKeySecret is unset")
+	assert.Contains(t, envNames, "AZURE_AD_TOKEN")
+}
+
 func Test_AdkApiTranslator_ServiceAccountNameOverride(t *testing.T) {
 	scheme := schemev1.Scheme
 	require.NoError(t, v1alpha2.AddToScheme(scheme))