Originally published at webofmike.com on 2026-09-08. The demo repo and every command in it were run before publishing. kagent v0.10.0 went GA on September 4 . Buried in a long release list is a pair of environment variables that decide whether an agent's credential works at one backend or all of them: KAGENT_STS_RESOURCE and KAGENT_STS_AUDIENCE . Both default to empty. I built a three-container harness that shows exactly what changes when you set them: themsquared/kagent-sts-audien...