feat(a2a): allow plaintext HTTP for agent cards in service meshes

[ArulJerald]

Link to Issue or Description of Change

1. Link to an existing issue (if applicable):

• Closes: RemoteA2aAgent enforces HTTPS for agent cards, blocking plaintext A2A inside a service mesh (mTLS) #7139

Problem:
RemoteA2aAgent previously enforced https:// (or loopback addresses like localhost / 127.0.0.1) for agent card URLs and RPC target URLs. In service mesh environments (such as Kubernetes with Istio, Linkerd, or Consul) where transport-layer security and identity are offloaded to mTLS sidecars, inter-service calls use internal plaintext HTTP endpoints (e.g., http://my-agent-service.default.svc.cluster.local:8080/agent.json). RemoteA2aAgent rejected these with AgentCardResolutionError, blocking A2A communication in mesh deployments.

Solution:

• Added an opt-in allow_insecure_http: bool = False configuration option to RemoteA2aAgent.__init__ and A2aRemoteAgentConfig.
• Added support for the ADK_A2A_ALLOW_INSECURE_HTTP=1 environment variable as a fallback.
• Updated _resolve_agent_card() and _validate_card_rpc_targets() to permit non-loopback http:// URLs when allow_insecure_http is active.
• Maintained secure-by-default behavior (default is False, refusing non-loopback cleartext HTTP).
• Preserved strict same-origin checks so RPC targets must still originate from the host and port the card was fetched from.

Testing Plan

Unit Tests:

• I have added or updated unit tests for my change.
• All unit tests pass locally.

Summary of pytest results:

• tests/unittests/a2a/agent/test_remote_a2a_agent.py: 266 passed (13 new tests added covering parameter, config, environment variable fallback, card resolution, and RPC validation)
• tests/unittests/a2a/: 732 passed, 49 skipped, 0 failures

Manual End-to-End (E2E) Tests:

Tested with a local HTTP service simulating a service mesh backend:

1. Configure an agent with allow_insecure_http=True targeting http://internal-mesh-service:8080/agent.json.
2. Verified that card resolution and RPC validation succeed when allow_insecure_http=True or ADK_A2A_ALLOW_INSECURE_HTTP=1 is set.
3. Verified that the agent rejects non-loopback HTTP with AgentCardResolutionError by default.

Checklist

• I have read the CONTRIBUTING.md document.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have added tests that prove my fix is effective or that my feature works.
• New and existing unit tests pass locally with my changes.
• I have manually tested my changes end-to-end.
• Any dependent changes have been merged and published in downstream modules.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[ArulJerald]

Thank you @surajksharma07 for the review!

1. Comment updated: Fixed the cut-off comment in src/google/adk/a2a/agent/_remote_a2a_agent.py around line 985.
2. Commit cleaned: The commit has been reset and now includes strictly the 5 relevant files for issue RemoteA2aAgent enforces HTTPS for agent cards, blocking plaintext A2A inside a service mesh (mTLS) #7139:
   • src/google/adk/a2a/agent/config.py
   • src/google/adk/a2a/agent/_remote_a2a_agent.py
   • src/google/adk/a2a/agent/__init__.py
   • src/google/adk/agents/remote_a2a_agent.py
   • tests/unittests/a2a/agent/test_remote_a2a_agent.py
3. Verification: Ran pyink, isort, ruff, scripts/compliance_checks.py, and all 266 unit tests in test_remote_a2a_agent.py pass.
4. The branch has been force-pushed.