agents-cli deploy has no way to pass CMEK (encryption_spec) for Agent Runtime, blocking deploys under constraints/gcp.restrictNonCmekServices

从 google/agents/cli/deploy/cmd_deploy.py 和 agent_runtime.py 开始，然后检查 vertexai.agent_engines._agent_engines.create() 的 encryption_spec 参数。针对强制执行 constraints/gcp.restrictNonCmekServices 的项目运行复现命令，并检查 agents-cli deploy --help。当 agent_runtime deploy 能够接收 KMS 加密密钥并满足该政策时，即表示完成。

What is your feature suggestion?

Description

Deploying as ADK Agent to Agent Runtime(agents-cli deploy --deployment-target agent_runtime) fails in any GCP project that enforces the org policy constraints/gcp.restrictNonCmekServices, because the CLI never passes a KMS encryption key to the undersying create call.

Reproduce

agents-cli scaffold create test-a2a-agent --agent adk --deployment-target agent_runtime --region us-central1 --cicd-runner skip
cd test-a2a-agent && agents-cli install
agents-cli deploy --project --region us-central1 --no-confirm-project

Observed Error

Error: Agent Runtime create request failed — 400 FAILED_PRECONDITION: The request has violated one or more Org Policies: violations {
type: "constraints/gcp.restrictNonCmekServices"
subject: "orgpolicy:projects/"
description: "Constraint constraints/gcp.restrictNonCmekServices violated for projects/<project> attempting to create a resource without specifying a KMS CryptoKey."
}

Root cause

• agents-cli deploy --help exposes flags for --network-attachment, --service-account, --agent-gateway-*, etc., but has no --kms-key / --encryption-spec flag.
• The underlying SDK (vertexai.agent_engines._agent_engines.create(), in google_cloud_aiplatform==1.165.1 as vendored by the CLI) already accepts an encryption_spec: Optional[aip_types.EncryptionSpec] parameter — the capability exists in the SDK layer, it's just never threaded through google/agents/cli/deploy/cmd_deploy.py / agent_runtime.py.

Requested fix

Add a --kms-key (or --encryption-spec) flag to agents-cli deploy for the agent_runtime target

What will this enable you to do?

Any organization that mandates CMEK for Vertex AI resources (a common enterprise/regulated-industry policy) cannot deploy to Agent Runtime via agents-cli at all — there is no workaround short of bypassing the CLI and calling the

Additional context

No response