From edc83b5283dc00939b586dd701630448174e07e1 Mon Sep 17 00:00:00 2001 From: artberger <20074219+artberger@users.noreply.github.com> Date: Fri, 4 Sep 2026 06:48:38 +0000 Subject: [PATCH] docs: Update kagent and kmcp API reference docs Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- docs-site/content/kagent/resources/api-ref.md | 787 +----------------- docs-site/content/kagent/resources/helm.md | 151 +--- 2 files changed, 26 insertions(+), 912 deletions(-) diff --git a/docs-site/content/kagent/resources/api-ref.md b/docs-site/content/kagent/resources/api-ref.md index f4eb0bfd..e897201f 100644 --- a/docs-site/content/kagent/resources/api-ref.md +++ b/docs-site/content/kagent/resources/api-ref.md @@ -14,359 +14,9 @@ author: kagent.dev Package v1alpha2 contains API Schema definitions for the kagent.dev v1alpha2 API group. ### Resource Types -- [Agent](#agent) -- [AgentHarness](#agentharness) - [ModelConfig](#modelconfig) - [ModelProviderConfig](#modelproviderconfig) - [RemoteMCPServer](#remotemcpserver) -- [SandboxAgent](#sandboxagent) - -#### A2AConfig - -_Appears in:_ -- [DeclarativeAgentSpec](#declarativeagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `skills` _[AgentSkill](#agentskill) array_ | | | MinItems: 1
| - -#### Agent - -Agent is the Schema for the agents API. - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `apiVersion` _string_ | `kagent.dev/v1alpha2` | | | -| `kind` _string_ | `Agent` | | | -| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | -| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | -| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | -| `spec` _[AgentSpec](#agentspec)_ | | | | -| `status` _[AgentStatus](#agentstatus)_ | | | | - -#### AgentHarness - -AgentHarness is a generic remote execution environment provisioned by a -backend (OpenClaw or Hermes) running on Agent Substrate. - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `apiVersion` _string_ | `kagent.dev/v1alpha2` | | | -| `kind` _string_ | `AgentHarness` | | | -| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | -| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | -| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | -| `spec` _[AgentHarnessSpec](#agentharnessspec)_ | | | | -| `status` _[AgentHarnessStatus](#agentharnessstatus)_ | | | | - -#### AgentHarnessBackendType - -_Underlying type:_ _string_ - -AgentHarnessBackendType selects which sandbox control plane provisions the -environment. Additional backends may be added in the future. - -_Validation:_ -- Enum: [openclaw hermes] - -_Appears in:_ -- [AgentHarnessSpec](#agentharnessspec) -- [AgentHarnessStatusRef](#agentharnessstatusref) - -| Field | Description | -| --- | --- | -| `openclaw` | | -| `hermes` | | - -#### AgentHarnessChannel - -AgentHarnessChannel declares one messenger binding inside a harness VM. - -_Appears in:_ -- [AgentHarnessSpec](#agentharnessspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `name` _string_ | Name is a stable id for this binding (OpenClaw channels.*.accounts key). | | MinLength: 1
| -| `type` _[AgentHarnessChannelType](#agentharnesschanneltype)_ | | | Enum: [telegram slack]
| -| `telegram` _[AgentHarnessTelegramChannelSpec](#agentharnesstelegramchannelspec)_ | | | | -| `slack` _[AgentHarnessSlackChannelSpec](#agentharnessslackchannelspec)_ | Slack configures Slack when type is Slack. | | | - -#### AgentHarnessChannelAccess - -_Underlying type:_ _string_ - -AgentHarnessChannelAccess controls whether the bot listens broadly or only on an allowlist. - -_Validation:_ -- Enum: [allowlist open disabled] - -_Appears in:_ -- [AgentHarnessOpenClawSlackOptions](#agentharnessopenclawslackoptions) - -| Field | Description | -| --- | --- | -| `allowlist` | | -| `open` | | -| `disabled` | | - -#### AgentHarnessChannelCredential - -AgentHarnessChannelCredential supplies a token from an inline value or a Secret/ConfigMap key. - -_Appears in:_ -- [AgentHarnessSlackChannelSpec](#agentharnessslackchannelspec) -- [AgentHarnessTelegramChannelSpec](#agentharnesstelegramchannelspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `value` _string_ | | | MaxLength: 8192
| -| `valueFrom` _[ValueSource](#valuesource)_ | | | | - -#### AgentHarnessChannelType - -_Underlying type:_ _string_ - -AgentHarnessChannelType selects a messenger integration for OpenClaw harness VMs. - -_Validation:_ -- Enum: [telegram slack] - -_Appears in:_ -- [AgentHarnessChannel](#agentharnesschannel) - -| Field | Description | -| --- | --- | -| `telegram` | | -| `slack` | | - -#### AgentHarnessConnection - -AgentHarnessConnection describes how clients reach the provisioned harness VM. - -_Appears in:_ -- [AgentHarnessStatus](#agentharnessstatus) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `endpoint` _string_ | Endpoint is the backend-specific address (gRPC target, SSH host:port,
...) clients should use to reach the harness. | | | - -#### AgentHarnessHermesSlackOptions - -AgentHarnessHermesSlackOptions configures Hermes-specific Slack settings (env vars in the sandbox). - -_Appears in:_ -- [AgentHarnessSlackChannelSpec](#agentharnessslackchannelspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `allowedUserIDs` _string array_ | AllowedUserIDs restricts which Slack member IDs may interact with the bot (SLACK_ALLOWED_USERS). | | MaxItems: 1024
| -| `allowedUserIDsFrom` _[ValueSource](#valuesource)_ | | | | -| `homeChannel` _string_ | HomeChannel is the default Slack channel ID for cron/scheduled messages (SLACK_HOME_CHANNEL). | | | -| `homeChannelName` _string_ | HomeChannelName is a human-readable label for HomeChannel (SLACK_HOME_CHANNEL_NAME). | | | - -#### AgentHarnessOpenClawSlackOptions - -AgentHarnessOpenClawSlackOptions configures OpenClaw-specific Slack routing. - -_Appears in:_ -- [AgentHarnessSlackChannelSpec](#agentharnessslackchannelspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `channelAccess` _[AgentHarnessChannelAccess](#agentharnesschannelaccess)_ | | | Enum: [allowlist open disabled]
| -| `allowlistChannels` _string array_ | AllowlistChannels is required when channelAccess is allowlist. | | MaxItems: 1024
| -| `interactiveReplies` _boolean_ | | true | | - -#### AgentHarnessSlackChannelSpec - -AgentHarnessSlackChannelSpec configures Slack when AgentHarnessChannel.type is Slack. -Backend-specific settings live under the matching backend key; AgentHarnessSpec validation -requires the key to match spec.backend. - -_Appears in:_ -- [AgentHarnessChannel](#agentharnesschannel) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `botToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | | -| `appToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | | -| `openclaw` _[AgentHarnessOpenClawSlackOptions](#agentharnessopenclawslackoptions)_ | OpenClaw configures OpenClaw-specific Slack routing. | | | -| `hermes` _[AgentHarnessHermesSlackOptions](#agentharnesshermesslackoptions)_ | Hermes configures Hermes-specific Slack settings. | | | - -#### AgentHarnessSpec - -AgentHarnessSpec describes a generic remote execution environment that agents -(or human operators) can attach to via exec or SSH. - -An AgentHarness is distinct from a SandboxAgent: it has no agent runtime baked -in. The backend is responsible for provisioning an environment that stays -ready to accept incoming commands. - -_Appears in:_ -- [AgentHarness](#agentharness) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `backend` _[AgentHarnessBackendType](#agentharnessbackendtype)_ | Backend selects the control plane to use. Required. | | Enum: [openclaw hermes]
| -| `substrate` _[AgentHarnessSubstrateSpec](#agentharnesssubstratespec)_ | Substrate configures the Agent Substrate provisioning stack. Required. | | | -| `description` _string_ | Description is a short human-readable summary shown in the UI (e.g. agents list). | | | -| `image` _string_ | Image is the container image to run in the harness VM, if the backend
supports per-resource images. Backend openclaw pins the image
to the OpenClaw sandbox base when this field is empty; backend hermes pins
to the Hermes sandbox base image when empty. | | | -| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | Env is a list of environment variables injected into the harness workload.
Values use the Kubernetes EnvVar shape; ValueFrom references are
resolved server-side where supported. | | | -| `modelConfigRef` _string_ | ModelConfigRef is the reference to the ModelConfig used to configure the harness.
The controller registers the gateway provider and, after the harness is Ready,
writes OpenClaw config inside the VM (~/.openclaw/openclaw.json) and starts the gateway. | | | -| `channels` _[AgentHarnessChannel](#agentharnesschannel) array_ | Channels configures Telegram and Slack integrations for OpenClaw inside the harness VM. | | MaxItems: 1024
| - -#### AgentHarnessStatus - -AgentHarnessStatus is the observed state of an AgentHarness. - -_Appears in:_ -- [AgentHarness](#agentharness) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `observedGeneration` _integer_ | | | | -| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#condition-v1-meta) array_ | | | | -| `backendRef` _[AgentHarnessStatusRef](#agentharnessstatusref)_ | BackendRef points at the harness instance on the backend control
plane, once Ensure has succeeded at least once. | | | -| `connection` _[AgentHarnessConnection](#agentharnessconnection)_ | Connection is populated by the controller when the harness is ready. | | | - -#### AgentHarnessStatusRef - -AgentHarnessStatusRef identifies a harness instance on an external control plane. - -_Appears in:_ -- [AgentHarnessStatus](#agentharnessstatus) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `backend` _[AgentHarnessBackendType](#agentharnessbackendtype)_ | | | Enum: [openclaw hermes]
| -| `id` _string_ | | | | - -#### AgentHarnessSubstrateSnapshotsConfig - -AgentHarnessSubstrateSnapshotsConfig points at a GCS prefix for actor memory snapshots. -Substrate currently expects a gs:// location (see Agent Substrate SnapshotsConfig). - -_Appears in:_ -- [AgentHarnessSubstrateSpec](#agentharnesssubstratespec) -- [SandboxSubstrateSpec](#sandboxsubstratespec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `location` _string_ | Location is the GCS URI prefix for golden and incremental snapshots.
Example: gs://ate-snapshots/kagent/my-namespace/my-harness/ | | Pattern: `^gs://`
| - -#### AgentHarnessSubstrateSpec - -AgentHarnessSubstrateSpec configures Agent Substrate (WorkerPool + ActorTemplate + Actor). - -kagent generates a per-harness ActorTemplate and creates an Actor from it. WorkerPool -capacity is referenced from workerPoolRef or the controller default; it is not -created or deleted by the AgentHarness controller. - -_Appears in:_ -- [AgentHarnessSpec](#agentharnessspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `workerPoolRef` _[TypedLocalReference](#typedlocalreference)_ | WorkerPoolRef references an existing ate.dev WorkerPool in the harness namespace.
When unset, the controller uses its configured default WorkerPool. | | | -| `snapshotsConfig` _[AgentHarnessSubstrateSnapshotsConfig](#agentharnesssubstratesnapshotsconfig)_ | SnapshotsConfig configures actor memory snapshots. Defaults to
gs://ate-snapshots/<namespace>/<agentharnessname> when unset. | | | -| `workloadImage` _string_ | WorkloadImage overrides the default openclaw sandbox image in the ActorTemplate. | | | - -#### AgentHarnessTelegramChannelSpec - -AgentHarnessTelegramChannelSpec configures Telegram when AgentHarnessChannel.type is Telegram. - -_Appears in:_ -- [AgentHarnessChannel](#agentharnesschannel) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `botToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | | -| `allowedUserIDs` _string array_ | | | MaxItems: 1024
| -| `allowedUserIDsFrom` _[ValueSource](#valuesource)_ | | | | - -#### AgentProvider - -AgentProvider identifies the organization responsible for an agent on its A2A AgentCard. - -_Appears in:_ -- [AgentSpec](#agentspec) -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `organization` _string_ | Organization is the name of the agent provider's organization. | | MinLength: 1
| -| `url` _string_ | URL is a URL for the agent provider's website or relevant documentation. | | Format: uri
| - -#### AgentSkill - -AgentSkill describes a specific capability or function of the agent. - -_Appears in:_ -- [A2AConfig](#a2aconfig) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `id` _string_ | ID is the unique identifier for the skill. | | | -| `name` _string_ | Name is the human-readable name of the skill. | | MinLength: 1
| -| `description` _string_ | Description is an optional detailed description of the skill. | | | -| `tags` _string array_ | Tags are optional tags for categorization. | | MaxItems: 20
| -| `examples` _string array_ | Examples are optional usage examples. | | MaxItems: 20
| -| `inputModes` _string array_ | InputModes are the supported input MIME types for this skill, overriding the agent's defaults. | | | -| `outputModes` _string array_ | OutputModes are the supported output MIME types for this skill, overriding the agent's defaults. | | | - -#### AgentSpec - -AgentSpec defines the desired state of Agent. - -_Appears in:_ -- [Agent](#agent) -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `type` _[AgentType](#agenttype)_ | | Declarative | Enum: [Declarative BYO]
| -| `byo` _[BYOAgentSpec](#byoagentspec)_ | BYO configures a "bring your own" agent backed by a user-provided
container image. Kagent deploys the image and expects it to serve the
agent over the A2A protocol on port 8080.
Required if type is BYO. | | | -| `declarative` _[DeclarativeAgentSpec](#declarativeagentspec)_ | Declarative configures an agent that is fully described by this resource
(model, instructions, tools) and runs on one of kagent's built-in runtimes.
Required if type is Declarative. | | | -| `description` _string_ | | | | -| `iconUrl` _string_ | IconURL is a URL to an icon representing the agent. It is surfaced on the
agent's A2A AgentCard. | | Format: uri
| -| `documentationUrl` _string_ | DocumentationURL is a URL to human-readable documentation for the agent. It
is surfaced on the agent's A2A AgentCard. | | Format: uri
| -| `version` _string_ | Version is the agent's version string, surfaced on the A2A AgentCard. | | | -| `provider` _[AgentProvider](#agentprovider)_ | Provider identifies the organization responsible for the agent. It is
surfaced on the agent's A2A AgentCard. | | | -| `skills` _[SkillForAgent](#skillforagent)_ | Skills to load into the agent. They will be pulled from OCI images, git repos,
and/or S3, and made available to the agent under the `/skills` folder. | | | -| `sandbox` _[SandboxConfig](#sandboxconfig)_ | Sandbox configures sandboxed execution behavior shared across runtimes.
This is intended for sandboxed declarative execution today, and can also
be consumed by BYO agents. | | | -| `allowedNamespaces` _[AllowedNamespaces](#allowednamespaces)_ | AllowedNamespaces defines which namespaces are allowed to reference this Agent as a tool.
This follows the Gateway API pattern for cross-namespace route attachments.
If not specified, only Agents in the same namespace can reference this Agent as a tool.
This field only applies when this Agent is used as a tool by another Agent.
See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-route-attachment | | | - -#### AgentStatus - -AgentStatus defines the observed state of Agent. - -_Appears in:_ -- [Agent](#agent) -- [SandboxAgent](#sandboxagent) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `observedGeneration` _integer_ | | | | -| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#condition-v1-meta) array_ | | | | - -#### AgentType - -_Underlying type:_ _string_ - -AgentType represents the agent type - -_Validation:_ -- Enum: [Declarative BYO] - -_Appears in:_ -- [AgentSpec](#agentspec) -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | -| --- | --- | -| `Declarative` | | -| `BYO` | | #### AllowedNamespaces @@ -377,9 +27,7 @@ following the pattern used by Gateway API for cross-namespace route attachments. By default (when not specified), only references from the same namespace are allowed. _Appears in:_ -- [AgentSpec](#agentspec) - [RemoteMCPServerSpec](#remotemcpserverspec) -- [SandboxAgentSpec](#sandboxagentspec) | Field | Description | Default | Validation | | --- | --- | --- | --- | @@ -433,16 +81,6 @@ _Appears in:_ | `maxTokens` _integer_ | Maximum tokens to generate | | | | `topP` _string_ | Top-p sampling parameter | | | -#### BYOAgentSpec - -_Appears in:_ -- [AgentSpec](#agentspec) -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `deployment` _[ByoDeploymentSpec](#byodeploymentspec)_ | Deployment configures the Kubernetes Deployment created for the BYO agent container. | | | - #### BaseVertexAIConfig _Appears in:_ @@ -486,142 +124,19 @@ _Appears in:_ | `version` _string_ | Version is the guardrail version: a numeric version (e.g. "1") or "DRAFT". | | MaxLength: 8
MinLength: 1
| | `trace` _string_ | | disabled | Enum: [disabled enabled enabled_full]
| -#### ByoDeploymentSpec - -_Appears in:_ -- [BYOAgentSpec](#byoagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `image` _string_ | Image is the container image of the BYO agent.
The image is expected to serve the agent over the A2A protocol on port 8080. | | MinLength: 1
| -| `cmd` _string_ | Cmd overrides the container entrypoint (the container's command). | | | -| `args` _string array_ | Args are the arguments passed to the container entrypoint. | | | -| `workingDir` _string_ | workingDir sets the container working directory. Defaults to the image WORKDIR when omitted. | | | -| `replicas` _integer_ | Replicas is the number of desired agent pods. Defaults to 1. | | | -| `imagePullSecrets` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core) array_ | ImagePullSecrets are references to secrets in the agent's namespace
used for pulling the agent container image. | | | -| `volumes` _[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#volume-v1-core) array_ | Volumes are additional volumes added to the agent pod. | | | -| `volumeMounts` _[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#volumemount-v1-core) array_ | VolumeMounts are additional volume mounts added to the agent container. | | | -| `labels` _object (keys:string, values:string)_ | Labels are additional labels added to the agent pods. | | | -| `annotations` _object (keys:string, values:string)_ | Annotations are additional annotations added to the agent pods. | | | -| `deploymentAnnotations` _object (keys:string, values:string)_ | DeploymentAnnotations are additional annotations added to the agent Deployment
object itself. Unlike Annotations, which apply to the agent pods, these apply to
the Deployment metadata. Keys set here take precedence over annotations inherited
from the agent resource metadata. This has no effect when the agent runs with the
Sandbox workload mode, as no Deployment is created in that mode. | | | -| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | Env are additional environment variables set on the agent container. | | | -| `envFrom` _[EnvFromSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envfromsource-v1-core) array_ | EnvFrom are sources (ConfigMaps/Secrets) used to populate environment variables
on the agent container. Values defined in Env with a duplicate key take precedence. | | | -| `imagePullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#pullpolicy-v1-core)_ | | | | -| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#resourcerequirements-v1-core)_ | | | | -| `tolerations` _[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#toleration-v1-core) array_ | Tolerations applied to the agent pods. | | | -| `affinity` _[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#affinity-v1-core)_ | | | | -| `topologySpreadConstraints` _[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#topologyspreadconstraint-v1-core) array_ | TopologySpreadConstraints describes how a group of pods ought to spread across topology
domains. All topologySpreadConstraints are ANDed. | | | -| `nodeSelector` _object (keys:string, values:string)_ | NodeSelector restricts the nodes the agent pods can be scheduled on. | | | -| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#securitycontext-v1-core)_ | | | | -| `podSecurityContext` _[PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#podsecuritycontext-v1-core)_ | | | | -| `serviceAccountName` _string_ | ServiceAccountName specifies the name of an existing ServiceAccount to use.
If this field is set, the Agent controller will not create a ServiceAccount for the agent.
This field is mutually exclusive with ServiceAccountConfig. | | | -| `serviceAccountConfig` _[ServiceAccountConfig](#serviceaccountconfig)_ | ServiceAccountConfig configures the ServiceAccount created by the Agent controller.
This field can only be used when ServiceAccountName is not set.
If ServiceAccountName is not set, a default ServiceAccount (named after the agent)
is created, and this config will be applied to it. | | | -| `extraContainers` _[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#container-v1-core) array_ | ExtraContainers is a list of additional containers to run alongside the main agent container.
Useful for sidecars such as token proxies, log shippers, or security agents. | | | - -#### ContextCompressionConfig - -ContextCompressionConfig configures event history compaction/compression. - -_Appears in:_ -- [ContextConfig](#contextconfig) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `compactionInterval` _integer_ | The number of *new* user-initiated invocations that, once fully represented in the session's events, will trigger a compaction. | 5 | Minimum: 1
| -| `overlapSize` _integer_ | The number of preceding invocations to include from the end of the last compacted range. This creates an overlap between consecutive compacted summaries, maintaining context. | 2 | Minimum: 0
| -| `summarizer` _[ContextSummarizerConfig](#contextsummarizerconfig)_ | Summarizer configures an LLM-based summarizer for event compaction.
If not specified, compacted events are dropped from the context without summarization. | | | -| `tokenThreshold` _integer_ | Post-invocation token threshold trigger. If set, ADK will attempt a post-invocation compaction when the most recently
observed prompt token count meets or exceeds this threshold. | | | -| `eventRetentionSize` _integer_ | EventRetentionSize is the number of most recent events to always retain. | | | - -#### ContextConfig - -ContextConfig configures context management for an agent. - -_Appears in:_ -- [DeclarativeAgentSpec](#declarativeagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `compaction` _[ContextCompressionConfig](#contextcompressionconfig)_ | Compaction configures event history compaction.
When enabled, older events in the conversation are compacted (compressed/summarized)
to reduce context size while preserving key information. | | | - -#### ContextSummarizerConfig - -ContextSummarizerConfig configures the LLM-based event summarizer. - -_Appears in:_ -- [ContextCompressionConfig](#contextcompressionconfig) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `modelConfig` _string_ | ModelConfig is the name of a ModelConfig resource to use for summarization.
Must be in the same namespace as the Agent.
If not specified, uses the agent's own model. | | | -| `promptTemplate` _string_ | PromptTemplate is a custom prompt template for the summarizer.
See the ADK LlmEventSummarizer for template details:
https://github.com/google/adk-python/blob/main/src/google/adk/apps/llm_event_summarizer.py | | | - -#### DeclarativeAgentSpec - -_Appears in:_ -- [AgentSpec](#agentspec) -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `runtime` _[DeclarativeRuntime](#declarativeruntime)_ | Runtime specifies which ADK implementation to use for this agent.
- "go": Uses the Go ADK (default, faster startup, most features supported)
- "python": Uses the Python ADK (slower startup, full feature set)
The runtime determines both the container image and readiness probe configuration. | go | Enum: [python go]
| -| `systemMessage` _string_ | SystemMessage is a string specifying the system message for the agent.
When PromptTemplate is set, this field is treated as a Go text/template
with access to an include("source/key") function and agent context variables
such as .AgentName, .AgentNamespace, .Description, .ToolNames, and .SkillNames. | | | -| `systemMessageFrom` _[ValueSource](#valuesource)_ | SystemMessageFrom is a reference to a ConfigMap or Secret containing the system message.
When PromptTemplate is set, the resolved value is treated as a Go text/template. | | | -| `promptTemplate` _[PromptTemplateSpec](#prompttemplatespec)_ | PromptTemplate enables Go text/template processing on the systemMessage field.
When set, systemMessage is treated as a Go template with access to the include function
and agent context variables. | | | -| `modelConfig` _string_ | The name of the model config to use.
If not specified, the default value is "default-model-config".
Must be in the same namespace as the Agent. | | | -| `stream` _boolean_ | Whether to stream the response from the model.
If not specified, the default value is false. | | | -| `tools` _[Tool](#tool) array_ | | | MaxItems: 20
| -| `a2aConfig` _[A2AConfig](#a2aconfig)_ | A2AConfig instantiates an A2A server for this agent,
served on the HTTP port of the kagent kubernetes
controller (default 8083).
The A2A server URL will be served at
<kagent-controller-ip>:8083/api/a2a/<agent-namespace>/<agent-name>
Read more about the A2A protocol here: https://github.com/a2aproject/A2A | | | -| `deployment` _[DeclarativeDeploymentSpec](#declarativedeploymentspec)_ | | | | -| `memory` _[MemorySpec](#memoryspec)_ | Memory configuration for the agent. | | | -| `shareTools` _boolean_ | ShareTools enables the built-in share link tools for this agent.
When true, the agent gains create_share_link, list_share_links, and delete_share_link tools
that allow it to manage share tokens for the current session. | | | -| `context` _[ContextConfig](#contextconfig)_ | Context configures context management for this agent.
This includes event compaction (compression) and context caching. | | | - -#### DeclarativeDeploymentSpec - -_Appears in:_ -- [DeclarativeAgentSpec](#declarativeagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `imageRegistry` _string_ | | | | -| `replicas` _integer_ | Replicas is the number of desired agent pods. Defaults to 1. | | | -| `imagePullSecrets` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core) array_ | ImagePullSecrets are references to secrets in the agent's namespace
used for pulling the agent container image. | | | -| `volumes` _[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#volume-v1-core) array_ | Volumes are additional volumes added to the agent pod. | | | -| `volumeMounts` _[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#volumemount-v1-core) array_ | VolumeMounts are additional volume mounts added to the agent container. | | | -| `labels` _object (keys:string, values:string)_ | Labels are additional labels added to the agent pods. | | | -| `annotations` _object (keys:string, values:string)_ | Annotations are additional annotations added to the agent pods. | | | -| `deploymentAnnotations` _object (keys:string, values:string)_ | DeploymentAnnotations are additional annotations added to the agent Deployment
object itself. Unlike Annotations, which apply to the agent pods, these apply to
the Deployment metadata. Keys set here take precedence over annotations inherited
from the agent resource metadata. This has no effect when the agent runs with the
Sandbox workload mode, as no Deployment is created in that mode. | | | -| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | Env are additional environment variables set on the agent container. | | | -| `envFrom` _[EnvFromSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envfromsource-v1-core) array_ | EnvFrom are sources (ConfigMaps/Secrets) used to populate environment variables
on the agent container. Values defined in Env with a duplicate key take precedence. | | | -| `imagePullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#pullpolicy-v1-core)_ | | | | -| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#resourcerequirements-v1-core)_ | | | | -| `tolerations` _[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#toleration-v1-core) array_ | Tolerations applied to the agent pods. | | | -| `affinity` _[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#affinity-v1-core)_ | | | | -| `topologySpreadConstraints` _[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#topologyspreadconstraint-v1-core) array_ | TopologySpreadConstraints describes how a group of pods ought to spread across topology
domains. All topologySpreadConstraints are ANDed. | | | -| `nodeSelector` _object (keys:string, values:string)_ | NodeSelector restricts the nodes the agent pods can be scheduled on. | | | -| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#securitycontext-v1-core)_ | | | | -| `podSecurityContext` _[PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#podsecuritycontext-v1-core)_ | | | | -| `serviceAccountName` _string_ | ServiceAccountName specifies the name of an existing ServiceAccount to use.
If this field is set, the Agent controller will not create a ServiceAccount for the agent.
This field is mutually exclusive with ServiceAccountConfig. | | | -| `serviceAccountConfig` _[ServiceAccountConfig](#serviceaccountconfig)_ | ServiceAccountConfig configures the ServiceAccount created by the Agent controller.
This field can only be used when ServiceAccountName is not set.
If ServiceAccountName is not set, a default ServiceAccount (named after the agent)
is created, and this config will be applied to it. | | | -| `extraContainers` _[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#container-v1-core) array_ | ExtraContainers is a list of additional containers to run alongside the main agent container.
Useful for sidecars such as token proxies, log shippers, or security agents. | | | - -#### DeclarativeRuntime +#### FoundryAPIFormat _Underlying type:_ _string_ -DeclarativeRuntime represents the runtime implementation for declarative agents - -_Validation:_ -- Enum: [python go] +FoundryAPIFormat selects the Foundry API format for a Foundry ModelConfig. _Appears in:_ -- [DeclarativeAgentSpec](#declarativeagentspec) +- [FoundryConfig](#foundryconfig) | Field | Description | | --- | --- | -| `python` | | -| `go` | | +| `OpenAI` | | +| `Anthropic` | | #### FoundryConfig @@ -641,7 +156,8 @@ _Appears in:_ | `endpoint` _string_ | Endpoint is the Foundry or Azure AI Services account endpoint
(e.g., https://my-account.cognitiveservices.azure.com/).
Mutually exclusive with EndpointFrom. | | | | `endpointFrom` _[ConfigMapKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#configmapkeyselector-v1-core)_ | EndpointFrom resolves the Foundry endpoint from a ConfigMap key, such as
one written by Azure Service Operator. Mutually exclusive with Endpoint.

The selector's optional flag only controls how a missing key is handled: when
set to true, the missing key is ignored while reading the ConfigMap, but a
Foundry endpoint must always be supplied, so an unresolved endpointFrom still
leaves the model unusable and the agent fails to start. | | | | `deployment` _string_ | Deployment is the Foundry model deployment name. | | | -| `apiVersion` _string_ | APIVersion is the Foundry OpenAI-compatible data-plane API version. | 2024-10-21 | | +| `apiVersion` _string_ | APIVersion is the Foundry OpenAI-compatible data-plane API version.
Ignored when APIFormat is Anthropic (the Messages surface is versioned via
the anthropic-version header instead). | 2024-10-21 | | +| `apiFormat` _[FoundryAPIFormat](#foundryapiformat)_ | APIFormat selects the Foundry API format: "OpenAI" (default, chat
completions) or "Anthropic" (Claude models served over the Anthropic
Messages API). | OpenAI | Enum: [OpenAI Anthropic]
| #### FromNamespaces @@ -704,20 +220,6 @@ _Appears in:_ | `candidateCount` _integer_ | Candidate count | | | | `responseMimeType` _string_ | Response mime type | | | -#### GitRepo - -GitRepo specifies a single Git repository to fetch skills from. - -_Appears in:_ -- [SkillForAgent](#skillforagent) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `url` _string_ | URL of the git repository (HTTPS or SSH). | | | -| `ref` _string_ | Git reference: branch name, tag, or commit SHA. | main | | -| `path` _string_ | Subdirectory within the repo to use as the skill root. The API validates
this input path, but treats repository contents as trusted: symlinks under
this path are dereferenced when materializing the skill. | | | -| `name` _string_ | Name for the skill directory under /skills. If omitted, defaults to the last
segment of Path when Path is set; otherwise defaults to the repo name (last
URL path segment, without .git). | | | - #### MCPTool _Appears in:_ @@ -728,33 +230,6 @@ _Appears in:_ | `name` _string_ | | | | | `description` _string_ | | | | -#### McpServerTool - -_Appears in:_ -- [Tool](#tool) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `kind` _string_ | | | | -| `apiGroup` _string_ | | | | -| `name` _string_ | | | | -| `namespace` _string_ | | | | -| `toolNames` _string array_ | The names of the tools to be provided by the ToolServer
For a list of all the tools provided by the server,
the client can query the status of the ToolServer object after it has been created | | MaxItems: 50
| -| `requireApproval` _string array_ | RequireApproval lists tool names that require human approval before
execution. Each name must also appear in ToolNames. When a tool in
this list is invoked by the agent, execution pauses and the user is
prompted to approve or reject the call. | | MaxItems: 50
| -| `allowedHeaders` _string array_ | AllowedHeaders specifies which headers from the A2A request should be
propagated to MCP tool calls. Header names are case-insensitive.

Authorization header behavior:
- Authorization headers CAN be propagated if explicitly listed in allowedHeaders
- When STS token propagation is enabled, STS-generated Authorization headers
will take precedence and replace any Authorization header from the A2A request
- This is a security measure to prevent request headers from overwriting
authentication tokens generated by the STS integration

Example: ["x-user-email", "x-tenant-id"] | | | - -#### MemorySpec - -MemorySpec enables long-term memory for an agent. - -_Appears in:_ -- [DeclarativeAgentSpec](#declarativeagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `modelConfig` _string_ | ModelConfig is the name of the ModelConfig object whose embedding
provider will be used to generate memory vectors. | | | -| `ttlDays` _integer_ | TTLDays controls how many days a stored memory entry remains valid before
it is eligible for pruning. Defaults to 15 days when unset or zero. | | Minimum: 1
| - #### ModelConfig ModelConfig is the Schema for the modelconfigs API. @@ -879,17 +354,6 @@ _Appears in:_ | `lastDiscoveryTime` _[Time](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#time-v1-meta)_ | LastDiscoveryTime is the timestamp of the last successful model discovery | | | | `secretHash` _string_ | SecretHash is a hash of the referenced secret data, used to detect secret changes | | | -#### NetworkConfig - -NetworkConfig configures outbound network access for sandboxed execution paths. - -_Appears in:_ -- [SandboxConfig](#sandboxconfig) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `allowedDomains` _string array_ | AllowedDomains lists the domains that sandboxed execution may contact.
Wildcards such as *.example.com are supported by the sandbox runtime. | | | - #### OllamaConfig OllamaConfig contains Ollama-specific configuration options @@ -939,7 +403,7 @@ _Appears in:_ | `seed` _integer_ | Seed value | | | | `n` _integer_ | N value | | | | `timeout` _integer_ | Timeout | | | -| `reasoningEffort` _[OpenAIReasoningEffort](#openaireasoningeffort)_ | Reasoning effort | | Enum: [none minimal low medium high xhigh]
| +| `reasoningEffort` _[OpenAIReasoningEffort](#openaireasoningeffort)_ | Reasoning effort | | Enum: [none minimal low medium high xhigh max]
| | `apiFormat` _[OpenAIAPIFormat](#openaiapiformat)_ | APIFormat selects which OpenAI HTTP API the runtime uses for this model.
chatCompletions (default) posts to /v1/chat/completions.
responses posts to /v1/responses. Use responses for OpenAI-compatible
gateways or models that require the Responses API. | chatCompletions | Enum: [chatCompletions responses]
| | `tokenExchange` _[TokenExchangeConfig](#tokenexchangeconfig)_ | TokenExchange configures dynamic bearer token acquisition via credential exchange.
Requires apiKeySecret (used as the service account secret) and is mutually exclusive with apiKeyPassthrough. | | | @@ -952,38 +416,11 @@ Supported values vary by model. Set to "none" to disable reasoning; some models require this to use function tools via the Chat Completions API. _Validation:_ -- Enum: [none minimal low medium high xhigh] +- Enum: [none minimal low medium high xhigh max] _Appears in:_ - [OpenAIConfig](#openaiconfig) -#### PromptSource - -PromptSource references a ConfigMap whose keys are available as prompt fragments. -In systemMessage templates, use include("alias/key") (or include("name/key") if no alias is set) -to insert the value of a specific key from this source. - -_Appears in:_ -- [PromptTemplateSpec](#prompttemplatespec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `kind` _string_ | | | | -| `apiGroup` _string_ | | | | -| `name` _string_ | | | | -| `alias` _string_ | Alias is an optional short identifier for use in include directives.
If set, use include("alias/key") instead of include("name/key"). | | | - -#### PromptTemplateSpec - -PromptTemplateSpec configures prompt template processing for an agent's system message. - -_Appears in:_ -- [DeclarativeAgentSpec](#declarativeagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `dataSources` _[PromptSource](#promptsource) array_ | DataSources defines the ConfigMaps whose keys can be included in the systemMessage
using Go template syntax, e.g. include("alias/key") or include("name/key"). | | MaxItems: 20
| - #### RemoteMCPServer RemoteMCPServer is the Schema for the RemoteMCPServers API. @@ -1046,23 +483,6 @@ _Appears in:_ | `discoveredTools` _[MCPTool](#mcptool) array_ | | | | | `secretHash` _string_ | SecretHash stores a hash of the TLS Secret referenced by spec.tls so
agents that consume this RemoteMCPServer can detect cert rotation and
roll on the next reconcile. Empty when spec.tls.caCertSecretRef is unset. | | | -#### S3SkillRef - -S3SkillRef specifies a skill bundle in an S3 bucket. - -Two bundle shapes are supported: - - Prefix: s3://bucket/path/to/skill/ containing SKILL.md (and siblings); synced recursively - - Archive: a single .zip / .tgz / .tar.gz object; downloaded and extracted - -_Appears in:_ -- [SkillForAgent](#skillforagent) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `uri` _string_ | S3 URI of the skill: s3://bucket/key-or-prefix | | MinLength: 1
Pattern: `^s3://.+`
| -| `region` _string_ | AWS region for the bucket. Optional when AWS_REGION / AWS_DEFAULT_REGION is set
on the skills-init container (e.g. via initContainer.env). | | | -| `name` _string_ | Name for the skill directory under /skills. If omitted, defaults to the last
non-empty path segment of the URI (archive extension stripped). | | | - #### SAPAICoreConfig SAPAICoreConfig contains SAP AI Core-specific configuration options. @@ -1076,65 +496,6 @@ _Appears in:_ | `resourceGroup` _string_ | Resource group in SAP AI Core | default | | | `authUrl` _string_ | OAuth2 token endpoint URL (e.g., https://tenant.authentication.eu10.hana.ondemand.com) | | | -#### SandboxAgent - -SandboxAgent declares an agent that runs in an isolated sandbox on Agent Substrate. - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `apiVersion` _string_ | `kagent.dev/v1alpha2` | | | -| `kind` _string_ | `SandboxAgent` | | | -| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | -| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | -| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | -| `spec` _[SandboxAgentSpec](#sandboxagentspec)_ | | | | -| `status` _[AgentStatus](#agentstatus)_ | | | | - -#### SandboxAgentSpec - -_Appears in:_ -- [SandboxAgent](#sandboxagent) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `type` _[AgentType](#agenttype)_ | | Declarative | Enum: [Declarative BYO]
| -| `byo` _[BYOAgentSpec](#byoagentspec)_ | BYO configures a "bring your own" agent backed by a user-provided
container image. Kagent deploys the image and expects it to serve the
agent over the A2A protocol on port 8080.
Required if type is BYO. | | | -| `declarative` _[DeclarativeAgentSpec](#declarativeagentspec)_ | Declarative configures an agent that is fully described by this resource
(model, instructions, tools) and runs on one of kagent's built-in runtimes.
Required if type is Declarative. | | | -| `description` _string_ | | | | -| `iconUrl` _string_ | IconURL is a URL to an icon representing the agent. It is surfaced on the
agent's A2A AgentCard. | | Format: uri
| -| `documentationUrl` _string_ | DocumentationURL is a URL to human-readable documentation for the agent. It
is surfaced on the agent's A2A AgentCard. | | Format: uri
| -| `version` _string_ | Version is the agent's version string, surfaced on the A2A AgentCard. | | | -| `provider` _[AgentProvider](#agentprovider)_ | Provider identifies the organization responsible for the agent. It is
surfaced on the agent's A2A AgentCard. | | | -| `skills` _[SkillForAgent](#skillforagent)_ | Skills to load into the agent. They will be pulled from OCI images, git repos,
and/or S3, and made available to the agent under the `/skills` folder. | | | -| `sandbox` _[SandboxConfig](#sandboxconfig)_ | Sandbox configures sandboxed execution behavior shared across runtimes.
This is intended for sandboxed declarative execution today, and can also
be consumed by BYO agents. | | | -| `allowedNamespaces` _[AllowedNamespaces](#allowednamespaces)_ | AllowedNamespaces defines which namespaces are allowed to reference this Agent as a tool.
This follows the Gateway API pattern for cross-namespace route attachments.
If not specified, only Agents in the same namespace can reference this Agent as a tool.
This field only applies when this Agent is used as a tool by another Agent.
See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-route-attachment | | | -| `substrate` _[SandboxSubstrateSpec](#sandboxsubstratespec)_ | Substrate is optional Agent Substrate-specific settings. | | | - -#### SandboxConfig - -SandboxConfig configures sandboxed execution behavior. - -_Appears in:_ -- [AgentSpec](#agentspec) -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `network` _[NetworkConfig](#networkconfig)_ | Network configures outbound network access for sandboxed execution paths.
When unset or when allowedDomains is empty, outbound access is denied by default. | | | - -#### SandboxSubstrateSpec - -SandboxSubstrateSpec configures Agent Substrate for a SandboxAgent. -WorkerPool capacity is referenced from workerPoolRef or the controller default. - -_Appears in:_ -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `workerPoolRef` _[TypedLocalReference](#typedlocalreference)_ | WorkerPoolRef references an existing ate.dev WorkerPool. | | | -| `snapshotsConfig` _[AgentHarnessSubstrateSnapshotsConfig](#agentharnesssubstratesnapshotsconfig)_ | SnapshotsConfig configures actor memory snapshots.
Defaults to gs://ate-snapshots/<namespace>/<agentname> when unset. | | | - #### SecretReference SecretReference references a Kubernetes Secret that must contain exactly one data key @@ -1147,75 +508,6 @@ _Appears in:_ | --- | --- | --- | --- | | `name` _string_ | Name is the name of the secret in the same namespace as the ModelProviderConfig. | | | -#### ServiceAccountConfig - -_Appears in:_ -- [ByoDeploymentSpec](#byodeploymentspec) -- [DeclarativeDeploymentSpec](#declarativedeploymentspec) -- [SharedDeploymentSpec](#shareddeploymentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `labels` _object (keys:string, values:string)_ | Labels are additional labels added to the created ServiceAccount. | | | -| `annotations` _object (keys:string, values:string)_ | Annotations are additional annotations added to the created ServiceAccount. | | | - -#### SharedDeploymentSpec - -_Appears in:_ -- [ByoDeploymentSpec](#byodeploymentspec) -- [DeclarativeDeploymentSpec](#declarativedeploymentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `replicas` _integer_ | Replicas is the number of desired agent pods. Defaults to 1. | | | -| `imagePullSecrets` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core) array_ | ImagePullSecrets are references to secrets in the agent's namespace
used for pulling the agent container image. | | | -| `volumes` _[Volume](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#volume-v1-core) array_ | Volumes are additional volumes added to the agent pod. | | | -| `volumeMounts` _[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#volumemount-v1-core) array_ | VolumeMounts are additional volume mounts added to the agent container. | | | -| `labels` _object (keys:string, values:string)_ | Labels are additional labels added to the agent pods. | | | -| `annotations` _object (keys:string, values:string)_ | Annotations are additional annotations added to the agent pods. | | | -| `deploymentAnnotations` _object (keys:string, values:string)_ | DeploymentAnnotations are additional annotations added to the agent Deployment
object itself. Unlike Annotations, which apply to the agent pods, these apply to
the Deployment metadata. Keys set here take precedence over annotations inherited
from the agent resource metadata. This has no effect when the agent runs with the
Sandbox workload mode, as no Deployment is created in that mode. | | | -| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | Env are additional environment variables set on the agent container. | | | -| `envFrom` _[EnvFromSource](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envfromsource-v1-core) array_ | EnvFrom are sources (ConfigMaps/Secrets) used to populate environment variables
on the agent container. Values defined in Env with a duplicate key take precedence. | | | -| `imagePullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#pullpolicy-v1-core)_ | | | | -| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#resourcerequirements-v1-core)_ | | | | -| `tolerations` _[Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#toleration-v1-core) array_ | Tolerations applied to the agent pods. | | | -| `affinity` _[Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#affinity-v1-core)_ | | | | -| `topologySpreadConstraints` _[TopologySpreadConstraint](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#topologyspreadconstraint-v1-core) array_ | TopologySpreadConstraints describes how a group of pods ought to spread across topology
domains. All topologySpreadConstraints are ANDed. | | | -| `nodeSelector` _object (keys:string, values:string)_ | NodeSelector restricts the nodes the agent pods can be scheduled on. | | | -| `securityContext` _[SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#securitycontext-v1-core)_ | | | | -| `podSecurityContext` _[PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#podsecuritycontext-v1-core)_ | | | | -| `serviceAccountName` _string_ | ServiceAccountName specifies the name of an existing ServiceAccount to use.
If this field is set, the Agent controller will not create a ServiceAccount for the agent.
This field is mutually exclusive with ServiceAccountConfig. | | | -| `serviceAccountConfig` _[ServiceAccountConfig](#serviceaccountconfig)_ | ServiceAccountConfig configures the ServiceAccount created by the Agent controller.
This field can only be used when ServiceAccountName is not set.
If ServiceAccountName is not set, a default ServiceAccount (named after the agent)
is created, and this config will be applied to it. | | | -| `extraContainers` _[Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#container-v1-core) array_ | ExtraContainers is a list of additional containers to run alongside the main agent container.
Useful for sidecars such as token proxies, log shippers, or security agents. | | | - -#### SkillForAgent - -_Appears in:_ -- [AgentSpec](#agentspec) -- [SandboxAgentSpec](#sandboxagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `insecureSkipVerify` _boolean_ | Fetch images insecurely from registries (allowing HTTP and skipping TLS verification).
Meant for development and testing purposes only. | | | -| `refs` _string array_ | The list of skill images to fetch. | | MaxItems: 20
MinItems: 1
| -| `imagePullSecrets` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core) array_ | ImagePullSecrets is a list of references to secrets in the same namespace to use for
pulling skill images from private registries. Each referenced secret must be of type
kubernetes.io/dockerconfigjson. The credentials from all secrets are merged and made
available to the skills-init container at /.kagent/.docker/config.json; krane will
use them automatically when pulling images. | | MaxItems: 20
| -| `gitAuthSecretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | Reference to a Secret containing git credentials.
Applied to all gitRefs entries.
The secret should contain a `token` key for HTTPS auth,
or `ssh-privatekey` for SSH auth. | | | -| `gitRefs` _[GitRepo](#gitrepo) array_ | Git repositories to fetch skills from. | | MaxItems: 20
MinItems: 1
| -| `s3Refs` _[S3SkillRef](#s3skillref) array_ | S3 object prefixes or archives to fetch skills from.
Auth uses the AWS SDK default credential chain (typically static keys via
skills.initContainer.env: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION). | | MaxItems: 20
MinItems: 1
| -| `initContainer` _[SkillsInitContainer](#skillsinitcontainer)_ | Configuration for the skills-init init container. | | | - -#### SkillsInitContainer - -SkillsInitContainer configures the skills-init init container. - -_Appears in:_ -- [SkillForAgent](#skillforagent) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#resourcerequirements-v1-core)_ | Resource requirements for the skills-init init container. | | | -| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | Additional environment variables for the skills-init init container. | | | - #### TLSConfig TLSConfig contains TLS/SSL configuration options for outbound HTTPS @@ -1262,69 +554,12 @@ _Appears in:_ | --- | --- | | `GDCHServiceAccount` | | -#### Tool - -_Appears in:_ -- [DeclarativeAgentSpec](#declarativeagentspec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `type` _[ToolProviderType](#toolprovidertype)_ | | | Enum: [McpServer Agent]
| -| `mcpServer` _[McpServerTool](#mcpservertool)_ | | | | -| `agent` _[TypedReference](#typedreference)_ | | | | -| `isolateSessions` _boolean_ | IsolateSessions controls per-call session isolation for Agent-type tools.
Only valid when Type is Agent.

When unset or false (default), every call this agent makes to the
referenced sub-agent reuses the same A2A context_id, so all calls land
in one shared sub-agent session (session continuity for stateful
sub-agents).

When true, each call mints a fresh context_id, so every invocation runs
in its own isolated sub-agent session. This is required for parallel
fan-out to a sub-agent: without it, N parallel calls in one turn
collapse into a single shared sub-agent session instead of N
independent ones.

Cross-turn/conversation continuity for stateful sub-agents does not
depend on this flag; it rides the x-kagent-root-context-id header,
which stays stable regardless of IsolateSessions. | | | -| `headersFrom` _[ValueRef](#valueref) array_ | HeadersFrom specifies a list of configuration values to be added as
headers to requests sent to the Tool from this agent. The value of
each header is resolved from either a Secret or ConfigMap in the same
namespace as the Agent. Headers specified here will override any
headers of the same name/key specified on the tool. | | | - -#### ToolProviderType - -_Underlying type:_ _string_ - -ToolProviderType represents the tool provider type - -_Validation:_ -- Enum: [McpServer Agent] - -_Appears in:_ -- [Tool](#tool) - -| Field | Description | -| --- | --- | -| `McpServer` | | -| `Agent` | | - -#### TypedLocalReference - -_Appears in:_ -- [AgentHarnessSubstrateSpec](#agentharnesssubstratespec) -- [PromptSource](#promptsource) -- [SandboxSubstrateSpec](#sandboxsubstratespec) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `kind` _string_ | | | | -| `apiGroup` _string_ | | | | -| `name` _string_ | | | | - -#### TypedReference - -_Appears in:_ -- [McpServerTool](#mcpservertool) -- [Tool](#tool) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `kind` _string_ | | | | -| `apiGroup` _string_ | | | | -| `name` _string_ | | | | -| `namespace` _string_ | | | | - #### ValueRef ValueRef represents a configuration value _Appears in:_ - [RemoteMCPServerSpec](#remotemcpserverspec) -- [Tool](#tool) | Field | Description | Default | Validation | | --- | --- | --- | --- | @@ -1337,10 +572,6 @@ _Appears in:_ ValueSource defines a source for configuration values from a Secret or ConfigMap _Appears in:_ -- [AgentHarnessChannelCredential](#agentharnesschannelcredential) -- [AgentHarnessHermesSlackOptions](#agentharnesshermesslackoptions) -- [AgentHarnessTelegramChannelSpec](#agentharnesstelegramchannelspec) -- [DeclarativeAgentSpec](#declarativeagentspec) - [ValueRef](#valueref) | Field | Description | Default | Validation | diff --git a/docs-site/content/kagent/resources/helm.md b/docs-site/content/kagent/resources/helm.md index e3198127..eeb0160f 100644 --- a/docs-site/content/kagent/resources/helm.md +++ b/docs-site/content/kagent/resources/helm.md @@ -13,18 +13,7 @@ A Helm chart for kagent, built with Google ADK | Repository | Name | Version | |------------|------|---------| | `${SUBSTRATE_REPO}` | substrate | `${SUBSTRATE_VERSION}` | -| file://../agents/argo-rollouts | argo-rollouts-agent | | -| file://../agents/cilium-debug | cilium-debug-agent | | -| file://../agents/cilium-manager | cilium-manager-agent | | -| file://../agents/cilium-policy | cilium-policy-agent | | -| file://../agents/helm | helm-agent | | -| file://../agents/istio | istio-agent | | -| file://../agents/k8s | k8s-agent | | -| file://../agents/kgateway | kgateway-agent | | -| file://../agents/observability | observability-agent | | -| file://../agents/promql | promql-agent | | | file://../tools/grafana-mcp | grafana-mcp | | -| file://../tools/querydoc | querydoc | | | https://oauth2-proxy.github.io/manifests | oauth2-proxy | ~10.7.0 | | oci://ghcr.io/kagent-dev/kmcp/helm | kmcp | `${KMCP_VERSION}` | | oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.2.1 | @@ -34,57 +23,16 @@ A Helm chart for kagent, built with Google ADK | Key | Type | Default | Description | |-----|------|---------|-------------| | annotations | object | `{}` | Additional annotations to add to all Kubernetes deployment resources | -| argo-rollouts-agent.enabled | bool | `true` | | -| argo-rollouts-agent.memory.enabled | bool | `false` | | -| argo-rollouts-agent.memory.modelConfigRef | string | `""` | | -| argo-rollouts-agent.memory.ttlDays | int | `15` | | -| argo-rollouts-agent.modelConfigRef | string | `""` | | -| argo-rollouts-agent.resources.limits.memory | string | `"256Mi"` | | -| argo-rollouts-agent.resources.requests.cpu | string | `"50m"` | | -| argo-rollouts-agent.resources.requests.memory | string | `"128Mi"` | | -| cilium-debug-agent.enabled | bool | `true` | | -| cilium-debug-agent.memory.enabled | bool | `false` | | -| cilium-debug-agent.memory.modelConfigRef | string | `""` | | -| cilium-debug-agent.memory.ttlDays | int | `15` | | -| cilium-debug-agent.modelConfigRef | string | `""` | | -| cilium-debug-agent.resources.limits.memory | string | `"256Mi"` | | -| cilium-debug-agent.resources.requests.cpu | string | `"50m"` | | -| cilium-debug-agent.resources.requests.memory | string | `"128Mi"` | | -| cilium-manager-agent.enabled | bool | `true` | | -| cilium-manager-agent.memory.enabled | bool | `false` | | -| cilium-manager-agent.memory.modelConfigRef | string | `""` | | -| cilium-manager-agent.memory.ttlDays | int | `15` | | -| cilium-manager-agent.modelConfigRef | string | `""` | | -| cilium-manager-agent.resources.limits.memory | string | `"256Mi"` | | -| cilium-manager-agent.resources.requests.cpu | string | `"50m"` | | -| cilium-manager-agent.resources.requests.memory | string | `"128Mi"` | | -| cilium-policy-agent.enabled | bool | `true` | | -| cilium-policy-agent.memory.enabled | bool | `false` | | -| cilium-policy-agent.memory.modelConfigRef | string | `""` | | -| cilium-policy-agent.memory.ttlDays | int | `15` | | -| cilium-policy-agent.modelConfigRef | string | `""` | | -| cilium-policy-agent.resources.limits.memory | string | `"256Mi"` | | -| cilium-policy-agent.resources.requests.cpu | string | `"50m"` | | -| cilium-policy-agent.resources.requests.memory | string | `"128Mi"` | | -| controller.a2aBaseUrl | string | `http://-controller..svc:` | The base URL of the A2A Server endpoint, as advertised to clients. | | controller.a2aClientTimeout | string | "" (no timeout) | HTTP client timeout for A2A requests from the controller to agent pods. 0 (the default) means no timeout, which is correct for SSE-based streaming agents that can run for an arbitrarily long time. The previous implicit default was 3m (inherited from the a2a-go SDK), which caused `context deadline exceeded` errors for agents that take longer than 3 minutes to complete. Set a positive Go duration string (e.g. "30m", "1h") only if you need a hard upper bound on individual A2A calls. | +| controller.a2aGatewayUrl | string | `http://-controller..svc:` | Public gRPC URL advertised by AgentInstance Agent Cards. | | controller.affinity | object | `{}` | [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) rules for the controller pod. | -| controller.agentDeployment | object | `{"host":"","nodeSelector":{},"podLabels":{},"serviceAccountName":""}` | Global deployment defaults applied to all agent pods. Per-agent settings in the Agent CRD take precedence over these defaults. | -| controller.agentDeployment.host | string | "" (controller falls back to "0.0.0.0"; "::" when ipv6.enabled) | Default host address for agent pods to bind to. Leave empty to use the controller's default fallback of "0.0.0.0". Automatically set to "::" when ipv6.enabled is true. Can be explicitly overridden here regardless of the ipv6 flag. | -| controller.agentDeployment.nodeSelector | object | {} (no default nodeSelector) | Default nodeSelector applied to all agent deployments. Useful when admission policies require a nodeSelector on every Deployment, since wizard-created Agents carry none. A per-agent nodeSelector in the Agent CRD takes precedence over these defaults. | -| controller.agentDeployment.podLabels | object | {} (no extra labels) | Default labels applied to all agent pod templates. Per-agent labels in the Agent CRD take precedence over these defaults. | -| controller.agentDeployment.serviceAccountName | string | "" (auto-create per-agent ServiceAccount) | Default ServiceAccount name for agent pods. When set, agent pods that don't specify an explicit serviceAccountName will use this ServiceAccount instead of creating a per-agent one. Useful for Workload Identity (GCP, AWS IRSA, Azure Workload Identity). Precedence: agent-level serviceAccountName > this default > auto-created SA. | -| controller.agentImage.pullPolicy | string | `""` | | -| controller.agentImage.pullSecret | string | `""` | Image pull secret name set on agent pods created by the controller | -| controller.agentImage.registry | string | `""` | | -| controller.agentImage.repository | string | `"kagent-dev/kagent/app"` | | -| controller.agentImage.tag | string | `""` | | +| controller.agentImage | object | `{"registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for declarative agents. | | controller.annotations | object | `{}` | Additional annotations to add to the controller Deployment metadata | | controller.auth.mode | string | `"unsecure"` | | | controller.auth.userIdClaim | string | `""` | | | controller.env | list | `[]` | | | controller.envFrom | list | `[]` | | -| controller.goAgentImage | object | `{"pullPolicy":"","registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for the Go (ADK) runtime agent. | +| controller.grpc | object | `{"bindAddress":":8084","maxMessageBytes":16777216,"reflection":false,"tlsCertFile":"","tlsKeyFile":""}` | Native gRPC application API settings. This port is internal unless a separate TLS-capable GRPCRoute or ingress is configured. | | controller.image.pullPolicy | string | `""` | | | controller.image.registry | string | `""` | | | controller.image.repository | string | `"kagent-dev/kagent/controller"` | | @@ -109,21 +57,15 @@ A Helm chart for kagent, built with Google ADK | controller.resources.requests.cpu | string | `"100m"` | | | controller.resources.requests.memory | string | `"128Mi"` | | | controller.service.annotations | object | `{}` | | +| controller.service.ports.grpc | int | `8084` | | | controller.service.ports.port | int | `8083` | | | controller.service.ports.targetPort | int | `8083` | | | controller.service.type | string | `"ClusterIP"` | | | controller.serviceAccount | object | `{"annotations":{}}` | ServiceAccount settings for the controller pod | | controller.serviceAccount.annotations | object | {} (no extra annotations) | Annotations to add to the controller ServiceAccount. Useful for GCP Workload Identity, AWS IRSA, or Azure Workload Identity. | -| controller.skillsInitImage | object | `{"pullPolicy":"","registry":"","repository":"kagent-dev/kagent/skills-init","tag":""}` | The image used by the skills-init container to clone skills from Git and pull OCI skill images. | | controller.startupProbe | object | httpGet /health on port http, periodSeconds=15, initialDelaySeconds=15 | Custom startup probe for the controller container. Setting a value replaces the default probe entirely — include a handler (httpGet / exec / tcpSocket / grpc) when overriding. | | controller.streaming | string | `nil` | @deprecated Removed in 0.10.0. The A2A SDK now handles SSE buffering and timeouts internally. These values have no effect and will be removed in a future release. | | controller.substrate.ateApiEndpoint | string | `""` | | -| controller.substrate.ateApiInsecure | bool | `false` | | -| controller.substrate.ateApiServer.namespace | string | `"ate-system"` | | -| controller.substrate.ateApiServer.serviceAccount | string | `"ate-api-server"` | | -| controller.substrate.ateApiTokenAudience | string | `"api.ate-system.svc"` | | -| controller.substrate.ateApiTokenExpirationSeconds | int | `3600` | | -| controller.substrate.ateApiTokenFile | string | `"/var/run/secrets/tokens/ate-api/token"` | | | controller.substrate.atenetRouterURL | string | `""` | | | controller.substrate.defaultWorkerPool.name | string | `""` | | | controller.substrate.defaultWorkerPool.namespace | string | `""` | | @@ -133,20 +75,22 @@ A Helm chart for kagent, built with Google ADK | controller.volumeMounts | list | `[]` | | | controller.volumes | list | `[]` | | | controller.watchNamespaces | list | [] (watches all available namespaces) | Namespaces the controller should watch. If empty, the controller will watch ALL available namespaces. | -| database.postgres.bundled | object | `{"enabled":true,"image":{"name":"postgres","pullPolicy":"IfNotPresent","registry":"docker.io","repository":"library","tag":"18.3-alpine"},"podSecurityContext":{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}},"resources":{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"storage":"500Mi","storageClassName":""}` | Bundled PostgreSQL instance — for development and evaluation only. Not suitable for production. Deployed when enabled is true and url/urlFile are not set. | +| database.postgres.bundled | object | `{"affinity":{},"enabled":true,"image":{"name":"postgres","pullPolicy":"IfNotPresent","registry":"docker.io","repository":"library","tag":"18.6-alpine3.23"},"nodeSelector":{},"podSecurityContext":{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}},"resources":{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"storage":"500Mi","storageClassName":"","tolerations":[]}` | Bundled PostgreSQL instance — for development and evaluation only. Not suitable for production. Deployed when enabled is true and url/urlFile are not set. | +| database.postgres.bundled.affinity | object | `{}` | [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) rules for the bundled PostgreSQL pod. | | database.postgres.bundled.enabled | bool | `true` | Set to false to disable the bundled database and provide your own via url or urlFile. | | database.postgres.bundled.image.name | string | `"postgres"` | Bundled PostgreSQL image name | | database.postgres.bundled.image.pullPolicy | string | `"IfNotPresent"` | Bundled PostgreSQL image pull policy | | database.postgres.bundled.image.registry | string | `"docker.io"` | Bundled PostgreSQL image registry | | database.postgres.bundled.image.repository | string | `"library"` | Bundled PostgreSQL image repository (org/namespace) | -| database.postgres.bundled.image.tag | string | `"18.3-alpine"` | Bundled PostgreSQL image tag | +| database.postgres.bundled.image.tag | string | `"18.6-alpine3.23"` | Bundled PostgreSQL image tag | +| database.postgres.bundled.nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | database.postgres.bundled.podSecurityContext | object | `{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}}` | Pod-level security context for the bundled PostgreSQL deployment. | | database.postgres.bundled.resources | object | `{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}}` | Resource requests/limits for the demo PostgreSQL container | | database.postgres.bundled.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}` | Container-level security context for the bundled PostgreSQL container. | | database.postgres.bundled.storage | string | `"500Mi"` | PersistentVolumeClaim size for demo PostgreSQL data | | database.postgres.bundled.storageClassName | string | `""` | StorageClass for the PostgreSQL PVC. Defaults to the cluster default when empty. | +| database.postgres.bundled.tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | database.postgres.pool | object | `{"maxConnIdleTime":"","maxConnLifetime":"","maxConns":null,"minConns":null}` | Optional pgxpool settings. Leave unset/null to keep pgx library defaults (MaxConns≈max(4,NumCPU), MinConns=0, MaxConnIdleTime=30m, MaxConnLifetime=1h). | -| database.postgres.sessionRetentionDays | int | `0` | Hard-delete idle sessions (and cascaded events/tasks/checkpoints/shares) after N days of no activity. Uses session.updated_at as a sliding idle clock (writes refresh it). 0 disables cleanup (default, existing installs unchanged). | | database.postgres.skipMigrations | bool | `false` | Skip running database migrations at controller startup. The controller instead verifies the database is already migrated and fails if it is not. Migrations must be applied out-of-band (e.g. from a CI/CD pipeline) before install/upgrade. | | database.postgres.url | string | `""` | External PostgreSQL connection string. Is always used if set regardless of the `.bundled.enabled` field. | | database.postgres.urlFile | string | `""` | Path to a file containing the database URL. Takes precedence over url when set. Is always used if set regardless of the `.bundled.enabled` field. | @@ -160,33 +104,9 @@ A Helm chart for kagent, built with Google ADK | grafana-mcp.resources.limits.memory | string | `"512Mi"` | | | grafana-mcp.resources.requests.cpu | string | `"100m"` | | | grafana-mcp.resources.requests.memory | string | `"128Mi"` | | -| helm-agent.enabled | bool | `true` | | -| helm-agent.memory.enabled | bool | `false` | | -| helm-agent.memory.modelConfigRef | string | `""` | | -| helm-agent.memory.ttlDays | int | `15` | | -| helm-agent.modelConfigRef | string | `""` | | -| helm-agent.resources.limits.memory | string | `"256Mi"` | | -| helm-agent.resources.requests.cpu | string | `"50m"` | | -| helm-agent.resources.requests.memory | string | `"128Mi"` | | | imagePullPolicy | string | `"IfNotPresent"` | | | imagePullSecrets | list | `[]` | | | ipv6 | object | false | Enable IPv6/dual-stack support. When true, configures all components for dual-stack (IPv4+IPv6) networking: - nginx listens on both IPv4 and IPv6 (adds `listen [::]:8080`) - Next.js binds to `::` instead of `0.0.0.0` - Agent pods bind to `::` for dual-stack reachability Leave disabled on clusters where IPv6 is disabled at the kernel level. | -| istio-agent.enabled | bool | `true` | | -| istio-agent.memory.enabled | bool | `false` | | -| istio-agent.memory.modelConfigRef | string | `""` | | -| istio-agent.memory.ttlDays | int | `15` | | -| istio-agent.modelConfigRef | string | `""` | | -| istio-agent.resources.limits.memory | string | `"256Mi"` | | -| istio-agent.resources.requests.cpu | string | `"50m"` | | -| istio-agent.resources.requests.memory | string | `"128Mi"` | | -| k8s-agent.enabled | bool | `true` | | -| k8s-agent.memory.enabled | bool | `false` | | -| k8s-agent.memory.modelConfigRef | string | `""` | | -| k8s-agent.memory.ttlDays | int | `15` | | -| k8s-agent.modelConfigRef | string | `""` | | -| k8s-agent.resources.limits.memory | string | `"256Mi"` | | -| k8s-agent.resources.requests.cpu | string | `"50m"` | | -| k8s-agent.resources.requests.memory | string | `"128Mi"` | | | kagent-tools.enabled | bool | `true` | | | kagent-tools.nameOverride | string | `"tools"` | | | kagent-tools.nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | @@ -202,14 +122,6 @@ A Helm chart for kagent, built with Google ADK | kagent-tools.tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | kagent-tools.tools.loglevel | string | `"debug"` | | | kagent-tools.tools.metrics.port | int | `8085` | | -| kgateway-agent.enabled | bool | `true` | | -| kgateway-agent.memory.enabled | bool | `false` | | -| kgateway-agent.memory.modelConfigRef | string | `""` | | -| kgateway-agent.memory.ttlDays | int | `15` | | -| kgateway-agent.modelConfigRef | string | `""` | | -| kgateway-agent.resources.limits.memory | string | `"256Mi"` | | -| kgateway-agent.resources.requests.cpu | string | `"50m"` | | -| kgateway-agent.resources.requests.memory | string | `"128Mi"` | | | kmcp.enabled | bool | `true` | | | kmcp.fullnameOverride | string | `""` | | | kmcp.nameOverride | string | `"kmcp"` | | @@ -234,7 +146,7 @@ A Helm chart for kagent, built with Google ADK | oauth2-proxy.extraArgs.redirect-url | string | `"$(OIDC_REDIRECT_URL)"` | | | oauth2-proxy.extraArgs.scope | string | `"openid profile email groups"` | | | oauth2-proxy.extraArgs.set-authorization-header | bool | `true` | | -| oauth2-proxy.extraArgs.skip-auth-regex | string | `"^/(login|_next/static|_next/image|login-bg\\.(jpg|png|webp)|logo-.*\\.png|favicon\\.ico|api/agentharnesses/.*/gateway).*$"` | | +| oauth2-proxy.extraArgs.skip-auth-regex | string | `"^/(login|assets/|env-config\\.js|logo-.*\\.png|favicon\\.ico).*$"` | | | oauth2-proxy.extraArgs.skip-auth-route | string | `"^/(health|login)$"` | | | oauth2-proxy.extraArgs.skip-jwt-bearer-tokens | bool | `true` | | | oauth2-proxy.extraArgs.upstream | string | `"$(UPSTREAM_URL)"` | | @@ -252,14 +164,6 @@ A Helm chart for kagent, built with Google ADK | oauth2-proxy.service.portNumber | int | `4180` | | | oauth2-proxy.service.type | string | `"ClusterIP"` | | | oauth2-proxy.sessionStorage.type | string | `"cookie"` | | -| observability-agent.enabled | bool | `true` | | -| observability-agent.memory.enabled | bool | `false` | | -| observability-agent.memory.modelConfigRef | string | `""` | | -| observability-agent.memory.ttlDays | int | `15` | | -| observability-agent.modelConfigRef | string | `""` | | -| observability-agent.resources.limits.memory | string | `"256Mi"` | | -| observability-agent.resources.requests.cpu | string | `"50m"` | | -| observability-agent.resources.requests.memory | string | `"128Mi"` | | | otel.logging.enabled | bool | `false` | | | otel.logging.exporter.otlp.endpoint | string | `""` | | | otel.logging.exporter.otlp.insecure | bool | `true` | | @@ -272,14 +176,6 @@ A Helm chart for kagent, built with Google ADK | podAnnotations | object | `{}` | | | podLabels | object | `{}` | Additional labels to add to all pod templates (merged into pod labels of the controller and UI Deployments; can be overridden per component). Useful for admission policies that require specific labels on pods. | | podSecurityContext | object | `{"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for all pods | -| promql-agent.enabled | bool | `true` | | -| promql-agent.memory.enabled | bool | `false` | | -| promql-agent.memory.modelConfigRef | string | `""` | | -| promql-agent.memory.ttlDays | int | `15` | | -| promql-agent.modelConfigRef | string | `""` | | -| promql-agent.resources.limits.memory | string | `"256Mi"` | | -| promql-agent.resources.requests.cpu | string | `"50m"` | | -| promql-agent.resources.requests.memory | string | `"128Mi"` | | | providers.annotations | object | `{}` | Annotations added to the metadata of the generated default ModelConfig (the one derived from `providers.default`). Omitted from the resource when empty. | | providers.anthropic.apiKeySecretKey | string | `"ANTHROPIC_API_KEY"` | | | providers.anthropic.apiKeySecretRef | string | `"kagent-anthropic"` | | @@ -296,7 +192,7 @@ A Helm chart for kagent, built with Google ADK | providers.default | string | `"openAI"` | | | providers.gemini.apiKeySecretKey | string | `"GOOGLE_API_KEY"` | | | providers.gemini.apiKeySecretRef | string | `"kagent-gemini"` | | -| providers.gemini.model | string | `"gemini-2.0-flash-lite"` | | +| providers.gemini.model | string | `"gemini-2.5-flash-lite"` | | | providers.gemini.provider | string | `"Gemini"` | | | providers.ollama.config.host | string | `"host.docker.internal:11434"` | | | providers.ollama.config.options.num_ctx | string | `"64000"` | | @@ -307,30 +203,18 @@ A Helm chart for kagent, built with Google ADK | providers.openAI.model | string | `"gpt-4.1-mini"` | | | providers.openAI.provider | string | `"OpenAI"` | | | proxy.url | string | `""` | | -| querydoc.enabled | bool | `true` | | -| querydoc.image.pullPolicy | string | `"IfNotPresent"` | | -| querydoc.image.registry | string | `"ghcr.io"` | | -| querydoc.image.repository | string | `"kagent-dev/doc2vec/mcp"` | | -| querydoc.image.tag | string | `"1.1.14"` | | -| querydoc.openai.apiKey | string | `""` | | -| querydoc.replicas | int | `1` | | -| querydoc.resources.limits.cpu | string | `"500m"` | | -| querydoc.resources.limits.memory | string | `"512Mi"` | | -| querydoc.resources.requests.cpu | string | `"100m"` | | -| querydoc.resources.requests.memory | string | `"128Mi"` | | | rbac.namespaces | list | `[]` | Namespaces in which to create Role and RoleBinding resources. If empty (default), the chart creates cluster-scoped ClusterRole and ClusterRoleBinding resources and the controller watches all namespaces. If set, the chart creates a Role + RoleBinding per listed namespace and the controller's WATCH_NAMESPACES is derived from this list (unless controller.watchNamespaces is set explicitly, which always takes precedence). | | registry | string | `"ghcr.io"` | | | securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}` | Security context for all containers | | substrate.enabled | bool | `false` | | -| substrateWorkerPool | object | `{"ateomImage":"","create":false,"labels":{},"name":"kagent-default","replicas":1,"sandboxClass":"gvisor","template":{}}` | Optional Agent Substrate WorkerPool installed by this chart. This is platform capacity and is not owned by individual AgentHarness resources. | +| substrateWorkerPool | object | `{"create":false,"labels":{},"name":"kagent-default","replicas":1,"sandboxClass":"gvisor","template":{},"workerImage":""}` | Optional Agent Substrate WorkerPool installed by this chart. This is platform capacity and is not owned by individual agents. | | tag | string | `""` | | | tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | -| ui.additionalForwardedHeaders | list | `[]` | Additional request headers (beyond Authorization) the UI proxy will forward to the backend. Names are case-insensitive. Hop-by-hop headers (Connection, Transfer-Encoding, etc.) are silently dropped. | +| ui.additionalForwardedHeaders | list | `[]` | Identity headers the UI's nginx proxy will forward to the backend on /api/ and /a2a/. Names are case-insensitive. Authorization is always forwarded; the auth-proxy identity headers (x-auth-request-*, x-forwarded-user, x-forwarded-email, x-forwarded-groups, x-forwarded-preferred-username) are stripped from client requests unless listed here, so a caller cannot spoof an identity the backend trusts. Headers outside that set are forwarded by nginx as normal. | | ui.affinity | object | `{}` | [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) rules for the UI pod. | | ui.annotations | object | `{}` | Additional annotations to add to the UI Deployment metadata | | ui.auth.ssoRedirectPath | string | `"/oauth2/start"` | | -| ui.backendInternalUrl | string | `""` | | -| ui.env | object | `{}` | | +| ui.env | list | `[]` | Extra environment variables for the UI container: a list of `{name, value}` entries, spliced into its `env:` verbatim. An installed app extension's own settings go here, named `EXTENSION_*`; the container's startup script copies those onto `window.environmentVariables` for the browser to read. | | ui.externalUrl | string | "" (share tools return paths only) | Public-facing base URL of the UI (e.g. https://kagent.example.com). When set, the controller injects KAGENT_UI_URL into agent pods so that share link tools return full clickable URLs instead of relative paths. | | ui.httpRoute | object | `{"annotations":{},"enabled":false,"hostnames":[],"labels":{},"parentRefs":[],"rules":[]}` | Gateway API `HTTPRoute` for the UI. Requires the Gateway API CRDs (`gateway.networking.k8s.io/v1`) and an existing `Gateway` to attach to via `parentRefs`. Disabled by default; enable to front the UI with a Gateway API implementation (kgateway, Istio, Envoy Gateway, etc.) instead of the OpenShift Route or bundled oauth2-proxy. | | ui.httpRoute.annotations | object | `{}` | Annotations to add to the `HTTPRoute`. | @@ -357,7 +241,7 @@ A Helm chart for kagent, built with Google ADK | ui.podAnnotations | object | `{}` | | | ui.podLabels | object | `{}` | Additional labels for the UI pod template, merged over the global `podLabels` (per-key; component keys win). Selector labels can never be overridden. | | ui.podSecurityContext | object | (uses global podSecurityContext) | Pod-level security context for the UI pod. Overrides the global podSecurityContext. | -| ui.publicBackendUrl | string | `"/api"` | | +| ui.publicBackendUrl | string | `"/api"` | Base URL the browser calls the controller API on. Reaches the browser at runtime as the `apiBaseUrl` key of /config.json, which the app fetches on startup — it is deliberately not baked into the bundle, so changing it here takes effect on pod restart rather than requiring an image rebuild. The default is a path on the UI's own hostname, which nginx proxies to the controller; set an absolute URL only if the browser must reach the API somewhere other than the UI origin. | | ui.readinessProbe | object | httpGet /health on port http, periodSeconds=30 | Custom readiness probe for the UI container. Override to adjust thresholds, use exec-based probes, or change the health path. | | ui.replicas | int | `1` | | | ui.resources.limits.cpu | string | `"1000m"` | | @@ -376,6 +260,5 @@ A Helm chart for kagent, built with Google ADK | ui.streamTimeoutSeconds | int | `1800` | Client-side chat stream inactivity timeout (seconds). The browser aborts a streaming response if no event is received within this window. Should be >= ui.nginx.proxyReadTimeout so nginx isn't the silent limit. Default 1800 (30m). | | ui.tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | ui.topologySpreadConstraints | list | `[]` | [Topology spread constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#pod-topology-spread-constraints) for the UI pod. | -| ui.volumes | object | `{"nextjsCache":"100Mi","tmp":"50Mi"}` | EmptyDir volume sizes for Next.js UI workload (typically used when enabling readOnlyRootFilesystem) | -| ui.volumes.nextjsCache | string | `"100Mi"` | Size limit for Next.js build cache (.next/cache). Default 100Mi is sufficient for typical Next.js apps with moderate caching needs. | -| ui.volumes.tmp | string | `"50Mi"` | Size limit for temporary files (/tmp). Default 50Mi provides ample space for Next.js runtime temporary data. | +| ui.volumes | object | `{"tmp":"50Mi"}` | EmptyDir volume sizes for the UI workload (typically used when enabling readOnlyRootFilesystem) | +| ui.volumes.tmp | string | `"50Mi"` | Size limit for temporary files (/tmp). Holds the nginx temp directories and the generated config.json. Default 50Mi is ample for both. |