diff --git a/src/app/docs/kagent/resources/api-ref/page.mdx b/src/app/docs/kagent/resources/api-ref/page.mdx index 55caefff..c31c3826 100644 --- a/src/app/docs/kagent/resources/api-ref/page.mdx +++ b/src/app/docs/kagent/resources/api-ref/page.mdx @@ -25,6 +25,7 @@ Package v1alpha1 contains API Schema definitions for the agent v1alpha1 API grou - [ModelConfig](#modelconfig) - [ModelProviderConfig](#modelproviderconfig) - [RemoteMCPServer](#remotemcpserver) +- [SandboxAgent](#sandboxagent) @@ -65,6 +66,8 @@ Agent is the Schema for the agents API. | `status` _[AgentStatus](#agentstatus)_ | | | | + + #### AgentSkill _Underlying type:_ _AgentSkill_ @@ -97,6 +100,7 @@ AgentSpec defines the desired state of Agent. _Appears in:_ - [Agent](#agent) +- [SandboxAgent](#sandboxagent) | Field | Description | Default | Validation | | --- | --- | --- | --- | @@ -105,6 +109,7 @@ _Appears in:_ | `declarative` _[DeclarativeAgentSpec](#declarativeagentspec)_ | | | | | `description` _string_ | | | | | `skills` _[SkillForAgent](#skillforagent)_ | Skills to load into the agent. They will be pulled from the specified container images.
and made available to the agent under the `/skills` folder. | | | +| `sandbox` _[SandboxConfig](#sandboxconfig)_ | Sandbox configures sandboxed execution behavior shared across runtimes.
This is intended for sandboxed declarative execution today, and can also
be consumed by BYO agents. | | | | `allowedNamespaces` _[AllowedNamespaces](#allowednamespaces)_ | AllowedNamespaces defines which namespaces are allowed to reference this Agent as a tool.
This follows the Gateway API pattern for cross-namespace route attachments.
If not specified, only Agents in the same namespace can reference this Agent as a tool.
This field only applies when this Agent is used as a tool by another Agent.
See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-routing | | | @@ -118,6 +123,7 @@ AgentStatus defines the observed state of Agent. _Appears in:_ - [Agent](#agent) +- [SandboxAgent](#sandboxagent) | Field | Description | Default | Validation | | --- | --- | --- | --- | @@ -469,6 +475,22 @@ _Appears in:_ | `Selector` | NamespacesFromSelector allows references from namespaces matching the selector.
| +#### GDCHServiceAccountConfig + + + +GDCHServiceAccountConfig holds GDCH-specific token exchange parameters. + + + +_Appears in:_ +- [TokenExchangeConfig](#tokenexchangeconfig) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `audience` _string_ | Audience is the token exchange audience URL (the GDC inference gateway base URL) | | | + + #### GeminiConfig @@ -616,11 +638,11 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `model` _string_ | | | | -| `apiKeySecret` _string_ | The name of the secret that contains the API key. Must be a reference to the name of a secret in the same namespace as the referencing ModelConfig | | | -| `apiKeySecretKey` _string_ | The key in the secret that contains the API key | | | +| `apiKeySecret` _string_ | The name of the secret that contains the API key. Must be a reference to the name of a secret in the same namespace as the referencing ModelConfig.
For the SAPAICore provider, the secret must contain two keys: "client_id" and "client_secret"
(the OAuth2 client credentials for SAP AI Core). The apiKeySecretKey field is not used for SAPAICore. | | | +| `apiKeySecretKey` _string_ | The key in the secret that contains the API key.
Not used for the SAPAICore provider (which always reads "client_id" and "client_secret" from the secret). | | | | `apiKeyPassthrough` _boolean_ | APIKeyPassthrough enables forwarding the Bearer token from incoming A2A requests
directly to the LLM provider as the API key. This is useful for organizations
with federated identity that want to avoid separate secret management.
Mutually exclusive with apiKeySecret. | | | | `defaultHeaders` _object (keys:string, values:string)_ | | | | -| `provider` _[ModelProvider](#modelprovider)_ | The provider of the model | OpenAI | Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock]
| +| `provider` _[ModelProvider](#modelprovider)_ | The provider of the model | OpenAI | Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock SAPAICore]
| | `openAI` _[OpenAIConfig](#openaiconfig)_ | OpenAI-specific configuration | | | | `anthropic` _[AnthropicConfig](#anthropicconfig)_ | Anthropic-specific configuration | | | | `azureOpenAI` _[AzureOpenAIConfig](#azureopenaiconfig)_ | Azure OpenAI-specific configuration | | | @@ -629,6 +651,7 @@ _Appears in:_ | `geminiVertexAI` _[GeminiVertexAIConfig](#geminivertexaiconfig)_ | Gemini Vertex AI-specific configuration | | | | `anthropicVertexAI` _[AnthropicVertexAIConfig](#anthropicvertexaiconfig)_ | Anthropic-specific configuration | | | | `bedrock` _[BedrockConfig](#bedrockconfig)_ | AWS Bedrock-specific configuration | | | +| `sapAICore` _[SAPAICoreConfig](#sapaicoreconfig)_ | SAP AI Core-specific configuration | | | | `tls` _[TLSConfig](#tlsconfig)_ | TLS configuration for provider connections.
Enables agents to connect to internal LiteLLM gateways or other providers
that use self-signed certificates or custom certificate authorities. | | | @@ -657,7 +680,7 @@ _Underlying type:_ _string_ ModelProvider represents the model provider type _Validation:_ -- Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock] +- Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock SAPAICore] _Appears in:_ - [ModelConfigSpec](#modelconfigspec) @@ -673,6 +696,7 @@ _Appears in:_ | `GeminiVertexAI` | | | `AnthropicVertexAI` | | | `Bedrock` | | +| `SAPAICore` | | #### ModelProviderConfig @@ -710,7 +734,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `type` _[ModelProvider](#modelprovider)_ | Type is the model provider type (OpenAI, Anthropic, etc.) | | Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock]
Required: \{\}
| +| `type` _[ModelProvider](#modelprovider)_ | Type is the model provider type (OpenAI, Anthropic, etc.) | | Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock SAPAICore]
Required: \{\}
| | `endpoint` _string_ | Endpoint is the API endpoint URL for the provider.
If not specified, the default endpoint for the provider type will be used. | | Pattern: `^https?://.*`
| | `secretRef` _[SecretReference](#secretreference)_ | SecretRef references the Kubernetes Secret containing the API key.
Optional for providers that don't require authentication (e.g., local Ollama). | | | @@ -736,6 +760,22 @@ _Appears in:_ | `secretHash` _string_ | SecretHash is a hash of the referenced secret data, used to detect secret changes | | | +#### NetworkConfig + + + +NetworkConfig configures outbound network access for sandboxed execution paths. + + + +_Appears in:_ +- [SandboxConfig](#sandboxconfig) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `allowedDomains` _string array_ | AllowedDomains lists the domains that sandboxed execution may contact.
Wildcards such as *.example.com are supported by the sandbox runtime. | | | + + #### OllamaConfig @@ -777,6 +817,7 @@ _Appears in:_ | `n` _integer_ | N value | | | | `timeout` _integer_ | Timeout | | | | `reasoningEffort` _[OpenAIReasoningEffort](#openaireasoningeffort)_ | Reasoning effort | | Enum: [minimal low medium high]
| +| `tokenExchange` _[TokenExchangeConfig](#tokenexchangeconfig)_ | TokenExchange configures dynamic bearer token acquisition via credential exchange.
Requires apiKeySecret (used as the service account secret) and is mutually exclusive with apiKeyPassthrough. | | | #### OpenAIReasoningEffort @@ -910,6 +951,61 @@ _Appears in:_ | `discoveredTools` _[MCPTool](#mcptool) array_ | | | Optional: \{\}
| +#### SAPAICoreConfig + + + +SAPAICoreConfig contains SAP AI Core-specific configuration options. + + + +_Appears in:_ +- [ModelConfigSpec](#modelconfigspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `baseUrl` _string_ | Base URL for the SAP AI Core API (e.g., https://api.ai.prod.eu-central-1.aws.ml.hana.ondemand.com) | | | +| `resourceGroup` _string_ | Resource group in SAP AI Core | default | | +| `authUrl` _string_ | OAuth2 token endpoint URL (e.g., https://tenant.authentication.eu10.hana.ondemand.com) | | | + + +#### SandboxAgent + + + +SandboxAgent declares an agent that runs in an isolated sandbox (agent-sandbox Sandbox CR). + + + + + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `kagent.dev/v1alpha2` | | | +| `kind` _string_ | `SandboxAgent` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | | +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | | +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `spec` _[AgentSpec](#agentspec)_ | | | | +| `status` _[AgentStatus](#agentstatus)_ | | | | + + +#### SandboxConfig + + + +SandboxConfig configures sandboxed execution behavior. + + + +_Appears in:_ +- [AgentSpec](#agentspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `network` _[NetworkConfig](#networkconfig)_ | Network configures outbound network access for sandboxed execution paths.
When unset or when allowedDomains is empty, outbound access is denied by default. | | | + + #### SecretReference @@ -995,6 +1091,24 @@ _Appears in:_ | `refs` _string array_ | The list of skill images to fetch. | | MaxItems: 20
MinItems: 1
| | `gitAuthSecretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#localobjectreference-v1-core)_ | Reference to a Secret containing git credentials.
Applied to all gitRefs entries.
The secret should contain a `token` key for HTTPS auth,
or `ssh-privatekey` for SSH auth. | | | | `gitRefs` _[GitRepo](#gitrepo) array_ | Git repositories to fetch skills from. | | MaxItems: 20
MinItems: 1
| +| `initContainer` _[SkillsInitContainer](#skillsinitcontainer)_ | Configuration for the skills-init init container. | | | + + +#### SkillsInitContainer + + + +SkillsInitContainer configures the skills-init init container. + + + +_Appears in:_ +- [SkillForAgent](#skillforagent) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#resourcerequirements-v1-core)_ | Resource requirements for the skills-init init container. | | | +| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.31/#envvar-v1-core) array_ | Additional environment variables for the skills-init init container. | | | #### TLSConfig @@ -1018,6 +1132,40 @@ _Appears in:_ | `disableSystemCAs` _boolean_ | DisableSystemCAs disables the use of system CA certificates.
When false (default), system CA certificates are used for verification (safe behavior).
When true, only the custom CA from CACertSecretRef is trusted.
This allows strict security policies where only corporate CAs should be trusted. | false | | +#### TokenExchangeConfig + + + +TokenExchangeConfig configures dynamic bearer token acquisition before model calls. + + + +_Appears in:_ +- [OpenAIConfig](#openaiconfig) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `type` _[TokenExchangeType](#tokenexchangetype)_ | | | Enum: [GDCHServiceAccount]
| +| `gdchServiceAccount` _[GDCHServiceAccountConfig](#gdchserviceaccountconfig)_ | | | | + + +#### TokenExchangeType + +_Underlying type:_ _string_ + +TokenExchangeType identifies the token exchange mechanism + +_Validation:_ +- Enum: [GDCHServiceAccount] + +_Appears in:_ +- [TokenExchangeConfig](#tokenexchangeconfig) + +| Field | Description | +| --- | --- | +| `GDCHServiceAccount` | | + + #### Tool @@ -1148,3 +1296,5 @@ _Appears in:_ | `Secret` | | + + diff --git a/src/app/docs/kagent/resources/helm/page.mdx b/src/app/docs/kagent/resources/helm/page.mdx index 1e168975..8dffbe8a 100644 --- a/src/app/docs/kagent/resources/helm/page.mdx +++ b/src/app/docs/kagent/resources/helm/page.mdx @@ -30,8 +30,9 @@ A Helm chart for kagent, built with Google ADK | file://../agents/promql | promql-agent | | | file://../tools/grafana-mcp | grafana-mcp | | | file://../tools/querydoc | querydoc | | +| https://oauth2-proxy.github.io/manifests | oauth2-proxy | ~7.0.0 | | oci://ghcr.io/kagent-dev/kmcp/helm | kmcp | `${KMCP_VERSION}` | -| oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.1.1 | +| oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.1.3 | ## Values @@ -88,12 +89,16 @@ A Helm chart for kagent, built with Google ADK | agents.promql-agent.resources.requests.cpu | string | `"100m"` | | | agents.promql-agent.resources.requests.memory | string | `"256Mi"` | | | controller.a2aBaseUrl | string | `http://-controller..svc.cluster.local:` | The base URL of the A2A Server endpoint, as advertised to clients. | -| controller.agentDeployment | object | `{"serviceAccountName":""}` | Global deployment defaults applied to all agent pods. Per-agent settings in the Agent CRD take precedence over these defaults. | +| controller.agentDeployment | object | `{"host":"","podLabels":{},"serviceAccountName":""}` | Global deployment defaults applied to all agent pods. Per-agent settings in the Agent CRD take precedence over these defaults. | +| controller.agentDeployment.host | string | "" (controller falls back to "0.0.0.0"; "::" when ipv6.enabled) | Default host address for agent pods to bind to. Leave empty to use the controller's default fallback of "0.0.0.0". Automatically set to "::" when ipv6.enabled is true. Can be explicitly overridden here regardless of the ipv6 flag. | +| controller.agentDeployment.podLabels | object | {} (no extra labels) | Default labels applied to all agent pod templates. Per-agent labels in the Agent CRD take precedence over these defaults. | | controller.agentDeployment.serviceAccountName | string | "" (auto-create per-agent ServiceAccount) | Default ServiceAccount name for agent pods. When set, agent pods that don't specify an explicit serviceAccountName will use this ServiceAccount instead of creating a per-agent one. Useful for Workload Identity (GCP, AWS IRSA, Azure Workload Identity). Precedence: agent-level serviceAccountName > this default > auto-created SA. | | controller.agentImage.pullPolicy | string | `""` | | | controller.agentImage.registry | string | `""` | | | controller.agentImage.repository | string | `"kagent-dev/kagent/app"` | | | controller.agentImage.tag | string | `""` | | +| controller.auth.mode | string | `"unsecure"` | | +| controller.auth.userIdClaim | string | `""` | | | controller.env | list | `[]` | | | controller.envFrom | list | `[]` | | | controller.image.pullPolicy | string | `""` | | @@ -102,6 +107,7 @@ A Helm chart for kagent, built with Google ADK | controller.image.tag | string | `""` | | | controller.loglevel | string | `"info"` | | | controller.nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | +| controller.podAnnotations | object | `{}` | | | controller.replicas | int | `1` | | | controller.resources.limits.cpu | int | `2` | | | controller.resources.limits.memory | string | `"512Mi"` | | @@ -118,20 +124,21 @@ A Helm chart for kagent, built with Google ADK | controller.volumeMounts | list | `[]` | | | controller.volumes | list | `[]` | | | controller.watchNamespaces | list | [] (watches all available namespaces) | Namespaces the controller should watch. If empty, the controller will watch ALL available namespaces. | -| database.postgres.bundled.enabled | bool | `true` | Deploy the bundled PostgreSQL pod and PVC. Set to `false` to disable the bundled instance and provide your own via `url` or `urlFile`. | -| database.postgres.bundled.image.registry | string | `"docker.io"` | Bundled PostgreSQL image registry. | -| database.postgres.bundled.image.repository | string | `"library"` | Bundled PostgreSQL image repository (org/namespace). | -| database.postgres.bundled.image.name | string | `"postgres"` | Bundled PostgreSQL image name. | -| database.postgres.bundled.image.tag | string | `"18"` | Bundled PostgreSQL image tag. | -| database.postgres.bundled.image.pullPolicy | string | `"IfNotPresent"` | Bundled PostgreSQL image pull policy. | -| database.postgres.bundled.storage | string | `"500Mi"` | PersistentVolumeClaim size for the bundled PostgreSQL instance. | -| database.postgres.bundled.resources.requests.cpu | string | `"250m"` | CPU request for the bundled PostgreSQL container. | -| database.postgres.bundled.resources.requests.memory | string | `"256Mi"` | Memory request for the bundled PostgreSQL container. | -| database.postgres.bundled.resources.limits.cpu | string | `"500m"` | CPU limit for the bundled PostgreSQL container. | -| database.postgres.bundled.resources.limits.memory | string | `"512Mi"` | Memory limit for the bundled PostgreSQL container. | -| database.postgres.url | string | `""` | External PostgreSQL connection string. Always used if set, regardless of `bundled.enabled`. | -| database.postgres.urlFile | string | `""` | Path to a file containing the database URL. Takes precedence over `url` when set. Always used if set, regardless of `bundled.enabled`. | -| database.postgres.vectorEnabled | bool | `false` | Enable pgvector extension and memory table migration. Set to `true` when using a PostgreSQL server that has pgvector installed. Required for vector-based memory features. | +| database.postgres.bundled | object | `{"enabled":true,"image":{"name":"postgres","pullPolicy":"IfNotPresent","registry":"docker.io","repository":"library","tag":"18.3-alpine"},"podSecurityContext":{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}},"resources":{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"seccompProfile":{"type":"RuntimeDefault"}},"storage":"500Mi","storageClassName":""}` | Bundled PostgreSQL instance — for development and evaluation only. Not suitable for production. Deployed when enabled is true and url/urlFile are not set. | +| database.postgres.bundled.enabled | bool | `true` | Set to false to disable the bundled database and provide your own via url or urlFile. | +| database.postgres.bundled.image.name | string | `"postgres"` | Bundled PostgreSQL image name | +| database.postgres.bundled.image.pullPolicy | string | `"IfNotPresent"` | Bundled PostgreSQL image pull policy | +| database.postgres.bundled.image.registry | string | `"docker.io"` | Bundled PostgreSQL image registry | +| database.postgres.bundled.image.repository | string | `"library"` | Bundled PostgreSQL image repository (org/namespace) | +| database.postgres.bundled.image.tag | string | `"18.3-alpine"` | Bundled PostgreSQL image tag | +| database.postgres.bundled.podSecurityContext | object | `{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}}` | Pod-level security context for the bundled PostgreSQL deployment. | +| database.postgres.bundled.resources | object | `{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}}` | Resource requests/limits for the demo PostgreSQL container | +| database.postgres.bundled.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"seccompProfile":{"type":"RuntimeDefault"}}` | Container-level security context for the bundled PostgreSQL container. | +| database.postgres.bundled.storage | string | `"500Mi"` | PersistentVolumeClaim size for demo PostgreSQL data | +| database.postgres.bundled.storageClassName | string | `""` | StorageClass for the PostgreSQL PVC. Defaults to the cluster default when empty. | +| database.postgres.url | string | `""` | External PostgreSQL connection string. Is always used if set regardless of the `.bundled.enabled` field. | +| database.postgres.urlFile | string | `""` | Path to a file containing the database URL. Takes precedence over url when set. Is always used if set regardless of the `.bundled.enabled` field. | +| database.postgres.vectorEnabled | bool | `false` | Enable the pgvector migration Required to use features that depend on database vector capability. (e.g. long-term memory) Set to true when using an external PostgreSQL that has the pgvector extension installed. | | fullnameOverride | string | `""` | | | grafana-mcp.grafana.serviceAccountToken | string | `""` | | | grafana-mcp.grafana.url | string | `"grafana.kagent:3000/api"` | | @@ -141,6 +148,7 @@ A Helm chart for kagent, built with Google ADK | grafana-mcp.resources.requests.memory | string | `"128Mi"` | | | imagePullPolicy | string | `"IfNotPresent"` | | | imagePullSecrets | list | `[]` | | +| ipv6 | object | false | Enable IPv6/dual-stack support. When true, configures all components for dual-stack (IPv4+IPv6) networking: - nginx listens on both IPv4 and IPv6 (adds `listen [::]:8080`) - Next.js binds to `::` instead of `0.0.0.0` - Agent pods bind to `::` for dual-stack reachability Leave disabled on clusters where IPv6 is disabled at the kernel level. | | kagent-tools.enabled | bool | `true` | | | kagent-tools.nameOverride | string | `"tools"` | | | kagent-tools.replicaCount | int | `1` | | @@ -158,20 +166,55 @@ A Helm chart for kagent, built with Google ADK | nameOverride | string | `""` | | | namespaceOverride | string | `.Release.Namespace` | Override the namespace | | nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | +| oauth2-proxy.config.clientID | string | `""` | | +| oauth2-proxy.config.clientSecret | string | `""` | | +| oauth2-proxy.config.cookieSecret | string | `""` | | +| oauth2-proxy.config.existingSecret | string | `""` | | +| oauth2-proxy.enabled | bool | `false` | | +| oauth2-proxy.extraArgs.approval-prompt | string | `"auto"` | | +| oauth2-proxy.extraArgs.cookie-samesite | string | `"lax"` | | +| oauth2-proxy.extraArgs.cookie-secure | bool | `true` | | +| oauth2-proxy.extraArgs.custom-templates-dir | string | `"/templates"` | | +| oauth2-proxy.extraArgs.email-domain | string | `"*"` | | +| oauth2-proxy.extraArgs.oidc-issuer-url | string | `"$(OIDC_ISSUER_URL)"` | | +| oauth2-proxy.extraArgs.pass-authorization-header | bool | `true` | | +| oauth2-proxy.extraArgs.provider | string | `"oidc"` | | +| oauth2-proxy.extraArgs.redirect-url | string | `"$(OIDC_REDIRECT_URL)"` | | +| oauth2-proxy.extraArgs.scope | string | `"openid profile email groups"` | | +| oauth2-proxy.extraArgs.set-authorization-header | bool | `true` | | +| oauth2-proxy.extraArgs.skip-auth-regex | string | `"^/(login|_next/static|_next/image|login-bg\\.(jpg|png|webp)|logo-.*\\.png|favicon\\.ico).*$"` | | +| oauth2-proxy.extraArgs.skip-auth-route | string | `"^/(health|login)$"` | | +| oauth2-proxy.extraArgs.skip-jwt-bearer-tokens | bool | `true` | | +| oauth2-proxy.extraArgs.upstream | string | `"$(UPSTREAM_URL)"` | | +| oauth2-proxy.extraEnv[0].name | string | `"OIDC_ISSUER_URL"` | | +| oauth2-proxy.extraEnv[0].value | string | `""` | | +| oauth2-proxy.extraEnv[1].name | string | `"OIDC_REDIRECT_URL"` | | +| oauth2-proxy.extraEnv[1].value | string | `""` | | +| oauth2-proxy.extraEnv[2].name | string | `"UPSTREAM_URL"` | | +| oauth2-proxy.extraEnv[2].value | string | `"http://kagent-ui:8080"` | | +| oauth2-proxy.extraVolumeMounts[0].mountPath | string | `"/templates"` | | +| oauth2-proxy.extraVolumeMounts[0].name | string | `"custom-templates"` | | +| oauth2-proxy.extraVolumeMounts[0].readOnly | bool | `true` | | +| oauth2-proxy.extraVolumes[0].configMap.name | string | `"kagent-oauth2-proxy-templates"` | | +| oauth2-proxy.extraVolumes[0].name | string | `"custom-templates"` | | +| oauth2-proxy.redis.enabled | bool | `false` | | +| oauth2-proxy.service.portNumber | int | `4180` | | +| oauth2-proxy.service.type | string | `"ClusterIP"` | | +| oauth2-proxy.sessionStorage.type | string | `"cookie"` | | | otel.logging.enabled | bool | `false` | | | otel.logging.exporter.otlp.endpoint | string | `""` | | | otel.logging.exporter.otlp.insecure | bool | `true` | | -| otel.logging.exporter.otlp.timeout | int | `15` | | +| otel.logging.exporter.otlp.timeout | int | `15000` | | | otel.tracing.enabled | bool | `false` | | | otel.tracing.exporter.otlp.endpoint | string | `""` | | | otel.tracing.exporter.otlp.insecure | bool | `true` | | | otel.tracing.exporter.otlp.protocol | string | `"grpc"` | | -| otel.tracing.exporter.otlp.timeout | int | `15` | | +| otel.tracing.exporter.otlp.timeout | int | `15000` | | | podAnnotations | object | `{}` | | -| podSecurityContext | object | `{}` | | +| podSecurityContext | object | `{"runAsNonRoot":true}` | Security context for all pods | | providers.anthropic.apiKeySecretKey | string | `"ANTHROPIC_API_KEY"` | | | providers.anthropic.apiKeySecretRef | string | `"kagent-anthropic"` | | -| providers.anthropic.model | string | `"claude-3-5-haiku-20241022"` | | +| providers.anthropic.model | string | `"claude-haiku-4-5"` | | | providers.anthropic.provider | string | `"Anthropic"` | | | providers.azureOpenAI.apiKeySecretKey | string | `"AZUREOPENAI_API_KEY"` | | | providers.azureOpenAI.apiKeySecretRef | string | `"kagent-azure-openai"` | | @@ -205,25 +248,36 @@ A Helm chart for kagent, built with Google ADK | querydoc.resources.limits.memory | string | `"512Mi"` | | | querydoc.resources.requests.cpu | string | `"100m"` | | | querydoc.resources.requests.memory | string | `"128Mi"` | | +| rbac.namespaces | list | `[]` | Namespaces in which to create Role and RoleBinding resources. If empty (default), the chart creates cluster-scoped ClusterRole and ClusterRoleBinding resources and the controller watches all namespaces. If set, the chart creates a Role + RoleBinding per listed namespace and the controller's WATCH_NAMESPACES is derived from this list (unless controller.watchNamespaces is set explicitly, which always takes precedence). | | registry | string | `"cr.kagent.dev"` | | -| securityContext | object | `{}` | | +| securityContext | object | `{"readOnlyRootFilesystem":true}` | Security context for all containers | | tag | string | `""` | | | tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | tools.grafana-mcp.enabled | bool | `true` | | | tools.querydoc.enabled | bool | `true` | | +| ui.auth.ssoRedirectPath | string | `"/oauth2/start"` | | | ui.env | object | `{}` | | | ui.image.pullPolicy | string | `""` | | | ui.image.registry | string | `""` | | | ui.image.repository | string | `"kagent-dev/kagent/ui"` | | | ui.image.tag | string | `""` | | | ui.nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | +| ui.podAnnotations | object | `{}` | | +| ui.podSecurityContext | object | (uses global podSecurityContext) | Pod-level security context for the UI pod. Overrides the global podSecurityContext. | +| ui.readinessProbe | object | httpGet /health on port http, periodSeconds=30 | Custom readiness probe for the UI container. Override to adjust thresholds, use exec-based probes, or change the health path. | | ui.replicas | int | `1` | | | ui.resources.limits.cpu | string | `"1000m"` | | | ui.resources.limits.memory | string | `"1Gi"` | | | ui.resources.requests.cpu | string | `"100m"` | | | ui.resources.requests.memory | string | `"256Mi"` | | +| ui.securityContext | object | (uses global securityContext) | Container-level security context for the UI container. Overrides the global securityContext. | +| ui.service.annotations | object | `{}` | | | ui.service.ports.port | int | `8080` | | | ui.service.ports.targetPort | int | `8080` | | | ui.service.type | string | `"ClusterIP"` | | +| ui.startupProbe | object | httpGet /health on port http, periodSeconds=1, initialDelaySeconds=1 | Custom startup probe for the UI container. Override to adjust thresholds, use exec-based probes, or change the health path. | | ui.tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | +| ui.volumes | object | `{"nextjsCache":"100Mi","tmp":"50Mi"}` | EmptyDir volume sizes for Next.js UI workload (typically used when enabling readOnlyRootFilesystem) | +| ui.volumes.nextjsCache | string | `"100Mi"` | Size limit for Next.js build cache (.next/cache). Default 100Mi is sufficient for typical Next.js apps with moderate caching needs. | +| ui.volumes.tmp | string | `"50Mi"` | Size limit for temporary files (/tmp). Default 50Mi provides ample space for Next.js runtime temporary data. |