diff --git a/docs-site/assets/kagent-docs/versions/kagent.md b/docs-site/assets/kagent-docs/versions/kagent.md index 274aad72..4b0e8454 100644 --- a/docs-site/assets/kagent-docs/versions/kagent.md +++ b/docs-site/assets/kagent-docs/versions/kagent.md @@ -1 +1 @@ -{{< version include-if="0.x" >}}0.10.1{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha2{{< /version >}} \ No newline at end of file +{{< version include-if="0.x" >}}0.10.2{{< /version >}}{{< version include-if="1.x" >}}1.0.0-alpha2{{< /version >}} \ No newline at end of file diff --git a/docs-site/content/kagent/0.x/resources/api-ref.md b/docs-site/content/kagent/0.x/resources/api-ref.md index ad2010e0..a9c5b341 100644 --- a/docs-site/content/kagent/0.x/resources/api-ref.md +++ b/docs-site/content/kagent/0.x/resources/api-ref.md @@ -87,8 +87,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `name` _string_ | Name is a stable id for this binding (OpenClaw channels.*.accounts key). | | MinLength: 1
| -| `type` _[AgentHarnessChannelType](#agentharnesschanneltype)_ | | | Enum: [telegram slack]
| +| `name` _string_ | Name is a stable id for this binding (OpenClaw channels.*.accounts key). | | MinLength: 1
**Required**
| +| `type` _[AgentHarnessChannelType](#agentharnesschanneltype)_ | | | Enum: [telegram slack]
**Required**
| | `telegram` _[AgentHarnessTelegramChannelSpec](#agentharnesstelegramchannelspec)_ | | | | | `slack` _[AgentHarnessSlackChannelSpec](#agentharnessslackchannelspec)_ | Slack configures Slack when type is Slack. | | | @@ -189,8 +189,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `botToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | | -| `appToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | | +| `botToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | **Required**
| +| `appToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | **Required**
| | `openclaw` _[AgentHarnessOpenClawSlackOptions](#agentharnessopenclawslackoptions)_ | OpenClaw configures OpenClaw-specific Slack routing. | | | | `hermes` _[AgentHarnessHermesSlackOptions](#agentharnesshermesslackoptions)_ | Hermes configures Hermes-specific Slack settings. | | | @@ -208,8 +208,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `backend` _[AgentHarnessBackendType](#agentharnessbackendtype)_ | Backend selects the control plane to use. Required. | | Enum: [openclaw hermes]
| -| `substrate` _[AgentHarnessSubstrateSpec](#agentharnesssubstratespec)_ | Substrate configures the Agent Substrate provisioning stack. Required. | | | +| `backend` _[AgentHarnessBackendType](#agentharnessbackendtype)_ | Backend selects the control plane to use. Required. | | Enum: [openclaw hermes]
**Required**
| +| `substrate` _[AgentHarnessSubstrateSpec](#agentharnesssubstratespec)_ | Substrate configures the Agent Substrate provisioning stack. Required. | | **Required**
| | `description` _string_ | Description is a short human-readable summary shown in the UI (e.g. agents list). | | | | `image` _string_ | Image is the container image to run in the harness VM, if the backend
supports per-resource images. Backend openclaw pins the image
to the OpenClaw sandbox base when this field is empty; backend hermes pins
to the Hermes sandbox base image when empty. | | | | `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#envvar-v1-core) array_ | Env is a list of environment variables injected into the harness workload.
Values use the Kubernetes EnvVar shape; ValueFrom references are
resolved server-side where supported. | | | @@ -239,8 +239,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `backend` _[AgentHarnessBackendType](#agentharnessbackendtype)_ | | | Enum: [openclaw hermes]
| -| `id` _string_ | | | | +| `backend` _[AgentHarnessBackendType](#agentharnessbackendtype)_ | | | Enum: [openclaw hermes]
**Required**
| +| `id` _string_ | | | **Required**
| #### AgentHarnessSubstrateSnapshotsConfig @@ -253,7 +253,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `location` _string_ | Location is the GCS URI prefix for golden and incremental snapshots.
Example: gs://ate-snapshots/kagent/my-namespace/my-harness/ | | Pattern: `^gs://`
| +| `location` _string_ | Location is the GCS URI prefix for golden and incremental snapshots.
Example: gs://ate-snapshots/kagent/my-namespace/my-harness/ | | Pattern: `^gs://`
**Required**
| #### AgentHarnessSubstrateSpec @@ -281,7 +281,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `botToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | | +| `botToken` _[AgentHarnessChannelCredential](#agentharnesschannelcredential)_ | | | **Required**
| | `allowedUserIDs` _string array_ | | | MaxItems: 1024
| | `allowedUserIDsFrom` _[ValueSource](#valuesource)_ | | | | @@ -295,8 +295,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `organization` _string_ | Organization is the name of the agent provider's organization. | | MinLength: 1
| -| `url` _string_ | URL is a URL for the agent provider's website or relevant documentation. | | Format: uri
| +| `organization` _string_ | Organization is the name of the agent provider's organization. | | MinLength: 1
**Required**
| +| `url` _string_ | URL is a URL for the agent provider's website or relevant documentation. | | Format: uri
**Required**
| #### AgentSkill @@ -308,7 +308,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `id` _string_ | ID is the unique identifier for the skill. | | | -| `name` _string_ | Name is the human-readable name of the skill. | | MinLength: 1
| +| `name` _string_ | Name is the human-readable name of the skill. | | MinLength: 1
**Required**
| | `description` _string_ | Description is an optional detailed description of the skill. | | | | `tags` _string array_ | Tags are optional tags for categorization. | | MaxItems: 20
| | `examples` _string array_ | Examples are optional usage examples. | | MaxItems: 20
| @@ -333,7 +333,7 @@ _Appears in:_ | `documentationUrl` _string_ | DocumentationURL is a URL to human-readable documentation for the agent. It
is surfaced on the agent's A2A AgentCard. | | Format: uri
| | `version` _string_ | Version is the agent's version string, surfaced on the A2A AgentCard. | | | | `provider` _[AgentProvider](#agentprovider)_ | Provider identifies the organization responsible for the agent. It is
surfaced on the agent's A2A AgentCard. | | | -| `skills` _[SkillForAgent](#skillforagent)_ | Skills to load into the agent. They will be pulled from OCI images, git repos,
and/or S3, and made available to the agent under the `/skills` folder. | | | +| `skills` _[SkillForAgent](#skillforagent)_ | Skills to load into the agent. They will be pulled from OCI images, git repos,
and/or S3, and made available to the agent under the `/skills` folder. | | AtLeastOneOf: [refs gitRefs s3Refs]
| | `sandbox` _[SandboxConfig](#sandboxconfig)_ | Sandbox configures sandboxed execution behavior shared across runtimes.
This is intended for sandboxed declarative execution today, and can also
be consumed by BYO agents. | | | | `allowedNamespaces` _[AllowedNamespaces](#allowednamespaces)_ | AllowedNamespaces defines which namespaces are allowed to reference this Agent as a tool.
This follows the Gateway API pattern for cross-namespace route attachments.
If not specified, only Agents in the same namespace can reference this Agent as a tool.
This field only applies when this Agent is used as a tool by another Agent.
See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-route-attachment | | | @@ -408,8 +408,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `projectID` _string_ | The project ID | | | -| `location` _string_ | The project location | | | +| `projectID` _string_ | The project ID | | **Required**
| +| `location` _string_ | The project location | | **Required**
| | `temperature` _string_ | Temperature | | | | `topP` _string_ | Top-p sampling parameter | | | | `topK` _string_ | Top-k sampling parameter | | | @@ -425,8 +425,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `azureEndpoint` _string_ | Endpoint for the Azure OpenAI API | | | -| `apiVersion` _string_ | API version for the Azure OpenAI API | | | +| `azureEndpoint` _string_ | Endpoint for the Azure OpenAI API | | **Required**
| +| `apiVersion` _string_ | API version for the Azure OpenAI API | | **Required**
| | `azureDeployment` _string_ | Deployment name for the Azure OpenAI API | | | | `azureAdToken` _string_ | Azure AD token for authentication | | | | `temperature` _string_ | Temperature for sampling | | | @@ -451,8 +451,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `projectID` _string_ | The project ID | | | -| `location` _string_ | The project location | | | +| `projectID` _string_ | The project ID | | **Required**
| +| `location` _string_ | The project location | | **Required**
| | `temperature` _string_ | Temperature | | | | `topP` _string_ | Top-p sampling parameter | | | | `topK` _string_ | Top-k sampling parameter | | | @@ -467,10 +467,10 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `region` _string_ | AWS region where the Bedrock model is available (e.g., us-east-1, us-west-2) | | | +| `region` _string_ | AWS region where the Bedrock model is available (e.g., us-east-1, us-west-2) | | **Required**
| | `additionalModelRequestFields` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#json-v1-apiextensions-k8s-io)_ | AdditionalModelRequestFields passes model-specific parameters to Bedrock's
additionalModelRequestFields in the Converse API. Use this for provider-specific
options that are not part of the standard InferenceConfiguration block, such as
Claude extended thinking or top_k. Values are forwarded as-is to the API.
Example: \{"top_k": 5, "thinking": \{"type": "enabled", "budget_tokens": 16000\}\} | | | -| `promptCaching` _boolean_ | PromptCaching enables Bedrock prompt caching by appending a CachePoint
block at the end of the Converse request's `system` content array and
the end of the `toolConfig.tools` array. Bedrock will cache the prefix up to and
including those cache points across requests in the same region for
roughly 5 minutes after first use, billing the cached portion at a
reduced rate on cache hits.

Recommended for tool-using agents that make many Converse calls per
task with a stable system prompt and tool set — the per-call input
token count can drop by 70-90% on hit. Has no effect on models that
don't support caching; the marker is ignored by Bedrock for those.

See https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html
for the current list of supported models and minimum prefix sizes. | false | | -| `cacheTTL` _string_ | CacheTTL controls how long Bedrock retains a cached prefix when
PromptCaching is enabled. Only meaningful when PromptCaching is true.

- "5m" (default): Bedrock's standard 5-minute sliding cache. Each cache
hit refreshes the window. Supported by all prompt-caching models.
- "1h": extended-TTL caching, useful for tasks whose Converse calls are
spaced more than 5 minutes apart.

NOTE: "1h" is NOT strictly better than "5m". Extended-TTL cache writes are
billed at a higher per-token rate than 5-minute writes, and 1h is supported
on a narrower set of models. Only choose "1h" when calls are spaced far
enough apart that a 5-minute cache would expire between them; otherwise the
higher write cost is wasted. See the AWS prompt-caching docs above. | 5m | Enum: [5m 1h]
| +| `promptCaching` _boolean_ | PromptCaching enables Bedrock prompt caching by appending a CachePoint
block at the end of the Converse request's `system` content array and
the end of the `toolConfig.tools` array. Bedrock will cache the prefix up to and
including those cache points across requests in the same region for
roughly 5 minutes after first use, billing the cached portion at a
reduced rate on cache hits.
Recommended for tool-using agents that make many Converse calls per
task with a stable system prompt and tool set — the per-call input
token count can drop by 70-90% on hit. Has no effect on models that
don't support caching; the marker is ignored by Bedrock for those.
See https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html
for the current list of supported models and minimum prefix sizes. | false | | +| `cacheTTL` _string_ | CacheTTL controls how long Bedrock retains a cached prefix when
PromptCaching is enabled. Only meaningful when PromptCaching is true.
- "5m" (default): Bedrock's standard 5-minute sliding cache. Each cache
hit refreshes the window. Supported by all prompt-caching models.
- "1h": extended-TTL caching, useful for tasks whose Converse calls are
spaced more than 5 minutes apart.
NOTE: "1h" is NOT strictly better than "5m". Extended-TTL cache writes are
billed at a higher per-token rate than 5-minute writes, and 1h is supported
on a narrower set of models. Only choose "1h" when calls are spaced far
enough apart that a 5-minute cache would expire between them; otherwise the
higher write cost is wasted. See the AWS prompt-caching docs above. | 5m | Enum: [5m 1h]
| | `guardrail` _[BedrockGuardrailConfig](#bedrockguardrailconfig)_ | | | | | `readTimeout` _integer_ | ReadTimeout is the Bedrock HTTP client read timeout in seconds, applied by
both the Python and Go ADK runtimes. Raise this for agents that make long
Converse calls (large tool-augmented turns, extended reasoning). On the
Python ADK it overrides botocore's ~60s read timeout, which otherwise
aborts long completions with a ReadTimeoutError; on the Go ADK it bounds
the whole Converse request (default 30m). When unset, each runtime's
default is used. | | Minimum: 1
| | `connectTimeout` _integer_ | ConnectTimeout is the Bedrock HTTP client connection-establishment timeout
in seconds, applied by both the Python and Go ADK runtimes. It bounds
connection setup only, not the response read. When unset, each runtime's
default is used (Python ADK: botocore; Go ADK: net dialer). | | Minimum: 1
| @@ -482,8 +482,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `identifier` _string_ | Identifier is the guardrail ID or full ARN. AWS accepts either a bare
guardrail ID or an arn:aws:bedrock:...:guardrail/... ARN, so the value is
only length-bounded here (AWS caps guardrailIdentifier at 2048 chars). | | MaxLength: 2048
MinLength: 1
| -| `version` _string_ | Version is the guardrail version: a numeric version (e.g. "1") or "DRAFT". | | MaxLength: 8
MinLength: 1
| +| `identifier` _string_ | Identifier is the guardrail ID or full ARN. AWS accepts either a bare
guardrail ID or an arn:aws:bedrock:...:guardrail/... ARN, so the value is
only length-bounded here (AWS caps guardrailIdentifier at 2048 chars). | | MaxLength: 2048
MinLength: 1
**Required**
| +| `version` _string_ | Version is the guardrail version: a numeric version (e.g. "1") or "DRAFT". | | MaxLength: 8
MinLength: 1
**Required**
| | `trace` _string_ | | disabled | Enum: [disabled enabled enabled_full]
| #### ByoDeploymentSpec @@ -638,8 +638,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `endpoint` _string_ | Endpoint is the Foundry or Azure AI Services account endpoint
(e.g., https://my-account.cognitiveservices.azure.com/).
Mutually exclusive with EndpointFrom. | | | -| `endpointFrom` _[ConfigMapKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#configmapkeyselector-v1-core)_ | EndpointFrom resolves the Foundry endpoint from a ConfigMap key, such as
one written by Azure Service Operator. Mutually exclusive with Endpoint.

The selector's optional flag only controls how a missing key is handled: when
set to true, the missing key is ignored while reading the ConfigMap, but a
Foundry endpoint must always be supplied, so an unresolved endpointFrom still
leaves the model unusable and the agent fails to start. | | | -| `deployment` _string_ | Deployment is the Foundry model deployment name. | | | +| `endpointFrom` _[ConfigMapKeySelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#configmapkeyselector-v1-core)_ | EndpointFrom resolves the Foundry endpoint from a ConfigMap key, such as
one written by Azure Service Operator. Mutually exclusive with Endpoint.
The selector's optional flag only controls how a missing key is handled: when
set to true, the missing key is ignored while reading the ConfigMap, but a
Foundry endpoint must always be supplied, so an unresolved endpointFrom still
leaves the model unusable and the agent fails to start. | | | +| `deployment` _string_ | Deployment is the Foundry model deployment name. | | **Required**
| | `apiVersion` _string_ | APIVersion is the Foundry OpenAI-compatible data-plane API version. | 2024-10-21 | | #### FromNamespaces @@ -671,7 +671,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `audience` _string_ | Audience is the token exchange audience URL (the GDC inference gateway base URL) | | | +| `audience` _string_ | Audience is the token exchange audience URL (the GDC inference gateway base URL) | | **Required**
| #### GeminiConfig @@ -693,8 +693,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `projectID` _string_ | The project ID | | | -| `location` _string_ | The project location | | | +| `projectID` _string_ | The project ID | | **Required**
| +| `location` _string_ | The project location | | **Required**
| | `temperature` _string_ | Temperature | | | | `topP` _string_ | Top-p sampling parameter | | | | `topK` _string_ | Top-k sampling parameter | | | @@ -712,7 +712,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `url` _string_ | URL of the git repository (HTTPS or SSH). | | | +| `url` _string_ | URL of the git repository (HTTPS or SSH). | | **Required**
| | `ref` _string_ | Git reference: branch name, tag, or commit SHA. | main | | | `path` _string_ | Subdirectory within the repo to use as the skill root. The API validates
this input path, but treats repository contents as trusted: symlinks under
this path are dereferenced when materializing the skill. | | | | `name` _string_ | Name for the skill directory under /skills. If omitted, defaults to the last
segment of Path when Path is set; otherwise defaults to the repo name (last
URL path segment, without .git). | | | @@ -724,8 +724,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `name` _string_ | | | | -| `description` _string_ | | | | +| `name` _string_ | | | **Required**
| +| `description` _string_ | | | **Required**
| #### McpServerTool @@ -736,11 +736,11 @@ _Appears in:_ | --- | --- | --- | --- | | `kind` _string_ | | | | | `apiGroup` _string_ | | | | -| `name` _string_ | | | | +| `name` _string_ | | | **Required**
| | `namespace` _string_ | | | | | `toolNames` _string array_ | The names of the tools to be provided by the ToolServer
For a list of all the tools provided by the server,
the client can query the status of the ToolServer object after it has been created | | MaxItems: 50
| | `requireApproval` _string array_ | RequireApproval lists tool names that require human approval before
execution. Each name must also appear in ToolNames. When a tool in
this list is invoked by the agent, execution pauses and the user is
prompted to approve or reject the call. | | MaxItems: 50
| -| `allowedHeaders` _string array_ | AllowedHeaders specifies which headers from the A2A request should be
propagated to MCP tool calls. Header names are case-insensitive.

Authorization header behavior:
- Authorization headers CAN be propagated if explicitly listed in allowedHeaders
- When STS token propagation is enabled, STS-generated Authorization headers
will take precedence and replace any Authorization header from the A2A request
- This is a security measure to prevent request headers from overwriting
authentication tokens generated by the STS integration

Example: ["x-user-email", "x-tenant-id"] | | | +| `allowedHeaders` _string array_ | AllowedHeaders specifies which headers from the A2A request should be
propagated to MCP tool calls. Header names are case-insensitive.
Authorization header behavior:
- Authorization headers CAN be propagated if explicitly listed in allowedHeaders
- When STS token propagation is enabled, STS-generated Authorization headers
will take precedence and replace any Authorization header from the A2A request
- This is a security measure to prevent request headers from overwriting
authentication tokens generated by the STS integration
Example: ["x-user-email", "x-tenant-id"] | | | #### MemorySpec @@ -751,7 +751,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `modelConfig` _string_ | ModelConfig is the name of the ModelConfig object whose embedding
provider will be used to generate memory vectors. | | | +| `modelConfig` _string_ | ModelConfig is the name of the ModelConfig object whose embedding
provider will be used to generate memory vectors. | | **Required**
| | `ttlDays` _integer_ | TTLDays controls how many days a stored memory entry remains valid before
it is eligible for pruning. Defaults to 15 days when unset or zero. | | Minimum: 1
| #### ModelConfig @@ -777,7 +777,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `model` _string_ | | | | +| `model` _string_ | | | **Required**
| | `apiKeySecret` _string_ | The name of the secret that contains the API key. Must be a reference to the name of a secret in the same namespace as the referencing ModelConfig.
For the SAPAICore provider, the secret must contain two keys: "client_id" and "client_secret"
(the OAuth2 client credentials for SAP AI Core). The apiKeySecretKey field is not used for SAPAICore. | | | | `apiKeySecretKey` _string_ | The key in the secret that contains the API key.
Not used for the SAPAICore provider (which always reads "client_id" and "client_secret" from the secret). | | | | `apiKeyPassthrough` _boolean_ | APIKeyPassthrough enables forwarding the Bearer token from incoming A2A requests
directly to the LLM provider as the API key. This is useful for organizations
with federated identity that want to avoid separate secret management.
Mutually exclusive with apiKeySecret. | | | @@ -858,7 +858,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `type` _[ModelProvider](#modelprovider)_ | Type is the model provider type (OpenAI, Anthropic, etc.) | | Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock SAPAICore Foundry]
| +| `type` _[ModelProvider](#modelprovider)_ | Type is the model provider type (OpenAI, Anthropic, etc.) | | Enum: [Anthropic OpenAI AzureOpenAI Ollama Gemini GeminiVertexAI AnthropicVertexAI Bedrock SAPAICore Foundry]
**Required**
| | `endpoint` _string_ | Endpoint is the API endpoint URL for the provider.
If not specified, the default endpoint for the provider type will be used. | | Pattern: `^https?://.*`
| | `secretRef` _[SecretReference](#secretreference)_ | SecretRef references the Kubernetes Secret containing the API key.
Optional for providers that don't require authentication (e.g., local Ollama). | | | @@ -969,7 +969,7 @@ _Appears in:_ | --- | --- | --- | --- | | `kind` _string_ | | | | | `apiGroup` _string_ | | | | -| `name` _string_ | | | | +| `name` _string_ | | | **Required**
| | `alias` _string_ | Alias is an optional short identifier for use in include directives.
If set, use include("alias/key") instead of include("name/key"). | | | #### PromptTemplateSpec @@ -1021,15 +1021,15 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `description` _string_ | | | | +| `description` _string_ | | | **Required**
| | `protocol` _[RemoteMCPServerProtocol](#remotemcpserverprotocol)_ | | STREAMABLE_HTTP | Enum: [SSE STREAMABLE_HTTP]
| -| `url` _string_ | | | MinLength: 1
| +| `url` _string_ | | | MinLength: 1
**Required**
| | `headersFrom` _[ValueRef](#valueref) array_ | | | | | `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta)_ | | 30s | | | `sseReadTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#duration-v1-meta)_ | | | | | `terminateOnClose` _boolean_ | | true | | -| `allowedNamespaces` _[AllowedNamespaces](#allowednamespaces)_ | AllowedNamespaces defines which namespaces are allowed to reference this RemoteMCPServer.
This follows the Gateway API pattern for cross-namespace route attachments.
If not specified, only Agents in the same namespace can reference this RemoteMCPServer.
See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-route-attachment

A cross-namespace-permitting value (from: All or from: Selector) is
mutually exclusive with spec.tls.caCertSecretRef (enforced by a spec-level
XValidation rule): a pinned CA Secret is mounted onto the consuming agent's
pod by bare name and Kubernetes resolves it in the agent's namespace, not
this RemoteMCPServer's, so a CA-pinning RemoteMCPServer cannot be referenced
cross-namespace. from: Same (the default) is always allowed. | | | -| `tls` _[TLSConfig](#tlsconfig)_ | TLS configuration for the upstream MCP server connection.
Use this for HTTPS upstreams that present a certificate the agent's
system trust store does not include (corporate CA, self-signed cert
on a test fixture, internal MCP gateway). Reuses the same TLSConfig
type as ModelConfig.spec.tls — disableVerify turns off certificate
validation entirely, caCertSecretRef + caCertSecretKey point at a
PEM bundle Secret in the same namespace, and disableSystemCAs
trusts only the named bundle.

Note one asymmetry with ModelConfig: a spec-level XValidation rule
on RemoteMCPServer rejects spec.tls when spec.url has the http://
scheme (a TLS opinion contradicts a plaintext URL). ModelConfig has
no equivalent rule, so a TLS block can sit alongside any baseUrl. | | | +| `allowedNamespaces` _[AllowedNamespaces](#allowednamespaces)_ | AllowedNamespaces defines which namespaces are allowed to reference this RemoteMCPServer.
This follows the Gateway API pattern for cross-namespace route attachments.
If not specified, only Agents in the same namespace can reference this RemoteMCPServer.
See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-route-attachment
A cross-namespace-permitting value (from: All or from: Selector) is
mutually exclusive with spec.tls.caCertSecretRef (enforced by a spec-level
XValidation rule): a pinned CA Secret is mounted onto the consuming agent's
pod by bare name and Kubernetes resolves it in the agent's namespace, not
this RemoteMCPServer's, so a CA-pinning RemoteMCPServer cannot be referenced
cross-namespace. from: Same (the default) is always allowed. | | | +| `tls` _[TLSConfig](#tlsconfig)_ | TLS configuration for the upstream MCP server connection.
Use this for HTTPS upstreams that present a certificate the agent's
system trust store does not include (corporate CA, self-signed cert
on a test fixture, internal MCP gateway). Reuses the same TLSConfig
type as ModelConfig.spec.tls — disableVerify turns off certificate
validation entirely, caCertSecretRef + caCertSecretKey point at a
PEM bundle Secret in the same namespace, and disableSystemCAs
trusts only the named bundle.
Note one asymmetry with ModelConfig: a spec-level XValidation rule
on RemoteMCPServer rejects spec.tls when spec.url has the http://
scheme (a TLS opinion contradicts a plaintext URL). ModelConfig has
no equivalent rule, so a TLS block can sit alongside any baseUrl. | | | #### RemoteMCPServerStatus @@ -1058,7 +1058,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `uri` _string_ | S3 URI of the skill: s3://bucket/key-or-prefix | | MinLength: 1
Pattern: `^s3://.+`
| +| `uri` _string_ | S3 URI of the skill: s3://bucket/key-or-prefix | | MinLength: 1
Pattern: `^s3://.+`
**Required**
| | `region` _string_ | AWS region for the bucket. Optional when AWS_REGION / AWS_DEFAULT_REGION is set
on the skills-init container (e.g. via initContainer.env). | | | | `name` _string_ | Name for the skill directory under /skills. If omitted, defaults to the last
non-empty path segment of the URI (archive extension stripped). | | | @@ -1071,7 +1071,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `baseUrl` _string_ | Base URL for the SAP AI Core API (e.g., https://api.ai.prod.eu-central-1.aws.ml.hana.ondemand.com) | | | +| `baseUrl` _string_ | Base URL for the SAP AI Core API (e.g., https://api.ai.prod.eu-central-1.aws.ml.hana.ondemand.com) | | **Required**
| | `resourceGroup` _string_ | Resource group in SAP AI Core | default | | | `authUrl` _string_ | OAuth2 token endpoint URL (e.g., https://tenant.authentication.eu10.hana.ondemand.com) | | | @@ -1104,7 +1104,7 @@ _Appears in:_ | `documentationUrl` _string_ | DocumentationURL is a URL to human-readable documentation for the agent. It
is surfaced on the agent's A2A AgentCard. | | Format: uri
| | `version` _string_ | Version is the agent's version string, surfaced on the A2A AgentCard. | | | | `provider` _[AgentProvider](#agentprovider)_ | Provider identifies the organization responsible for the agent. It is
surfaced on the agent's A2A AgentCard. | | | -| `skills` _[SkillForAgent](#skillforagent)_ | Skills to load into the agent. They will be pulled from OCI images, git repos,
and/or S3, and made available to the agent under the `/skills` folder. | | | +| `skills` _[SkillForAgent](#skillforagent)_ | Skills to load into the agent. They will be pulled from OCI images, git repos,
and/or S3, and made available to the agent under the `/skills` folder. | | AtLeastOneOf: [refs gitRefs s3Refs]
| | `sandbox` _[SandboxConfig](#sandboxconfig)_ | Sandbox configures sandboxed execution behavior shared across runtimes.
This is intended for sandboxed declarative execution today, and can also
be consumed by BYO agents. | | | | `allowedNamespaces` _[AllowedNamespaces](#allowednamespaces)_ | AllowedNamespaces defines which namespaces are allowed to reference this Agent as a tool.
This follows the Gateway API pattern for cross-namespace route attachments.
If not specified, only Agents in the same namespace can reference this Agent as a tool.
This field only applies when this Agent is used as a tool by another Agent.
See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-route-attachment | | | | `substrate` _[SandboxSubstrateSpec](#sandboxsubstratespec)_ | Substrate is optional Agent Substrate-specific settings. | | | @@ -1144,7 +1144,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `name` _string_ | Name is the name of the secret in the same namespace as the ModelProviderConfig. | | | +| `name` _string_ | Name is the name of the secret in the same namespace as the ModelProviderConfig. | | **Required**
| #### ServiceAccountConfig @@ -1188,6 +1188,9 @@ _Appears in:_ #### SkillForAgent +_Validation:_ +- AtLeastOneOf: [refs gitRefs s3Refs] + _Appears in:_ - [AgentSpec](#agentspec) - [SandboxAgentSpec](#sandboxagentspec) @@ -1241,7 +1244,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `type` _[TokenExchangeType](#tokenexchangetype)_ | | | Enum: [GDCHServiceAccount]
| +| `type` _[TokenExchangeType](#tokenexchangetype)_ | | | Enum: [GDCHServiceAccount]
**Required**
| | `gdchServiceAccount` _[GDCHServiceAccountConfig](#gdchserviceaccountconfig)_ | | | | #### TokenExchangeType @@ -1270,7 +1273,7 @@ _Appears in:_ | `type` _[ToolProviderType](#toolprovidertype)_ | | | Enum: [McpServer Agent]
| | `mcpServer` _[McpServerTool](#mcpservertool)_ | | | | | `agent` _[TypedReference](#typedreference)_ | | | | -| `isolateSessions` _boolean_ | IsolateSessions controls per-call session isolation for Agent-type tools.
Only valid when Type is Agent.

When unset or false (default), every call this agent makes to the
referenced sub-agent reuses the same A2A context_id, so all calls land
in one shared sub-agent session (session continuity for stateful
sub-agents).

When true, each call mints a fresh context_id, so every invocation runs
in its own isolated sub-agent session. This is required for parallel
fan-out to a sub-agent: without it, N parallel calls in one turn
collapse into a single shared sub-agent session instead of N
independent ones.

Cross-turn/conversation continuity for stateful sub-agents does not
depend on this flag; it rides the x-kagent-root-context-id header,
which stays stable regardless of IsolateSessions. | | | +| `isolateSessions` _boolean_ | IsolateSessions controls per-call session isolation for Agent-type tools.
Only valid when Type is Agent.
When unset or false (default), every call this agent makes to the
referenced sub-agent reuses the same A2A context_id, so all calls land
in one shared sub-agent session (session continuity for stateful
sub-agents).
When true, each call mints a fresh context_id, so every invocation runs
in its own isolated sub-agent session. This is required for parallel
fan-out to a sub-agent: without it, N parallel calls in one turn
collapse into a single shared sub-agent session instead of N
independent ones.
Cross-turn/conversation continuity for stateful sub-agents does not
depend on this flag; it rides the x-kagent-root-context-id header,
which stays stable regardless of IsolateSessions. | | | | `headersFrom` _[ValueRef](#valueref) array_ | HeadersFrom specifies a list of configuration values to be added as
headers to requests sent to the Tool from this agent. The value of
each header is resolved from either a Secret or ConfigMap in the same
namespace as the Agent. Headers specified here will override any
headers of the same name/key specified on the tool. | | | #### ToolProviderType @@ -1301,7 +1304,7 @@ _Appears in:_ | --- | --- | --- | --- | | `kind` _string_ | | | | | `apiGroup` _string_ | | | | -| `name` _string_ | | | | +| `name` _string_ | | | **Required**
| #### TypedReference @@ -1313,7 +1316,7 @@ _Appears in:_ | --- | --- | --- | --- | | `kind` _string_ | | | | | `apiGroup` _string_ | | | | -| `name` _string_ | | | | +| `name` _string_ | | | **Required**
| | `namespace` _string_ | | | | #### ValueRef @@ -1326,7 +1329,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `name` _string_ | | | | +| `name` _string_ | | | **Required**
| | `value` _string_ | | | | | `valueFrom` _[ValueSource](#valuesource)_ | | | | @@ -1343,9 +1346,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `type` _[ValueSourceType](#valuesourcetype)_ | | | Enum: [ConfigMap Secret]
| -| `name` _string_ | The name of the ConfigMap or Secret. | | MaxLength: 253
| -| `key` _string_ | The key of the ConfigMap or Secret. | | MaxLength: 253
| +| `type` _[ValueSourceType](#valuesourcetype)_ | | | Enum: [ConfigMap Secret]
**Required**
| +| `name` _string_ | The name of the ConfigMap or Secret. | | MaxLength: 253
**Required**
| +| `key` _string_ | The key of the ConfigMap or Secret. | | MaxLength: 253
**Required**
| #### ValueSourceType diff --git a/docs-site/content/kagent/0.x/resources/helm.md b/docs-site/content/kagent/0.x/resources/helm.md index 3b78bdfd..cd739075 100644 --- a/docs-site/content/kagent/0.x/resources/helm.md +++ b/docs-site/content/kagent/0.x/resources/helm.md @@ -13,17 +13,17 @@ A Helm chart for kagent, built with Google ADK | Repository | Name | Version | |------------|------|---------| | `${SUBSTRATE_REPO}` | substrate | `${SUBSTRATE_VERSION}` | -| file://../agents/argo-rollouts | argo-rollouts-agent | 0.10.1 | -| file://../agents/cilium-debug | cilium-debug-agent | 0.10.1 | -| file://../agents/cilium-manager | cilium-manager-agent | 0.10.1 | -| file://../agents/cilium-policy | cilium-policy-agent | 0.10.1 | -| file://../agents/helm | helm-agent | 0.10.1 | -| file://../agents/istio | istio-agent | 0.10.1 | -| file://../agents/k8s | k8s-agent | 0.10.1 | -| file://../agents/kgateway | kgateway-agent | 0.10.1 | -| file://../agents/observability | observability-agent | 0.10.1 | -| file://../agents/promql | promql-agent | 0.10.1 | -| file://../tools/grafana-mcp | grafana-mcp | 0.10.1 | +| file://../agents/argo-rollouts | argo-rollouts-agent | 0.10.2 | +| file://../agents/cilium-debug | cilium-debug-agent | 0.10.2 | +| file://../agents/cilium-manager | cilium-manager-agent | 0.10.2 | +| file://../agents/cilium-policy | cilium-policy-agent | 0.10.2 | +| file://../agents/helm | helm-agent | 0.10.2 | +| file://../agents/istio | istio-agent | 0.10.2 | +| file://../agents/k8s | k8s-agent | 0.10.2 | +| file://../agents/kgateway | kgateway-agent | 0.10.2 | +| file://../agents/observability | observability-agent | 0.10.2 | +| file://../agents/promql | promql-agent | 0.10.2 | +| file://../tools/grafana-mcp | grafana-mcp | 0.10.2 | | https://oauth2-proxy.github.io/manifests | oauth2-proxy | ~10.7.0 | | oci://ghcr.io/kagent-dev/kmcp/helm | kmcp | `${KMCP_VERSION}` | | oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.2.1 |