diff --git a/docs-site/content/kagent/resources/api-ref.md b/docs-site/content/kagent/resources/api-ref.md index f4eb0bfd..9cdece23 100644 --- a/docs-site/content/kagent/resources/api-ref.md +++ b/docs-site/content/kagent/resources/api-ref.md @@ -939,7 +939,7 @@ _Appears in:_ | `seed` _integer_ | Seed value | | | | `n` _integer_ | N value | | | | `timeout` _integer_ | Timeout | | | -| `reasoningEffort` _[OpenAIReasoningEffort](#openaireasoningeffort)_ | Reasoning effort | | Enum: [none minimal low medium high xhigh]
| +| `reasoningEffort` _[OpenAIReasoningEffort](#openaireasoningeffort)_ | Reasoning effort | | Enum: [none minimal low medium high xhigh max]
| | `apiFormat` _[OpenAIAPIFormat](#openaiapiformat)_ | APIFormat selects which OpenAI HTTP API the runtime uses for this model.
chatCompletions (default) posts to /v1/chat/completions.
responses posts to /v1/responses. Use responses for OpenAI-compatible
gateways or models that require the Responses API. | chatCompletions | Enum: [chatCompletions responses]
| | `tokenExchange` _[TokenExchangeConfig](#tokenexchangeconfig)_ | TokenExchange configures dynamic bearer token acquisition via credential exchange.
Requires apiKeySecret (used as the service account secret) and is mutually exclusive with apiKeyPassthrough. | | | @@ -952,7 +952,7 @@ Supported values vary by model. Set to "none" to disable reasoning; some models require this to use function tools via the Chat Completions API. _Validation:_ -- Enum: [none minimal low medium high xhigh] +- Enum: [none minimal low medium high xhigh max] _Appears in:_ - [OpenAIConfig](#openaiconfig) diff --git a/docs-site/content/kagent/resources/helm.md b/docs-site/content/kagent/resources/helm.md index e3198127..7b12ac5d 100644 --- a/docs-site/content/kagent/resources/helm.md +++ b/docs-site/content/kagent/resources/helm.md @@ -13,18 +13,7 @@ A Helm chart for kagent, built with Google ADK | Repository | Name | Version | |------------|------|---------| | `${SUBSTRATE_REPO}` | substrate | `${SUBSTRATE_VERSION}` | -| file://../agents/argo-rollouts | argo-rollouts-agent | | -| file://../agents/cilium-debug | cilium-debug-agent | | -| file://../agents/cilium-manager | cilium-manager-agent | | -| file://../agents/cilium-policy | cilium-policy-agent | | -| file://../agents/helm | helm-agent | | -| file://../agents/istio | istio-agent | | -| file://../agents/k8s | k8s-agent | | -| file://../agents/kgateway | kgateway-agent | | -| file://../agents/observability | observability-agent | | -| file://../agents/promql | promql-agent | | | file://../tools/grafana-mcp | grafana-mcp | | -| file://../tools/querydoc | querydoc | | | https://oauth2-proxy.github.io/manifests | oauth2-proxy | ~10.7.0 | | oci://ghcr.io/kagent-dev/kmcp/helm | kmcp | `${KMCP_VERSION}` | | oci://ghcr.io/kagent-dev/tools/helm | kagent-tools | 0.2.1 | @@ -34,57 +23,17 @@ A Helm chart for kagent, built with Google ADK | Key | Type | Default | Description | |-----|------|---------|-------------| | annotations | object | `{}` | Additional annotations to add to all Kubernetes deployment resources | -| argo-rollouts-agent.enabled | bool | `true` | | -| argo-rollouts-agent.memory.enabled | bool | `false` | | -| argo-rollouts-agent.memory.modelConfigRef | string | `""` | | -| argo-rollouts-agent.memory.ttlDays | int | `15` | | -| argo-rollouts-agent.modelConfigRef | string | `""` | | -| argo-rollouts-agent.resources.limits.memory | string | `"256Mi"` | | -| argo-rollouts-agent.resources.requests.cpu | string | `"50m"` | | -| argo-rollouts-agent.resources.requests.memory | string | `"128Mi"` | | -| cilium-debug-agent.enabled | bool | `true` | | -| cilium-debug-agent.memory.enabled | bool | `false` | | -| cilium-debug-agent.memory.modelConfigRef | string | `""` | | -| cilium-debug-agent.memory.ttlDays | int | `15` | | -| cilium-debug-agent.modelConfigRef | string | `""` | | -| cilium-debug-agent.resources.limits.memory | string | `"256Mi"` | | -| cilium-debug-agent.resources.requests.cpu | string | `"50m"` | | -| cilium-debug-agent.resources.requests.memory | string | `"128Mi"` | | -| cilium-manager-agent.enabled | bool | `true` | | -| cilium-manager-agent.memory.enabled | bool | `false` | | -| cilium-manager-agent.memory.modelConfigRef | string | `""` | | -| cilium-manager-agent.memory.ttlDays | int | `15` | | -| cilium-manager-agent.modelConfigRef | string | `""` | | -| cilium-manager-agent.resources.limits.memory | string | `"256Mi"` | | -| cilium-manager-agent.resources.requests.cpu | string | `"50m"` | | -| cilium-manager-agent.resources.requests.memory | string | `"128Mi"` | | -| cilium-policy-agent.enabled | bool | `true` | | -| cilium-policy-agent.memory.enabled | bool | `false` | | -| cilium-policy-agent.memory.modelConfigRef | string | `""` | | -| cilium-policy-agent.memory.ttlDays | int | `15` | | -| cilium-policy-agent.modelConfigRef | string | `""` | | -| cilium-policy-agent.resources.limits.memory | string | `"256Mi"` | | -| cilium-policy-agent.resources.requests.cpu | string | `"50m"` | | -| cilium-policy-agent.resources.requests.memory | string | `"128Mi"` | | | controller.a2aBaseUrl | string | `http://-controller..svc:` | The base URL of the A2A Server endpoint, as advertised to clients. | | controller.a2aClientTimeout | string | "" (no timeout) | HTTP client timeout for A2A requests from the controller to agent pods. 0 (the default) means no timeout, which is correct for SSE-based streaming agents that can run for an arbitrarily long time. The previous implicit default was 3m (inherited from the a2a-go SDK), which caused `context deadline exceeded` errors for agents that take longer than 3 minutes to complete. Set a positive Go duration string (e.g. "30m", "1h") only if you need a hard upper bound on individual A2A calls. | +| controller.a2aGatewayUrl | string | `http://-controller..svc:` | Public gRPC URL advertised by AgentInstance Agent Cards. | | controller.affinity | object | `{}` | [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) rules for the controller pod. | -| controller.agentDeployment | object | `{"host":"","nodeSelector":{},"podLabels":{},"serviceAccountName":""}` | Global deployment defaults applied to all agent pods. Per-agent settings in the Agent CRD take precedence over these defaults. | -| controller.agentDeployment.host | string | "" (controller falls back to "0.0.0.0"; "::" when ipv6.enabled) | Default host address for agent pods to bind to. Leave empty to use the controller's default fallback of "0.0.0.0". Automatically set to "::" when ipv6.enabled is true. Can be explicitly overridden here regardless of the ipv6 flag. | -| controller.agentDeployment.nodeSelector | object | {} (no default nodeSelector) | Default nodeSelector applied to all agent deployments. Useful when admission policies require a nodeSelector on every Deployment, since wizard-created Agents carry none. A per-agent nodeSelector in the Agent CRD takes precedence over these defaults. | -| controller.agentDeployment.podLabels | object | {} (no extra labels) | Default labels applied to all agent pod templates. Per-agent labels in the Agent CRD take precedence over these defaults. | -| controller.agentDeployment.serviceAccountName | string | "" (auto-create per-agent ServiceAccount) | Default ServiceAccount name for agent pods. When set, agent pods that don't specify an explicit serviceAccountName will use this ServiceAccount instead of creating a per-agent one. Useful for Workload Identity (GCP, AWS IRSA, Azure Workload Identity). Precedence: agent-level serviceAccountName > this default > auto-created SA. | -| controller.agentImage.pullPolicy | string | `""` | | -| controller.agentImage.pullSecret | string | `""` | Image pull secret name set on agent pods created by the controller | -| controller.agentImage.registry | string | `""` | | -| controller.agentImage.repository | string | `"kagent-dev/kagent/app"` | | -| controller.agentImage.tag | string | `""` | | +| controller.agentImage | object | `{"registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for declarative agents. | | controller.annotations | object | `{}` | Additional annotations to add to the controller Deployment metadata | | controller.auth.mode | string | `"unsecure"` | | | controller.auth.userIdClaim | string | `""` | | | controller.env | list | `[]` | | | controller.envFrom | list | `[]` | | -| controller.goAgentImage | object | `{"pullPolicy":"","registry":"","repository":"kagent-dev/kagent/golang-adk","tag":""}` | The image used for the Go (ADK) runtime agent. | +| controller.grpc | object | `{"bindAddress":":8084","maxMessageBytes":16777216,"reflection":false,"tlsCertFile":"","tlsKeyFile":""}` | Native gRPC application API settings. This port is internal unless a separate TLS-capable GRPCRoute or ingress is configured. | | controller.image.pullPolicy | string | `""` | | | controller.image.registry | string | `""` | | | controller.image.repository | string | `"kagent-dev/kagent/controller"` | | @@ -109,21 +58,17 @@ A Helm chart for kagent, built with Google ADK | controller.resources.requests.cpu | string | `"100m"` | | | controller.resources.requests.memory | string | `"128Mi"` | | | controller.service.annotations | object | `{}` | | +| controller.service.ports.grpc | int | `8084` | | | controller.service.ports.port | int | `8083` | | | controller.service.ports.targetPort | int | `8083` | | | controller.service.type | string | `"ClusterIP"` | | | controller.serviceAccount | object | `{"annotations":{}}` | ServiceAccount settings for the controller pod | | controller.serviceAccount.annotations | object | {} (no extra annotations) | Annotations to add to the controller ServiceAccount. Useful for GCP Workload Identity, AWS IRSA, or Azure Workload Identity. | -| controller.skillsInitImage | object | `{"pullPolicy":"","registry":"","repository":"kagent-dev/kagent/skills-init","tag":""}` | The image used by the skills-init container to clone skills from Git and pull OCI skill images. | | controller.startupProbe | object | httpGet /health on port http, periodSeconds=15, initialDelaySeconds=15 | Custom startup probe for the controller container. Setting a value replaces the default probe entirely — include a handler (httpGet / exec / tcpSocket / grpc) when overriding. | | controller.streaming | string | `nil` | @deprecated Removed in 0.10.0. The A2A SDK now handles SSE buffering and timeouts internally. These values have no effect and will be removed in a future release. | | controller.substrate.ateApiEndpoint | string | `""` | | -| controller.substrate.ateApiInsecure | bool | `false` | | | controller.substrate.ateApiServer.namespace | string | `"ate-system"` | | | controller.substrate.ateApiServer.serviceAccount | string | `"ate-api-server"` | | -| controller.substrate.ateApiTokenAudience | string | `"api.ate-system.svc"` | | -| controller.substrate.ateApiTokenExpirationSeconds | int | `3600` | | -| controller.substrate.ateApiTokenFile | string | `"/var/run/secrets/tokens/ate-api/token"` | | | controller.substrate.atenetRouterURL | string | `""` | | | controller.substrate.defaultWorkerPool.name | string | `""` | | | controller.substrate.defaultWorkerPool.namespace | string | `""` | | @@ -133,18 +78,21 @@ A Helm chart for kagent, built with Google ADK | controller.volumeMounts | list | `[]` | | | controller.volumes | list | `[]` | | | controller.watchNamespaces | list | [] (watches all available namespaces) | Namespaces the controller should watch. If empty, the controller will watch ALL available namespaces. | -| database.postgres.bundled | object | `{"enabled":true,"image":{"name":"postgres","pullPolicy":"IfNotPresent","registry":"docker.io","repository":"library","tag":"18.3-alpine"},"podSecurityContext":{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}},"resources":{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"storage":"500Mi","storageClassName":""}` | Bundled PostgreSQL instance — for development and evaluation only. Not suitable for production. Deployed when enabled is true and url/urlFile are not set. | +| database.postgres.bundled | object | `{"affinity":{},"enabled":true,"image":{"name":"postgres","pullPolicy":"IfNotPresent","registry":"docker.io","repository":"library","tag":"18.3-alpine"},"nodeSelector":{},"podSecurityContext":{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}},"resources":{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}},"storage":"500Mi","storageClassName":"","tolerations":[]}` | Bundled PostgreSQL instance — for development and evaluation only. Not suitable for production. Deployed when enabled is true and url/urlFile are not set. | +| database.postgres.bundled.affinity | object | `{}` | [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) rules for the bundled PostgreSQL pod. | | database.postgres.bundled.enabled | bool | `true` | Set to false to disable the bundled database and provide your own via url or urlFile. | | database.postgres.bundled.image.name | string | `"postgres"` | Bundled PostgreSQL image name | | database.postgres.bundled.image.pullPolicy | string | `"IfNotPresent"` | Bundled PostgreSQL image pull policy | | database.postgres.bundled.image.registry | string | `"docker.io"` | Bundled PostgreSQL image registry | | database.postgres.bundled.image.repository | string | `"library"` | Bundled PostgreSQL image repository (org/namespace) | | database.postgres.bundled.image.tag | string | `"18.3-alpine"` | Bundled PostgreSQL image tag | +| database.postgres.bundled.nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | database.postgres.bundled.podSecurityContext | object | `{"fsGroup":999,"runAsGroup":999,"runAsNonRoot":true,"runAsUser":999,"seccompProfile":{"type":"RuntimeDefault"}}` | Pod-level security context for the bundled PostgreSQL deployment. | | database.postgres.bundled.resources | object | `{"limits":{"cpu":"500m","memory":"512Mi"},"requests":{"cpu":"250m","memory":"256Mi"}}` | Resource requests/limits for the demo PostgreSQL container | | database.postgres.bundled.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}` | Container-level security context for the bundled PostgreSQL container. | | database.postgres.bundled.storage | string | `"500Mi"` | PersistentVolumeClaim size for demo PostgreSQL data | | database.postgres.bundled.storageClassName | string | `""` | StorageClass for the PostgreSQL PVC. Defaults to the cluster default when empty. | +| database.postgres.bundled.tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | database.postgres.pool | object | `{"maxConnIdleTime":"","maxConnLifetime":"","maxConns":null,"minConns":null}` | Optional pgxpool settings. Leave unset/null to keep pgx library defaults (MaxConns≈max(4,NumCPU), MinConns=0, MaxConnIdleTime=30m, MaxConnLifetime=1h). | | database.postgres.sessionRetentionDays | int | `0` | Hard-delete idle sessions (and cascaded events/tasks/checkpoints/shares) after N days of no activity. Uses session.updated_at as a sliding idle clock (writes refresh it). 0 disables cleanup (default, existing installs unchanged). | | database.postgres.skipMigrations | bool | `false` | Skip running database migrations at controller startup. The controller instead verifies the database is already migrated and fails if it is not. Migrations must be applied out-of-band (e.g. from a CI/CD pipeline) before install/upgrade. | @@ -160,33 +108,9 @@ A Helm chart for kagent, built with Google ADK | grafana-mcp.resources.limits.memory | string | `"512Mi"` | | | grafana-mcp.resources.requests.cpu | string | `"100m"` | | | grafana-mcp.resources.requests.memory | string | `"128Mi"` | | -| helm-agent.enabled | bool | `true` | | -| helm-agent.memory.enabled | bool | `false` | | -| helm-agent.memory.modelConfigRef | string | `""` | | -| helm-agent.memory.ttlDays | int | `15` | | -| helm-agent.modelConfigRef | string | `""` | | -| helm-agent.resources.limits.memory | string | `"256Mi"` | | -| helm-agent.resources.requests.cpu | string | `"50m"` | | -| helm-agent.resources.requests.memory | string | `"128Mi"` | | | imagePullPolicy | string | `"IfNotPresent"` | | | imagePullSecrets | list | `[]` | | | ipv6 | object | false | Enable IPv6/dual-stack support. When true, configures all components for dual-stack (IPv4+IPv6) networking: - nginx listens on both IPv4 and IPv6 (adds `listen [::]:8080`) - Next.js binds to `::` instead of `0.0.0.0` - Agent pods bind to `::` for dual-stack reachability Leave disabled on clusters where IPv6 is disabled at the kernel level. | -| istio-agent.enabled | bool | `true` | | -| istio-agent.memory.enabled | bool | `false` | | -| istio-agent.memory.modelConfigRef | string | `""` | | -| istio-agent.memory.ttlDays | int | `15` | | -| istio-agent.modelConfigRef | string | `""` | | -| istio-agent.resources.limits.memory | string | `"256Mi"` | | -| istio-agent.resources.requests.cpu | string | `"50m"` | | -| istio-agent.resources.requests.memory | string | `"128Mi"` | | -| k8s-agent.enabled | bool | `true` | | -| k8s-agent.memory.enabled | bool | `false` | | -| k8s-agent.memory.modelConfigRef | string | `""` | | -| k8s-agent.memory.ttlDays | int | `15` | | -| k8s-agent.modelConfigRef | string | `""` | | -| k8s-agent.resources.limits.memory | string | `"256Mi"` | | -| k8s-agent.resources.requests.cpu | string | `"50m"` | | -| k8s-agent.resources.requests.memory | string | `"128Mi"` | | | kagent-tools.enabled | bool | `true` | | | kagent-tools.nameOverride | string | `"tools"` | | | kagent-tools.nodeSelector | object | `{}` | Node labels to match for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | @@ -202,14 +126,6 @@ A Helm chart for kagent, built with Google ADK | kagent-tools.tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | kagent-tools.tools.loglevel | string | `"debug"` | | | kagent-tools.tools.metrics.port | int | `8085` | | -| kgateway-agent.enabled | bool | `true` | | -| kgateway-agent.memory.enabled | bool | `false` | | -| kgateway-agent.memory.modelConfigRef | string | `""` | | -| kgateway-agent.memory.ttlDays | int | `15` | | -| kgateway-agent.modelConfigRef | string | `""` | | -| kgateway-agent.resources.limits.memory | string | `"256Mi"` | | -| kgateway-agent.resources.requests.cpu | string | `"50m"` | | -| kgateway-agent.resources.requests.memory | string | `"128Mi"` | | | kmcp.enabled | bool | `true` | | | kmcp.fullnameOverride | string | `""` | | | kmcp.nameOverride | string | `"kmcp"` | | @@ -234,7 +150,7 @@ A Helm chart for kagent, built with Google ADK | oauth2-proxy.extraArgs.redirect-url | string | `"$(OIDC_REDIRECT_URL)"` | | | oauth2-proxy.extraArgs.scope | string | `"openid profile email groups"` | | | oauth2-proxy.extraArgs.set-authorization-header | bool | `true` | | -| oauth2-proxy.extraArgs.skip-auth-regex | string | `"^/(login|_next/static|_next/image|login-bg\\.(jpg|png|webp)|logo-.*\\.png|favicon\\.ico|api/agentharnesses/.*/gateway).*$"` | | +| oauth2-proxy.extraArgs.skip-auth-regex | string | `"^/(login|assets/|env-config\\.js|logo-.*\\.png|favicon\\.ico|api/agentharnesses/.*/gateway).*$"` | | | oauth2-proxy.extraArgs.skip-auth-route | string | `"^/(health|login)$"` | | | oauth2-proxy.extraArgs.skip-jwt-bearer-tokens | bool | `true` | | | oauth2-proxy.extraArgs.upstream | string | `"$(UPSTREAM_URL)"` | | @@ -252,14 +168,6 @@ A Helm chart for kagent, built with Google ADK | oauth2-proxy.service.portNumber | int | `4180` | | | oauth2-proxy.service.type | string | `"ClusterIP"` | | | oauth2-proxy.sessionStorage.type | string | `"cookie"` | | -| observability-agent.enabled | bool | `true` | | -| observability-agent.memory.enabled | bool | `false` | | -| observability-agent.memory.modelConfigRef | string | `""` | | -| observability-agent.memory.ttlDays | int | `15` | | -| observability-agent.modelConfigRef | string | `""` | | -| observability-agent.resources.limits.memory | string | `"256Mi"` | | -| observability-agent.resources.requests.cpu | string | `"50m"` | | -| observability-agent.resources.requests.memory | string | `"128Mi"` | | | otel.logging.enabled | bool | `false` | | | otel.logging.exporter.otlp.endpoint | string | `""` | | | otel.logging.exporter.otlp.insecure | bool | `true` | | @@ -272,14 +180,6 @@ A Helm chart for kagent, built with Google ADK | podAnnotations | object | `{}` | | | podLabels | object | `{}` | Additional labels to add to all pod templates (merged into pod labels of the controller and UI Deployments; can be overridden per component). Useful for admission policies that require specific labels on pods. | | podSecurityContext | object | `{"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for all pods | -| promql-agent.enabled | bool | `true` | | -| promql-agent.memory.enabled | bool | `false` | | -| promql-agent.memory.modelConfigRef | string | `""` | | -| promql-agent.memory.ttlDays | int | `15` | | -| promql-agent.modelConfigRef | string | `""` | | -| promql-agent.resources.limits.memory | string | `"256Mi"` | | -| promql-agent.resources.requests.cpu | string | `"50m"` | | -| promql-agent.resources.requests.memory | string | `"128Mi"` | | | providers.annotations | object | `{}` | Annotations added to the metadata of the generated default ModelConfig (the one derived from `providers.default`). Omitted from the resource when empty. | | providers.anthropic.apiKeySecretKey | string | `"ANTHROPIC_API_KEY"` | | | providers.anthropic.apiKeySecretRef | string | `"kagent-anthropic"` | | @@ -296,7 +196,7 @@ A Helm chart for kagent, built with Google ADK | providers.default | string | `"openAI"` | | | providers.gemini.apiKeySecretKey | string | `"GOOGLE_API_KEY"` | | | providers.gemini.apiKeySecretRef | string | `"kagent-gemini"` | | -| providers.gemini.model | string | `"gemini-2.0-flash-lite"` | | +| providers.gemini.model | string | `"gemini-2.5-flash-lite"` | | | providers.gemini.provider | string | `"Gemini"` | | | providers.ollama.config.host | string | `"host.docker.internal:11434"` | | | providers.ollama.config.options.num_ctx | string | `"64000"` | | @@ -307,17 +207,6 @@ A Helm chart for kagent, built with Google ADK | providers.openAI.model | string | `"gpt-4.1-mini"` | | | providers.openAI.provider | string | `"OpenAI"` | | | proxy.url | string | `""` | | -| querydoc.enabled | bool | `true` | | -| querydoc.image.pullPolicy | string | `"IfNotPresent"` | | -| querydoc.image.registry | string | `"ghcr.io"` | | -| querydoc.image.repository | string | `"kagent-dev/doc2vec/mcp"` | | -| querydoc.image.tag | string | `"1.1.14"` | | -| querydoc.openai.apiKey | string | `""` | | -| querydoc.replicas | int | `1` | | -| querydoc.resources.limits.cpu | string | `"500m"` | | -| querydoc.resources.limits.memory | string | `"512Mi"` | | -| querydoc.resources.requests.cpu | string | `"100m"` | | -| querydoc.resources.requests.memory | string | `"128Mi"` | | | rbac.namespaces | list | `[]` | Namespaces in which to create Role and RoleBinding resources. If empty (default), the chart creates cluster-scoped ClusterRole and ClusterRoleBinding resources and the controller watches all namespaces. If set, the chart creates a Role + RoleBinding per listed namespace and the controller's WATCH_NAMESPACES is derived from this list (unless controller.watchNamespaces is set explicitly, which always takes precedence). | | registry | string | `"ghcr.io"` | | | securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true}` | Security context for all containers | @@ -325,11 +214,10 @@ A Helm chart for kagent, built with Google ADK | substrateWorkerPool | object | `{"ateomImage":"","create":false,"labels":{},"name":"kagent-default","replicas":1,"sandboxClass":"gvisor","template":{}}` | Optional Agent Substrate WorkerPool installed by this chart. This is platform capacity and is not owned by individual AgentHarness resources. | | tag | string | `""` | | | tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | -| ui.additionalForwardedHeaders | list | `[]` | Additional request headers (beyond Authorization) the UI proxy will forward to the backend. Names are case-insensitive. Hop-by-hop headers (Connection, Transfer-Encoding, etc.) are silently dropped. | +| ui.additionalForwardedHeaders | list | `[]` | Identity headers the UI's nginx proxy will forward to the backend on /api/ and /a2a/. Names are case-insensitive. Authorization is always forwarded; the auth-proxy identity headers (x-auth-request-*, x-forwarded-user, x-forwarded-email, x-forwarded-groups, x-forwarded-preferred-username) are stripped from client requests unless listed here, so a caller cannot spoof an identity the backend trusts. Headers outside that set are forwarded by nginx as normal. | | ui.affinity | object | `{}` | [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) rules for the UI pod. | | ui.annotations | object | `{}` | Additional annotations to add to the UI Deployment metadata | | ui.auth.ssoRedirectPath | string | `"/oauth2/start"` | | -| ui.backendInternalUrl | string | `""` | | | ui.env | object | `{}` | | | ui.externalUrl | string | "" (share tools return paths only) | Public-facing base URL of the UI (e.g. https://kagent.example.com). When set, the controller injects KAGENT_UI_URL into agent pods so that share link tools return full clickable URLs instead of relative paths. | | ui.httpRoute | object | `{"annotations":{},"enabled":false,"hostnames":[],"labels":{},"parentRefs":[],"rules":[]}` | Gateway API `HTTPRoute` for the UI. Requires the Gateway API CRDs (`gateway.networking.k8s.io/v1`) and an existing `Gateway` to attach to via `parentRefs`. Disabled by default; enable to front the UI with a Gateway API implementation (kgateway, Istio, Envoy Gateway, etc.) instead of the OpenShift Route or bundled oauth2-proxy. | @@ -357,7 +245,7 @@ A Helm chart for kagent, built with Google ADK | ui.podAnnotations | object | `{}` | | | ui.podLabels | object | `{}` | Additional labels for the UI pod template, merged over the global `podLabels` (per-key; component keys win). Selector labels can never be overridden. | | ui.podSecurityContext | object | (uses global podSecurityContext) | Pod-level security context for the UI pod. Overrides the global podSecurityContext. | -| ui.publicBackendUrl | string | `"/api"` | | +| ui.publicBackendUrl | string | `"/api"` | Base URL the browser calls the controller API on. Reaches the browser at runtime as the `apiBaseUrl` key of /config.json, which the app fetches on startup — it is deliberately not baked into the bundle, so changing it here takes effect on pod restart rather than requiring an image rebuild. The default is a path on the UI's own hostname, which nginx proxies to the controller; set an absolute URL only if the browser must reach the API somewhere other than the UI origin. | | ui.readinessProbe | object | httpGet /health on port http, periodSeconds=30 | Custom readiness probe for the UI container. Override to adjust thresholds, use exec-based probes, or change the health path. | | ui.replicas | int | `1` | | | ui.resources.limits.cpu | string | `"1000m"` | | @@ -376,6 +264,5 @@ A Helm chart for kagent, built with Google ADK | ui.streamTimeoutSeconds | int | `1800` | Client-side chat stream inactivity timeout (seconds). The browser aborts a streaming response if no event is received within this window. Should be >= ui.nginx.proxyReadTimeout so nginx isn't the silent limit. Default 1800 (30m). | | ui.tolerations | list | `[]` | Node taints which will be tolerated for `Pod` [scheduling](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). | | ui.topologySpreadConstraints | list | `[]` | [Topology spread constraints](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#pod-topology-spread-constraints) for the UI pod. | -| ui.volumes | object | `{"nextjsCache":"100Mi","tmp":"50Mi"}` | EmptyDir volume sizes for Next.js UI workload (typically used when enabling readOnlyRootFilesystem) | -| ui.volumes.nextjsCache | string | `"100Mi"` | Size limit for Next.js build cache (.next/cache). Default 100Mi is sufficient for typical Next.js apps with moderate caching needs. | -| ui.volumes.tmp | string | `"50Mi"` | Size limit for temporary files (/tmp). Default 50Mi provides ample space for Next.js runtime temporary data. | +| ui.volumes | object | `{"tmp":"50Mi"}` | EmptyDir volume sizes for the UI workload (typically used when enabling readOnlyRootFilesystem) | +| ui.volumes.tmp | string | `"50Mi"` | Size limit for temporary files (/tmp). Holds the nginx temp directories and the generated config.json. Default 50Mi is ample for both. |