For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.
Azure AI Foundry
Configure kagent to use models served through an Azure AI Foundry deployment.
The Foundry provider calls a model deployment in an Azure AI Foundry resource. The chat model must be reachable through Foundry’s OpenAI-compatible chat completions API.
Create the ModelConfig
Save your Azure AI Foundry API key as an environment variable.
export FOUNDRY_API_KEY=<your-foundry-api-key>Create a Kubernetes Secret that stores the API key. Create it in the same namespace as the AgentTemplates that use it, such as
kagent.kubectl create secret generic foundry-api-key -n kagent --from-literal api-key=$FOUNDRY_API_KEYCreate a
ModelConfigfor your Foundry deployment.kubectl apply -f - <<EOF apiVersion: kagent.dev/v1alpha3 kind: ModelConfig metadata: name: foundry-model-config namespace: kagent spec: apiKeySecret: foundry-api-key apiKeySecretKey: api-key model: gpt-4.1-nano provider: Foundry foundry: endpoint: https://<account>.cognitiveservices.azure.com/ deployment: gpt-4-1-nano apiVersion: "2024-10-21" EOFField Description apiKeySecretThe name of the Kubernetes Secret that stores the API key, in the same namespace as this ModelConfig. apiKeySecretKeyThe key within that Secret that holds the API key. modelThe model that the deployment serves. providerThe provider to use, Foundry.foundry.endpointThe endpoint of your Foundry account. foundry.deploymentThe name of the deployment within the account. This field is required. foundry.apiVersionThe Foundry API version to call. Defaults to 2024-10-21.
Azure AI Foundry provider settings
The foundry block takes the following settings. For every field, including its type, default, and validation rules, see the API reference.
| Field | Description |
|---|---|
deployment | The deployment name within the Foundry account. Required. |
endpoint | The endpoint of the Foundry account. |
endpointFrom | Read the endpoint from a key in a ConfigMap instead of setting it inline. Use this field when the endpoint differs per environment and is published by a platform team. |
apiVersion | The Foundry API version. Defaults to 2024-10-21. |
Read the endpoint from a ConfigMap
Set endpointFrom in place of endpoint to take the endpoint from a ConfigMap in the same namespace.
spec:
provider: Foundry
model: gpt-4.1-nano
apiKeySecret: foundry-api-key
apiKeySecretKey: api-key
foundry:
endpointFrom:
name: foundry-endpoint
key: endpoint
deployment: gpt-4-1-nanoWhen the named ConfigMap or key does not exist, the ModelConfigModelConfigA Kubernetes custom resource naming one model at one provider, along with the credentials to reach it. An AgentTemplate references one by name, and every agent compiled from that template calls the model that it names.Learn more reports Accepted as False. Inspect it to find which reference failed.
kubectl describe modelconfig foundry-model-config -n kagentAuthentication
| Configuration | Credential |
|---|---|
apiKeySecret is set | The API key from the referenced Secret. |
apiKeyPassthrough: true | The bearer token from the caller’s request, forwarded to Foundry as the API key. Mutually exclusive with apiKeySecret. |
Warning
Azure Workload Identity is not currently supported. In earlier versions of kagent, omitting the credential fields fell back to Azure Workload Identity, which depended on an annotated ServiceAccount on the agent’s pod. An agent now runs as a Substrate Actor rather than as a pod that kagent controls, so there is no per-agent ServiceAccount to federate an Azure identity onto. Supply an API key instead.
Use the ModelConfig
Reference the ModelConfig by name from an AgentTemplate in the same namespace.
spec:
modelConfig:
name: foundry-model-configMemory embeddings
A Foundry deployment can also serve the embedding model behind long-term memory. Point a second ModelConfig at your embedding deployment, then name it from the Harness’s spec.kagent.memory.modelConfigRef.
kubectl apply -f - <<EOF
apiVersion: kagent.dev/v1alpha3
kind: ModelConfig
metadata:
name: foundry-embeddings
namespace: kagent
spec:
apiKeySecret: foundry-api-key
apiKeySecretKey: api-key
model: text-embedding-3-small
provider: Foundry
foundry:
endpoint: https://<account>.cognitiveservices.azure.com/
deployment: text-embedding-3-small
EOFTroubleshooting
| Symptom | Cause |
|---|---|
The ModelConfig reports Accepted as False | A referenced Secret or endpointFrom ConfigMap does not exist, or does not hold the named key. Run kubectl describe modelconfig to see which one. |
Foundry returns 401 Unauthorized or 403 Forbidden | The API key does not have access to the resource. |
The AgentTemplate reports Compatible as False | The resolved configuration cannot run on the Harness. Read the condition message for the specific reason. |