Skip to content

[backport] feat: improve install and first-agent onboarding - #3629

Open
EItanya wants to merge 1 commit into
release/v1.0.xfrom
backport/v1.0.x/3566
Open

EItanya wants to merge 1 commit into
release/v1.0.xfrom
backport/v1.0.x/3566

Conversation

@EItanya

@EItanya EItanya commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

Backport of #3566 to release/v1.0.x.

Description

Cherry-pick of 7dfd5f72c2f903307acb3b851ff27f754aefe636 without changes. It applied with no conflicts.

This is opened as written so we can decide here what 1.0.x should take. #3566 is a feature PR, and the backport policy asks for explicit maintainer approval before backporting features or API changes.

Decisions for reviewers

These parts change behaviour for existing 1.0.0 installs:

  • Default model on helm upgrade. Installs on chart defaults have their OpenAI ModelConfig moved from gpt-4.1-mini to gpt-5-mini with apiFormat: responses. Azure OpenAI moves to gpt-5-mini and API version 2024-10-21. codex-default needs apiFormat: responses on the default OpenAI ModelConfig, so dropping this entirely leaves Codex not working out of the box.
  • gRPC reflection requires the configured authentication. It was AccessPublic. With authentication on, anonymous grpcurl reflection stops working.
  • kagent install creates default Harnesses. A re-run creates kagent-default, codex-default and claude-default in the release namespace. A Harness a user already created under one of those names will likely make Helm fail on resource ownership. This is not tested.
  • kagent install enables gRPC reflection unless a values file turns it off.

The rest is additive: --provider, version --client, UpdateHarness, ListWorkerPools, the UI changes, the image-pull diagnostics, and the latest input in tag.yaml.

Change Type

/kind feature

Testing

Run locally on this branch's content:

  • go build ./...
  • Go tests for core/internal/grpcserver, core/cli and core/pkg/install, and the golden-retry controller tests
  • UI tsc --noEmit and vitest (822/822)
  • make helm-test (354/354)
  • scripts/get-kagent_test.sh

Not run locally, left to CI:

  • The controller envtest integration tests (no etcd binary on the machine used)
  • The Go e2e suite, including the new TestInstalledDefaultHarnesses
  • The upgrade tests
  • Playwright and lint

Changelog

The chart's default models changed. The default OpenAI ModelConfig now uses `gpt-5-mini` with `apiFormat: responses` (was `gpt-4.1-mini`), and Azure OpenAI now defaults to `gpt-5-mini` with API version `2024-10-21` (was `gpt-4.1-mini` and `2023-05-15`). Installs that rely on the chart defaults pick this up on upgrade. To keep the previous settings, set `providers.openAI.model` and `providers.openAI.config`, or `providers.azureOpenAI.model` and `providers.azureOpenAI.config.apiVersion`, in your values file.

gRPC reflection now requires the configured authentication.

`kagent install` now ships default Harnesses (`kagent-default`, `codex-default`, `claude-default`), enables gRPC reflection, and adds `--provider`. The UI can edit Harnesses.

🤖 Generated with Claude Code

## Summary

Reduces the steps from `curl | bash` to a running Codex or Claude agent,
based on install feedback from 1.0.0-rc3.

### Defaults that work out of the box
- `kagent install` now ships default Harnesses `kagent-default`,
`codex-default` and `claude-default` in the release namespace. They use
the built-in images, the default WorkerPool and the bundled snapshot
bucket. The chart value is `harnesses.enabled`, off in the chart and on
in `kagent install`.
- The default OpenAI ModelConfig uses `apiFormat: responses` (Codex
requires it) and `gpt-5-mini`. Azure OpenAI defaults to `gpt-5-mini` and
API version `2024-10-21`.

### Installer
- `kagent install --provider <name>`: choosing a provider no longer
needs a CLI config file.
- `kagent install` prints next steps when it finishes.
- `kagent install` enables gRPC reflection, so the grpcurl guides work
without extra setup. The chart default stays `false`, and an operator
values file can turn it off.
- gRPC reflection now requires the configured authentication instead of
being `AccessPublic`. Insecure mode (the default) still answers
anonymous callers. With authentication on, callers must pass
credentials, because reflection lists every registered service,
including consumer extensions.
- `kagent version --client` prints the CLI version without contacting a
server.
- `scripts/get-kagent`:
- installs the release GitHub marks latest, reading its tag from the
`/releases/latest` redirect instead of the rate-limited API. `--version`
still pins a release.
- offers only platforms that are actually published, and fixes the
Windows `.exe` name
  - no longer needs `jq`
  - has tests, which now run in CI
- The release workflow has a "latest" checkbox, on by default, so
whoever dispatches a release decides whether a plain install gets it.
Release candidates are released as latest until 1.0 is final. Patches to
an older line clear the checkbox; `release/v0.10.x` never marks itself
latest (#3567). A `-` tag is a prerelease only when it is not latest,
because GitHub can't mark a prerelease latest.

### UI
- Harness form:
- The image is optional for the kagent, Codex and Claude harness types.
- The worker pool is a type-ahead list from the new `ListWorkerPools`
RPC.
  - The snapshot location is prefilled and explained.
- Harnesses can be edited (new `UpdateHarness` RPC and an edit page).
- Agent form:
  - Harness selection comes first, with a sensible harness preselected.
  - A "Create harness" dialog keeps the rest of the form intact.
  - A warning appears when the Harness and ModelConfig are incompatible.
  - All validation problems are listed together.
- ModelConfig form: `apiFormat` and `reasoningEffort` are dropdowns.
- The agent page shows a banner explaining why the last update failed.

### Diagnosability
- When an image can't be pulled, golden build failures now say "could
not pull image <ref>". Previously the status only said
`GoldenActorCrashed`. The ref is taken only from the ActorTemplate spec,
so the existing redaction still holds.
- Every golden build retry is now logged, with its retry number.

## Follow-ups (outside this PR)
- kagent.dev docs:
  - add a `/install` redirect and a favicon
- remove the `grpcReflection` and config-file steps from the quickstart
(`kagent install` now enables reflection; plain Helm installs still need
`config.server.grpcReflection=true`)
  - mention `--provider`

## Testing
- Go unit tests and `make -C go lint` pass. New e2e
`TestInstalledDefaultHarnesses`.
- `make helm-test` passes (354/354).
- UI: typecheck and lint pass, vitest 822/822, Playwright specs added
for the new flows.
- `scripts/get-kagent_test.sh` passes.
- Not run:
- The Go e2e suite, including the new `TestInstalledDefaultHarnesses`.
It's left to CI.
- Playwright was run on each part of the change separately, not on the
combined branch.
- `make proto-generate` was rate-limited by Buf, so the generated code
came from a local `buf generate`. CI's generation check will confirm it.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 7dfd5f7)
Signed-off-by: Eitan Yarmush <eitan.yarmush@solo.io>
@EItanya
EItanya requested a review from a team as a code owner November 10, 2026 14:05
@iplay88keys

Copy link
Copy Markdown
Contributor

Default model on helm upgrade. Installs on chart defaults have their OpenAI ModelConfig moved from gpt-4.1-mini to gpt-5-mini with apiFormat: responses.

I'm wondering if we should keep the defaults the same on 1.0.x and just set the model and apiformat for kagent install. That way existing setups will continue working (if they use helm upgrade) whereas new installs (with kagent install) will get this change.


🤖 AI finding:

The bigger risk is installs that already set providers.openAI.config. Helm merges apiFormat: responses into it, so a baseUrl pointing at a Chat-Completions-only gateway starts failing after the upgrade. The release note's workaround doesn't cover this, because config: {} still renders apiFormat: responses.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants