[FEATURE] Helm Secret Creation Feature Flag

[Matcham89]

📋 Prerequisites

• I have searched the existing issues to avoid creating a duplicate
• By submitting this issue, you agree to follow our Code of Conduct

📝 Feature Summary

Create a feature flag for helm secrets

❓ Problem Statement / Motivation

• provider secrets are created by default
• helm/kagent/templates/secret.yaml comments state that the app container will fail if the secret is NULL.
• if a user wants to deploy via helm and has a secret manager (external-secrets) there will be conflicts/duplication.
• if a user wants to deploy via helm delcaratively (argocd) & with a secret manager, there will be ownership warnings.

💡 Proposed Solution

would be good to have a feature-flag for the secret creation, per provider.

providers.openAI.secretCreation.enabled

providers:
  default: openAI
  openAI:
    secretCreation: false
    provider: OpenAI
    model: "gpt-4.1-mini"
    apiKeySecretRef: kagent-openai
    apiKeySecretKey: OPENAI_API_KEY

{{- $dot := . }}
{{- $model := index $dot.Values.providers $dot.Values.providers.default  }}
{{- if $model.secretCreation.enabled }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ $model.apiKeySecretRef | quote }}
  labels:
    {{- include "kagent.labels" $dot | nindent 4 }}
type: Opaque
data:
  {{/*  to prevent app container to fail with empty key use default - */}}
  {{ $model.apiKeySecretKey | default (printf "%s_API_KEY" $model.provider | upper) }}: {{ $model.apiKey | default "-" | b64enc }}
{{- end }}

🔄 Alternatives Considered

No response

🎯 Affected Service(s)

App Service

📚 Additional Context

No response

🙋 Are you willing to contribute?

• I am willing to submit a PR for this feature

[EItanya]

I agree that we need to make secret creation optional, but I think it's worth thinking about multiple options for the API. For now can we just rely on the $model.apiKey? If that value isn't set the secret will be invalid anyway.

For example:

{{- $dot := . }}
{{- $model := index $dot.Values.providers $dot.Values.providers.default  }}
{{- if $model.apiKey }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ $model.apiKeySecretRef | quote }}
  labels:
    {{- include "kagent.labels" $dot | nindent 4 }}
type: Opaque
data:
  {{/*  to prevent app container to fail with empty key use default - */}}
  {{ $model.apiKeySecretKey | default (printf "%s_API_KEY" $model.provider | upper) }}: {{ $model.apiKey | default "-" | b64enc }}
{{- end }}

There may be other downstream things we'd need to fix as a result of this, but this feels closer to what we really want. What do you think?

[Matcham89]

Nice - yeah this totally works.

I tested it on my cluster and the behaviour was as we'd expect - no down stream breaking either that I could see.

This would open up the option for users with pre-defined secrets for apiKey: to omit the value - and users whom are happy to set the value for apiKey:

[Igor992]

@EItanya, sorry for opening a closed thread, but when will this be pushed as a new chart version?

• 0.3.11 still does not contain changes that you introduced on the last feat: Enable feature flag for Helm secret creation #441 merged PR 🙏