[github-actions]

The target's own content scan fails where the base build passed (docs-theme-extras markdown-leaks / built-html-integrity):

• markdown-leaks.spec.ts > markdown-leaks: rendered HTML scan > no leaked markdown across built HTML pages

kagent-dev/kagent#3494 — api/models: update ModelProviderConfig discovery contract

Docs versions: main

No code-path rule covers 6 touched file(s). The planner could route these only by identifier search, so the candidate pages may miss what they changed, including in the other mode:

• go/api/clientset/versioned/typed/api/v1alpha3/api_client.go
• go/api/clientset/versioned/typed/api/v1alpha3/fake/fake_api_client.go
• go/api/clientset/versioned/typed/api/v1alpha3/fake/fake_modelproviderconfig.go
• go/api/clientset/versioned/typed/api/v1alpha3/generated_expansion.go
• go/api/clientset/versioned/typed/api/v1alpha3/modelproviderconfig.go
• go/core/internal/service/model/discovery.go

What changes for users: ModelProviderConfig now separates credentials for model discovery from credentials for the generated ModelConfigs. Discovery is OpenAI-compatible only, cached model inventories are no longer stored in status, and a non-refresh model lookup returns NotFound.

What the docs now say: The model providers guide now documents ModelProviderConfig discovery credentials, generated ModelConfig invocation credentials, endpoint constraints, and status fields. The 0.x upgrade guide now converts the old spec.secretRef into both spec.discoveryAuth.secretRef and spec.modelConfigTemplate.auth.secretRef.

How kagent-3494 was drafted

Plan, and what changed it

• Planned: Document the new ModelProviderConfig discovery and generated ModelConfig credential contract on the model providers page, then fix stale migration guidance.
• Learned: The broad target list mostly matched shared auth field names; the dossier diff and target pages showed that setup/model-providers/about-model-providers.md and operations/upgrade-from-0x.md owned the changed ModelProviderConfig behavior.
• Did: Added a ModelProviderConfig discovery section to the model providers guide and corrected the 0.x conversion command to preserve invocation credentials for generated ModelConfigs.

Why a documentation change is necessary

The pull request adds spec.discoveryAuth and spec.modelConfigTemplate, removes cached model inventory fields from ModelProviderConfig status, and changes non-refresh model lookup to return NotFound. The model providers guide did not explain ModelProviderConfig discovery at all, so readers could not learn that discovery credentials are not inherited by generated ModelConfigs. The 0.x upgrade guide already converted spec.secretRef to spec.discoveryAuth.secretRef, but that conversion left generated ModelConfigs without the invocation credential that the new API requires explicitly.

How to verify this change

1. Apply a ModelProviderConfig like the example in setup/model-providers/about-model-providers.md.
2. Run kubectl get modelproviderconfig llm-gateway -n kagent -o yaml and check that spec.discoveryAuth.secretRef.name, spec.discoveryAuth.secretRef.key, spec.modelConfigTemplate.auth.secretRef.name, and spec.modelConfigTemplate.auth.secretRef.key are present.
3. Run the yq conversion command from operations/upgrade-from-0x.md against an exported v1alpha2 ModelProviderConfig that has spec.secretRef.name; the converted file should contain both spec.discoveryAuth.secretRef and spec.modelConfigTemplate.auth.secretRef with <secret-key> placeholders.

Proposed release note

No proposed-release-note.md written because markers.notes_placeable is false. Suggested note text: ModelProviderConfig now separates credentials for model discovery from credentials for generated ModelConfigs, supports only OpenAI-compatible discovery endpoints, and no longer stores model inventories in status. Set spec.discoveryAuth.secretRef for discovery and spec.modelConfigTemplate.auth for invocation credentials.

Files in this pull request

• docs-site/content/kagent/main/operations/upgrade-from-0x.md
• docs-site/content/kagent/main/setup/model-providers/about-model-providers.md

How the pages were chosen (triage report)

Draft a documentation change

kagent-dev/kagent#3494 — api/models: update ModelProviderConfig discovery contract

• Product: kagent (upstream) → kagent-dev/website
• Docs version: main
• Summary (read from the body): ModelProviderConfig needs separate credentials for model discovery and invocation, with explicit settings for generated ModelConfigs.
• Not tested: no cluster was available, so every command in this diff is unrun
• No rule covers 6 touched file(s). The candidate pages below come from the files that DID match a rule, so they may scope this narrower than the change is. Read these before deciding the change is only about the pages listed:
  • go/api/clientset/versioned/typed/api/v1alpha3/api_client.go
  • go/api/clientset/versioned/typed/api/v1alpha3/fake/fake_api_client.go
  • go/api/clientset/versioned/typed/api/v1alpha3/fake/fake_modelproviderconfig.go
  • go/api/clientset/versioned/typed/api/v1alpha3/generated_expansion.go
  • go/api/clientset/versioned/typed/api/v1alpha3/modelproviderconfig.go
  • go/core/internal/service/model/discovery.go

Draft branch: pr-tracker-draft-kagent-3494

---

Important

The test suite has not run on this pull request. It was opened by github-actions[bot], and GitHub does not start workflows for pull requests opened with the repository's own token. This repository's checks are held as action_required until somebody presses Approve and run on the Checks tab. Checks that come from GitHub Apps rather than Actions, such as DCO, run on their own.

Please approve the checks before reviewing the content: an absence of failures here means the tests have not run, not that they passed.