For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Understand why Vertex AI models do not run on kagent 1.0, and which providers serve the same models instead.

Neither Vertex AI provider runs on kagent 1.0. AnthropicVertexAI and GeminiVertexAI both authenticate with a Google service account key, and such a key is signed locally to obtain an access token. An agent reaches its model provider through the Agent SubstrateAgent SubstrateThe runtime that kagent runs agents on. It multiplexes many sandboxed Actors onto a smaller pool of pre-started Workers, suspending idle ones to snapshots.Learn more egress gateway, which injects a static credential into an HTTP header and performs no signing, so kagent rejects a Vertex AI ModelConfigModelConfigA Kubernetes custom resource naming one model at one provider, along with the credentials to reach it. An AgentTemplate references one by name, and every agent compiled from that template calls the model that it names.Learn more rather than passing the key to the runtime.

The rejection happens at compile time. The AgentTemplate reports the Compatible condition as False with the reason UnsupportedConfiguration, and kagent compiles no revision from it. On a claude HarnessHarnessA Kubernetes custom resource defining how an agent is allowed to run: its runtime, workload image, WorkerPool and snapshot storage, and which AgentTemplates it accepts.Learn more the message names the credential.

environment credential "KAGENT_CLAUDE_GOOGLE_CREDENTIALS_JSON" cannot use gateway header injection; local signing and arbitrary secret environment variables are unsupported

On the kagent and byo runtimes the same ModelConfig fails for a second reason as well, because those runtimes mount the key as a file: ModelConfig requires volume mounts unsupported by Substrate ActorTemplate.

Reach the same models another way

Vertex AI serves two model families, and a provider that authenticates with an API key is available for each.

For every credential that the gateway cannot inject, and the alternative for each, see About model providers.

Next steps