use existing secrets in helm charts

[MasayaAoyama]

Add template values for using existing secrets in the Helm chart.
This is useful when used together with other secret management tools such as ExternalSecret.

Test

• useExistingSecret=false

# helm template kagent . --set providers.openAI.apiKey=test-key --set providers.openAI.useExistingSecret=false | yq 'select(.kind == "Secret")'
# Source: kagent/templates/modelconfig-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: "kagent-openai"
  namespace: argocd
  labels:
    helm.sh/chart: kagent-v1
    app.kubernetes.io/name: kagent
    app.kubernetes.io/instance: kagent
    app.kubernetes.io/version: "v1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: kagent
type: Opaque
data:
  OPENAI_API_KEY: dGVzdC1rZXk=
---
# Source: kagent/templates/postgresql-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: kagent-postgresql
  namespace: argocd
  labels:
    helm.sh/chart: kagent-v1
    app.kubernetes.io/name: kagent
    app.kubernetes.io/instance: kagent
    app.kubernetes.io/version: "v1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: kagent
    app.kubernetes.io/component: database
type: Opaque
data:
  POSTGRES_PASSWORD: "a2FnZW50"

• useExistingSecret=true

# helm template kagent . --set providers.openAI.apiKey=test-key --set providers.openAI.useExistingSecret=true | yq 'select(.kind == "Secret")'
# Source: kagent/templates/postgresql-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: kagent-postgresql
  namespace: argocd
  labels:
    helm.sh/chart: kagent-v1
    app.kubernetes.io/name: kagent
    app.kubernetes.io/instance: kagent
    app.kubernetes.io/version: "v1"
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: kagent
    app.kubernetes.io/component: database
type: Opaque
data:
  POSTGRES_PASSWORD: "a2FnZW50"

[Copilot]

Pull request overview

Adds a Helm values flag to allow using pre-created/provider-managed Kubernetes Secrets (e.g., ExternalSecrets) instead of having the chart generate an API key Secret for the default LLM provider.

Changes:

• Introduces providers.<provider>.useExistingSecret values (default false) for several providers.
• Updates modelconfig-secret.yaml to skip rendering the Secret when useExistingSecret is enabled.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
helm/kagent/values.yaml	Adds useExistingSecret values and inline docs for LLM providers.
helm/kagent/templates/modelconfig-secret.yaml	Gates Secret rendering on useExistingSecret being false.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[EItanya]

Overall this makes sense, but can't you just set apiKeySecretRef and skip apiKey to achieve the same behavior?

[MasayaAoyama]

@EItanya Thank you for the review!

If we use apiKeySecretRef in that way, then when users provide the apiKey directly, we would likely need to hardcode the Secret name on the chart side when generating the Secret. Alternatively, we might need to introduce another separate value for that purpose.

Also, this approach would break backward compatibility with older versions, and it would also affect the Secret name used when mounting the Secret from the Deployment.

For these reasons, this PR keeps the current implementation.

What do you think about the current approach?

[EItanya]

@EItanya Thank you for the review!

If we use apiKeySecretRef in that way, then when users provide the apiKey directly, we would likely need to hardcode the Secret name on the chart side when generating the Secret. Alternatively, we might need to introduce another separate value for that purpose.

Also, this approach would break backward compatibility with older versions, and it would also affect the Secret name used when mounting the Secret from the Deployment.

For these reasons, this PR keeps the current implementation.

What do you think about the current approach?

I'm a little confused, I think the way I mentioned would work today. If a user specifies just apiKeySecretRef then we template out the following in the modelConfig:

  {{- if $model.apiKeySecretRef }}
  apiKeySecret: {{.apiKeySecretRef}}
  {{- end }}
  {{- if $model.apiKeySecretKey }}
  apiKeySecretKey: {{.apiKeySecretKey}}
  {{- end }}

Why is the apiKey involved at all in this flow?