description |
string |
yes |
|
min length 1; max length 4096 |
Description is the routing blurb, rendered into the A2A agent card. |
persona |
object |
yes |
|
|
Persona is the OCI artifact holding the persona (persona.yaml, instructions.md, skills/, mcp.yaml) under its /files directory, mounted read-only at /persona. |
persona.image |
string |
yes |
|
min length 1 |
Image is the OCI reference of the persona artifact. |
harness |
object |
yes |
|
|
Harness is the worker image and its model routing. |
harness.image |
string |
yes |
|
min length 1 |
Image is the worker image: a harness speaking the headless CLI contract, wrapped by the bus adapter. |
harness.model |
string |
no |
|
|
Model is the model route, via LiteLLM. |
harness.maxTurns |
integer |
no |
|
min 0 |
MaxTurns is the turn budget. |
tools |
[]object |
no |
|
max items 16 |
Tools are OCI images of command-line tools for the profile’s pods. Each is mounted read-only at /opt/tools/<name> and its bin/ directory is put on PATH, in list order, so one tools image serves every harness. A tools image holds no credentials: a tool that needs them (kubectl or gcloud against the fleet, a forge CLI) gets them from the broker, per task. |
tools[].name |
string |
yes |
|
min length 1; max length 24; pattern ^[a-z0-9]([-a-z0-9]{0,22}[a-z0-9])?$ |
Name is the tool’s directory under /opt/tools: a DNS-1123 label unique in the list, at most 24 characters so the staging init container’s name (“stage-tool-<name>”) stays within the 35 GKE Autopilot allows. |
tools[].image |
string |
yes |
|
min length 1 |
Image is the OCI reference of the tools image. Its payload is the image’s /files directory, mounted at /opt/tools/<name>; binaries go in /files/bin. |
tools[].imagePullPolicy |
corev1.PullPolicy |
no |
|
one of Always, IfNotPresent, Never |
ImagePullPolicy is the pull policy for the image. Absent means IfNotPresent. |
bus |
object |
no |
|
|
Bus holds topic grants beyond the task subjects every executor gets. Absent or empty grants no topic at all. |
bus.publishTopics |
[]string |
no |
|
max items 32; items pattern ^(shared\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?|agent\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?)$; items max length 133 |
PublishTopics are the topics the profile’s pods may write. |
bus.subscribeTopics |
[]string |
no |
|
max items 32; items pattern ^(shared\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?|agent\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?\.[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?)$; items max length 133 |
SubscribeTopics are the topics the profile’s pods may read. |
identity |
object |
no |
|
|
Identity names the ServiceAccount the profile’s pods run as. Absent, the operator creates one with zero RBAC bindings: the token exists to authenticate to the bus, not to talk to the API server. |
identity.serviceAccountName |
string |
no |
|
max length 253; pattern ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ |
ServiceAccountName is an existing ServiceAccount in the profile namespace (<namespace>-profiles), and it serves the profile’s one allowed tier. Naming one hands this profile’s pods whatever RBAC it holds; absent, the operator creates a ServiceAccount per tier with none. |
clusterRef |
object |
no |
|
|
ClusterRef is set on cluster agents only: the cluster this profile is scoped to, as structured data rather than a parsed name. |
clusterRef.projectId |
string |
yes |
|
min length 1 |
|
clusterRef.cluster |
string |
yes |
|
min length 1 |
|
clusterRef.location |
string |
yes |
|
min length 1 |
|
lifecycle |
object |
yes |
|
|
Lifecycle bounds one task’s wall clock and how long the finished Job lingers. |
lifecycle.activeDeadlineSeconds |
integer |
yes |
|
min 1 |
ActiveDeadlineSeconds is the hard ceiling on one task’s wall clock, enforced by Kubernetes from Job spawn. |
lifecycle.ttlSecondsAfterFinished |
integer |
yes |
|
min 0 |
TTLSecondsAfterFinished is how long a finished Job lingers for inspection before garbage collection. |
queueTimeoutSeconds |
integer |
no |
|
min 0 |
QueueTimeoutSeconds is how stale a queued submission may be, by its JetStream server ingest time, before the dispatcher refuses to run it. Absent or zero means DefaultAgentProfileQueueTimeoutSeconds. |
concurrency |
integer |
yes |
|
min 1 |
Concurrency is the most pods this profile runs at once. |
allowedTiers |
[]string |
no |
|
min items 1; max items 2; items one of read, unattended |
AllowedTiers are the tiers this profile may run at. A task runs at its requester’s tier, and the dispatcher refuses one whose tier is not listed here; a pinned production profile might allow only read. Tier is authority, so it lives on the CR, never in the persona. Absent means read alone (AllowedTierList). |
parameters |
[]object |
no |
|
max items 16 |
Parameters are the task parameters this profile’s persona declares, as the gateway and the dispatcher need them without reading the persona image: the gateway routes cluster work to a profile that declares project, location and cluster, and the dispatcher refuses a submission missing a required one. The worker checks this list against the persona’s at start and refuses to run a task when they differ. |
parameters[].name |
string |
yes |
|
pattern ^[a-z][a-z0-9_]{0,62}$ |
|
parameters[].required |
boolean |
no |
|
|
Required means a submission without it is refused. |
resources |
object |
yes |
|
|
Resources is the pod resource class. |
resources.requests |
object |
yes |
|
|
AgentProfileResourceList is a cpu and memory pair. |
resources.requests.cpu |
resource.Quantity |
yes |
|
|
|
resources.requests.memory |
resource.Quantity |
yes |
|
|
|
resources.limits |
object |
yes |
|
|
AgentProfileResourceList is a cpu and memory pair. |
resources.limits.cpu |
resource.Quantity |
yes |
|
|
|
resources.limits.memory |
resource.Quantity |
yes |
|
|
|