fix(cli): allow minimal installs without a provider API key

Treat the minimal install profile as a provider-less bootstrap path so kagent install --profile minimal no longer blocks on OPENAI_API_KEY.

Add a chart flag to skip rendering the default ModelConfig and enable it in the minimal profile so the installation does not create a broken default provider configuration.

Refs #1622

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>

Author: officialasishkumar

go/core/cli/internal/cli/agent/install.go

@@ -24,6 +24,24 @@ type InstallCfg struct {
 	Profile string
 }
 
+func resolveInstallProfile(profile string) string {
+	profile = strings.TrimSpace(profile)
+	if profile == "" {
+		return ""
+	}
+
+	if slices.Contains(profiles.Profiles, profile) {
+		return profile
+	}
+
+	fmt.Fprintf(os.Stderr, "Invalid --profile value (%s), defaulting to demo\n", profile)
+	return profiles.ProfileDemo
+}
+
+func shouldRequireProviderCredentials(profile string, modelProvider v1alpha2.ModelProvider) bool {
+	return profiles.InstallsDefaultModelConfig(profile) && GetProviderAPIKey(modelProvider) != ""
+}
+
 // installChart installs or upgrades a Helm chart with the given parameters
 func installChart(ctx context.Context, chartName string, namespace string, registry string, version string, setValues []string, inlineValues string) (string, error) {
 	args := []string{
@@ -78,12 +96,12 @@ func InstallCmd(ctx context.Context, cfg *InstallCfg) *PortForward {
 
 	// get model provider from KAGENT_DEFAULT_MODEL_PROVIDER environment variable or use DefaultModelProvider
 	modelProvider := GetModelProvider()
+	selectedProfile := resolveInstallProfile(cfg.Profile)
 
-	// If model provider is openai, check if the API key is set
 	apiKeyName := GetProviderAPIKey(modelProvider)
 	apiKeyValue := os.Getenv(apiKeyName)
 
-	if apiKeyName != "" && apiKeyValue == "" {
+	if shouldRequireProviderCredentials(selectedProfile, modelProvider) && apiKeyValue == "" {
 		fmt.Fprintf(os.Stderr, "%s is not set\n", apiKeyName)
 		fmt.Fprintf(os.Stderr, "Please set the %s environment variable\n", apiKeyName)
 		return nil
@@ -92,13 +110,9 @@ func InstallCmd(ctx context.Context, cfg *InstallCfg) *PortForward {
 	helmConfig := setupHelmConfig(modelProvider, apiKeyValue)
 
 	// setup profile if provided
-	if cfg.Profile = strings.TrimSpace(cfg.Profile); cfg.Profile != "" {
-		if !slices.Contains(profiles.Profiles, cfg.Profile) {
-			fmt.Fprintf(os.Stderr, "Invalid --profile value (%s), defaulting to demo\n", cfg.Profile)
-			cfg.Profile = profiles.ProfileDemo
-		}
-
-		helmConfig.inlineValues = profiles.GetProfileYaml(cfg.Profile)
+	if selectedProfile != "" {
+		cfg.Profile = selectedProfile
+		helmConfig.inlineValues = profiles.GetProfileYaml(selectedProfile)
 	}
 
 	return install(ctx, cfg.Config, helmConfig, modelProvider)
@@ -120,22 +134,19 @@ func InteractiveInstallCmd(ctx context.Context, c *ishell.Context) *PortForward
 	// get model provider from KAGENT_DEFAULT_MODEL_PROVIDER environment variable or use DefaultModelProvider
 	modelProvider := GetModelProvider()
 
-	// if model provider is openai, check if the api key is set
+	// Add profile selection
+	profileIdx := c.MultiChoice(profiles.Profiles, "Select a profile:")
+	selectedProfile := profiles.Profiles[profileIdx]
+
 	apiKeyName := GetProviderAPIKey(modelProvider)
 	apiKeyValue := os.Getenv(apiKeyName)
-
-	if apiKeyName != "" && apiKeyValue == "" {
+	if shouldRequireProviderCredentials(selectedProfile, modelProvider) && apiKeyValue == "" {
 		fmt.Fprintf(os.Stderr, "%s is not set\n", apiKeyName)
 		fmt.Fprintf(os.Stderr, "Please set the %s environment variable\n", apiKeyName)
 		return nil
 	}
 
 	helmConfig := setupHelmConfig(modelProvider, apiKeyValue)
-
-	// Add profile selection
-	profileIdx := c.MultiChoice(profiles.Profiles, "Select a profile:")
-	selectedProfile := profiles.Profiles[profileIdx]
-
 	helmConfig.inlineValues = profiles.GetProfileYaml(selectedProfile)
 
 	return install(ctx, cfg, helmConfig, modelProvider)

go/core/cli/internal/cli/agent/install_test.go

@@ -0,0 +1,63 @@
+package cli
+
+import (
+	"testing"
+
+	"github.com/kagent-dev/kagent/go/api/v1alpha2"
+	"github.com/kagent-dev/kagent/go/core/cli/internal/profiles"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestResolveInstallProfile(t *testing.T) {
+	t.Run("empty profile remains empty", func(t *testing.T) {
+		assert.Equal(t, "", resolveInstallProfile(""))
+	})
+
+	t.Run("valid profile is preserved", func(t *testing.T) {
+		assert.Equal(t, profiles.ProfileMinimal, resolveInstallProfile(" minimal "))
+	})
+
+	t.Run("invalid profile falls back to demo", func(t *testing.T) {
+		assert.Equal(t, profiles.ProfileDemo, resolveInstallProfile("unknown"))
+	})
+}
+
+func TestShouldRequireProviderCredentials(t *testing.T) {
+	tests := []struct {
+		name          string
+		profile       string
+		modelProvider v1alpha2.ModelProvider
+		want          bool
+	}{
+		{
+			name:          "default install requires credentials for openai",
+			profile:       "",
+			modelProvider: v1alpha2.ModelProviderOpenAI,
+			want:          true,
+		},
+		{
+			name:          "minimal install skips credentials for openai",
+			profile:       profiles.ProfileMinimal,
+			modelProvider: v1alpha2.ModelProviderOpenAI,
+			want:          false,
+		},
+		{
+			name:          "demo install still requires credentials for anthropic",
+			profile:       profiles.ProfileDemo,
+			modelProvider: v1alpha2.ModelProviderAnthropic,
+			want:          true,
+		},
+		{
+			name:          "ollama never requires credentials",
+			profile:       profiles.ProfileDemo,
+			modelProvider: v1alpha2.ModelProviderOllama,
+			want:          false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, shouldRequireProviderCredentials(tt.profile, tt.modelProvider))
+		})
+	}
+}

go/core/cli/internal/profiles/README.md

@@ -4,6 +4,6 @@ KAgent's profiles provide a simpler way to set up KAgent in a configured way bas
 
 Currently, there are two profiles:
 1. `Demo`: For an installation of kagent that includes all our agents. This is useful for demo purposes and new users.
-2. `Minimal`: (default) For an installation that does not include any pre-defined agent. This is useful for users who want to start from scratch.
+2. `Minimal`: (default) For an installation that does not include any pre-defined agent or a default model configuration. This is useful for users who want to start from scratch.
 
 **Important**: When adding a new profile or updating a name, make sure to update the proper embeddings for it.

go/core/cli/internal/profiles/minimal.yaml

@@ -1,5 +1,8 @@
 # The minimal profile does not install any agents, and is meant as a bare minimum installation for kagent.
 # This is useful for users who only want to set up kagent without any extra agents.
+providers:
+  createDefaultModelConfig: false
+
 agents:
   k8s-agent:
     enabled: false

go/core/cli/internal/profiles/profiles.go

@@ -25,3 +25,12 @@ func GetProfileYaml(profile string) string {
 		return DemoProfileYaml
 	}
 }
+
+func InstallsDefaultModelConfig(profile string) bool {
+	switch profile {
+	case ProfileMinimal:
+		return false
+	default:
+		return true
+	}
+}

helm/kagent/templates/modelconfig-secret.yaml

@@ -1,3 +1,4 @@
+{{- if ne .Values.providers.createDefaultModelConfig false }}
 {{- $dot := . }}
 {{- $model := index $dot.Values.providers $dot.Values.providers.default  }}
 {{- if and $model.apiKeySecretRef $model.apiKey }}
@@ -13,3 +14,4 @@ type: Opaque
 data:
   {{ $model.apiKeySecretKey | default (printf "%s_API_KEY" $model.provider | upper) }}: {{ $model.apiKey | b64enc }}
 {{- end }}
+{{- end }}

helm/kagent/templates/modelconfig.yaml

@@ -1,3 +1,4 @@
+{{- if ne .Values.providers.createDefaultModelConfig false }}
 {{- $dot := . }}
 {{- $defaultProfider := .Values.providers.default | default "openAI" }}
 {{- $model := index .Values.providers $defaultProfider }}
@@ -31,3 +32,4 @@ spec:
   {{- toYaml $model.config | nindent 4 }}
   {{- end }}
   {{- end }}
+{{- end }}

helm/kagent/tests/modelconfig-secret_test.yaml

@@ -99,4 +99,14 @@ tests:
     asserts:
       - equal:
           path: metadata.namespace
-          value: custom-namespace 
+          value: custom-namespace
+
+  - it: should not render secret when default modelconfig is disabled
+    set:
+      providers:
+        createDefaultModelConfig: false
+        openAI:
+          apiKey: "test-key"
+    asserts:
+      - hasDocuments:
+          count: 0

helm/kagent/tests/modelconfig_test.yaml

@@ -113,4 +113,12 @@ tests:
     asserts:
       - equal:
           path: metadata.namespace
-          value: custom-namespace 
+          value: custom-namespace
+
+  - it: should not render modelconfig when disabled
+    set:
+      providers:
+        createDefaultModelConfig: false
+    asserts:
+      - hasDocuments:
+          count: 0

helm/kagent/values.yaml

@@ -266,6 +266,8 @@ ui:
 # https://kagent.dev/docs/getting-started/configuring-providers
 
 providers:
+  # -- Create the default ModelConfig resource during installation.
+  createDefaultModelConfig: true
   default: openAI
   openAI:
     provider: OpenAI