# Everything here is an endpoint or a public identifier. The one secret the
# agent holds arrives through assistant-agent-secrets; nothing in this file is
# sensitive, which is the point of keeping the split visible.
apiVersion: v1
kind: ConfigMap
metadata:
  name: assistant-agent-config
  namespace: agents
data:
  ASSISTANT_KEYCLOAK_REALM_URL: https://keycloak.sttlab.local/realms/classic-models
  ASSISTANT_CLIENT_ID: classic-models-agent-assistant

  ASSISTANT_LLM_BASE_URL: https://llm-dev.sttlab.local/llm/v1
  ASSISTANT_LLM_MODEL: google/gemini-3.7-flash

  # Trust the lab CA rather than disabling verification. Mounted from the
  # sttlab-ca ConfigMap.
  ASSISTANT_CA_BUNDLE: /etc/sttlab-ca/ca.crt

  # What callers dial, so it is the Service DNS name and not the bind address.
  # Advertised in the Agent Card; get it wrong and A2A callers are pointed at
  # nothing.
  ASSISTANT_PUBLIC_URL: http://assistant-agent.agents.svc.cluster.local:8080/

  # Specialists are reached at their own Service names, compiled into
  # specialists.py. ASSISTANT_URL_<NAME> overrides one, and exists only for
  # running the orchestrator outside the cluster against a port-forward.