From 4660fcb346669dd9a067f839fb74ea180052e214 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Moritz=20Schmitz=20von=20H=C3=BClst?= Date: Fri, 23 Oct 2026 13:34:47 +0200 Subject: [PATCH 1/2] docs: add Mistral AI model provider page for kagent 1.x (#517) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Moritz Schmitz von Hülst --- .../1.x/setup/model-providers/mistral.md | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 docs-site/content/kagent/1.x/setup/model-providers/mistral.md diff --git a/docs-site/content/kagent/1.x/setup/model-providers/mistral.md b/docs-site/content/kagent/1.x/setup/model-providers/mistral.md new file mode 100644 index 00000000..40d7a67e --- /dev/null +++ b/docs-site/content/kagent/1.x/setup/model-providers/mistral.md @@ -0,0 +1,87 @@ +--- +title: Mistral +description: Configure kagent to use Mistral models by creating a ModelConfig for the Mistral provider. +weight: 20 +author: kagent.dev +--- + +The `Mistral` provider calls the Mistral API directly. Mistral speaks the OpenAI-compatible wire protocol, but kagent exposes it as its own `provider: Mistral` value rather than routing it through the `OpenAI` provider. + +> [!NOTE] +> This provider works on the `kagent` and `byo` runtimes, but not on `codex` or `claude`. For more information, see [Agent harness]({{< link path="agents/agent-harness#model-provider-support" >}}). + +## Create the ModelConfig + +1. Save your [Mistral API key](https://console.mistral.ai/api-keys) as an environment variable. + ```bash + export MISTRAL_API_KEY= + ``` + +2. Create a Kubernetes Secret that stores the API key. Create it in the same namespace as the AgentTemplates that use it, such as `kagent`. + ```bash + kubectl create secret generic kagent-mistral -n kagent --from-literal MISTRAL_API_KEY=$MISTRAL_API_KEY + ``` + +3. Create a `ModelConfig` that references the Secret. Every field in the `mistral` block is optional, and an empty block is valid. + ```yaml + kubectl apply -f - <}}). + +| Field | Description | +| ----- | ----------- | +| `baseUrl` | An alternative Mistral API endpoint. Defaults to `https://api.mistral.ai/v1`. | +| `temperature` | How much randomness the model applies when it picks the next token, written as a string. | +| `topP` | The nucleus sampling cutoff, written as a string. | +| `maxTokens` | A cap on the tokens generated in one response. Minimum 1. | +| `timeout` | How long to wait on a request to the provider, in seconds. Minimum 1. | + +Mistral embeddings (`mistral-embed`) are out of scope for this page. + +## How the credential reaches Mistral + +The credential never enters the agent. kagent binds the `apiKeySecret` Secret to one destination and one header, `authorization: Bearer *** scoped to `baseUrl` or `https://api.mistral.ai`, and the Agent Substrate egress gateway injects it into each request. For the full credential model, see [About model providers]({{< link path="setup/model-providers/about-model-providers" >}}). + +A `MISTRAL_API_KEY` environment variable on the runtime is a fallback for an image that reads its own key; it is not the ModelConfig path. + +## Use the ModelConfig + +Reference the ModelConfig by name from an AgentTemplate in the same namespace. + +```yaml +spec: + modelConfig: + name: mistral-model-config +``` + +## Next steps + +{{< cards >}} + {{< card link=`{{< link path="get-started/your-first-agent" >}}` title="Your first agent" subtitle="Create an agent that uses this model, and hold a conversation with it." >}} + {{< card link=`{{< link path="setup/model-providers/byo-openai" >}}` title="BYO OpenAI-compatible endpoint" subtitle="Point the OpenAI provider at a different service." >}} +{{< /cards >}} From af7208042208d5283634d78e2f867787bcd3bfc3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Moritz=20Schmitz=20von=20H=C3=BClst?= Date: Sat, 24 Oct 2026 05:19:16 +0200 Subject: [PATCH 2/2] docs: apply review feedback to Mistral page (#517) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Moritz Schmitz von Hülst --- .../1.x/setup/model-providers/about-model-providers.md | 3 ++- .../kagent/1.x/setup/model-providers/mistral.md | 10 +--------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/docs-site/content/kagent/1.x/setup/model-providers/about-model-providers.md b/docs-site/content/kagent/1.x/setup/model-providers/about-model-providers.md index b1c15636..58a1bba3 100644 --- a/docs-site/content/kagent/1.x/setup/model-providers/about-model-providers.md +++ b/docs-site/content/kagent/1.x/setup/model-providers/about-model-providers.md @@ -68,7 +68,8 @@ When a request is made to a provider, the gateway puts the credential in the hea | `Foundry` API key in Anthropic format | `x-api-key: ` | | `Gemini` API key | `x-goog-api-key: ` | | `Bedrock` bearer token | `authorization: Bearer ` | -| `Ollama` API key, for an Ollama Cloud model | `authorization: Bearer ` | +| `Ollama` API key, for an Ollama Cloud model | `authorization: Bearer *** | +| `Mistral` API key | `authorization: Bearer *** | | A Secret-backed `RemoteMCPServer` header | The header that the server names | Substrate matches a destination on the exact DNS hostname, without path, port, or scheme. Two credentials that target the same hostname and header are rejected, including a conflict between an agent's model, a memory embedding model, and an MCP server. Give such origins distinct DNS names. A destination given as an IP address cannot carry an injected credential at all. diff --git a/docs-site/content/kagent/1.x/setup/model-providers/mistral.md b/docs-site/content/kagent/1.x/setup/model-providers/mistral.md index 40d7a67e..00140437 100644 --- a/docs-site/content/kagent/1.x/setup/model-providers/mistral.md +++ b/docs-site/content/kagent/1.x/setup/model-providers/mistral.md @@ -45,9 +45,7 @@ The `Mistral` provider calls the Mistral API directly. Mistral speaks the OpenAI | `apiKeySecretKey` | The key within that Secret that holds the API key. | | `model` | The model to use. For the available models, see the [Mistral model docs](https://docs.mistral.ai/models). | | `provider` | The provider to use, `Mistral`. | - | `mistral` | Settings that only the Mistral provider takes. An empty block is valid. | - -A CEL rule rejects a `mistral` block on any other provider: `provider.mistral must be nil if the provider is not Mistral`. + | `mistral` | Settings that only the Mistral provider takes. An empty block is valid. A CEL rule rejects a `mistral` block on any other provider. | ## Mistral provider settings @@ -63,12 +61,6 @@ The `mistral` block takes the following optional settings. For every field, incl Mistral embeddings (`mistral-embed`) are out of scope for this page. -## How the credential reaches Mistral - -The credential never enters the agent. kagent binds the `apiKeySecret` Secret to one destination and one header, `authorization: Bearer *** scoped to `baseUrl` or `https://api.mistral.ai`, and the Agent Substrate egress gateway injects it into each request. For the full credential model, see [About model providers]({{< link path="setup/model-providers/about-model-providers" >}}). - -A `MISTRAL_API_KEY` environment variable on the runtime is a fallback for an image that reads its own key; it is not the ModelConfig path. - ## Use the ModelConfig Reference the ModelConfig by name from an AgentTemplate in the same namespace.