[danielle-mustillo]

Why

kagent 1.x dropped the ready-made example agents that 0.x shipped as Helm charts. kagent-dev/tools#91 ports their domain guidance to Agent Skills inside the kagent-tools image. This PR adds a chart flag that installs example Agents that load those skills, so a user can try the skills without writing their own Agent.

What changed

• exampleAgents.enabled (off by default) installs one Go ADK Harness, kagent-tools-example, and three Agents on it:

  Agent	Skills	Tools
  kagent-tools-cluster-ops	k8s-troubleshooting, helm-release-management, argo-rollouts-progressive-delivery, prometheus-observability	29
  kagent-tools-networking	istio-traffic-debugging, cilium-network-debugging	31
  kagent-tools-security	kubescape-security-posture	10

  Each Agent uses default-model-config, the built-in prompts, one binding to the chart's kagent-tools MCP server, and the skills from opt/kagent-tools-skills in the kagent-tools image, pinned by @sha256 digest.

• make helm-publish resolves the digest of the kagent-tools image that the chart depends on and packages it as files/kagent-tools-image.json. It records no digest for kagent-tools 0.3.0 and earlier, which have no skills.

• exampleAgents.snapshotLocation defaults to gs://ate-snapshots/kagent/, the bucket that the Substrate chart's built-in rustfs store creates.

exampleAgents:
  enabled: true
  skillsImage: ghcr.io/kagent-dev/kagent/tools@sha256:<digest>

Scope

• Until a kagent-tools release contains feat: ship kagent 1.x skills bundle in the tools OCI image tools#91, users must set exampleAgents.skillsImage to an image built from that PR. A follow-up PR bumps the kagent-tools dependency so that the packaged digest makes skillsImage optional.
• A user who turned off rustfs in the Substrate chart must set snapshotLocation to their own bucket.
• Skill sources are OCI only. Git and S3 sources fail to load until fix(substrate): let the golden actor fetch git and S3 skill sources #3435 merges.

Tradeoffs

The original request was for a single example Agent. One Agent cannot hold all seven skills. The skills name 64 tools, one binding lists at most 50, and the whole tool server exceeds the 128-tool limit of OpenAI and Azure OpenAI. Two bindings to the same server work on Go ADK. The Claude and Codex harnesses reject them. Three Agents with one binding each run on every harness.

Blast radius

Nothing renders unless a user sets the flag, and the render fails with a clear message when skillsImage is missing or snapshotLocation is empty. The skills image mounts read-only in full, so an Agent can read the files of skills it did not select. Skill selection is not a security boundary.

Verification

• helm unittest helm/kagent (347 passed), scripts/package-release-charts_test.sh, and make lint pass.
• The new e2e test TestExampleAgentToolsSkills checks that each Agent advertises exactly its own skills and loads one of them, on the kagent, byo-adk, Claude, and Codex harnesses with a mock model. It passed 3 of 3 runs on a local Kind cluster with an image built from feat: ship kagent 1.x skills bundle in the tools OCI image tools#91. CI skips it until a kagent-tools release ships the skills.
• On a local Kind cluster, all three Agents loaded a skill and called its tools in 3 of 3 runs each on Go ADK with Azure OpenAI and with Gemini. Claude with Anthropic and Codex with OpenAI also passed one run per Agent. After the networking Agent gained four Kubernetes read tools, it called them after it loaded its skill, 3 of 3 runs on each provider.

[moezdil]

delete and uninstall tools lack requireApproval here