Skip to content

Provider CRD

The Provider custom resource defines a reusable LLM provider configuration that can be referenced by multiple AgentRuntimes. This enables centralized credential management and consistent model configuration across agents.

apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider

The LLM provider type.

ValueDescription
claudeAnthropic’s Claude models
openaiOpenAI’s GPT models
geminiGoogle’s Gemini models
autoAuto-detect based on available credentials
spec:
type: claude

The model identifier to use. If not specified, the provider’s default model is used.

ProviderExample Models
Claudeclaude-sonnet-4-20250514, claude-opus-4-20250514
OpenAIgpt-4o, gpt-4-turbo, gpt-3.5-turbo
Geminigemini-pro, gemini-1.5-pro
spec:
type: claude
model: claude-sonnet-4-20250514

Reference to a Secret containing API credentials.

FieldTypeRequiredDescription
secretRef.namestringYesName of the Secret
secretRef.keystringNoSpecific key to use (auto-detected if omitted)
spec:
secretRef:
name: llm-credentials

If key is not specified, the controller looks for provider-appropriate keys:

  • Claude: ANTHROPIC_API_KEY or api-key
  • OpenAI: OPENAI_API_KEY or api-key
  • Gemini: GEMINI_API_KEY or api-key

Override the provider’s default API endpoint. Useful for proxies, Azure OpenAI, or self-hosted models.

spec:
type: openai
baseURL: https://my-openai-proxy.internal/v1

Tuning parameters applied to all requests using this provider.

FieldTypeRangeDescription
temperaturestring0.0-2.0Controls randomness (lower = more focused)
topPstring0.0-1.0Nucleus sampling threshold
maxTokensinteger-Maximum tokens in response
spec:
defaults:
temperature: "0.7"
topP: "0.9"
maxTokens: 4096

Custom pricing for cost tracking. If not specified, PromptKit’s built-in pricing is used.

FieldTypeDescription
inputCostPer1KstringCost per 1000 input tokens
outputCostPer1KstringCost per 1000 output tokens
cachedCostPer1KstringCost per 1000 cached tokens
spec:
pricing:
inputCostPer1K: "0.003"
outputCostPer1K: "0.015"
cachedCostPer1K: "0.0003"

When enabled, the controller validates credentials with the provider during reconciliation.

spec:
validateCredentials: true
ValueDescription
ReadyProvider is configured and credentials are valid
ErrorConfiguration error or invalid credentials
TypeDescription
ReadyOverall readiness of the Provider
SecretValidReferenced Secret exists and contains required key
CredentialsValidatedCredentials validated with provider (if enabled)

Timestamp of the last successful credential validation (only set when validateCredentials: true).

apiVersion: v1
kind: Secret
metadata:
name: anthropic-credentials
namespace: agents
stringData:
ANTHROPIC_API_KEY: "sk-ant-api03-..."
---
apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider
metadata:
name: claude-production
namespace: agents
spec:
type: claude
model: claude-sonnet-4-20250514
secretRef:
name: anthropic-credentials
defaults:
temperature: "0.7"
maxTokens: 4096
pricing:
inputCostPer1K: "0.003"
outputCostPer1K: "0.015"
validateCredentials: true

Reference a Provider from an AgentRuntime using providerRef:

apiVersion: omnia.altairalabs.ai/v1alpha1
kind: AgentRuntime
metadata:
name: my-agent
spec:
promptPackRef:
name: my-prompts
providerRef:
name: claude-production
namespace: agents # Optional, defaults to same namespace
facade:
type: websocket
port: 8080

You can create multiple Provider resources for different use cases:

# Production provider with Claude Sonnet
apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider
metadata:
name: claude-production
spec:
type: claude
model: claude-sonnet-4-20250514
secretRef:
name: prod-credentials
defaults:
temperature: "0.3" # More deterministic
---
apiVersion: omnia.altairalabs.ai/v1alpha1
kind: Provider
metadata:
name: claude-development
spec:
type: claude
model: claude-haiku-20250514
secretRef:
name: dev-credentials
defaults:
temperature: "0.7"

Providers can be referenced across namespaces:

apiVersion: omnia.altairalabs.ai/v1alpha1
kind: AgentRuntime
metadata:
name: my-agent
namespace: app-team
spec:
providerRef:
name: shared-claude-provider
namespace: shared-providers # Provider in different namespace

Note: Ensure appropriate RBAC permissions are configured for cross-namespace access.