agentkit.yaml

AgentKit CLI currently uses two agentkit.yaml files:

Root agentkit.yaml: created by agentkit init or agentkit config --init, read by build, deploy, launch, status, and destroy for lifecycle-style build and deploy.
.agentkit/agentkit.yaml: created by agentkit release config, read by release, release build, and release apply for the full cloud release flow that can include IM channels and frontend BFF.

This page covers the root lifecycle config first, then the .agentkit/agentkit.yaml release config. Do not mix the two: lifecycle commands read root agentkit.yaml by default, while release reads .agentkit/agentkit.yaml by default.

Lifecycle Config

Root agentkit.yaml describes how an agent application is built, deployed, and inspected. common.launch_type selects the active strategy: local means local Docker build and local container deploy, cloud means cloud build and cloud runtime deploy, and hybrid means local build followed by cloud runtime deploy.

agentkit.yaml

common:
  agent_name: my-agent
  entry_point: agent.py
  description: AgentKit project my-agent
  language: Python
  language_version: "3.12"
  agent_type: Basic App
  dependencies_file: requirements.txt
  runtime_envs:
    LOG_LEVEL: INFO
  launch_type: cloud
  cloud_provider: volcengine

launch_types:
  cloud:
    region: cn-beijing
    tos_bucket: agentkit-platform-{{account_id}}
    tos_prefix: agentkit-builds
    image_tag: "{{timestamp}}"
    cr_instance_name: agentkit-platform-{{account_id}}
    cr_namespace_name: agentkit
    cr_repo_name: my-agent
    cr_auto_create_instance_type: Micro
    build_timeout: 3600
    cp_workspace_name: agentkit-cli-workspace
    cp_pipeline_name: Auto
    project_name: default
    runtime_id: Auto
    runtime_name: Auto
    runtime_role_name: Auto
    runtime_auth_type: key_auth
    runtime_apikey_name: Auto
    runtime_apikey: Auto
    runtime_jwt_allowed_clients: []
    runtime_envs: {}
    runtime_bindings: {}
    runtime_network: {}

docker_build:
  base_image:
  build_script:

Root lifecycle configuration does not substitute ${VAR} from the environment. After exporting a model key, use agentkit config --runtime_envs "MODEL_AGENT_API_KEY=$MODEL_AGENT_API_KEY" so the shell expands it first. This writes the actual key to agentkit.yaml; add that file and .env to both .gitignore and .dockerignore before running the command. The ${VAR} syntax described below applies to Release configuration in .agentkit/agentkit.yaml

Common Fields

Field	Description	Default
`common.agent_name`	Agent application name; only letters, digits, underscores, and hyphens are allowed.	—
`common.entry_point`	Application entry file, such as `agent.py`, `main.go`, or `build.sh`.	`agent.py`
`common.description`	Application description.	—
`common.language`	Application language; the config wizard currently supports `Python` and `Golang`.	`Python`
`common.language_version`	Language version; Python defaults to `3.12`, Go defaults to `1.24`.	By language
`common.agent_type`	Application type label.	`Basic App`
`common.dependencies_file`	Dependency file; Python defaults to `requirements.txt`, Go defaults to `go.mod`.	By language
`common.runtime_envs`	Runtime environment variables shared by all launch modes.	`{}`
`common.launch_type`	Launch mode: `local`, `cloud`, or `hybrid`.	`cloud`
`common.cloud_provider`	Cloud provider: `volcengine` or `byteplus`.	Current cloud environment

Local Strategy

Field	Description	Default
`launch_types.local.image_tag`	Local image tag.	`latest`
`launch_types.local.invoke_port`	Application invoke port.	`8000`
`launch_types.local.container_name`	Local container name; generated from the app name when empty.	—
`launch_types.local.ports`	Docker port mappings.	`["8000:8000"]`
`launch_types.local.volumes`	Docker volume mounts.	`[]`
`launch_types.local.restart_policy`	Docker restart policy.	`unless-stopped`
`launch_types.local.memory_limit`	Local container memory limit.	`1g`
`launch_types.local.cpu_limit`	Local container CPU limit.	`1`
`launch_types.local.runtime_envs`	Runtime environment variables for local mode.	`{}`

Cloud And Hybrid Strategies

cloud and hybrid share most runtime, auth, networking, and container registry fields. cloud also includes TOS and Code Pipeline fields; hybrid uses the local build result and omits those cloud-build fields.

Field	Description	Default
`region`	AgentKit Runtime region.	Provider default region
`region_overrides`	Per-service region overrides for services such as `agentkit`, `cr`, `cp`, and `tos`.	`{}`
`tos_bucket`	TOS bucket for `cloud` build artifacts.	`agentkit-platform-{{account_id}}`
`tos_prefix`	Object prefix for `cloud` build artifacts.	`agentkit-builds`
`image_tag`	Image tag; supports `{{timestamp}}`.	`{{timestamp}}`
`cr_instance_name`	Container Registry instance name.	`agentkit-platform-{{account_id}}`
`cr_namespace_name`	Container Registry namespace.	`agentkit`
`cr_repo_name`	Container Registry repository name.	Agent application name
`cr_auto_create_instance_type`	Instance type when auto-creating CR.	`Micro`
`build_timeout`	Cloud build timeout in seconds for `cloud` mode.	`3600`
`cp_workspace_name`	Code Pipeline workspace name for `cloud` mode.	`agentkit-cli-workspace`
`cp_pipeline_name`	Code Pipeline pipeline name for `cloud` mode.	`Auto`
`cp_pipeline_id`	Existing Code Pipeline pipeline id.	—
`project_name`	AgentKit project name.	`default`
`runtime_id`	Deployed runtime id; `Auto` means create or resolve automatically.	`Auto`
`runtime_name`	Runtime name; `Auto` means generated from the app name.	`Auto`
`runtime_role_name`	Runtime IAM role name.	`Auto`
`runtime_auth_type`	Runtime gateway auth type: `key_auth` or `custom_jwt`.	`key_auth`
`runtime_apikey_name`	API key name for `key_auth`.	`Auto`
`runtime_apikey`	API key value recorded after deployment.	`Auto`
`runtime_jwt_discovery_url`	OIDC discovery URL for `custom_jwt`.	—
`runtime_jwt_allowed_clients`	Allowed client ids for `custom_jwt`.	`[]`
`runtime_endpoint`	Runtime endpoint recorded after deployment.	—
`runtime_envs`	Runtime environment variables for the current strategy, merged with `common.runtime_envs`.	`{}`
`runtime_bindings.knowledge_id`	Bound knowledge base id.	—
`runtime_bindings.memory_id`	Bound memory collection id.	—
`runtime_bindings.tool_id`	Bound tool id.	—
`runtime_bindings.mcp_toolset_id`	Bound MCP toolset id.	—
`runtime_gateway_mode`	Runtime gateway mode: `Shared` or `Exclusive`	`Shared`
`runtime_gateway_instance_id`	Exclusive gateway instance ID, required in Exclusive mode	—
`runtime_network.mode`	Network mode: `public`, `private`, or `hybrid`. `private` disables public access and enables private networking; `hybrid` keeps public access and enables private networking.	Platform default
`runtime_network.vpc_id`	VPC id for private networking; required when `mode` is `private` or `hybrid`.	—
`runtime_network.subnet_ids`	Subnet ids for private networking; provide at least one and at most 5 when `mode` is `private` or `hybrid`.	`[]`
`runtime_network.security_group_ids`	Security group ids for private networking.	`[]`
`runtime_network.enable_shared_internet_access`	Whether shared internet access is enabled for private networking.	Platform default

When deploying a cloud runtime from lifecycle config, runtime_network.mode: hybrid enables both public ingress and private VPC networking. Use runtime_network.mode: private when the runtime should be private-only, or omit runtime_network / use runtime_network.mode: public for the platform’s default public behavior.

Build Fields

Field	Description	Default
`docker_build.base_image`	Base image used when generating a Dockerfile; empty means selected from language and cloud provider.	—
`docker_build.build_script`	Custom build script used when generating a Dockerfile.	—

Release Config

.agentkit/agentkit.yaml is the release config. Generate it with agentkit release config; agentkit release, release build, and release apply all read from it. In the generated file, required and common fields are active, and optional fields are shown commented-out with their full shape, so you uncomment and fill them to enable them. Secrets are not written in plaintext; instead, reference the deploy environment with ${VAR}, resolved by the CLI at deploy time:

${VAR} — required; the deploy fails if it is unset;
${VAR:-default} — use the default when unset or empty;
${VAR:?message} — required; fail with message when unset;
$$ — a literal $.

The CLI loads the project’s .env (from the working directory) before resolving these, so it is enough to put the values in .env — no manual export is needed. Variables already set in your shell take precedence, and .env is never uploaded to the runtime.

Release Config Full Example

.agentkit/agentkit.yaml

# agentkit.yaml — AgentKit release configuration (fully yaml-driven).
#
# `agentkit release` reads everything from this file — no flags required.
# Secrets are NOT written here in plaintext: reference the deploy environment
# with ${VAR}. Forms: ${VAR} (required) · ${VAR:-default} · ${VAR:?message} ·
# $$ for a literal $. Values are resolved by the CLI at deploy time.

# ── Project ──────────────────────────────────────────────
name: my-agent
description: ""
cloud_provider: volcengine      # volcengine | byteplus
region: cn-beijing
project: default

# ── Runtime resources ────────────────────────────────────
runtime:
  region: cn-beijing
  project: default
  cpu_milli: 2000              # CPU in milli-cores (2000 = 2 vCPU)
  memory_mb: 4096              # memory in MB (4096 = 4 GiB)
  min_instance: 1              # keep one warm instance by default
  max_instance: 5
  max_concurrency: 20          # concurrent requests per instance
  # tags:
  #   owner: team-name
  # network:
  #   enable_public_network: true
  #   enable_private_network: false
  #   vpc_id: ${VPC_ID}
  #   subnet_ids:
  #     - ${SUBNET_ID}
  #   security_group_ids:
  #     - ${SECURITY_GROUP_ID}
  #   enable_shared_internet_access: true

# ── Harness Sidecar optimization (optional) ─────────────
# Enabling any component selects the managed Sidecar Runtime. Initial support is
# Volcengine cn-shanghai/cn-beijing, CPython 3.12, linux/amd64, and exactly one instance;
# set runtime.min_instance/max_instance to 1. The private Runtime artifact is
# supplied by the platform and must never be written into this file.
# harness_sidecar:
#   enabled: true
#   profile: default
#   component_overrides:
#     context_engine: true
#     compressor: false
#     verifier: false
#     long_run_control: false   # Studio name: Goal任务控制
#     mcp_resilience: false     # automatically includes SQL readonly protection

# ── Build ────────────────────────────────────────────────
# Defaults to .agentkit/Dockerfile (or ./Dockerfile if present).
# dockerfile: .agentkit/Dockerfile

# ── Runtime environment variables (injected into the runtime) ────
# Use ${VAR} for secrets — resolved from the deploy env, never committed here.
envs:
  # MODEL_AGENT_API_KEY: ${MODEL_AGENT_API_KEY:?set MODEL_AGENT_API_KEY in your env}
  # LOG_LEVEL: ${LOG_LEVEL:-info}

# ── Model / associated resources (optional) ──────────────
# model_agent_name: ep-xxxxxxxx
# knowledge_id: ${KNOWLEDGE_ID}
# memory_id: ${MEMORY_ID}
# tool_id: ${TOOL_ID}
# mcp_toolset_id: ${MCP_TOOLSET_ID}

# ── Gateway auth (optional; pick one type) ───────────────
# When `frontend` (below) is enabled, this is derived automatically from its
# userpool — you do NOT need to repeat it here.
# auth:
#   type: custom_jwt           # key_auth | custom_jwt
#   # --- key_auth ---
#   api_key_name: ""           # auto-created if omitted
#   api_key_location: header   # header | query
#   # --- custom_jwt ---
#   discovery_url: ${USERPOOL_DISCOVERY_URL}
#   allowed_clients:
#     - ${USERPOOL_CLIENT_ID}

# ── IM channels (optional) ───────────────────────────────
# Deploys a bot proxy to VeFaaS after the runtime. Credentials via ${VAR}.
im:
  region: cn-beijing
  project: default
#   feishu:
#     enabled: true
#     app_id: ${FEISHU_APP_ID}
#     app_secret: ${FEISHU_APP_SECRET}
#   wecom:
#     enabled: true
#     bot_id: ${WECOM_BOT_ID}
#     bot_secret: ${WECOM_BOT_SECRET}
#   dingtalk:
#     enabled: true
#     client_id: ${DINGTALK_CLIENT_ID}
#     client_secret: ${DINGTALK_CLIENT_SECRET}

# ── Frontend BFF (optional) ──────────────────────────────
# Public VeFaaS front door: OAuth login at the edge, then reverse-proxy to the
# runtime forwarding the user's JWT (no shared key). The runtime's gateway auth
# is auto-set to custom_jwt from this userpool. The callback is auto-registered
# and OAUTH2_REDIRECT_URI auto-derived — you only declare the userpool here.
frontend:
  enabled: false
  region: cn-beijing
  project: default
#   gateway: ${VEFAAS_SERVERLESS_GATEWAY}
#   oauth2:
#     region: cn-shanghai
#     project: identity-project
#     user_pool_id: ${USERPOOL_ID}
#     client_id: ${USERPOOL_CLIENT_ID}
#     client_secret: ${USERPOOL_CLIENT_SECRET}

# ── Observability (optional) ─────────────────────────────
# apmplus: true                # enable APMPlus monitoring

# ── Advanced (optional) ──────────────────────────────────
# role_name: ""                # IAM role; reuse a qualified role or create one when omitted

# ── Infrastructure ───────────────────────────────────────
# Where the image is built and stored. "Auto" = created & managed for you.
infrastructure:
  container_registry:          # Volcengine Container Registry (CR)
    region: cn-beijing
    project: default
    instance_name: Auto        # Auto → agentkit-platform-<account-id>
    namespace_name: agentkit
    repo_name: my-agent         # defaults to the app name
  tos:                         # TOS (build artifacts)
    region: cn-beijing
    project: default
    bucket_name: Auto          # Auto → provider/region-safe account bucket
    object_prefix: agentkit-builds
  # code_pipeline:
  #   workspace_name: agentkit-cli-workspace
  #   workspace_id: ""           # optional; pins an existing workspace
  #   pipeline_name: my-agent
  #   pipeline_id: ""            # optional; pins an existing compatible pipeline

Project

The top-level fields provide the default cloud provider, region, and project inherited by resource blocks. A resource block may override its region and project, but one release cannot mix cloud providers.

Field	Description	Default
`name`	Runtime/app name; the runtime is created or updated idempotently by this name.	`agent`
`description`	Runtime description.	—
`cloud_provider`	Cloud provider: `volcengine` or `byteplus`. Applies to Runtime, IAM/STS, CR, TOS, and Code Pipeline.	Current cloud environment
`region`	Default region inherited by resource blocks.	Provider default region
`project`	The AgentKit project it belongs to.	`default`

Runtime resources

The runtime block configures compute resources and the scaling policy.

Field	Description	Default
`region`	Runtime region; inherits the top-level `region` when omitted.	Top-level `region`
`project`	Runtime project; inherits the top-level `project` when omitted.	Top-level `project`
`cpu_milli`	CPU in millicores (`2000` = 2 vCPU).	`2000`
`memory_mb`	Memory in MB.	`4096`
`min_instance`	Minimum instances. Set `0` to allow scale-to-zero when idle.	`1`
`max_instance`	Maximum instances.	`5`
`max_concurrency`	Concurrent requests per instance.	`20`
`tags`	Tags written when a new runtime is created. Updating this config later does not rewrite tags on an existing runtime.	`{}`

Runtime network

runtime.network is optional. Before enabling private networking, confirm that the VPC, subnets, and security groups are in the Runtime region.

Field	Description	Default
`enable_public_network`	Whether to enable public networking.	Platform default
`enable_private_network`	Whether to enable private networking.	Platform default
`vpc_id`	VPC ID for private networking.	—
`subnet_ids`	Subnet IDs for private networking.	`[]`
`security_group_ids`	Security-group IDs for private networking.	`[]`
`enable_shared_internet_access`	Whether the private network uses shared internet access.	Platform default

Harness Sidecar

harness_sidecar enables Product Component capabilities for a managed Harness Runtime. When it is enabled, release uses a platform-provided managed Sidecar base image, injects the Sidecar runtime configuration during release, and verifies the Sidecar, the enabled model proxy, and the required MCP gateway after the runtime becomes ready. When this block is enabled, set at least one selectable component to true in component_overrides.

Managed Harness Sidecar currently supports Volcengine cn-shanghai and cn-beijing, CPython 3.12, linux/amd64, and exactly one runtime instance, so both runtime.min_instance and runtime.max_instance must be 1. It also requires the release environment to provide the platform-managed Sidecar base image configuration; release fails in ordinary local environments where that configuration is unavailable. Sidecar releases must use header-based key_auth gateway authentication and cannot be combined with custom_jwt or frontend BFF-derived auth.

runtime:
  region: cn-shanghai
  min_instance: 1
  max_instance: 1

harness_sidecar:
  enabled: true
  profile: default
  component_overrides:
    context_engine: true
    compressor: true
    verifier: true
    long_run_control: true
    mcp_resilience: false

Field	Type	Default	Description
`harness_sidecar.enabled`	boolean	`true` when the object exists	Whether to enable managed Sidecar. Set it to `false`, or omit the whole block, to disable it.
`harness_sidecar.profile`	string	`default`	Product Component profile. Supported values are `default` and `ops`.
`harness_sidecar.catalog_version`	string	`2026.07.1`	Expected Catalog version. When provided, it must match the version supported by the current CLI.
`harness_sidecar.runtime_version`	string	—	Target managed Runtime version. Omit it to let the platform choose.
`harness_sidecar.component_overrides`	object	`{}`	Selectable component switches. Supported keys are `context_engine`, `compressor`, `verifier`, `long_run_control`, and `mcp_resilience`; values must be boolean. At least one value must be `true` when Sidecar is enabled.
`harness_sidecar.fail_open`	boolean	`false`	Whether to pass traffic through when Sidecar fails. Managed APIG runtime requires this to stay `false`.
`harness_sidecar.transport`	`apig_runtime_port` \| `local`	`apig_runtime_port`	How Sidecar reaches the model proxy and MCP gateway. Managed release uses `apig_runtime_port`.
`harness_sidecar.model_proxy.enabled`	boolean	Derived from the component plan	Whether to enable the model proxy. When set explicitly, it must match the plan from `harness sidecar resolve`.
`harness_sidecar.model_proxy.host`	string	`0.0.0.0`	Model proxy bind host. With managed APIG transport, it must be externally reachable when the model proxy is enabled.
`harness_sidecar.model_proxy.port`	integer	`18787` when enabled, otherwise `0`	Model proxy bind port.
`harness_sidecar.model_proxy.upstream_base_url_env`	string	`MODEL_AGENT_API_BASE`	Runtime environment variable name that points to the upstream model base URL.
`harness_sidecar.model_proxy.upstream_api_key_env`	string	`MODEL_AGENT_API_KEY`	Runtime environment variable name that points to the upstream model API key.
`harness_sidecar.model_proxy.prefer_configured_upstream_api_key`	boolean	`true` when the model proxy is enabled with managed APIG transport	Whether to prefer the configured upstream model API key. Managed APIG transport requires this only when the model proxy is enabled.
`harness_sidecar.model_proxy.compression_provider`	string	`noop`	Compression provider used by the model proxy.
`harness_sidecar.model_proxy.fail_open`	boolean	Inherits `harness_sidecar.fail_open`	Whether to pass traffic through when the model proxy fails.
`harness_sidecar.mcp_gateway.enabled`	boolean	Derived from the component plan	Whether to enable the MCP gateway. It is enabled when `mcp_resilience` or SQL read-only protection is active.
`harness_sidecar.mcp_gateway.host`	string	`0.0.0.0`	MCP gateway bind host. Managed APIG runtime requires an externally reachable host.
`harness_sidecar.mcp_gateway.port`	integer	`18788`	MCP gateway bind port.
`harness_sidecar.mcp_gateway.upstreams_env`	string	`MCP_URLS`	Runtime environment variable name that points to upstream MCP URLs.
`harness_sidecar.mcp_gateway.upstream_api_key_env`	string	`MCP_API_KEY`	Runtime environment variable name that points to the upstream MCP API key.
`harness_sidecar.mcp_gateway.prefer_configured_upstream_api_key`	boolean	`true` when managed MCP gateway is enabled	Managed APIG runtime requires the configured upstream MCP API key.
`harness_sidecar.mcp_gateway.fail_open`	boolean	Inherits `harness_sidecar.fail_open`	Whether to pass traffic through when the MCP gateway fails. Managed APIG runtime requires this to stay `false`.

With apig_runtime_port transport, the resolved plan must enable at least one of the model proxy or MCP gateway. For tool-only components such as mcp_resilience, the model proxy can stay disabled, and release readiness checks only validate the Sidecar and MCP gateway. Available components are listed below. mcp_resilience automatically includes SQL read-only protection; sql_readonly, browser, evaluation, and shadow are not directly selectable component_overrides.

Component ID	Description	Directly selectable
`context_engine`	Governs context assembly, task anchoring, and context budget.	Yes
`compressor`	Compresses long context and large tool results to reduce token cost.	Yes
`verifier`	Verifies evidence and answers, then repairs or alerts on failure.	Yes
`long_run_control`	Manages Goal task progress, continuation, and stopping conditions.	Yes
`mcp_resilience`	Governs MCP connection handling, timeouts, empty results, large responses, and call budgets; automatically includes SQL read-only protection.	Yes
`sql_readonly`	Provides SQL read-only protection for selected MCP routes.	No
`browser`	Browser task enhancement; unavailable in the current Runtime contract.	No
`evaluation`	Online evaluation; unavailable in the current Runtime contract.	No
`shadow`	Shadow comparison runs; unavailable in the current Runtime contract.	No

Use harness sidecar resolve before release to validate the selected plan.

Environment variables

envs declares the environment variables injected into the runtime. To keep secrets out of the repository, reference the deploy environment with ${VAR} (syntax at the top of this page); the CLI resolves them at deploy time.

envs:
  MODEL_AGENT_API_KEY: ${MODEL_AGENT_API_KEY:?set MODEL_AGENT_API_KEY in your env}
  LOG_LEVEL: ${LOG_LEVEL:-info}

For local release, export the variables in your shell or put them in a local .env; in continuous deployment, configure them as repository secrets and export them into the release job environment. The VOLCENGINE_* release credentials are not injected into the runtime.

${VAR} replaces the older AK_-prefix injection: each variable is now declared explicitly in envs and read via ${VAR}, which is clearer and reviewable. Secrets in the auth, im, and frontend blocks use ${VAR} the same way.

Model and associated resources

All optional — specify the model the runtime uses and the platform resources it attaches.

Field	Description
`model_agent_name`	The model the runtime uses.
`knowledge_id`	Associated knowledge base id.
`memory_id`	Associated memory collection id.
`tool_id`	Associated tool id.
`mcp_toolset_id`	Associated MCP toolset id.

Gateway auth

auth configures the runtime gateway’s authentication, one type of two. When frontend (below) is enabled, gateway auth is set to custom_jwt automatically from its userpool, so you do not repeat it here.

Field	Description
`type`	Auth type: `key_auth` (API key) or `custom_jwt` (JWT).
`api_key_name`	API key name for `key_auth`; auto-created if omitted.
`api_key_location`	Key location for `key_auth`: `header` or `query`.
`discovery_url`	OIDC discovery URL for `custom_jwt`; required.
`allowed_clients`	Optional client-id allow-list for `custom_jwt`.

IM channels

The im block deploys a bot proxy to VeFaaS after the runtime to connect a messaging channel. Provide credentials via ${VAR}. Feishu, WeCom, and DingTalk are supported; enable any combination. im.region and im.project control where the messaging proxies are deployed. They inherit the top-level region and project when omitted.

Feishu

Field	Description
`im.feishu.enabled`	Whether to enable the Feishu channel.
`im.feishu.app_id`	Feishu app App ID.
`im.feishu.app_secret`	Feishu app App Secret.

WeCom

Field	Description
`im.wecom.enabled`	Whether to enable the WeCom channel.
`im.wecom.connection_mode`	Connection mode; currently only `websocket` is supported.
`im.wecom.bot_id`	WeCom bot id.
`im.wecom.bot_secret`	WeCom bot secret.
`im.wecom.websocket_url`	WebSocket endpoint.
`im.wecom.send_thinking_message`	Whether to send an interim “thinking” message; defaults to `true`.

The WeCom proxy connects over WebSocket. The endpoint (websocket_url, default wss://openws.work.weixin.qq.com) and whether to send an interim “thinking” message (send_thinking_message, default true) can also be set but are rarely needed.

DingTalk

Field	Description
`im.dingtalk.enabled`	Whether to enable the DingTalk channel.
`im.dingtalk.connection_mode`	Connection mode; currently only `websocket` is supported.
`im.dingtalk.client_id`	DingTalk app Client ID (AppKey).
`im.dingtalk.client_secret`	DingTalk app Client Secret (AppSecret).
`im.dingtalk.send_thinking_message`	Whether to send an interim “thinking” message.

Frontend

The frontend block deploys a public front door on VeFaaS: OAuth login at the edge, then reverse-proxy to the runtime forwarding the user’s JWT (no shared key). Once enabled, the runtime gateway auth is set to custom_jwt from this userpool, the callback is auto-registered, and OAUTH2_REDIRECT_URI is auto-derived, so you only declare the userpool here.

Field	Description
`frontend.enabled`	Whether to enable the front door.
`frontend.region`	Region for the frontend function and gateway; inherits top-level `region` when omitted.
`frontend.project`	Project for the frontend function and gateway; inherits top-level `project` when omitted.
`frontend.gateway`	Serverless gateway name to pin. When omitted, the CLI reuses an existing gateway or creates one if none is available.
`frontend.oauth2.region`	Region used to locate the user pool. Omit to search known regions; multiple matches are rejected.
`frontend.oauth2.project`	Project used to locate the user pool. Omit to search all projects; multiple matches are rejected.
`frontend.oauth2.user_pool_id`	User pool id.
`frontend.oauth2.client_id`	User pool client id.
`frontend.oauth2.client_secret`	User pool client secret. Optional — auto-fetched from the user-pool client when omitted; set it only if the client exposes no secret or you want to override.

Observability

Set apmplus to true to enable APMPlus monitoring.

Advanced

Field	Description
`role_name`	IAM role name; explicitly configured roles are validated. Otherwise creation reuses a qualified role or creates one; updates retain the current role.

Infrastructure

infrastructure specifies where the image is built and stored. Auto means the platform creates and manages it for you; replace a value with your own resource to reuse one.

Field	Description	Default
`container_registry.region`	CR region; inherits top-level `region` when omitted.	Top-level `region`
`container_registry.project`	CR project; inherits top-level `project` when omitted.	Top-level `project`
`container_registry.instance_name`	Container Registry instance. `Auto` → `agentkit-platform-<account-id>`.	`Auto`
`container_registry.namespace_name`	Image namespace.	`agentkit`
`container_registry.repo_name`	Image repository name.	app name
`tos.region`	TOS region; inherits top-level `region` when omitted.	Top-level `region`
`tos.project`	TOS project; inherits top-level `project` when omitted.	Top-level `project`
`tos.bucket_name`	Object storage bucket for build artifacts. `Auto` derives a provider-, region-, and account-safe default name to avoid cross-region conflicts.	`Auto`
`tos.object_prefix`	Object prefix for build artifacts.	`agentkit-builds`
`code_pipeline.workspace_name`	Code Pipeline workspace name. When `workspace_id` is not set, the CLI finds or creates by this name.	—
`code_pipeline.workspace_id`	Code Pipeline workspace ID to pin and reuse.	—
`code_pipeline.pipeline_name`	Code Pipeline pipeline name. Defaults to the app name when omitted.	app name
`code_pipeline.pipeline_id`	Compatible Code Pipeline pipeline ID to pin and reuse. Managed Harness Sidecar releases still resolve the current compatible pipeline by name.	—

Build

The dockerfile field sets the path to the Dockerfile used for the build, defaulting to .agentkit/Dockerfile (or ./Dockerfile if one exists at the project root). The process inside the container must listen on 0.0.0.0:8000; the runtime probes that port to decide whether an instance is ready.

Exclusive runtime gateways

Lifecycle configuration uses runtime_gateway_mode and runtime_gateway_instance_id under launch_types.cloud or launch_types.hybrid. Release configuration uses gateway_mode and gateway_instance_id under runtime

.agentkit/agentkit.yaml

runtime:
  gateway_mode: Exclusive
  gateway_instance_id: gateway-example

Flag / argument	Description	Default
`runtime.gateway_mode`	Gateway mode: `Shared` or `Exclusive`	`Shared`
`runtime.gateway_instance_id`	Existing exclusive gateway instance ID	Required in Exclusive mode

Exclusive mode cannot include runtime network configuration because the gateway supplies the network. Shared mode cannot specify an instance ID. Gateway bindings cannot change after creation; deployment stops when desired settings conflict with an existing binding

agentkit config --runtime_gateway_mode Exclusive --runtime_gateway_instance_id gateway-example

With frontend BFF and Identity authentication enabled, the frontend proxy preserves login callbacks, session cookies, and return paths so requests continue in the signed-in session. Keep the issuer, client ID, and registered callback URL consistent. This fix requires no additional configuration fields

Getting Started

AI-Friendly

Command reference

Lifecycle Config

Common Fields

Local Strategy

Cloud And Hybrid Strategies

Build Fields

Release Config

Release Config Full Example

Project

Runtime resources

Runtime network

Harness Sidecar

Environment variables

Model and associated resources

Gateway auth

IM channels

Feishu

WeCom

DingTalk

Frontend

Observability

Advanced

Infrastructure

Build

Exclusive runtime gateways

​Lifecycle Config

​Common Fields

​Local Strategy

​Cloud And Hybrid Strategies

​Build Fields

​Release Config

​Release Config Full Example

​Project

​Runtime resources

​Runtime network

​Harness Sidecar

​Environment variables

​Model and associated resources

​Gateway auth

​IM channels

​Feishu

​WeCom

​DingTalk

​Frontend

​Observability

​Advanced

​Infrastructure

​Build

​Exclusive runtime gateways

​Frontend login sessions

Lifecycle Config

Common Fields

Local Strategy

Cloud And Hybrid Strategies

Build Fields

Release Config

Release Config Full Example

Project

Runtime resources

Runtime network

Harness Sidecar

Environment variables

Model and associated resources

Gateway auth

IM channels

Feishu

WeCom

DingTalk

Frontend

Observability

Advanced

Infrastructure

Build

Exclusive runtime gateways

Frontend login sessions