0.5. Provider Options

Why a fresh clone already resolves to the local model

A model provider is whatever answers the agent’s model calls. A hosted one attaches an account, a key to rotate, a per-token bill, and prompt data leaving the machine to every exercise in this course; a weights file on your own disk has none of those and runs offline. So there is no provider variable to set: a fresh clone already resolves to the account-free path, a local model reached over an OpenAI-compatible endpoint — the request shape ADK’s OpenAI client speaks and Ollama serves.

This page is the decision — which of the three model paths you take — and 1.4. Providers is the configuration. Here is that default resolving: mise run config:check prints forty-eight resolved settings, and this capture keeps only the four that pick a model:

cd agents/go
mise run config:check

Agent configuration is valid. Resolved settings (secrets masked):
- AGENT_MODEL = qwen3:4b-instruct
- AGENT_MODEL_PROVIDER = openai-compatible
- OPENAI_API_KEY = **********
- OPENAI_BASE_URL = http://127.0.0.1:11434/v1

That masked key is not a credential: local-ollama is a non-secret placeholder the OpenAI client library insists on having, and Ollama accepts any non-empty string. The base URL points at your own machine, so no network call happens during imports or offline tests. Chapter 5 changes exactly one of those four values: provider and model stay put while OPENAI_BASE_URL moves to agentgateway. That is how a governed data plane — the path requests actually travel, agent through gateway to model — arrives without an application rewrite.

Open weights is not open source

Strictly, Qwen3 is not open source. Its published weights — the trained parameter file a runtime loads — are Apache-2.0: run, modify, and redistribute them commercially, with no account and no fee. Fully open source would also mean publishing the training data and the code to reproduce the weights, and almost no frontier-class model does.

That licence is what makes the account-free path genuinely account-free: no click-through, no terms, no telemetry back to a vendor. What it does not buy is speed — the download is several gigabytes, CPU inference is slow, and quality depends on your memory. The qwen3:4b-instruct tag can also move, so record the installed model id from ollama list beside any evaluation result: a score with no model id behind it cannot be compared with a later one.

Newer families have shipped since: checked on 13 August 2026, Ollama carried Qwen3.5 from 0.8B to 122B and Qwen3.6 at 27B and 35B. The course stays on Qwen3 because every capture in it was produced against qwen3:4b-instruct, so a newer tag changes the thing being measured — it belongs in the 2.2. Models experiment, not in the default you inherit.

Google’s Gemma family is ungated and locally runnable too. Its larger instruction-tuned tags bring native function calling at several times the footprint. But its weights ship under Google’s own Gemma Terms of Use, with a prohibited-use policy attached, rather than Apache-2.0. That licence gap is a second reason Qwen3 is the default, beyond the smaller footprint.

What the two optional hosted paths require

Both are optional comparisons, needed for no core outcome and never relabelled as open source.

These three rows are the model column of the four routes 0.0. Course lists, under the same three names; its fourth route — offline engineering — has no row here because it runs no model at all.

Pick one credential for the native path and stop there: an AI Studio key, or Vertex AI with an explicit project and location through Application Default Credentials, the identity a Google library finds on the machine rather than a key you paste. On that provider, setting GOOGLE_API_KEY while GOOGLE_GENAI_USE_ENTERPRISE=true is the combination mise run config:check refuses by name, so an accidental mix fails at startup with a sentence naming both paths instead of authenticating as whichever one the library happened to prefer. On GKE a Kubernetes service account maps to Google IAM through Workload Identity Federation, which swaps pod identity for cloud permissions so no long-lived key exists to leak.

Keep the key off your command line, too: a secret typed into a shell outlives the session in that shell’s history file, so rotating it later does not un-type it. The course reads credentials from a gitignored .env for that reason, and never from a manifest, an image, or a span attribute.

Nothing here uses LiteLLM: provider routing, identity, and limits belong at agentgateway instead.

What you can do now

• You can say which of the three model paths you are taking, and that the default one needs no account, no fee, and no variable set.
• You can explain why “open weights” is the honest phrase for Qwen3 and “open source” is not.
• You can name the one setting Chapter 5 changes to put a gateway in front of the same model.

That choice is what keeps the rest of the course free: the model you will operate is a file you own a copy of, running on hardware you already have.

Bookmark 0.6. Resources, 0.7. Troubleshooting, and 0.8. Glossary for later, and continue to 1. Setup when you have chosen a path.