Skip to content

1.4. Providers

Do you need provider credentials now?

No. Run mise run check:core and mise run test before configuring a model. These gates exercise tools, state, security callbacks, MCP, A2A construction, and adversarial cases without sending data to a provider or requiring the Chapter 5 container engine.

You need a model only for interactive run/web, live ADK evaluation, and the later gateway lab. The required model path needs no provider credential.

How do you configure local Qwen3?

Install Ollama from its supported distribution, then pull the Apache-2.0 open-weight Qwen3 model:

ollama pull qwen3:4b
ollama list

The agent defaults to these values:

AGENT_MODEL_PROVIDER=openai-compatible
AGENT_MODEL=qwen3:4b
OPENAI_BASE_URL=http://127.0.0.1:11434/v1
OPENAI_API_KEY=local-ollama

local-ollama is a non-secret marker that satisfies the OpenAI client contract; it is not an Ollama credential. Run mise run doctor:model, then start the agent directly. Chapter 5 changes OPENAI_BASE_URL to http://127.0.0.1:4000/v1 after the gateway starts.

How do you configure native Gemini?

Create a gitignored root .env from the supplied template and add only the variables for your selected Google authentication method:

cp .env.example .env
chmod 600 .env

For a Gemini API key:

AGENT_MODEL_PROVIDER=gemini
AGENT_MODEL=gemini-3.5-flash
GOOGLE_API_KEY=replace-me

For Vertex AI with Application Default Credentials on your workstation:

gcloud auth application-default login
AGENT_MODEL_PROVIDER=gemini
AGENT_MODEL=gemini-3.5-flash
GOOGLE_GENAI_USE_ENTERPRISE=true
GOOGLE_CLOUD_PROJECT=agentops-open-course
GOOGLE_CLOUD_LOCATION=global

Run mise run doctor:gcp before using this optional path. The GKE overlay uses Workload Identity Federation and does not store a service-account key.

How does configuration fail fast?

agents/python/src/agent/config.py parses AGENT_* variables into typed settings. agents/python/src/agent/model.py selects exactly one path:

  • openai-compatible: require OPENAI_BASE_URL and OPENAI_API_KEY, then construct the ADK OpenAI-compatible adapter.
  • gemini: require either a masked GOOGLE_API_KEY, or the course's enterprise/ADC mode with explicit project and location; then construct ADK's native adapter with an HTTP deadline and retry policy.

Missing or inconsistent values raise a configuration error during startup instead of silently falling back to another provider. mise run doctor:gcp separately proves that the external ADC credential is actually available.

How do you protect model data and credentials?

  • Keep .env out of Git and restrict its permissions.
  • Never bake credentials into an image, ConfigMap, command example, trace, or screenshot.
  • Leave ADK/GenAI message-content capture disabled unless you have reviewed the data policy.
  • Route cloud workloads through identity federation instead of long-lived service-account keys.
  • Treat model prompts and tool output as potentially sensitive even in a fictional exercise.

What is the provider checkpoint?

Choose one:

# Local path
mise run doctor:model
(cd agents/python && mise run run)

# Optional Gemini path, after configuring .env
(cd agents/python && mise run run)

For either provider, stop the CLI after a simple read-only prompt such as List open incidents. Do not test a write action until Chapter 4 explains approval and audit behavior.