fix: render ModelConfig TLS in Helm chart

helm/kagent/templates/modelconfig.yaml

@@ -26,6 +26,10 @@ spec:
   defaultHeaders:
     {{- toYaml $model.defaultHeaders | nindent 4 }}
   {{- end }}
+  {{- if $model.tls }}
+  tls:
+    {{- toYaml $model.tls | nindent 4 }}
+  {{- end }}
   {{- if $model.config }}
   {{ $dot.Values.providers.default }}:
   {{- toYaml $model.config | nindent 4 }}

helm/kagent/tests/modelconfig_test.yaml

@@ -89,6 +89,29 @@ tests:
           path: spec.model
           value: "gpt-4-turbo"
 
+  - it: should render provider tls configuration
+    set:
+      providers:
+        openAI:
+          tls:
+            disableVerify: true
+            caCertSecretRef: custom-ca
+            caCertSecretKey: ca.crt
+            disableSystemCAs: true
+    asserts:
+      - equal:
+          path: spec.tls.disableVerify
+          value: true
+      - equal:
+          path: spec.tls.caCertSecretRef
+          value: custom-ca
+      - equal:
+          path: spec.tls.caCertSecretKey
+          value: ca.crt
+      - equal:
+          path: spec.tls.disableSystemCAs
+          value: true
+
   - it: should have correct labels
     asserts:
       - equal:
@@ -113,4 +136,4 @@ tests:
     asserts:
       - equal:
           path: metadata.namespace
-          value: custom-namespace 
+          value: custom-namespace

helm/kagent/values.yaml

@@ -426,6 +426,13 @@ providers:
     apiKeySecretRef: kagent-openai
     apiKeySecretKey: OPENAI_API_KEY
     # apiKey: ""
+    # Optional TLS settings for the generated ModelConfig.
+    # This same block can be used under any provider.
+    # tls:
+    #   disableVerify: false
+    #   caCertSecretRef: ""
+    #   caCertSecretKey: ""
+    #   disableSystemCAs: false
   ollama:
     provider: Ollama
     model: "llama3.2"