Agent Operator {{ .Chart.AppVersion }} installed in namespace {{ .Release.Namespace }}.

In-cluster callback URL (agent Jobs → operator):
  {{ include "agent-operator.operatorURL" . }}

{{- $extURL := include "agent-operator.operatorExternalURL" . }}
{{- if $extURL }}
External webhook URL (forge → operator):
  {{ $extURL }}/
  Register this URL as your forge project webhook.
{{- else }}
External webhook URL: not configured.
  Expose the operator externally via ingress.enabled=true or httproute.enabled=true,
  or set operator.externalURL explicitly, then register the URL as your forge webhook.
{{- end }}

{{- $llmSecret := include "agent-operator.llmSecretName" . }}
{{- $poolBase := include "agent-operator.llmPoolSecretName" . }}
{{- $poolLen := len .Values.llm.pool }}
LLM credentials: {{- if $llmSecret }} Secret "{{ $llmSecret }}" created in namespace {{ .Release.Namespace }}.
{{- else }} not configured (set llm.provider or llm.existingSecret).
{{- end }}
{{- if gt $poolLen 0 }}
LLM credential pool ({{ $poolLen }} member{{ if ne $poolLen 1 }}s{{ end }}) for rotation/fail-over:
{{- range $i, $m := .Values.llm.pool }}
  {{ $poolBase }}-{{ $i }}
{{- end }}
{{- if .Values.llm.poolProvider }}
  Each also has a matching LLMCredential CR (provider: {{ .Values.llm.poolProvider }}).
  Set spec.projectDefaults.llmProvider: {{ .Values.llm.poolProvider }} on your ForgeProject
  to autodiscover + rotate through them (see below).
{{- else }}
  Reference all of the above in spec.projectDefaults.llmCredentialsRefs (see below).
  (Set llm.poolProvider to generate LLMCredential CRs and use llmProvider autodiscovery instead.)
{{- end }}
{{- end }}

Next steps:
  1. Create a ForgeProject CR pointing at your repository:

       kubectl apply -f - <<EOF
       apiVersion: agentoperator.io/v1alpha1
       kind: ForgeProject
       metadata:
         name: my-project
       spec:
         projectRef: mygroup/myrepo
         repoURL: https://gitlab.com/mygroup/myrepo.git
         projectDefaults:
           agentImage: {{ .Values.projectDefaults.agentImage }}
           # Optional: pin where agent Job pods run (see values.yaml projectDefaults
           # for full examples): nodeSelector / affinity / tolerations.
           {{- if $llmSecret }}
           llmCredentialsRef: {{ $llmSecret }}
           {{- end }}
           {{- if gt $poolLen 0 }}
           {{- if .Values.llm.poolProvider }}
           llmProvider: {{ .Values.llm.poolProvider }}
           {{- else }}
           llmCredentialsRefs:
           {{- range $i, $m := .Values.llm.pool }}
             - {{ $poolBase }}-{{ $i }}
           {{- end }}
           {{- end }}
           {{- end }}
       EOF

  2. Configure a webhook on the forge to POST to the external webhook URL above.
  3. Watch resources:
       kubectl get forgeprojects,agentprojects,agenttasks -A

Prerequisites:
  - Flux >= 2.3.0 when using helmChartRef (HelmRelease GVK helm.toolkit.fluxcd.io/v2 requires
    Flux 2.3.0+; older clusters only have v2beta2 / v2beta1).

Notable values:
  - operator.gitlabAPIRps         Forge API rate limit in req/s (default: 10).
  - metrics.serviceMonitor.enabled  Set to true to create a Prometheus ServiceMonitor.
  - imagePullSecrets              List of registry pull secrets for the operator image.
  - llm.provider                  LLM provider preset (openai/anthropic/google/azure/mistral/ollama).

Security notes:
  - Do NOT pass gitlab.clientSecret or llm.*.apiKey via --set or --set-string in CI pipelines.
    Helm stores all --set values in the release Secret (visible via `helm get values`).
    Use gitlab.existingSecret / llm.existingSecret to reference pre-created Secrets instead,
    or pipe credentials via a secrets manager (e.g. external-secrets, Vault agent injector).
{{- if eq .Values.operator.kubeAPICIDR "" }}

  WARNING: operator.kubeAPICIDR is not set. Agent pods have unrestricted egress to
  port 443, including the Kubernetes API server. Set operator.kubeAPICIDR to the
  API server CIDR (e.g. "10.96.0.1/32") in production to prevent agents from
  calling the Kubernetes API. Find it with:
    kubectl get endpoints kubernetes -n default
{{- end }}
