Create your first agent

Create, configure, and deploy your first agentic application using the Backbase Agentic Platform.

Prerequisites

Before you begin, ensure you have:

Completed the Onboarding steps.
Access to the Self-Service repository.
Access to the Applications Live repository.

Step 1: Create a new repository

Use the Self-Service GitOps workflow to provision a new repository based on the starter-agent template.

Clone the Self-Service repository.
Create a new branch (e.g., feat/my-first-agent).
Open self-service.tfvars and add your new repository definition under the repositories block:

repositories = {
  # ... existing repos ...
  
  my-first-agent = {
    description = "My first agentic application"
    enable_branch_protection = true
    protected_branches       = ["main", "develop"]
    
    repository_template = {
      owner      = "bb-ecos-agbs"
      repository = "starter-agent"
    }
  }
}

Commit your changes and push the branch.
Open a Pull Request (PR) and merge it after approval.
Once the PR is merged, a new repository named my-first-agent gets provisioned and the Repository Provisioning Workflow runs automatically to set up the repository with the template contents and CI/CD pipelines.

Repository successfully provisioned with starter-agent template!

Step 2: Build and publish Docker image

Now that your repository is provisioned, you need to build the application and publish a Docker image to Azure Container Registry (ACR).

Navigate to your newly provisioned repository on GitHub.
Go to Actions tab.
Select the Build and Publish workflow from the left sidebar.
Click Run workflow and select the branch (typically main or develop).
The workflow will:
- Build the application
- Create a Docker image
- Push the image to ACR with a tag (e.g., 0.1.0.dev0-develop.2a7f4f6d)

Your application’s runnable image is now available on ACR!

Note the image tag generated by the workflow - you’ll need it in the next step. The tag format is typically VERSION-BRANCH.COMMIT_HASH.

Step 3: Deploy to Kubernetes runtime

Deploy your agent to the Kubernetes cluster using the Applications Live repository and ArgoCD.

Create ArgoCD application

Clone the Applications Live repository:

git clone https://github.com/bb-ecos-agbs/gc-devhub-agbs-applications-live.git
cd gc-devhub-agbs-applications-live

Create a new branch for your changes:

git checkout -b feat/deploy-my-first-agent

Create an ArgoCD Application manifest in the appropriate environment folder (e.g., runtimes/dev/applications/):

runtimes/dev/applications/my-first-agent.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-namespace
  namespace: argocd
spec:
  project: devhub-grandcentral
  destination:
    server: https://kubernetes.default.svc
    namespace: my-namespace
  sources:
    - repoURL: git@github.com:bb-ecos-agbs/gc-devhub-agbs-applications-live.git
      targetRevision: main
      ref: apps-live

    - repoURL: cragbs508.azurecr.io/charts
      chart: helm-chart-template
      targetRevision: 0.5.1
      helm:
        releaseName: my-first-agent-v0
        parameters:
          - name: "nameOverride"
            value: my-first-agent
        valueFiles:
          - $apps-live/runtimes/dev/values/my-namespace/my-first-agent-v0.values.yaml

Create Helm values file

Create a values file at runtimes/dev/values/my-namespace/my-first-agent-v0.values.yaml:

runtimes/dev/values/my-namespace/my-first-agent-v0.values.yaml

# Replica count for the deployment
replicaCount: 1

# Container image configuration
image:
  repository: cragbs508.azurecr.io/images/my-first-agent
  pullPolicy: IfNotPresent
  # Use the tag from Step 2 Build and Publish workflow
  tag: "0.1.0.dev0-develop.2a7f4f6d"

# Volume mounts for temporary storage
volumeMounts:
  - mountPath: /app/tmp
    name: temp

volumes:
  - name: temp
    emptyDir:
      sizeLimit: 500Mi

# Container port configuration
container:
  ports:
    - name: http
      containerPort: 8000
      protocol: TCP

# Kubernetes service configuration
service:
  type: ClusterIP
  ports:
    - port: &servicePort 80
      targetPort: http
      protocol: TCP
      name: http

# Istio virtualservice for external access
virtualService:
  enabled: true
  spec:
    gateways:
      - "knative-serving/knative-ingress-gateway"
    hosts:
      - '{{ include "helm-chart-template.fullname" . }}-{{ .Release.Namespace }}.dev.agbs.gcservices.io'
    http:
      - route:
          - destination:
              host: '{{ include "helm-chart-template.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local'
              port:
                number: *servicePort

# Resource limits and requests
resources:
  limits:
    cpu: "500m"
    memory: "512Mi"
  requests:
    cpu: "50m"
    memory: "150Mi"

# Health probes (optional)
livenessProbe: {}
readinessProbe: {}

# Environment variables
env:
  - name: APP_ENV
    value: "development"
  - name: AI_GATEWAY_ENDPOINT
    valueFrom:
      secretKeyRef:
        name: my-agent-secrets
        key: AI_GATEWAY_ENDPOINT
  - name: AI_GATEWAY_API_KEY
    valueFrom:
      secretKeyRef:
        name: my-agent-secrets
        key: AI_GATEWAY_API_KEY
  - name: LANGFUSE_SECRET_KEY
    valueFrom:
      secretKeyRef:
        name: my-agent-secrets
        key: LANGFUSE_SECRET_KEY
  - name: LANGFUSE_PUBLIC_KEY
    valueFrom:
      secretKeyRef:
        name: my-agent-secrets
        key: LANGFUSE_PUBLIC_KEY
  - name: LANGFUSE_BASE_URL
    valueFrom:
      secretKeyRef:
        name: my-agent-secrets
        key: LANGFUSE_BASE_URL

The environment variables reference a Kubernetes secret named my-agent-secrets. You must create this secret in your namespace using SOPS encryption before deploying. The secret should contain the following keys: AI_GATEWAY_ENDPOINT, AI_GATEWAY_API_KEY, LANGFUSE_SECRET_KEY, LANGFUSE_PUBLIC_KEY, and LANGFUSE_BASE_URL.

To create encrypted secrets with SOPS, follow the steps here

Commit and push your changes:

git add .
git commit -m "feat: deploy my-first-agent to dev environment"
git push origin feat/deploy-my-first-agent

Open a Pull Request and merge it after approval.
Once merged, ArgoCD will automatically sync and deploy your application to the my-namespace namespace.

Your agentic application is now deployed on the Kubernetes cluster!

Test your deployed agent

Your agent is now accessible via the Istio VirtualService URL. Test it using the following curl command:

curl --location 'https://my-first-agent-v0-my-namespace.dev.agbs.gcservices.io/run/instructions_agent' \
  --header 'Content-Type: application/json' \
  --data '{
    "query": "I'\''m my first agent"
}'

Your agentic application is deployed on the cluster and accessible via API!

This is not a secured way of accessing your agent. You should expose it via API Management (APIM) where you can set up authentication and different policies for production use.

Step 4: Expose via APIM (secure access)

To securely access your agent’s API with authentication and policies, expose it through API Management (APIM).

Create API repository

Go back to the Self-Service repository and create a new branch.
Add an API repository definition in self-service.tfvars:

repositories = {
  # ... existing repos ...
  
  my-first-agent-api = {
    enable_branch_protection     = false
    enforce_admins               = true
    default_branch               = "develop"
    require_branch_up_to_date    = true
    protected_branches           = ["main", "develop", "release/*"]
    required_status_checks       = ["Validate pull request / Verify Maven project"]
    
    repository_init_from_zip = {
      name    = "grandcentral-generic-api"
      version = "2.0.3"
    }
    
    repository_visibility = "private"
  }
}

Commit, push, and merge the PR.
Once the -api repository is created, clone it and add the OpenAPI specification for your agent (e.g., openapi.yaml) that describes your agent’s endpoints.

Configure APIM in applications live

Now configure the API, backend, product, and subscription in the Applications Live repository.

Create API application

Create a file at runtimes/dev/apim/apis/my-first-agent-api.yaml:

runtimes/dev/apim/apis/my-first-agent-api.yaml

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-first-agent-api
  namespace: argocd
spec:
  project: devhub-grandcentral
  destination:
    server: https://kubernetes.default.svc
    namespace: devhub-grandcentral
  sources:
    - repoURL: git@github.com:bb-ecos-agbs/gc-devhub-agbs-applications-live.git
      targetRevision: main
      ref: apps-live
    - repoURL: cragbs508.azurecr.io/charts
      chart: my-first-agent-api
      targetRevision: 0.1.0-20361246926
      helm:
        releaseName: my-first-agent-api-v0
        valueFiles:
          - $apps-live/runtimes/dev/apim/apis/common.apim.values.yaml
  syncPolicy:
    automated:
      prune: true
      allowEmpty: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=false

Update the targetRevision with the actual chart version from your API repository’s build workflow.

Add API to version sets

Add your API to runtimes/dev/apim/apiVersionsets.yaml:

# ... existing version sets ...
- name: "my-first-agent-api"

Create backend

Add a backend entry in runtimes/dev/apim/backends.yaml:

# ... existing backends ...
- name: my-first-agent-backend
  url: 'https://my-first-agent-v0-my-namespace.dev.agbs.gcservices.io'
  title: "My First Agent Backend"
  description: "My First Agent Backend"

The backend URL should match the VirtualService URL from Step 4 where you tested your agent.

Create product with policies

Add a product definition in runtimes/dev/apim/products.yaml:

# ... existing products ...
- name: my-first-agent-product
  description: My First Agent Product
  displayName: My First Agent Product
  approvalRequired: "false"
  policy:
    apiBackend:
      - api: my-first-agent-api-0
        backend: my-first-agent-backend
    value: |
      <policies>
          <inbound>
              <base />
              <set-header name="Accept" exists-action="override">
                 <value>application/json, text/event-stream</value>
              </set-header>
              <set-header name="Content-Type" exists-action="override">
                 <value>application/json</value>
              </set-header>
              <set-backend-service backend-id="my-first-agent-backend" />
          </inbound>
          <backend>
              <base />
          </backend>
          <outbound>
              <base />
          </outbound>
          <on-error>
              <base />
          </on-error>
      </policies>
  productApis:
    - apiName: my-first-agent-api-0

The policy section defines how requests are processed. You can add authentication, rate limiting, and other policies here.

Create subscription

Add a subscription in runtimes/dev/apim/subscriptions.yaml:

# ... existing subscriptions ...
- name: my-first-agent-subscription
  productScope: my-first-agent-product

The subscription generates an API key that clients use to access your agent through APIM.

Deploy APIM configuration

Commit and push all the APIM configuration changes, then open a Pull Request and merge it. ArgoCD will automatically sync and apply the APIM configurations.

Access your agent via APIM

Once the APIM configuration is deployed, you can access your agent securely using the subscription key:

curl --location 'https://apim.dev.agbs.gcservices.io/my-first-agent-api/v0/run/instructions_agent' \
  --header 'api-key: YOUR_SUBSCRIPTION_KEY' \
  --header 'Content-Type: application/json' \
  --data '{
    "query": "I'\''m my first agent."
}'

Replace YOUR_SUBSCRIPTION_KEY with the actual subscription key generated for my-first-agent-subscription. You can find this in the APIM portal or Kubernetes secrets.

You have successfully created, deployed, and exposed your first agentic application with secure API access through APIM!

Next steps

Local development: Learn how to run and test your agent locally in the Development Guide
CI/CD workflows: Understand the automated workflows in CI/CD Overview
BB AI SDK: Explore SDK features in BB AI SDK Documentation
Starter kits: Check out other templates in Starter kits

Overview

Architecture and technology

Agent Development Lifecycle

Get started

Starter kits

BB AI SDK

MCP support

CI/CD workflows

Prerequisites

Step 1: Create a new repository

Step 2: Build and publish Docker image

Step 3: Deploy to Kubernetes runtime

Create ArgoCD application

Create Helm values file

Test your deployed agent

Step 4: Expose via APIM (secure access)

Create API repository

Configure APIM in applications live

Deploy APIM configuration

Access your agent via APIM

Next steps

​Prerequisites

​Step 1: Create a new repository

​Step 2: Build and publish Docker image

​Step 3: Deploy to Kubernetes runtime

​Create ArgoCD application

​Create Helm values file

​Test your deployed agent

​Step 4: Expose via APIM (secure access)

​Create API repository

​Configure APIM in applications live

​Deploy APIM configuration

​Access your agent via APIM

​Next steps

Prerequisites

Step 1: Create a new repository

Step 2: Build and publish Docker image

Step 3: Deploy to Kubernetes runtime

Create ArgoCD application

Create Helm values file

Test your deployed agent

Step 4: Expose via APIM (secure access)

Create API repository

Configure APIM in applications live

Deploy APIM configuration

Access your agent via APIM

Next steps