Deploy the extension for Agentic Retrieval in Foundry Local

In the Azure portal, go to the Azure Kubernetes cluster on Azure Local.

Select Settings > Extensions > + Add, and Agentic Retrieval from the list.

Select Create.

On the Basics tab, provide the following information:

Select Next.

On the Configurations tab, provide the following information:

Select Next.

On the Access tab, provide the following information:

Select Review + create.

Review and validate the parameters you provided.

Select Create to complete the Agentic Retrieval deployment.

When the deployment is complete, under Extensions, validate that the extension types microsoft.arc.rag and microsoft.extensiondiagnostics are listed.

Use one base deployment script and set optional parameters only for the connection types you enable.

Before you run the script, choose one deployment path:

• Kerberos only: set enableKerberos=true and enableSharePoint=false.
• SharePoint ingestion only: set enableKerberos=false and enableSharePoint=true.
• Kerberos and SharePoint ingestion: set both values to true.

For language model source, set useFoundryLocal=true only when you're using a Foundry Local model endpoint. Otherwise, set useFoundryLocal=false.

If you enable Kerberos, complete Set up NFS with Kerberos authentication for Agentic Retrieval first. If you enable SharePoint ingestion, complete Set up SharePoint server-to-server authentication for Agentic Retrieval first.

Set common deployment values:

$gpu_enabled = "true"  # Mark it true if you have GPUs available for Agentic Retrieval
$localextname = "edgeragdemo" # Once used do not change
$autoUpgrade = "false"
$tenantId = "<App Tenant ID>" # App registrations -> Your app -> Overview on Azure portal
$appId = "<App ID>" # App registrations -> Your app -> Overview on Azure portal
$domainName = "arcrag.contoso.com" # App redirect URI and this domain name should be the same
$sub = "<Subscription GUID>"
$rg = "<Resource Group name>"
$k8scluster = "<Azure Kubernetes Service (AKS) Arc cluster name>"
$extension = "microsoft.arc.rag" # do not change
$n = "arc-rag" # do not change

Set values for the language model, deployment mode, and optional connection types:

#  Set your model endpoint (mandatory)
$apiEndpoint = "<Your OpenAI-compatible LLM endpoint URI>"
$apiModel = "<Model Name>"
$maxTokensInK = "<Max Tokens In K (e.g. 10, 20 etc.)>"
$layerSelection = "combined" # Options: combined, agentic, knowledge

# Foundry Local setting
$useFoundryLocal = "false"
$foundryClientId = "<foundry_app_registration_client_id>" # Required only when useFoundryLocal=true

# Optional connection switches
$enableKerberos = "false"
$enableSharePoint = "false"

# Kerberos setting (required only when enableKerberos=true)
$kerberosSpn = "nfs/edgerag-svc@CONTOSO.COM"

# SharePoint settings (required only when enableSharePoint=true)
$keyVaultName = "<Key Vault name>"
$kvCertSecretName = "edgerag-sp-s2s-cert"
$kvCertPasswordSecretName = "sp-cert-password"
$workloadIdentityClientId = "<Managed identity client ID>"

Create the BYOM API key secret only when language model source is Bring your own (useFoundryLocal=false):

# Create the BYOM API key secret before extension installation only for BYOM endpoints
if ($useFoundryLocal -eq "false") {
   kubectl create namespace arc-rag --dry-run=client -o yaml | kubectl apply -f -
   kubectl delete secret byom-api-key -n arc-rag --ignore-not-found
   kubectl create secret generic byom-api-key --from-literal=BYOM_API_KEY="<your_api_key>" -n arc-rag
}

The BYOM API key is stored as a Kubernetes secret rather than passed as a configuration parameter. Create this secret before extension installation only when useFoundryLocal=false.

After you populate the values, build configuration settings and deploy the Azure Arc extension:

az provider register --namespace Microsoft.KubernetesConfiguration
 az feature register --namespace Microsoft.KubernetesConfiguration --name extensions

 $config = @(
    "isManagedIdentityRequired=true",
    "gpu_enabled=$gpu_enabled",
    "AgentOperationTimeoutInMinutes=30",
    "auth.tenantId=$tenantId",
    "auth.clientId=$appId",
    "ingress.domainname=$domainName",
    "layerSelection=$layerSelection",
    "byom.enabled=true",
    "byom.apiEndpoint=$apiEndpoint",
    "byom.apiModel=$apiModel",
    "byom.maxTokensInK=$maxTokensInK"
 )

 if ($enableKerberos -eq "true") {
    $config += @(
       "kerberos.enabled=true",
       "kerberos.spn=$kerberosSpn"
    )
 }

 if ($enableSharePoint -eq "true") {
    $config += @(
       "sharepoint.sharepointIngestionEnabled=true",
       "sharepoint.s2s.keyvaultName=$keyVaultName",
       "sharepoint.s2s.kvCertSecretName=$kvCertSecretName",
       "sharepoint.s2s.kvCertPasswordSecretName=$kvCertPasswordSecretName",
       "sharepoint.s2s.workloadIdentityClientId=$workloadIdentityClientId"
    )
 }

 if ($useFoundryLocal -eq "true") {
    $config += @(
       "foundryClientId=$foundryClientId"
    )
 }

 az k8s-extension create `
    --cluster-type connectedClusters `
    --cluster-name $k8scluster `
    --resource-group $rg `
    --name $localextname `
    --extension-type $extension `
    --release-train preview `
    --auto-upgrade $autoUpgrade `
    --configuration-settings $config