Model providers

Overview

The trace analyzer sends each eligible session to a model endpoint in your provider account for analysis. Use this guide to choose that endpoint and set up its authentication before you write the spec.analysis settings for your deployment. For a manually managed installation, set the equivalent worker chart values.

Choose the provider independently from the cloud that hosts PIG. The analyzer can use the same supported provider as your agents. For example, an analyzer on GKE with Cloud Storage can use OpenAI or Azure OpenAI.

Support for Anthropic’s Claude models is coming soon.

Choose a supported endpoint

The analyzer calls the provider’s Responses API. Set provider, baseURL, and authentication to one of these combinations:

Provider value	Responses API base URL	Authentication
`openai`	`https://api.openai.com/v1`	`api_key`
`azure_openai`	`https://RESOURCE.openai.azure.com/openai/v1` or `https://RESOURCE.services.ai.azure.com/openai/v1`	`api_key`
`aws_bedrock`	`https://bedrock-mantle.REGION.api.aws/v1` or the same host with `/openai/v1`	`api_key` or `aws_sigv4`

Replace RESOURCE and REGION with your provider settings. Set name to a model available to your account through that endpoint. For Azure OpenAI, use the model deployment name.

The analyzer accepts only these endpoint shapes. Each URL uses HTTPS, with no embedded credentials, explicit port, query parameters, or fragment. The analyzer rejects ordinary Bedrock Runtime URLs and other OpenAI-compatible endpoints. Vertex AI isn’t a supported provider, including for deployments on Google Cloud.

Configure API key authentication

Use API key authentication with any of the three providers.

Deliver the provider’s API key through your secret manager to a Kubernetes Secret in the deployment’s namespace. For example, use key model-api-key in Secret pig-credentials.

Set the model fields under spec.analysis and reference that Secret:

model:
  provider: openai
  authentication: api_key
  baseURL: https://api.openai.com/v1
  name: REPLACE_MODEL_NAME
  apiKeySecretRef:
    name: pig-credentials
    key: model-api-key

Authenticate to Bedrock with AWS credentials

Use AWS Signature Version 4 (SigV4) to authenticate to Bedrock with the analyzer’s AWS workload identity in place of an API key.

Grant the analyzer’s AWS identity access to the chosen Bedrock model. Storage permissions alone don’t authorize inference.
Set the model fields under spec.analysis with provider: aws_bedrock and authentication: aws_sigv4, and omit apiKeySecretRef:
```
model:
  provider: aws_bedrock
  authentication: aws_sigv4
  baseURL: https://bedrock-mantle.REGION.api.aws/v1
  name: REPLACE_MODEL_NAME
```
The analyzer signs each request with the AWS credentials available to its pod, such as its workload identity. It takes the signing region from the baseURL hostname.

Plan access, quota, and data handling

The analyzer sends session content and relevant instruction context to your selected model endpoint. Choose a region and provider policy that meet your requirements, as described in Trust and data model.

Reserve model quota for analysis alongside your agents’ traffic. Before you expand collection, monitor rate limits, latency, and analysis completion time. A larger cluster doesn’t add model quota.