docs: drop certificates.k8s.io/v1beta1 requirement from 1.x install guide

docs-site/content/kagent/1.x/get-started/your-first-agent.md

@@ -152,7 +152,16 @@ The `invoke` command takes a few more options that are useful beyond a first con
 > [!TIP]
 > Run `kagent` with no arguments to open an interactive workspace in your terminal, where you can browse your Sessions and chat with them without passing an ID to each command.
 
-## Clean up
+## Next steps
+
+{{< cards >}}
+  {{< card link=`{{< link path="get-started/your-first-mcp-tool" >}}` title="Your first MCP tool" subtitle="Bind a Model Context Protocol tool so that your agent can act on live cluster data." >}}
+  {{< card link=`{{< link path="about/architecture/agent-substrate" >}}` title="Agent Substrate architecture" subtitle="Understand what happens to your Session's Actor when it sits idle." >}}
+  {{< card link=`{{< link path="agents/agent-harness" >}}` title="Agent harness" subtitle="Choose from the full set of Harness runtime options." >}}
+  {{< card link=`{{< link path="skills-and-mcp/skills" >}}` title="Skills" subtitle="Give your agent capabilities beyond its system prompt." >}}
+{{< /cards >}}
+
+## Optional: clean up
 
 > [!IMPORTANT]
 > Other guides build on the Harness, AgentTemplate, and Agent that you created here, including [Your first MCP tool]({{< link path="get-started/your-first-mcp-tool" >}}) and [Agent Substrate]({{< link path="examples/agent-substrate" >}}). Unless you are finished with the kagent guides, leave the resources in place.
@@ -172,12 +181,3 @@ To remove the resources, follow these steps.
    kubectl delete agenttemplate my-first-template -n kagent
    kubectl delete harness my-first-harness -n kagent
    ```
-
-## Next steps
-
-{{< cards >}}
-  {{< card link=`{{< link path="get-started/your-first-mcp-tool" >}}` title="Your first MCP tool" subtitle="Bind a Model Context Protocol tool so that your agent can act on live cluster data." >}}
-  {{< card link=`{{< link path="about/architecture/agent-substrate" >}}` title="Agent Substrate architecture" subtitle="Understand what happens to your Session's Actor when it sits idle." >}}
-  {{< card link=`{{< link path="agents/agent-harness" >}}` title="Agent harness" subtitle="Choose from the full set of Harness runtime options." >}}
-  {{< card link=`{{< link path="skills-and-mcp/skills" >}}` title="Skills" subtitle="Give your agent capabilities beyond its system prompt." >}}
-{{< /cards >}}

docs-site/content/kagent/1.x/get-started/your-first-mcp-tool.md

@@ -172,7 +172,7 @@ A `RemoteMCPServer` points at any MCP server that the cluster can reach, whether
 ## Clean up
 
 > [!IMPORTANT]
-> Leave the Harness, AgentTemplate, Agent, and Sessions in place. Other guides build on them, and [Your first agent]({{< link path="get-started/your-first-agent#clean-up" >}}) covers removing them when you are finished with the kagent guides. Leave `kagent-tool-server` in place as well, because the kagent installation owns it.
+> Leave the Harness, AgentTemplate, Agent, and Sessions in place. Other guides build on them, and [Your first agent]({{< link path="get-started/your-first-agent#optional-clean-up" >}}) covers removing them when you are finished with the kagent guides. Leave `kagent-tool-server` in place as well, because the kagent installation owns it.
 
 If you created a RemoteMCPServer of your own in [Bind your own MCP server](#bind-your-own-mcp-server), delete it.
 

docs-site/content/kagent/1.x/setup/installation.md

@@ -31,46 +31,31 @@ author: kagent.dev
    export OPENAI_API_KEY="your-api-key-here"
    ```
 
-3. Prepare a Kubernetes cluster at **1.37 or later** and enable it with the following requirements for Agent Substrate.
+3. Prepare a Kubernetes cluster at **1.37 or later**. Agent Substrate depends on the `PodCertificateRequest` and `ClusterTrustBundle` APIs, which are GA in 1.37 and served at `certificates.k8s.io/v1` by default.
 
    {{< tabs >}}
    {{% tab name="Local kind cluster" %}}
-   For local testing and development, create a [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) cluster at Kubernetes 1.37 or later. Use kind v0.32.0 or later. Enable the `certificates.k8s.io/v1beta1` API, which Agent Substrate depends on.
+   For local testing and development, create a [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) cluster at Kubernetes 1.37 or later. Use kind v0.32.0 or later. No extra API configuration is needed.
    ```bash
-   kind create cluster --image kindest/node:v1.37.0 --config=- <<EOF
-   kind: Cluster
-   apiVersion: kind.x-k8s.io/v1alpha4
-   name: kagent
-   runtimeConfig:
-     "certificates.k8s.io/v1beta1": "true"
-   EOF
+   kind create cluster --name kagent --image kindest/node:v1.37.0
    ```
    {{% /tab %}}
 
    {{% tab name="Existing 1.37+ cluster" %}}
-   To use an existing Kubernetes 1.37 or later cluster, you must manually enable the `certificates.k8s.io/v1beta1` API, which Agent Substrate depends on.
-   1. On each control plane node, add the runtime configuration to the kube-apiserver manifest. The kubelet restarts the static pod when the file changes, so no restart command is needed.
-      ```yaml
-      # /etc/kubernetes/manifests/kube-apiserver.yaml
-      spec:
-        containers:
-        - command:
-          - kube-apiserver
-          - --runtime-config=certificates.k8s.io/v1beta1=true
-      ```
-      > [!NOTE]
-      > If the command list already has a `--runtime-config` flag, edit that line instead of adding a second one. A duplicate flag is silently ignored, and the API is not served.
-
-   2. Confirm that the beta group is served. Be sure to check the served API versions, not the resource list.
-      ```bash
-      kubectl api-versions | grep certificates.k8s.io
-      ```
-
-      Example output:
-      ```console
-      certificates.k8s.io/v1
-      certificates.k8s.io/v1beta1
-      ```
+   Kubernetes 1.37 and later serve the required APIs at `certificates.k8s.io/v1` by default, so you do not need to change the API server configuration. This includes managed control planes such as Amazon EKS, Google GKE, and Azure AKS.
+
+   Confirm that the cluster serves the required APIs.
+   ```bash
+   kubectl api-resources --api-group=certificates.k8s.io
+   ```
+
+   Example output:
+   ```console
+   NAME                           SHORTNAMES   APIVERSION               NAMESPACED   KIND
+   certificatesigningrequests     csr          certificates.k8s.io/v1   false        CertificateSigningRequest
+   clustertrustbundles                         certificates.k8s.io/v1   false        ClusterTrustBundle
+   podcertificaterequests                      certificates.k8s.io/v1   true         PodCertificateRequest
+   ```
    {{% /tab %}}
    {{< /tabs >}}