1. Docs
  2. Changes and releases

agent-platform release v1.1.21

AI Agents agent-platform v1.1.21

Fixed

  • Downgrade bundled agentgateway and agentgateway-crds charts from v2.2.1 back to v1.2.1. The upstream project released v2.2.x before resetting semver to v1.0.0; v2.2.1 is older than v1.0.0 and was incorrectly treated as an upgrade (agentgateway/agentgateway#1249). Block the bogus v2.2.x range in renovate.json5.
  • templates/agentgateway/agentgatewayparameters.yaml: data-plane image override moved from the deployment container spec to spec.image.registry/repository/tag. Drops AGW_XDS_SERVICE_NAME from controller.extraEnv and removes the explicit controller image tag pin: the v1.2.1 chart already sets AGW_XDS_SERVICE_NAME: agentgateway-controller correctly via fullnameOverride, and the controller image tag defaults to the chart’s appVersion (v1.2.1) when unset.
  • templates/kagent/ui-httproute.yaml: oauth2-proxy backend name now resolves oauth2-proxy.fullnameOverride from values (falling back to <release>-oauth2-proxy), so the HTTPRoute points at the correct service when fullnameOverride: kagent-oauth2-proxy is set.
  • Bundled kagent declarative agents (cilium-policy-agent, promql-agent, and all others) now deploy into the kagent namespace. The kagent kagent.namespace helper resolves namespaceOverride from the subchart’s own .Values scope; the parent chart’s kagent.namespaceOverride: kagent is not visible there, so agents were landing in the Helm release namespace (agentic-platform). Both default-model-config (ModelConfig) and kagent-tool-server (RemoteMCPServer) live in kagent and are resolved by bare name within the agent’s own namespace, causing every agent to show Accepted=False. Each bundled agent subchart block now sets namespaceOverride: kagent explicitly.
  • templates/kagent/ui-backendtrafficpolicy.yaml: route-level BackendTrafficPolicy for the kagent UI HTTPRoute. The cluster-wide gateway-giantswarm-default-error-pages policy replaces all 4xx/5xx bodies with static HTML; without a route-level override, Envoy replaces oauth2-proxy’s 403 sign-in page body (which meta-refreshes to /login) with that static page, breaking the login flow entirely. Any route-level BackendTrafficPolicy overrides the gateway-wide one, so this policy is rendered with enabled: true by default whenever kagent.uiRoute.enabled: true.

Added

  • klausGateway.enabled (default false) adds giantswarm/klaus-gateway as an opt-in conditional dependency (condition: klausGateway.enabled, alias klausGateway). With the flag unset or false the rendered output is byte-identical to the previous chart version. When enabled, the sub-chart installs the Klaus Gateway Deployment, Service, RBAC, and ChannelRoute CRD (via crd.install: true). The sub-chart’s own agentgateway dependency is disabled (klausGateway.agentgateway.enabled: false) so the umbrella’s bundled agentgateway is reused.
  • Single ingress.mode topology selector (muster-direct | agentgateway-muster | agentgateway-direct) that declares the whole request topology in one place. The umbrella now owns both public routes — muster’s / catch-all (new templates/ingress/muster-httproute.yaml, rendered in all modes) and the agentgateway /mcp interception route — fed from a single shared ingress.parentRefs / ingress.hostnames, so the two routes can no longer drift. A template-time guard (templates/validate.yaml) fails fast on an invalid mode, on ingress.parentRefs empty in any mode (the umbrella-owned muster / route attaches to it — an empty parentRefs would otherwise render a route bound to no Gateway), and on agentgateway.enabled / agentic-platform-mcps.agentgateway.viaMuster disagreeing with the mode.
  • agentgateway.enabled (default false) gates the agentgateway controller dependency via condition: agentgateway.enabled in Chart.yaml. In the default muster-direct mode the controller, its GatewayClass, the data-plane Gateway/AgentgatewayParameters, and the data-plane NetworkPolicies are not installed.
  • agentgateway-direct mode is modelled but fail-guarded — install is blocked with a clear message until a DCR-capable IdP (RFC 7591/8707) lands.
  • make verify-modes target (wired into a new CircleCI branch test job) asserts the fail-guards fire; ci/test-full-stack-values.yaml now exercises the previously-untested agentgateway-muster path.
  • Route-scoped BackendTrafficPolicy for muster’s / route (new templates/ingress/muster-backendtrafficpolicy.yaml), rendered in all modes when ingress.backendTrafficPolicy.enabled is set — not just the agentgateway /mcp route. This preserves muster’s 401 … WWW-Authenticate challenge against the cluster-wide error-pages policy in muster-direct mode (where muster serves /mcp directly) and restores the pre-refactor muster.gatewayAPI.backendTrafficPolicy behavior on muster’s own route.
  • Per-route ingress.httpRoute.muster.{annotations,labels} and ingress.httpRoute.mcp.{annotations,labels} overrides, merged on top of the shared ingress.httpRoute.{annotations,labels} (per-route keys win on collision). Lets a downstream diverge one route — e.g. a different cert-manager issuer or Envoy route policy per route — without forking the shared block.
  • kagent-crds (v0.9.5, oci://ghcr.io/kagent-dev/kagent/helm) bundled as a sub-chart. Installs the kagent CRDs (Agent, AgentHarness, ModelConfig, MCPServer, RemoteMCPServer, Memory, ToolServer, SandboxAgent). Must be installed before the agentic-platform chart when kagent.enabled: true. Note: upstream does not mark these CRDs helm.sh/resource-policy: keep; helm uninstall agentic-platform-crds will remove them and cascade to all kagent CRs.
  • kagent (v0.9.5, oci://ghcr.io/kagent-dev/kagent/helm) bundled as a conditional sub-chart (kagent.enabled, default false). All kagent resources land in kagent.namespaceOverride (default kagent) so they stay separate from the umbrella’s release namespace. The kagent-crds chart is added to agentic-platform-crds as a prerequisite. Enabling kagent requires agentic-platform-crds to be installed first.
  • kagent.oauth2-proxy.metrics.serviceMonitor.enabled: true — Prometheus ServiceMonitor for the oauth2-proxy metrics endpoint (:44180), labelled observability.giantswarm.io/tenant: giantswarm.
  • templates/kagent/netpol.yaml: oauth2-proxy ingress CNP extended to allow scraping of the metrics port (:44180) from any cluster-entity source, and oauth2-proxy egress extended to include cluster alongside world on port 443 — required when the Dex hostname resolves to an internal LB VIP (private-range IP classified as cluster by Cilium, not world).
  • postgres block: opt-in CloudNativePG Cluster CR (postgres.enabled, default false) provisioning the kagent application database in a named kagent schema (not public). Supports pgvector via postInitTemplateSQL (any CNPG version, bundled image) or the ImageVolume approach (postgres.vector.extensionImage.reference, CNPG 1.29+/PG18). The CNPG operator and its CRDs remain a cluster-level prerequisite. An optional Klaus sessions database (postgres.sessionsDatabase.enabled, default false) is templated but left off pending the core-runtime persistence decision.
  • templates/namespace.yaml: renders the kagent Namespace when kagent.namespaceOverride differs from the release namespace, so fresh installs do not require manual namespace pre-creation.
  • templates/kagent/controller-route.yaml: opt-in AgentgatewayBackend + HTTPRoute (kagent.controllerRoute.enabled) exposing the kagent controller API through agentgateway with JWT validation.
  • templates/kagent/netpol.yaml: cross-namespace network policies for kagent (cilium and kubernetes flavors, gated on networkPolicy.flavor). Cilium: egress from agentgateway data-plane to kagent controller (port 8083) + ingress policy in the kagent namespace. Kubernetes: NetworkPolicy restricting kagent controller ingress to the release and kagent namespaces, preventing direct access that would bypass agentgateway JWT validation.
  • templates/kagent/ui-httproute.yaml: opt-in HTTPRoute (kagent.uiRoute.enabled) exposing the kagent UI on the public Gateway. When oauth2-proxy.enabled: true routes through oauth2-proxy (port 4180); otherwise routes directly to the UI (dev only). Placed in the kagent namespace to avoid cross-namespace backend refs.
  • ci/test-postgres-values.yaml: CI values file exercising the kagent+postgres path through helm template/lint.
  • ci/test-kagent-routing-values.yaml: CI values file exercising controllerRoute + uiRoute + oauth2-proxy.
  • Kagent defaults hardened for GS clusters: restricted-PSS securityContext applied at umbrella level (Kyverno requirement); bundled agents/tools disabled with comments explaining why and under what conditions to re-enable; Anthropic set as the default model provider (claude-sonnet-4-6); OTel traces and logs routed to otlp-gateway.kube-system.svc:4317; controller.auth.mode: trusted-proxy (agentgateway validates the JWT upstream and the netpols fence the controller); oauth2-proxy values pre-wired for Dex OIDC integration (enabled: false until Dex client credentials are provided).

Fixed

  • In-cluster MCP backends that listen on a non-80/443 port (e.g. the bundled pro / runbooks MCP servers on 8080, reached via a ClusterIP) were unreachable from muster — its sub-chart CNP permits cluster-entity egress only on 80/443, so those connections timed out and the corresponding MCPServers went Failed. The umbrella now renders a supplementary CiliumNetworkPolicy (<muster>-mcp-egress) that widens muster’s egress to networkPolicy.musterInClusterMcpPorts (default [8080]; cilium flavor only; Cilium policies are additive, so no sub-chart fork). Set to [] to disable.
  • Muster Service name is now pinned via muster.fullnameOverride: agentic-platform-muster, read directly by the umbrella’s agentic-platform.musterFullname helper instead of re-deriving the muster sub-chart’s release-name algorithm. The route backendRef, the BackendTrafficPolicy target, and agentic-platform-mcps.musterUrl now reference one source of truth that stays in lockstep with the sub-chart’s Service regardless of release name or any future muster naming change. A blank override fails the render loudly rather than silently pointing the route at a non-existent Service (503).

Changed

  • Bumped bundled muster to 0.2.6 (includes the muster#772 JWT signing-key wiring fix + jwt_key.go enabling edge JWT validation, and the CNP ingress-gateway egress fix from muster#788).
  • Bumped bundled agentic-platform-mcps to 0.2.4 — corrects the identityProviders value schema (it was additionalProperties: false with no properties, forbidding every provider key and making auth.mode: exchange unconfigurable). Unblocks multi-cluster token-exchange consumers; forward-only installs are unaffected.

Removed

  • Breaking: gateway.enabled, gateway.httpRoute.*, and gateway.backendTrafficPolicy.* are removed — replaced by ingress.mode (topology switch), ingress.parentRefs / ingress.hostnames (shared route attachment), and ingress.backendTrafficPolicy.*. The retained gateway.* keys now hold data-plane infrastructure only and apply in agentgateway-* modes. muster.gatewayAPI.enabled is now false (the umbrella renders muster’s public route) — set ingress.parentRefs / ingress.hostnames instead of muster.gatewayAPI.httpRoute.*.