agent-platform release v4.146.0

Changed

• components.substrate.versionRange and components.substrate-crds.versionRange are >=1.14.0 <1.15.0 (were >=1.13.0 <1.14.0), the kagent WorkerPool’s worker image follows to ateom-gvisor:1.14.0, the customer BOM pins Substrate 1.14.0, and substrate.credentialProvider.additionalProviders routes google-access-token.k8s.io to the credential provider plugin (giantswarm/giantswarm#38547). Substrate 1.14.0’s bundled Kubernetes credential provider serves k8s.io alone (giantswarm/substrate#455); the Google access token a Vertex AI ModelConfig’s actor needs comes from components.google-access-token-credential-provider, deployed since 4.141.0, which the egress gateway now reaches for that class. Vertex AI ModelConfigs and their Secrets are unchanged.
• One source of truth for the component version floors (giantswarm/agent-platform#1102). components.<name>.versionRange in values.yaml is the one place a floor is declared: tests/floors.py reads the ranges and floors from it, and the checks that named a floor (verify-presets’ muster, verify-meta’s agentgateway and BOM, verify-components’ ranges, Substrate pin and release-candidate filters, verify-cluster-manager, verify-workspace-manager) ask it instead; a feature floor a check holds a range to stays a minimum (floors.py floor <name> --min). The customer BOM pins every component with a >= floor at that floor: make golden-update writes the pins, make verify-meta fails on one that differs. A floor move is one edit of values.yaml plus make golden-update. The BOM’s agent-manager pin moves from 2.1.0 to 2.3.0, the floor of its range.

Removed

• ingress.mode: agentgateway-direct is gone (giantswarm/agent-platform#252). The mode never rendered: its guard failed every install for want of a DCR-capable IdP. The connectivity chart now refuses it as an unknown mode (must be one of: agentgateway-muster, muster-direct); its viaMuster: false guard, the meta chart’s unused copies of the ingress guard and the mode’s values comments go with it. No installation renders differently. make verify-modes asserts the refusal.