1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents agent-platform v2.4.3

    Added

    • klausGateway.obo.connectors (umbrella + connectivity values.yaml and values.schema.json) is forwarded to the klaus-gateway subchart, which enables the reactive Slack connector UX (obo.connectors.enabled -> KLAUS_GATEWAY_OBO_CONNECTORS_ENABLED): the gateway detects a core_auth_login challenge in the agent’s response stream and offers a “Connect ” button from the login link the agent relays. Disabled by default. The obo block in both schemas is additionalProperties: false, so a cluster setting this key on 2.4.2 fails the HelmRelease schema check (Additional property connectors is not allowed); this entry closes that gap.
  • AI Agents klaus v0.0.280

    Changed

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.279...v0.0.280

  • AI Agents klaus v0.0.279

    Fixed

    • (deps) Update module github.com/prometheus/client_golang to v1.24.0 in #411 by @renovate[bot]

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.278...v0.0.279

  • AI Agents muster v1.2.0

    Fixed

    • OAuth proxy start endpoint (/oauth/proxy/start): auth-challenge login URLs now point the browser at this muster-hosted endpoint, which redirects to the upstream authorization server. The login flow is unchanged for users; the URL in core_auth_login results is now a short muster URL instead of the full upstream authorization URL.
    • Browser-consent connector logins now push tools/resources/prompts list_changed notifications to the user’s live sessions once the OAuth callback connects the backend, matching the SSO connect path. Clients that honor list_changed (e.g. Claude Code) see the newly available tools without re-running core_auth_login.
  • AI Agents muster v1.1.0

    Fixed

    • MCP structuredContent from downstream tools is now preserved. The call_tool meta-tool propagates structuredContent from the wrapped tool both natively on its own result and as a structuredContent field inside its JSON envelope (previously it was silently dropped), and the agent client restores it when unwrapping. Core tools can opt in via the new StructuredContent field on api.CallToolResult; none set it yet. Text-only consumers are unaffected.
  • AI Agents agent-platform v2.4.2

    Removed

    • klausGateway.slack.dmOnly (umbrella values.yaml and both values.schema.json). klaus-gateway removed the SLACK_DM_ONLY env and the slack.dmOnly value, replacing them with dmMode + channelMode, and already ignores a leftover dmOnly. The umbrella drops the dead default and, with additionalProperties: false, no longer accepts the key. Migration: dmOnly: true becomes dmMode: serve + channelMode: none; the old dmOnly: false (channels served, DMs redirected) becomes dmMode: redirect + channelMode: all. An install still setting dmOnly (e.g. graveler giantswarm-configs#742) must migrate before this merges.

    Fixed

    • The same channelMode / channelAllowlist / dmMode keys are declared in the agentic-platform-connectivity values.schema.json too. The umbrella forwards its whole klausGateway block to the connectivity HelmRelease via forwardAllValues, so fixing only the umbrella would relocate the Additional property channelMode is not allowed failure to the connectivity release once the umbrella upgrade reconciles.
  • AI Agents muster v1.0.8

    Fixed

    • Reading an aggregated resource or prompt from a backend that reported connected but had no live client crashed muster with a nil-pointer panic (AggregatorServer.ReadResource / GetPrompt dereferenced the client). GetClient now returns an error in that state instead of handing back a nil client, so the tool call fails cleanly rather than aborting the connection.
  • AI Agents agent-platform v2.4.1

    Fixed

    • klausGateway.slack.channelMode / channelAllowlist / dmMode added to the umbrella values.schema.json. The klaus-gateway subchart (0.20.x) introduced channel-mode routing (channelMode: all/allowlist/none with channelAllowlist, and dmMode: serve/redirect/ignore), but the umbrella schema’s klausGateway.slack block (additionalProperties: false) was never extended, so any installation setting these keys — e.g. gazelle’s swarmgeist channel pilot (giantswarm-configs#762) — failed the helm upgrade at schema validation (Additional property channelMode is not allowed), leaving the HelmRelease stuck in Failed and blocking all pending upgrades (PagerDuty incident #6917). The umbrella now mirrors the subchart’s schema for these three keys.
  • AI Agents agent-platform v2.4.0

    Added

    Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v2.3.0...v2.4.0

  • AI Agents agent-platform v2.3.0

    Added

    • kagent.controllerRoute.jwtAuthentication (umbrella + connectivity values.yaml and values.schema.json): opt-in JWT validation on the inner kagent-controller HTTPRoute. When enabled, the connectivity chart renders an AgentgatewayPolicy (dex issuer, no required audiences) and a static AgentgatewayBackend (kagent-controller-jwks) for the JWKS endpoint, so agentgateway verifies the bearer’s signature, issuer, and expiry against dex before forwarding to the kagent controller. kagent.controllerRoute.jwtAuthentication.mode selects the validation strictness (enum Strict, Optional, Permissive; default Strict): Strict rejects requests with a missing or invalid token, Optional validates a token when present but allows requests with none, Permissive validates without rejecting so an install can confirm real traffic carries valid dex tokens before enforcing. This makes the trusted-proxy assumption of kagent.controller.auth.mode: trusted-proxy hold for A2A callers routed through agentgateway; previously no policy existed and any parseable JWT passed. Intra-namespace agent pods (app: kagent) that call the controller directly on 8083 (allowed by the kagent NetworkPolicy) bypass agentgateway and this policy, and are out of scope. Off by default: enabling it rejects callers that do not present a dex-issued JWT (opaque muster tokens, Kubernetes ServiceAccount tokens), so enable it per install only once all A2A callers forward dex JWTs. Requires gateway.jwksEgress.enabled: true so the data plane can reach dex. A ci/test-kagent-jwt-policy-values.yaml render test covers the new resources, and a render-time guard fails when it is enabled without an issuer.