Fixed
- (deps) Update module github.com/giantswarm/mcp-oauth to v1.0.12 in #408 by @renovate[bot]
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.277...v0.0.278
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.277...v0.0.278
Full Changelog: https://github.com/giantswarm/muster/compare/v1.0.1...v1.0.2
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.276...v0.0.277
agents.models → kagent.modelConfigs, agents.remoteMcpServers → kagent.remoteMcpServers (umbrella + connectivity values.yaml and values.schema.json). With agent creation gone (see Removed), the leftover agents key only held admin-owned kagent CRs, which was misleading; both lists now live in the kagent block next to providers (whose anthropic entry already yields the subchart-created default-model-config), under the same “read by connectivity templates, not the subchart” convention as controllerRoute/uiRoute. models is renamed to modelConfigs to match the CR kind. The rendering templates moved up from templates/kagent/agents/ to templates/kagent/, and kagent.remoteMcpServers gains the schema validation it never had (required name/url, optional description/tokenSecret, additionalProperties: false). Note these keys ride into the kagent component’s HelmRelease values (ignored by that chart today, like the routing keys) — if upstream kagent ever introduces same-named values, they must be renamed here.agents.* values key. Agents are no longer created by this chart — install one release of the generic agent chart per agent instead, per the creating-agents PRD. The agents.definitions block is removed from the umbrella and connectivity values.yaml, along with the templates it drove in agentic-platform-connectivity: the kagent Agent CR + chart-owned ServiceAccount (agents.yaml), the per-agent muster-<name> RemoteMCPServer loop (the agent chart references the shared muster server cross-namespace instead), the per-agent A2A AgentgatewayBackend + /agents/<name> HTTPRoute (agentgateway-backends.yaml — not part of the PRD’s chart scope and unused: in-cluster A2A callers go through the kagent controller route; use extraObjects for one-offs), and the now-unused _agents.tpl helpers. The two admin-owned lists that remained (agents.models, agents.remoteMcpServers) moved into the kagent block — see Changed — dissolving the agents key entirely. Leftover agents.* keys in per-cluster values are silently ignored (the root schema is deliberately permissive for forwardAllValues), which enables a zero-gap migration on the auto-updating dev track: add the kagent.* keys alongside the old ones, let the chart roll out, then delete the old keys. The rest of the admin-owned surface the agent chart depends on stays: the shared muster RemoteMCPServer and the kagent-namespace policies (muster-egress CNP, Kyverno exception, declarative-agent pod security), which apply to agent pods regardless of which chart created them. Migration: any cluster with agents.definitions.sre-agent.enabled: true must have an agent-chart-based replacement (carrying the eval-tuned systemMessage) deployed before upgrading, or the live Agent CR is deleted; per-cluster values setting agents.models/agents.remoteMcpServers should add the equivalent kagent.modelConfigs/kagent.remoteMcpServers keys before the chart rolls out (old keys can be removed afterwards).Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.275...v0.0.276
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.274...v0.0.275
RemoteMCPServer for tenant agents. The connectivity chart now renders a single RemoteMCPServer named muster in the release namespace (agentic-platform) with allowedNamespaces: {from: All}, so agents in any namespace can reference the muster gateway cross-namespace — this is the admin-owned server the generic agent chart defaults its serverRef to (muster/agentic-platform), per the creating-agents PRD. On-behalf-of only: the server sets no headersFrom, so the caller token forwarded by kagent (KAGENT_PROPAGATE_TOKEN) is the only Authorization reaching muster, and muster authenticates every call. Rendered unconditionally whenever kagent.enabled and muster.enabled — the CR is inert until an agent references it — and the name is fixed by the template: name/namespace are the platform contract the agent chart’s default serverRef depends on, so neither is a value.agents.definitions.<agent>.obo flag. The muster-token-init Job, the muster-refresh CronJob, the shared token pod-spec helper, the Secret-writer Role/RoleBinding, the static headersFrom Authorization on the per-agent muster RemoteMCPServer, and the agents.muster.{kubectlImage,busyboxImage,tokenExpirationSeconds,tokenRefreshSchedule} values are removed from agentic-platform-connectivity (and the umbrella defaults). With M2M gone, acting on behalf of the user is the only mode: the RemoteMCPServer carries no static credentials and kagent’s propagated user token (KAGENT_PROPAGATE_TOKEN) is the sole Authorization reaching muster, so the obo toggle has nothing left to switch. agents.remoteMcpServers[].tokenSecret now only accepts a pre-existing Secret; the chart no longer writes one.Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.273...v0.0.274
Full Changelog: https://github.com/giantswarm/muster/compare/v1.0.0...v1.0.1
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.272...v0.0.273