1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents klaus v0.0.248

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.247...v0.0.248

  • AI Agents klaus-operator v0.0.116

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.115...v0.0.116

  • AI Agents klaus v0.0.247

    Changed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.246...v0.0.247

  • AI Agents klaus-operator v0.0.115

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.114...v0.0.115

  • AI Agents klaus v0.0.246

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.245...v0.0.246

  • AI Agents klausctl v0.2.23

    Fixed

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.2.22...v0.2.23

  • AI Agents agent-platform v1.18.3

    Fixed

    • kagent A2A routing: the inner kagent-controller HTTPRoute (on the agentgateway data-plane Gateway) is no longer hostname-scoped. It was rendered with hostnames: [<public hostname>] from kagent.controllerRoute.hostname, but in-cluster A2A callers — notably klaus-gateway’s --a2a-url, which targets the agentgateway Service’s cluster-DNS name (agentgateway.<ns>.svc.cluster.local) — send that Service host, which did not match the public hostname. The request fell through to the catch-all MCP route (agentic-platform-mcps, path /), was handled as MCP Streamable-HTTP, and was rejected with 406 Not Acceptable ("mcp: client must accept both application/json and text/event-stream"), so the Slack OBO sre-agent turn never reached the agent (it had passed JWT validation — the human token was forwarded — but died at content negotiation on the wrong route). The inner hop is internal and must match any Host; the /kagent prefix is more specific than the MCP / route, so a hostname-less route wins for every Host. The outer kagent-controller-public route keeps the public hostname (required on the shared TLS Gateway).
  • AI Agents agent-platform v1.18.2

    Fixed

    • klausgateway channel routing: a new *-dataplane-to-klausgateway egress policy (cilium + kubernetes flavors, rendered when klausGateway.agentgatewayRoute.enabled) lets the agentgateway data-plane reach the klaus-gateway Service on :8080. The channel paths (/v1, /web, /cli/v1, and /channels/slack when slack.enabled) are served on the data-plane Gateway and forwarded to klaus-gateway, but the data-plane runs in default-deny egress (the -dataplane policy) whose cluster allowance only covers 80/443. klaus-gateway listens on 8080, so the forward was dropped and every channel request — including inbound Slack events delivered to the public hostname — failed with 503 UpstreamFailure ("Connect: deadline has elapsed"), so the Slack bot never replied. Mirrors the existing -dataplane-to-kagent allowance.
  • AI Agents agent-platform v1.18.1

    Fixed

    • agentic-platform-connectivity values.schema.json: allow klausGateway.slack.{dmOnly,botToken,signingSecret,appToken}. The umbrella forwards its whole klausGateway block to the connectivity HelmRelease via forwardAllValues, but the connectivity slack schema had additionalProperties: false and only declared enabled/mode/secretName, so a real install (gazelle) failed the HelmRelease upgrade with Additional property dmOnly/botToken/signingSecret/appToken is not allowed. These keys are consumed by the klaus-gateway subchart, not this chart; they are now declared (and documented as forwarded-only) so validation passes.
  • AI Agents agent-platform v1.18.0

    Added

    • klausgateway Slack OBO (on-behalf-of) wiring. The klausGateway.obo.* block (enabled, musterUrl, callbackBaseUrl, storePath, stateKey, storeKey) is now declared and documented in both the umbrella and connectivity values.yaml (with matching values.schema.json entries) so it is forwarded to the klaus-gateway subchart. The connectivity chart renders a new public HTTPRoute (klausgateway-obo) that exposes the unauthenticated OAuth-bootstrap paths /auth/slack/link, /auth/slack/callback, and the CIMD document /auth/slack/client.json on the gateway’s public hostname (derived from obo.callbackBaseUrl), routing straight to the klaus-gateway Service so they bypass the JWT policy that guards the channel paths. Both the linking browser and muster (CIMD fetch) reach the gateway over this route. Disabled by default. A ci/test-klausgateway-obo-values.yaml render test covers the new route.
    • klausGateway.slack.dmOnly (umbrella values.yaml + values.schema.json) is forwarded to the klaus-gateway subchart, which renders it as SLACK_DM_ONLY to restrict the Slack adapter to direct messages (channel messages and @-mentions ignored). Recommended for the OBO gateway, which is a DM-only bot. Default false. Requires the klaus-gateway chart that renders the env (giantswarm/klaus-gateway#113).
    • klausGateway.slack.botToken / signingSecret / appToken (umbrella values.yaml + values.schema.json) are forwarded to the klaus-gateway subchart, which renders the slack.secretName Secret (keys bot-token / signing-secret / app-token) from them. This lets the per-cluster secret-values.yaml.patch stage SOPS-encrypted Slack credentials that become the slack-credentials Secret the gateway consumes. Requires the klaus-gateway chart that renders the Secret (giantswarm/klaus-gateway#114).

    Fixed

    • klausgateway Slack OBO egress: a new klausgateway-obo-egress NetworkPolicy (cilium + kubernetes flavors, rendered when klausGateway.obo.enabled) lets the klaus-gateway pod reach the muster authorization server on 443/10443 for RFC 8414 discovery and the OAuth token exchange. The gateway is put into default-deny egress by the klausgateway-a2a-egress policy, which only allowed DNS + the agentgateway data plane; without this allowance the OBO token call to muster’s public issuer host (which resolves to the public NLB / private LB VIP) was dropped. Mirrors the existing kagent-agent and oauth2-proxy world+cluster 443/10443 egress.
    • klausgateway connectivity route: the AgentgatewayBackend .spec.static.host now defaults to the correct klaus-gateway Service name (the klaus-gateway chart’s default, matching templates/klausgateway/netpol.yaml) instead of klausgateway, which resolved to a non-existent Service when klausGateway.fullnameOverride was unset.