Added
- (config) Add workloadGroupGrants.granted.subject and nest groups under granted in #890 by @QuentinBisson
Full Changelog: https://github.com/giantswarm/muster/compare/v0.13.2...v0.14.0
Full Changelog: https://github.com/giantswarm/muster/compare/v0.13.2...v0.14.0
agentgateway, kagent, and agent-sandbox drop their dependsOn: [agentic-platform-crds] (they already ship their CRDs with crds: CreateReplace). The CR consumers repoint to the CRD-owning components: agentic-platform-mcps now dependsOn: [muster, agentgateway] and agentic-platform-connectivity now dependsOn: [agentgateway, kagent] (both were agentic-platform-crds). The handoff is non-destructive: release A had already overwritten the live agentgateway/kagent/kmcp CRDs with the wrapper charts’ helm.sh/resource-policy: keep copies, so Flux pruning the retired bundle HelmRelease cannot delete the CRDs or cascade to any CR.dependsOn reference to a component that is toggled off (new agentic-platform.componentEnabled helper). With app-owned CRDs a CR consumer dependsOn the opt-in component that ships the CRD it needs; in the default muster-direct topology agentgateway/kagent are off and render no HelmRelease, so without this filtering the always-on agentic-platform-connectivity release would block forever on a dependency that was never rendered.agentic-platform-crds bundle chart — every component now owns its CRDs (app-owned CRDs). The standalone chart (helm/agentic-platform-crds/), its CircleCI build/test/push jobs, and the now-dead Renovate helmv3 lockstep packageRules are deleted. There is no longer a components.agentic-platform-crds entry in the meta-package.Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.9.0...v1.9.1
agentgateway and kagent are repointed from their upstream chart repositories to the Giant Swarm wrapper charts (oci://gsoci.azurecr.io/charts/giantswarm/{agentgateway,kagent}, from giantswarm/agentgateway and giantswarm/kagent-app) that vendor the upstream chart as a subchart and ship the agentgateway.dev / kagent.dev + kmcp CRDs in their own crds/ dir with helm.sh/resource-policy: keep. agent-sandbox already pointed at its GS chart. All three now set crds: CreateReplace. This is the non-destructive first step of the staged handoff: every component KEEPS its dependsOn: [agentic-platform-crds] and the bundle keeps shipping the CRDs, so CreateReplace overwrites the live (un-annotated) CRDs with the keep-annotated copies before any bundle dependency is dropped (release B). The meta-package’s generic component loop gains an optional valuesKey field: the agentgateway / kagent blocks are nested under the subchart key when forwarded to the wrapper chart, leaving the flat top-level blocks (and every per-cluster override path and the connectivity chart’s reads of them) unchanged. Wrapping the upstream kagent chart as a subchart keeps its .Chart.Version a clean 0.9.9, so the app.kubernetes.io/version label is no longer corrupted by the OCI +digest — the kagent version pin (0.9.9 -> 0.x) and the postRenderers kustomize label-sanitization hack are both removed.Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.8.2...v1.8.3
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.226...v0.0.227
Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.2.13...v0.2.14
Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.105...v0.0.106
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.8.1...v1.8.2
allowPrivateIPJWKS now honors the process CA bundle, so a backend validating muster’s in-cluster JWKS over TLS with an internal CA no longer fails with x509: unknown authority.