agents.muster.tokenExpirationSeconds: 3600, was 365 days) and is re-minted by a new muster-token-refresh CronJob on agents.muster.tokenRefreshSchedule (default every 15 minutes). The bootstrap Job still seeds the Secret on install/upgrade; kagent’s RemoteMCPServer picks up the rotated Secret without restarting the agent. Removes the year-long at-rest bearer token.oauth.server.tokenExchangeBroker.targets[].type: local-mint mints a muster-signed RFC 9068 JWT locally. Requires enableJWTMode: true. The issued token carries sub = the validated human subject, the subject’s email and groups claims (plus any broker-granted groups), and act = the validated agent SA nested over any prior delegation chain on the subject token, signed by muster’s own access-token key. Downstream services that trust muster as an issuer receive the subject’s identity and the full delegation chain without a separate Dex exchange, so group-to-tenant and email-to-org routing resolve correctly.Full Changelog: https://github.com/giantswarm/muster/compare/v0.12.0...v0.13.0
agents.sreAgent: opt-in bundled Declarative kagent Agent (sre-agent) that reaches muster machine-to-machine through the static muster RemoteMCPServer (SA Bearer token from the <name>-kagent-muster-token Secret). spec.declarative.deployment.serviceAccountName is omitted so the kagent controller auto-creates the sre-agent SA. Configurable modelConfig (default default-model-config), systemMessage, toolServer (default muster), toolNames, allowedHeaders, deployment.resources, and deployment.env. allowedHeaders is inert: forwarding a request header onto muster tool calls additionally needs kagent-dev/kagent#2044, absent from the pinned kagent 0.9.9. Disabled by default.agents.muster.userServer and the header-less muster-user RemoteMCPServer. On the pinned kagent 0.9.9 it lists zero tools (no static Authorization for controller discovery) and the forwarded-token override it depended on (kagent-dev/kagent#2044) is absent, so it could not impersonate the end user. User impersonation returns once kagent ships #2044 and muster carries the human identity (email/groups).Full Changelog: https://github.com/giantswarm/muster/compare/v0.11.2...v0.12.0
Full Changelog: https://github.com/giantswarm/muster/compare/v0.11.1...v0.11.2
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.7.0...v1.7.1
Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.2.12...v0.2.13
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.225...v0.0.226
Full Changelog: https://github.com/giantswarm/klaus-oci/compare/v0.0.52...v0.0.53