Fixed
- (deps) Update module github.com/giantswarm/mcp-oauth to v0.4.2 in #337 by @renovate[bot]
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.208...v0.0.209
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.208...v0.0.209
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.2.6...v1.2.7
Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.98...v0.0.99
mcp-oauth to v0.4.2, which makes the trusted-issuer JWKS cache rotation-safe: a subject token presenting a kid absent from the cached JWKS now triggers a single bounded refetch (rate-limited per JWKS URI) and retries verification before rejecting. Previously, a Dex signing-key rotation made the token-exchange broker reject every current user token with subject_token_validation_failed until the muster pod was restarted (the shared broker took down all downstream audiences at once). Closes #847.muster sub-chart 0.5.5 -> 0.5.6, which bumps mcp-oauth to v0.4.1. The token-exchange broker and MCP OAuth client now RFC 6749-encode client credentials before HTTP Basic auth, so token-exchange client secrets containing + (and other reserved characters) no longer fail Dex client authentication with invalid_client. Unblocks the tunnelport private-cluster devportal rollout (giantswarm#36880) for clusters whose muster-token-exchange-<mc> secret contains + without per-cluster secret rotation.Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.2.4...v1.2.5
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.2.3...v1.2.4
mcp-oauth to v0.4.1, which RFC 6749 §2.3.1-encodes client credentials in token-exchange Basic auth. Cross-cluster SSO token exchange previously failed with invalid_client for downstream clusters whose muster-token-exchange-* Dex client secret contained + (decoded to a space on the wire); base64-std secrets with only / and = were unaffected, which is why some clusters worked and others did not.Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.2.5...v0.2.6
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.207...v0.0.208