Fixed
- (deps) Update module github.com/giantswarm/mcp-oauth to v0.4.0 in #333 by @renovate[bot]
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.206...v0.0.207
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.206...v0.0.207
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.205...v0.0.206
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.204...v0.0.205
Full Changelog: https://github.com/giantswarm/klaus-oci/compare/v0.0.49...v0.0.50
Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.2.4...v0.2.5
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.203...v0.0.204
agents.muster: replaced tokenDuration (Go duration) with tokenExpirationSeconds (integer, fed to the projected token volume); added busyboxImage.agentic-platform-kagent-agent-muster-egress CNP was missing an egress rule for kagent agent pods to reach the kagent-controller on port 8083. Agent pods had no path to dial into the controller, blocking agent-to-controller communication.kagent-muster-token-init): no longer depends on a shell in the kubectl image, which is distroless (registry.k8s.io/kubectl) and crash-looped BackoffLimitExceeded on /bin/sh: no such file or directory, failing post-upgrade. The token is now minted via a projected serviceAccountToken volume, the Bearer <token> Secret manifest is rendered by a busybox init container, and kubectl is invoked with args only to apply it. The Job runs as kagent-muster-client (the identity muster trusts); the serviceaccounts/token create RBAC is dropped.Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.2.1...v1.2.2
Full Changelog: https://github.com/giantswarm/agentic-platform/compare/v1.2.0...v1.2.1
templates/klausgateway/netpol.yaml: NetworkPolicy (cilium + kubernetes flavors) allowing klaus-gateway egress to the agentgateway data-plane Gateway on port 8080, rendered when klausGateway.enabled and klausGateway.a2a.enabled.klausGateway.a2a.url now routes through the agentgateway data-plane Service (http://agentgateway.agentic-platform.svc.cluster.local:8080/kagent/api/a2a/kagent) instead of hitting kagent-controller:8083 directly, so A2A egress is authenticated and observed by agentgateway. Requires a klaus-gateway release that forwards the caller’s bearer token.