oauth.server.trustedIssuers[].acceptedTypHeaders: accepted JWT typ header values for Bearer tokens from a trusted issuer. Empty keeps the RFC 9068 default (at+jwt). Kubernetes ServiceAccount tokens carry no typ header; use [""] to accept them.Full Changelog: https://github.com/giantswarm/muster/compare/v0.4.3...v0.4.4
Full Changelog: https://github.com/giantswarm/muster/compare/v0.4.2...v0.4.3
Full Changelog: https://github.com/giantswarm/muster/compare/v0.4.1...v0.4.2
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.202...v0.0.203
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.201...v0.0.202
trustedAudiences) are no longer hard-rejected when the same issuer is also configured in trustedIssuers for the token-exchange broker — fixes Backstage AI-chat SSO forwarding returning 401 behind the agentgateway.trustedAudiences) are no longer hard-rejected by the trusted-issuer Bearer branch when the same issuer is also configured in trustedIssuers — fixes Backstage AI-chat SSO token forwarding returning 401 (typ header is "", expected "at+jwt") on deployments with the token-exchange broker enabled.gateway.jwksEgress now also opens egress on the agentgateway controller network policy
(Cilium and kubernetes flavors). The controller fetches remote JWKS centrally and distributes
keys to the data plane via xDS, so the data-plane-only rule left JWKS fetches timing out
(e.g. Dex on giantswarm/dex:5556 for extra JWT providers).agentgateway.jwt.extraProviders value lets the
inbound agentgateway JWT policy accept tokens from additional issuers (e.g. Dex-issued ID tokens
forwarded by Backstage AI chat alongside muster-issued JWTs, giantswarm#36840). Also fixes the
identityProviders values schema that rejected every populated provider map.templates/kagent/declarative-agent-pod-security.yaml: retarget the Kyverno mutate from Deployment (controller output) to Agent CR (controller input). The previous policy patched the Deployment after the kagent controller had already stamped privileged: true on the git-skills path, causing the API server to reject the Deployment as self-contradictory (privileged: true + allowPrivilegeEscalation: false). Mutating the Agent CR instead sets allowPrivilegeEscalation: false on the controller input, which trips the controller’s own guard and prevents privileged: true from being set in the first place. A (type): "Declarative" condition anchor scopes the mutation to Declarative agents only.