Added
- Initial agentic-platform chart bundling
muster0.1.197 andagentgatewayv1.2.1. Gateway(nameagentgateway) andAgentgatewayParametersoverlay injecting restricted-PSSsecurityContexton the controller-rendered data-plane pod.gateway.parameters.serviceType(defaultClusterIP) overlaysAgentgatewayParameters.spec.service.typeso the data-plane Service stays internal; the controller hardcodesLoadBalancer.gateway.parameters.dataPlaneEnv,dataPlaneVolumes,dataPlaneVolumeMountsstrategic-merge lists on the AgentgatewayParameters overlay.CiliumNetworkPolicyfor the agentgateway controller pod in addition to the data-plane pod (upstream agentgateway chart ships no policies).networking.k8s.io/v1 NetworkPolicyrendering whennetworkPolicy.flavor: kubernetes— best-effort (no entity selectors, no FQDN egress).networkPolicy.kubernetes.{apiServerCIDR,worldExcludedCIDRs}for thekubernetesflavor.- Top-level
extraObjects: []rendering arbitrary manifests throughtplalongside the chart. values.schema.jsoncovering top-level keys with a cross-field combo check (muster valkey storage requiresvalkey.enabledor an explicit URL).UPGRADE.mddocumenting the breaking changes for the first stable release.
Changed
- CRD lifecycle:
agentgateway-crdsis a cluster prerequisite (upstream agentgateway ships controller + CRDs as separate charts). Muster’s CRDs continue to ship inside the umbrella via the muster sub-chart’stemplates/crds.yaml. - Data-plane policy selector switched to the Gateway-API standard label
gateway.networking.k8s.io/gateway-name=<gateway.name>(wasapp.kubernetes.io/name=agentgateway, which matched both the controller and the data plane). - Controller policy selector uses the agentgateway sub-chart’s selector triple (
agentgateway: agentgateway+app.kubernetes.io/name=agentgateway+app.kubernetes.io/instance=<release>). - Data-plane CNP gains xDS egress to the controller on TCP 9978; controller CNP gains xDS ingress from data-plane pods.
CiliumNetworkPolicyegress coverskube-dns,coredns,k8s-dns-node-cacheon 53 + 1053 (UDP + TCP); world 80/443; cluster 80/443 for in-cluster ingress (Dex / MCPServers); muster on 8090.- Muster sub-chart’s NetworkPolicy values migrate from
ciliumNetworkPolicy.*tonetworkPolicy.{enabled,flavor,cilium.allowClusterIngress,kubernetes.*}(muster 0.1.197). Umbrella overridesenabled: true,flavor: cilium,cilium.allowClusterIngress: true. valkey.enabledandmuster.muster.oauth.server.enableddefault totrue. Operators must provideoauth.server.baseUrl,oauth.server.dex.{issuerUrl,clientId},oauth.server.existingSecret, andvalkey.valkey.auth.usersExistingSecret— muster’s template-time fail-guards reject install otherwise.muster.gatewayAPI.httpRoute.parentRefs/.hostnamesno longer default to the data-plane Gateway. Muster’s HTTPRoute must attach to the cluster’s public Gateway (typicallyenvoy-gateway-system/giantswarm-default); the muster fail-guard enforces this.- Bundled
giantswarm/valkey-app0.1.2 as a conditional sub-chart (condition: valkey.enabled). Single Deployment + PVC; Service atmuster-valkey.<namespace>.svc:6379. ACL-based auth: adefaultuser with full permissions reads its password fromvalkey-passwordinvalkey.valkey.auth.usersExistingSecret. - Muster wired to the bundled valkey by default:
muster.muster.oauth.server.storage.type=valkeyandstorage.valkey.url=muster-valkey:6379. Inert whileoauth.server.enabled: false; kicks in the moment OAuth is enabled. networkPolicy.flavorenum changed fromcilium | nonetocilium | kubernetes. Opt out vianetworkPolicy.enabled: false.- README is now Flux HelmRelease-first (no Giant Swarm App platform). Adds a “Gateway API CR ownership” section clarifying that only
AgentgatewayParametersis vendor-specific to agentgateway. - Templates grouped under
templates/agentgateway/(Gateway, AgentgatewayParameters, four NetworkPolicy variants). Chart.yamldescription reflects the runtime contract (muster + agentgateway + opt-in Valkey; CRDs as cluster prerequisite).appVersionstays at the umbrella’s own0.1.0.
Removed
bootstrap.oauth.*values and thetemplates/oauth-bootstrap-secret.yamlHelmlookup-based Secret generator. UseextraObjectsto ship the Secret in the same release, or pre-create it out of band and reference viamuster.muster.oauth.server.existingSecret.