Fixed
- Downgrade bundled agentgateway and agentgateway-crds charts from
v2.2.1back tov1.2.1. The upstream project releasedv2.2.xbefore resetting semver tov1.0.0;v2.2.1is older thanv1.0.0and was incorrectly treated as an upgrade (agentgateway/agentgateway#1249). Block the bogusv2.2.xrange inrenovate.json5. templates/agentgateway/agentgatewayparameters.yaml: data-plane image override moved from the deployment container spec tospec.image.registry/repository/tag. DropsAGW_XDS_SERVICE_NAMEfromcontroller.extraEnvand removes the explicit controller image tag pin: the v1.2.1 chart already setsAGW_XDS_SERVICE_NAME: agentgateway-controllercorrectly viafullnameOverride, and the controller image tag defaults to the chart’sappVersion(v1.2.1) when unset.templates/kagent/ui-httproute.yaml: oauth2-proxy backend name now resolvesoauth2-proxy.fullnameOverridefrom values (falling back to<release>-oauth2-proxy), so theHTTPRoutepoints at the correct service whenfullnameOverride: kagent-oauth2-proxyis set.- Bundled kagent declarative agents (
cilium-policy-agent,promql-agent, and all others) now deploy into thekagentnamespace. The kagentkagent.namespacehelper resolvesnamespaceOverridefrom the subchart’s own.Valuesscope; the parent chart’skagent.namespaceOverride: kagentis not visible there, so agents were landing in the Helm release namespace (agentic-platform). Bothdefault-model-config(ModelConfig) andkagent-tool-server(RemoteMCPServer) live inkagentand are resolved by bare name within the agent’s own namespace, causing every agent to showAccepted=False. Each bundled agent subchart block now setsnamespaceOverride: kagentexplicitly. templates/kagent/ui-backendtrafficpolicy.yaml: route-levelBackendTrafficPolicyfor the kagent UIHTTPRoute. The cluster-widegateway-giantswarm-default-error-pagespolicy replaces all 4xx/5xx bodies with static HTML; without a route-level override, Envoy replaces oauth2-proxy’s 403 sign-in page body (which meta-refreshes to/login) with that static page, breaking the login flow entirely. Any route-levelBackendTrafficPolicyoverrides the gateway-wide one, so this policy is rendered withenabled: trueby default wheneverkagent.uiRoute.enabled: true.
Added
klausGateway.enabled(defaultfalse) addsgiantswarm/klaus-gatewayas an opt-in conditional dependency (condition: klausGateway.enabled, aliasklausGateway). With the flag unset or false the rendered output is byte-identical to the previous chart version. When enabled, the sub-chart installs the Klaus Gateway Deployment, Service, RBAC, and ChannelRoute CRD (viacrd.install: true). The sub-chart’s own agentgateway dependency is disabled (klausGateway.agentgateway.enabled: false) so the umbrella’s bundled agentgateway is reused.- Single
ingress.modetopology selector (muster-direct|agentgateway-muster|agentgateway-direct) that declares the whole request topology in one place. The umbrella now owns both public routes — muster’s/catch-all (newtemplates/ingress/muster-httproute.yaml, rendered in all modes) and the agentgateway/mcpinterception route — fed from a single sharedingress.parentRefs/ingress.hostnames, so the two routes can no longer drift. A template-time guard (templates/validate.yaml) fails fast on an invalid mode, oningress.parentRefsempty in any mode (the umbrella-owned muster/route attaches to it — an emptyparentRefswould otherwise render a route bound to no Gateway), and onagentgateway.enabled/agentic-platform-mcps.agentgateway.viaMusterdisagreeing with the mode. agentgateway.enabled(defaultfalse) gates the agentgateway controller dependency viacondition: agentgateway.enabledinChart.yaml. In the defaultmuster-directmode the controller, itsGatewayClass, the data-planeGateway/AgentgatewayParameters, and the data-plane NetworkPolicies are not installed.agentgateway-directmode is modelled but fail-guarded — install is blocked with a clear message until a DCR-capable IdP (RFC 7591/8707) lands.make verify-modestarget (wired into a new CircleCI branch test job) asserts the fail-guards fire;ci/test-full-stack-values.yamlnow exercises the previously-untestedagentgateway-musterpath.- Route-scoped
BackendTrafficPolicyfor muster’s/route (newtemplates/ingress/muster-backendtrafficpolicy.yaml), rendered in all modes wheningress.backendTrafficPolicy.enabledis set — not just the agentgateway/mcproute. This preserves muster’s401 … WWW-Authenticatechallenge against the cluster-wide error-pages policy inmuster-directmode (where muster serves/mcpdirectly) and restores the pre-refactormuster.gatewayAPI.backendTrafficPolicybehavior on muster’s own route. - Per-route
ingress.httpRoute.muster.{annotations,labels}andingress.httpRoute.mcp.{annotations,labels}overrides, merged on top of the sharedingress.httpRoute.{annotations,labels}(per-route keys win on collision). Lets a downstream diverge one route — e.g. a different cert-manager issuer or Envoy route policy per route — without forking the shared block. kagent-crds(v0.9.5,oci://ghcr.io/kagent-dev/kagent/helm) bundled as a sub-chart. Installs the kagent CRDs (Agent,AgentHarness,ModelConfig,MCPServer,RemoteMCPServer,Memory,ToolServer,SandboxAgent). Must be installed before theagentic-platformchart whenkagent.enabled: true. Note: upstream does not mark these CRDshelm.sh/resource-policy: keep;helm uninstall agentic-platform-crdswill remove them and cascade to all kagent CRs.kagent(v0.9.5,oci://ghcr.io/kagent-dev/kagent/helm) bundled as a conditional sub-chart (kagent.enabled, defaultfalse). All kagent resources land inkagent.namespaceOverride(defaultkagent) so they stay separate from the umbrella’s release namespace. Thekagent-crdschart is added toagentic-platform-crdsas a prerequisite. Enabling kagent requiresagentic-platform-crdsto be installed first.kagent.oauth2-proxy.metrics.serviceMonitor.enabled: true— PrometheusServiceMonitorfor the oauth2-proxy metrics endpoint (:44180), labelledobservability.giantswarm.io/tenant: giantswarm.templates/kagent/netpol.yaml: oauth2-proxy ingress CNP extended to allow scraping of the metrics port (:44180) from any cluster-entity source, and oauth2-proxy egress extended to includeclusteralongsideworldon port 443 — required when the Dex hostname resolves to an internal LB VIP (private-range IP classified asclusterby Cilium, notworld).postgresblock: opt-in CloudNativePGClusterCR (postgres.enabled, defaultfalse) provisioning the kagent application database in a namedkagentschema (notpublic). Supports pgvector viapostInitTemplateSQL(any CNPG version, bundled image) or the ImageVolume approach (postgres.vector.extensionImage.reference, CNPG 1.29+/PG18). The CNPG operator and its CRDs remain a cluster-level prerequisite. An optional Klaus sessions database (postgres.sessionsDatabase.enabled, defaultfalse) is templated but left off pending the core-runtime persistence decision.templates/namespace.yaml: renders thekagentNamespacewhenkagent.namespaceOverridediffers from the release namespace, so fresh installs do not require manual namespace pre-creation.templates/kagent/controller-route.yaml: opt-inAgentgatewayBackend+HTTPRoute(kagent.controllerRoute.enabled) exposing the kagent controller API through agentgateway with JWT validation.templates/kagent/netpol.yaml: cross-namespace network policies for kagent (cilium and kubernetes flavors, gated onnetworkPolicy.flavor). Cilium: egress from agentgateway data-plane to kagent controller (port 8083) + ingress policy in the kagent namespace. Kubernetes:NetworkPolicyrestricting kagent controller ingress to the release and kagent namespaces, preventing direct access that would bypass agentgateway JWT validation.templates/kagent/ui-httproute.yaml: opt-in HTTPRoute (kagent.uiRoute.enabled) exposing the kagent UI on the public Gateway. Whenoauth2-proxy.enabled: trueroutes through oauth2-proxy (port 4180); otherwise routes directly to the UI (dev only). Placed in the kagent namespace to avoid cross-namespace backend refs.ci/test-postgres-values.yaml: CI values file exercising the kagent+postgres path throughhelm template/lint.ci/test-kagent-routing-values.yaml: CI values file exercising controllerRoute + uiRoute + oauth2-proxy.- Kagent defaults hardened for GS clusters: restricted-PSS
securityContextapplied at umbrella level (Kyverno requirement); bundled agents/tools disabled with comments explaining why and under what conditions to re-enable; Anthropic set as the default model provider (claude-sonnet-4-6); OTel traces and logs routed tootlp-gateway.kube-system.svc:4317;controller.auth.mode: trusted-proxy(agentgateway validates the JWT upstream and the netpols fence the controller);oauth2-proxyvalues pre-wired for Dex OIDC integration (enabled: falseuntil Dex client credentials are provided).
Fixed
- In-cluster MCP backends that listen on a non-80/443 port (e.g. the bundled
pro/runbooksMCP servers on8080, reached via a ClusterIP) were unreachable from muster — its sub-chart CNP permits cluster-entity egress only on 80/443, so those connections timed out and the correspondingMCPServers wentFailed. The umbrella now renders a supplementaryCiliumNetworkPolicy(<muster>-mcp-egress) that widens muster’s egress tonetworkPolicy.musterInClusterMcpPorts(default[8080]; cilium flavor only; Cilium policies are additive, so no sub-chart fork). Set to[]to disable. - Muster Service name is now pinned via
muster.fullnameOverride: agentic-platform-muster, read directly by the umbrella’sagentic-platform.musterFullnamehelper instead of re-deriving the muster sub-chart’s release-name algorithm. The routebackendRef, theBackendTrafficPolicytarget, andagentic-platform-mcps.musterUrlnow reference one source of truth that stays in lockstep with the sub-chart’s Service regardless of release name or any future muster naming change. A blank override fails the render loudly rather than silently pointing the route at a non-existent Service (503).
Changed
- Bumped bundled
musterto0.2.6(includes the muster#772 JWT signing-key wiring fix +jwt_key.goenabling edge JWT validation, and the CNP ingress-gateway egress fix from muster#788). - Bumped bundled
agentic-platform-mcpsto0.2.4— corrects theidentityProvidersvalue schema (it wasadditionalProperties: falsewith no properties, forbidding every provider key and makingauth.mode: exchangeunconfigurable). Unblocks multi-cluster token-exchange consumers;forward-only installs are unaffected.
Removed
- Breaking:
gateway.enabled,gateway.httpRoute.*, andgateway.backendTrafficPolicy.*are removed — replaced byingress.mode(topology switch),ingress.parentRefs/ingress.hostnames(shared route attachment), andingress.backendTrafficPolicy.*. The retainedgateway.*keys now hold data-plane infrastructure only and apply inagentgateway-*modes.muster.gatewayAPI.enabledis nowfalse(the umbrella renders muster’s public route) — setingress.parentRefs/ingress.hostnamesinstead ofmuster.gatewayAPI.httpRoute.*.