Added
components.<name>.semverFilterandgitops.self.semverFilterselect a dev channel: a Go regexp rendered asOCIRepository.spec.ref.semverFilter, which Flux applies to the registry’s tags before it evaluates the semver range. With a prerelease-admitting range (>=3.0.0-0 <4.0.0-0) and the filter of one branch’s dev builds (.*-dev\.<sanitized-branch>\..*) a component — or, under self-management, the chart itself — follows that branch’s newest build and never falls back to a stable tag. Unset by default. The deadcomponents.<name>.filterTagsblock (an ImagePolicy field, never an OCIRepository one, undeclared in the schema) is gone.
Changed
- BREAKING — meta chart 4.0:
components.kagentdelivers the kagent line (kagent API v2,kagent.dev/v1alpha3).components.kagentand the new roster entrycomponents.kagent-crdsresolve the chartskagentandkagent-crdsof giantswarm/kagent-upstream (upstream kagentmainat a pinned commit plus the carried patches) fromoci://ghcr.io/giantswarm/kagent/helmon the line’s release range>=0.11.0-gs.1 <0.11.1-0— the releases0.11.0-gs.Nof upstream 0.11.0, not the line’s0.11.0-dev.giantswarm.…builds (Flux’s Masterminds semver compares prerelease identifiers left to right,dev<gs; the-0on the ceiling admits prereleases at all, and the ceiling holds the patch because a prerelease is confined to no patch tuple; a bare0.11.0would be admitted, should upstream’s release ever appear at this OCI path) — instead of thegiantswarm/kagent0.x wrapper (kagent 0.10,v1alpha2) from gsoci.kagent-crdsrenders the five v1alpha3 CRDs as templates carryinghelm.sh/resource-policy: keep(nocrds/dir, nocrds:policy), followscomponents.kagentunless switched explicitly (agent-platform.componentEnabled), the kagent release and the connectivity releasedependsOnit, and the render refuses kagent on without it (agent-platform.validateKagentCrds). Thekagent:block names one build of the line:registry: ghcr.io, the fork’s image names (giantswarm/kagent/{controller,golang-adk,ui}), an explicittagequal to the chart version of the build (upstream’s chart falls back to.Chart.Version, which under helm-controller is<version>+<oci digest>, an invalid image tag),kagent.harness.image— the Go ADK image by digest the connectivity chart renders the platformHarnessfrom (the CRD accepts no tag) —controller.substrate.*(ate-api,atenet-routerinate-system, the default WorkerPool) andsubstrateWorkerPool(kagent-default, four gVisor workers on the Giant Swarm Substrate line’s worker image), pgvector on the bundled Postgres; a re-pin of the line moves the tag, the digest and the two ranges together from the fork’sbuilds.mdledger (README “Re-pinning the kagent line”). Every sibling range selects the kagent API v2 line:agent-platform-connectivity>=4.0.0 <5.0.0(its own major; the 3.x line held<4.0.0),agent-managerandbackstage1.x(their 1.0 releases; until published the ranges resolve nothing — both are off by default),model-manager>=0.20.0 <1.0.0(0.20.0 renders the ModelConfig version the cluster serves; the line stays 0.x); nosemverFilteranywhere by default,gitops.self.semverFilterempty.agent-manager.agentChart.semverdefaults to1.x(wasx.x.x, which would have rolled the Generic agent chart 1.0.0 to every existing agent the moment it is published).examples/customer-bom.yamlpins the line (kagentandkagent-crds0.11.0-gs.1— the same release, one build —agent-platform-connectivity4.0.0,agent-managerandbackstage1.0.0,model-manager0.20.0). Every installation acts (UPGRADE.md “3.x → 4.0”): the release is inert until the fleet’sagent-platformrange bound (<4.0.0) is lifted per installation; a 4.0 installation with kagent on needs Kubernetes 1.35 with theClusterTrustBundle,ClusterTrustBundleProjectionandPodCertificateRequestfeature gates and Agent Substrate inate-system.make verify-meta(tests/verify-kagent-wiring.py, withtests/fluxsemver.pyreimplementing Flux’s constraint semantics offline) asserts the sources, the range’s admitted and refused shapes, one build (tag and range on one upstream version, the Harness image a digest), the omitted keys and the retired ones;make verify-componentsthe sibling ranges, kagent-crds following kagent and the BOM;make verify-components-chartspulls the managers’ and the kagent line’s charts at what the ranges resolve to (the way Flux resolves,-gs.Nprereleases included) and renders the forwarded blocks against them — while a range waits for an unpublished release (a sibling’s 1.0, the line’s first tag) it renders against the buildkagent.tagnames or the newest 0.x and says so.
Removed
- The ten bundled example agents’ value blocks (
kagent.k8s-agent…kagent.cilium-debug-agent, eachenabled: falsewithnamespaceOverride: kagent),kagent.controller.skillsInitImageand theMETRICS_BIND_ADDRESS/METRICS_SECUREentries ofkagent.controller.env: the kagent line ships none of the agents and no skills-init image, and its controller serves no Prometheus/metrics. With thatkagent.serviceMonitor.enableddefaults tofalsein both charts and the forwardedkagent.controller.metrics.enabledisfalseexplicitly — the connectivity chart’s controller metricsServiceandServiceMonitorand upstream’s metrics Service would point at a port nothing listens on and sit atup=0; nothing reads those metrics (the fleet’sKagentControllerDownreads kube-state-metrics).make verify-globalasserts the default renders no kagent monitor and thatkagent.serviceMonitor.enabled: truestill renders it under the global gate; both go back on when upstream serves metrics. The ATS kind smoke keeps kagent and agent-manager off and skips the agent round trips with the reason while the cluster has neither the feature gates nor Substrate (tests/ats/values-kagent.yaml,KAGENT_ON); agentlab proves them, giantswarm/agent-platform#343 turns them back on.