1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents agent-platform v3.22.0

    Added

    • gitops.forbidPinnedLoginConnector (default false): with true the render fails when muster.muster.oauth.server.dex.connectorId is set, naming the key. A pinned connector makes muster (through mcp-oauth) append connector_id to every Dex authorization request, so Dex’s connector chooser never appears; on an installation whose Dex serves several identity providers — the operator’s and the tenant’s — the pin hides every other connector, and people from those providers either cannot sign in to muster or, when the pinned connector is not the provider their MCP-server allowlists (allowedGroups, RBAC) are written for, receive a token without those groups. Backstage and the kagent UI leave the choice to Dex; the knob lets a fleet template hold muster to the same rule against a per-installation override, at render time and with the same shape as gitops.forbidInlineSecrets. Meta-package plumbing: not forwarded to the muster release. No installation needs to act: off by default, every render is unchanged. make verify-login-connector asserts the four cases (default renders and forwards a pin; on plus a pin fails naming the key and never repeating the value; on plus an empty or absent key renders; the knob reaches no child release).
  • AI Agents muster v5.15.0

    Fixed

    • oauth.mcpClient.tokenExchange.allowPrivateIP (Helm: muster.oauth.mcpClient.tokenExchange.allowPrivateIP): the token endpoint of a remote Dex muster exchanges tokens with (spec.auth.tokenExchange.dexTokenEndpoint) may resolve to a private or loopback address – a management or workload cluster whose Dex sits behind an internal-only load balancer. Until now only --extra-ca-file lifted the token-exchange client’s SSRF guard, so an exchange against such a Dex failed with a DNS-rebinding error although the endpoint was reachable. Off by default; emits a startup warning when set; TLS verification is unchanged.
  • AI Agents agent-platform v3.21.2

    Fixed

    • The data-plane NetworkPolicy admits the Prometheus scrape of the agentgateway data plane (pod port 15020, /metrics), in both flavours. The PodMonitor this chart renders targets that port, but the policy’s only ingress rule listed the Gateway’s listener ports — 8080, and 8081 once llmRouting is on — so Cilium dropped every scrape: measured on graveler, the target reported up=0 with scrape_samples_scraped=0 for as long as the monitor had existed, JobScrapingFailure sat pending against it, and not one GenAI or HTTP series ever reached the tenant’s Mimir. The monitor was therefore inert from the moment it was added, and the LLM cutover’s whole point — tokens, cost and latency per model call — produced nothing on an installation that had done both rollout steps correctly. A second fromEntities: ["cluster"] rule now admits 15020, exactly as the sibling controller policy admits the controller’s own 9092/9093; the port is fixed by the agentgateway controller (it names the container port metrics and sets the prometheus.io/* annotations), not an operator choice, so it is written literally rather than as a value. Unconditional, like that sibling rule, because a cluster may scrape by pod annotation with no PodMonitor at all. An installation with the agentgateway component on gains one ingress rule on that policy and starts reporting the data plane’s metrics; nothing else changes and no pod rolls. make verify-llm-routing asserts the port in both flavours and with llmRouting off, where the monitor already renders; reverting either template fails it.
  • AI Agents agent-platform v3.21.1

    Changed

    • Ignore graphify-out/ (regenerable knowledge graph) in #322 by @teemow

    Full Changelog: https://github.com/giantswarm/agent-platform/compare/v3.21.0...v3.21.1

  • AI Agents klaus-operator v0.0.157

    Changed

    • Ignore graphify-out/ (regenerable knowledge graph) in #209 by @teemow

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.156...v0.0.157

  • AI Agents agent-platform v3.21.0

    Added

    • llmRouting (default enabled: false) in both charts: agent inference traffic through the installation’s agentgateway, so the data plane emits GenAI metrics — tokens by type, cost in USD, request duration, time to first token — for every model call. An installation that sets nothing renders byte-identically (the golden check pins this). When on, the connectivity chart renders an llm listener on the data-plane Gateway (llmRouting.listener, default port 8081), an AgentgatewayBackend for the provider, an HTTPRoute pinned to that listener by sectionName and matching the provider path prefixes (llmRouting.pathPrefixes, default /v1) so it outranks the agent-platform-mcps catch-all route, which attaches to every listener of the same Gateway and wins an equal match, one Gateway-scoped AgentgatewayPolicy carrying the route-type map (llmRouting.routes) and the agent attribution labels (llmRouting.metricLabels), and the model-price ConfigMap (llmRouting.modelCatalog) that the Gateway’s AgentgatewayParameters references. The gateway holds no provider credential: agent pods keep their own key and the client x-api-key header passes through, so reach to the listener grants no spend. Turning the listener on routes nothing by itself — the cutover is a second value, kagent.providers.anthropic.config.baseUrl, and rollback is its removal. The render fails when llmRouting.enabled is true without the agentgateway data plane, when the listener port collides with an existing one, or when llmRouting.pathPrefixes is empty or contains a bare /. See the connectivity chart README for the rollout.
    • A PodMonitor for the agentgateway data plane, gated on the agentgateway component and the shared metrics helper — not on llmRouting.enabled, so the MCP path is scraped too and the monitor exists before an LLM cutover. The data plane serves Prometheus text on pod port 15020; the controller-provisioned Service exposes listener ports only, so a ServiceMonitor would match nothing. It carries the same tenant label as the kagent ServiceMonitor, which alloy-metrics discovers monitors by.
    • kagent.modelConfigs[].baseUrl (optional): sends a chart-owned ModelConfig’s traffic through the LLM listener. Without it an extra ModelConfig calls the provider directly and its usage is unmetered.
  • AI Agents muster v5.14.4

    Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.14.3...v5.14.4

  • AI Agents klaus v0.1.3

    Changed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.1.2...v0.1.3

  • AI Agents klaus-operator v0.0.156

    Changed

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.155...v0.0.156

  • AI Agents muster v5.14.3

    Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.14.2...v5.14.3