1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents muster v5.8.0

    Fixed

    • Authorization servers muster cannot discover or register with (GitHub). spec.auth.authorizationServer gains three optional fields: authorizationEndpoint/tokenEndpoint pin the endpoints of an authorization server that publishes no RFC 8414 document (muster then performs no discovery for that issuer and assumes S256 PKCE); clientCredentialsSecretRef names a Secret with a client registered out of band (a GitHub App or OAuth App), which muster uses instead of its CIMD URL or a dynamic registration (clientIdMethod: preregistered); grantScope: subject files the tokens under the user’s identity as well as the session, so any later session of the same person reuses the grant without a new consent until core_auth_logout on that server or “sign out everywhere”. Together they connect the hosted GitHub MCP server – or any in-house server that verifies GitHub tokens – to the person’s own GitHub account. See docs/how-to/connecting-non-rfc9728-mcp-servers.md.
  • AI Agents agent-platform v3.7.0

    Added

    • (model-manager) Accept a backends list — one model-manager in front of several serving backends: guards for every listed driver (enum, duplicates, Ollama/Lemonade endpoint, kserve API), one host-server egress rule per listed host backend and the Hub egress when kserve is listed, in both flavors in #263 by @teemow

    Full Changelog: https://github.com/giantswarm/agent-platform/compare/v3.6.0...v3.7.0

  • AI Agents klausctl v0.2.55

    Fixed

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.2.54...v0.2.55

  • AI Agents agent-platform v3.6.0

    Added

    • (model-manager) Accept backend lemonade — a Lemonade Server (FastFlowLM on AMD Ryzen AI NPUs, llama.cpp) as the second host-proxying backend: lemonade.{endpoint, agentHost} in the model-manager block, the render guard, and network-policy egress to its endpoint in both flavors in #261 by @teemow

    Full Changelog: https://github.com/giantswarm/agent-platform/compare/v3.5.0...v3.6.0

  • AI Agents muster v5.7.21

    Fixed

    • A forwarded-token rejection is now attributed to the token’s audiences, not only its issuer. When a forwardToken backend answers the forwarded ID token with 401, the log line and the auth://status detail used to name the token’s iss and hint at the issuer’s JWKS — which sent an investigation towards JWKS and egress when the backend had in fact trusted the issuer and refused the token’s audience (agent-manager on gazelle: the Backstage client’s audiences were not in its trusted set). The diagnostic now reads forwarded token iss=…, aud=[…]; the backend must trust this issuer's JWKS and one of these audiences, and when the backend’s 401 carries a WWW-Authenticate challenge its error and error_description are quoted as well (agent-manager sent no identity token to act with towards the Kubernetes API; muster used to drop the header at the transport). auth://status returns the same account in the server’s error field next to reauth_required / sso_attempt_failed, so a client can show why SSO failed instead of a generic pointer to an administrator; muster auth status --server <name> prints it as Reason:. Audiences are client identifiers, and the token itself is never logged. (#1141)
  • AI Agents muster v5.7.20

    Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.7.19...v5.7.20

  • AI Agents muster v5.7.19

    Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.7.18...v5.7.19

  • AI Agents agent-platform v3.5.0

    Added

    • modelManager.networkPolicy.egress (fqdns, cidrs, both empty): further destinations of model-manager on 443 whatever the backend — a private identity provider, a model mirror — the same knob agentManager.networkPolicy.egress already is. cilium: FQDN selectors next to the Hugging Face names and the Ollama endpoint, blocks as toCIDR; kubernetes: the blocks as ipBlocks (names are ignored, the flavor has no FQDN selector). networkPolicy.additionalEgressCIDRs / additionalEgressFQDNs now apply to the model-manager cilium egress for the ollama backend too (they used to render only for the kserve backend; the kubernetes flavor always applied them).
    • agent-platform.idpHosts helper in the connectivity chart: the hosts a service that validates tokens itself reaches at its identity provider, from the OAuth provider and the issuer URL — the Dex issuer host, or Google’s accounts.google.com, www.googleapis.com and oauth2.googleapis.com. agent-platform.idpEgress.cilium takes provider next to issuerUrl and renders one toFQDNs rule over those hosts.

    Fixed

    • The model-manager and agent-manager cilium network policies open egress to Google when the component validates tokens with oauth.provider: google. The IdP egress rule named the issuer host by FQDN and the per-component issuer helpers deliberately return nothing for the google provider, so a Google-backed install rendered no name at all: mcp-oauth’s JWKS fetch (www.googleapis.com/oauth2/v3/certs), userinfo fallback and discovery (accounts.google.com) timed out under policyEnforcementMode: always, muster’s forwarded-token sessions failed and the operator had to add the three hosts to agentManager.networkPolicy.egress.fqdns and open world:443 for model-manager by hand (agent-platform-standalone#106). The rule now derives the hosts from the provider: accounts.google.com (discovery, authorization), www.googleapis.com (JWKS, userinfo) and oauth2.googleapis.com (token, revocation) — the endpoints mcp-oauth’s google provider dials — next to the unchanged cluster entity on 443/10443. The dex render is byte-identical; the kubernetes flavor already opened every public destination on 443 while OAuth is on. make verify-managers asserts both providers and the new egress knob.
  • AI Agents agent-platform v3.4.0

    Added

    • modelManager.networkPolicy.ingress.additionalPeers and agentManager.networkPolicy.ingress.additionalPeers (default []), in both charts: extra callers the model-manager / agent-manager ingress policies admit on the Service port next to the agentgateway data plane and muster — a list of pod label maps (matchLabels) in the release namespace, rendered as fromEndpoints entries with io.kubernetes.pod.namespace pinned to the release namespace (cilium) or as podSelector entries (kubernetes). A non-empty list counts as a platform caller, so the no-caller placeholder peer does not render next to it; an item that is not a non-empty label map fails the render. For an umbrella that runs a portal next to the managers (the standalone chart’s Backstage, which patched the peer into its generated copies until now). make verify-managers covers it. No installation needs to act: the default render is unchanged.
  • AI Agents agent-platform v3.3.1

    Fixed

    • The model-manager values comment names KServe as a prerequisite of the kserve backend, not as something the Agent Platform does not bundle in #257 by @teemow

    Full Changelog: https://github.com/giantswarm/agent-platform/compare/v3.3.0...v3.3.1