Changes and Releases
Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.
Added
- (aggregator) Relay a backend’s URL elicitation, from allowlisted servers to the Dev Portal only in #1769 by @fiunchinho
- (aggregator) Complete a relayed backend URL elicitation: wait for and pass on elicitation/complete in #1773 by @fiunchinho
- (mcpserver) Spec.auth.grantScope makes a server that discovers its authorization server subject-scoped in #1757 by @marians
Fixed
- (aggregator) Sweep the sign-ins of gone organization namespaces after a restart in #1774 by @fiunchinho
Full Changelog: https://github.com/giantswarm/muster/compare/v5.56.3...v5.57.0
Fixed
- (aggregator) Retry a failed sign-in sweep of an organization namespace until it succeeds in #1770 by @fiunchinho
Full Changelog: https://github.com/giantswarm/muster/compare/v5.56.2...v5.56.3
Added
- Allow in-cluster ingress to the Policy Reporter MCP server’s port (
policy-reporter.mcp.port, default 9090) in the allow-kyverno-policy-reporter-talk-to-apiserver CiliumNetworkPolicy when policy-reporter.mcp.enabled is true, so muster and teleport-kube-agent can reach it. - Added
ciliumNetworkPolicy.imageVerificationEgress, enabled by default, which allows the Kyverno admission and reports controllers to reach the Giant Swarm container registry and Sigstore for image signature verification. Customers can add their own registries to the fqdns list.
Changed
- set size limits for emptyDir volumes
- Updated
policy-reporter to upstream version v3.11.2. - Updated
kyverno to upstream version v1.19.2. - Raise
policy-reporter-ui memory limit to 64Mi to stop OOM kills at startup. - Cap the
policy-reporter-ui and kyverno-plugin VPAs at 64Mi memory.
Fixed
- Point the
policy-reporter-ui and kyverno-plugin VPAs at their actual Deployments.
Added
- (gitops) Add gitops upgrade to migrate repositories between structure versions in #2169 by @weatherhog
- Template cluster emits Flux HelmRelease+OCIRepository for release charts in #2139 by @uvegla
Changed
Fixed
Full Changelog: https://github.com/giantswarm/kubectl-gs/compare/v5.12.5...v5.13.0
Fixed
- (server) Accept the 22-character state the Codex CLI sends in #1768 by @marians
Full Changelog: https://github.com/giantswarm/muster/compare/v5.56.1...v5.56.2
Changed
Kubernetes and AWS cluster info dashboards: CPU and network rate panels now use $__rate_interval instead of a fixed 3m window, so they stay smooth whatever the cAdvisor scrape interval.
Fixed
validate-dashboards reads the team list from giantswarm/github with a read-only token of the heraldbot App instead of architectbot’s expired ISSUE_AUTOMATION token, and runs on changes to its own workflow file (the path filter missed the leading dot).- Fix Grafana Cloud dashboard backup scripts failing with newer curl versions.
Removed
Added
- (agent-platform) Usage counts for agents, sessions and Customize in telemetry by @marians — For operators: where usage data is turned on, the portal also reports how many skills and tools an opened agent has, how many turns an opened session has and what the Customize page counts, as numbers without names.
- (agent-platform) One duration format for the Agent Platform by @marians — Durations across the Agent Platform read one way, such as
420 ms, 1.2 s, 2 min 30 s or 1 h 5 min, instead of 0 s for a fast reply or 300 s for a five-minute workflow. - (agent-platform) One link style across the whole portal shell by @marians — Links across the Agent Platform look the same everywhere, blue and underlined, on white pages, inside cards and in banners. Before, some were text-coloured and underlined only on hover.
- (agent-platform) Show only the workspace’s name on the session header’s chip by @marians — A session’s header shows only its workspace’s name, so a long name is no longer cut off; the last synchronization and the number of repositories fetched show on hover or keyboard focus.
- (agent-platform) Show created and connection times as relative dates by @marians — An agent’s creation time and a connector’s
Added date, last connection and next retry read as relative times, such as 3 days ago, with the exact local date and time on hover. The agent page shows its creation time once. - (muster) Default OAuth connectors to one sign-in for every session, and say when a sign-in covers the portal only by @marians — Where the app’s issuer URL is set, the new connector wizard defaults personal sign-ins to
Once, for the portal and every agent conversation; otherwise it warns that agents will ask again. A connector whose sign-in covers the portal only reads Portal only on the Connectors tab.
Changed
Fixed
- (agent-platform) Show clock times that can cross midnight relative to now by @marians — A model’s eviction from memory, a GPU node’s last model cache scan and a stalled agent’s last progress read relative to now, such as
in about 3 hours, with the exact time on hover, instead of a bare clock time that looked like today. - (agent-platform) Name time windows in words, not as PromQL durations by @marians — Usage and cost notes on the Agent Platform say
the last 7 days instead of the last 7d. - (agent-platform) Draw Model hosting’s tabs where cluster-manager runs without a serving layer by @marians — Wherever cluster-manager runs, Customize’s Models tab offers Model hosting, and its GPU pools and Model cache tabs show under all installations, so a kept model cache can be found and removed there.
- (agent-platform) Count cached input once in the session cost estimate’s rate by @marians — A session’s estimated cost is about twice what it showed before, closer to what the model provider bills, because cached input was counted twice. Its explanation says it is a 7-day average that can read low for short sessions.
- (agent-platform) Show what each cluster removal pass did and offer Finish removal only when it helps by @marians — The Delete cluster dialog shows what each removal step removed and what it is waiting for, and offers
Finish removal only once there is something left to remove, instead of a button that did nothing visible. - (app) Drop app.extensions entries that name no extension by @marians — For operators:
app-config.yaml no longer lists nav-item:* entries under app.extensions, which name no extension and log INVALID_EXTENSION_CONFIG_KEY at start-up. An instance’s own nav-item:agent-platform entry should go too. - (app, agent-platform) Retry the inbox’s read marks on a 503 and say when they fail by @marians — When the portal cannot save that you read your notifications,
Mark all read tries again by itself, and if that fails too the notifications panel says so and offers Try again. - (muster) Label chart days in UTC with the shared day helpers by @marians — On Usage and a connector’s Usage tab,
Tool calls by outcome labels each bar with the same day as the other Usage charts, also west of UTC. Its tooltip and a workflow’s Runs per day tooltip include the year. - (ui-react) Keep a multi-line hint’s line breaks in InfoHint’s tooltip by @marians — A status explanation of several sentences shows each sentence on its own line in its info icon’s tooltip, instead of one run-on paragraph, and a long word such as a model ID stays inside the tooltip.
Development and CI/CD
Full Changelog: https://github.com/giantswarm/backstage/compare/v3.29.0...v3.30.0
Changed
- Update
alloy apps to 0.25.0 (Alloy v1.21.3). mimir.rules.kubernetes now recovers after a Mimir outage during a leader change.loki_write_* metrics no longer carry the tenant label.
