agent-platform release v3.17.0

Added

• kagent.fluxServiceAccountName (default kagent-flux), in both charts: the tenant identity of the agents’ Flux HelmReleases, from ONE value. The connectivity chart renders ServiceAccount kagent-flux in the kagent namespace with a RoleBinding to cluster-admin (namespace-scoped admin: full control of the kagent namespace, nothing outside it) whenever kagent is on (templates/kagent/flux-service-account.yaml); the meta chart derives agent-manager’s flux.helmReleaseServiceAccount from the same value (agent-platform.componentDerivedValues, merged over the forwarded agent-manager block — agent-manager.flux.helmReleaseServiceAccount is no longer set in values.yaml, and a value set there must agree or the render fails naming the one key); and the agent-platform.kagent.fluxServiceAccountName helper exports it for the portal’s agentPlatform.fluxServiceAccountName. Changing it in one place changes all three; an empty value renders no identity and hands both callers an empty name. Under a Flux multi-tenancy lockdown (helm-controller with --no-cross-namespace-refs and a rights-less default ServiceAccount, or the Flux multi-tenancy admission policy on Giant Swarm management clusters) a HelmRelease without it runs as the default ServiceAccount and fails with secrets is forbidden. make verify-identity (in CI) asserts the objects, the single value across the three consumers, the guard and the empty case. No installation needs to act: a management cluster carried the same two objects hand-written in its Flux bases; the chart’s copy has the same spec, helm-controller takes ownership of them on the upgrade (its default) and both writers set the same fields. The hand-written copy is removed from the bases in a follow-up.

Fixed

• Six of the text patches the standalone umbrella’s generator applied to its copy of the connectivity templates were bugs here too and are fixed at their upstream location, so no generator is needed:
  • The kagent UI HTTPRoute (kagent.uiRoute without oauth2-proxy) targets the Service the kagent chart names from kagent.fullnameOverride (kagent-ui), not <release>-ui — as the oauth2-proxy branch and the controller route already did. The fleet runs the oauth2-proxy branch, so its render is unchanged.
  • The muster / HTTPRoute renders only while the muster component is on (components.muster.enabled): hostname-less on a shared Gateway, it blackholed every request when an umbrella turned muster off. The meta chart force-enables muster, so the fleet render is unchanged.
  • ingress.mode: muster-direct refuses the knobs that render agentgateway.dev objects or attach to the agentgateway Gateway — kagent.controllerRoute.enabled, klausGateway.agentgatewayRoute.enabled, and agent-platform-mcps’ agentgateway.enabled with mcpServers set — naming the knob, instead of shipping objects the API server rejects on a cluster without the agentgateway CRDs (the model-manager / agent-manager routes already guarded themselves this way). ci/test-klausgateway-obo-values.yaml moves to agentgateway-muster, ci/test-mcps-values.yaml sets agent-platform-mcps.agentgateway.enabled: false; every management cluster runs agentgateway-muster.
  • The legacy component-toggle probe (agent-platform.validateLegacyToggles, both charts) reports a leftover <block>.enabled whatever its value, also true under a component that is on: neither chart has a Helm dependency, so no chart default is ever coalesced into those blocks and the key can only be the operator’s. The “on + true passes” leg and its prose described an umbrella that feeds the blocks to real dependencies (the standalone patched both); make verify-modes asserts the strict probe in both charts.
  • The kserve API guard of the model-manager wiring defers to the platform’s own KServe when it is bundled: with components.kserve-resources or components.modelServing on, that component’s guards own the check (a missing API is then the first install) and the message names the components. The new agent-platform.optionalComponentEnabled helper treats a component absent from the roster as off — unlike componentEnabled, whose absent-is-on rule is for the force-on components.
  • The agent-platform.serviceMonitor helper’s prose stated default true, which an umbrella flipped; with the knob defaulting to auto (#291) the prose says so and no umbrella has a reason to flip it.