agent-platform release v3.19.0

Added

• The standalone umbrella’s wiring, ported into the connectivity chart and gated on the component toggles the meta chart forwards (roadmap#4348, PRD Q6): with components.backstage on, the portal’s Agent Platform app-config ConfigMap agent-platform-backstage-app-config (the login provider from global.identity, one installation backstage.installationName, the in-cluster Kubernetes and muster entries, agentPlatform.fluxServiceAccountName from the one kagent.fluxServiceAccountName value, the skill repositories, the kagent / model-manager API routes when on, the pg block for backstage.database.engine: postgresql), the public HTTPRoute backstage.<domain> and a post-install/post-upgrade config-reload hook that stamps the rendered app-config’s checksum into the Backstage Deployment’s pod template (kubectl set env by label: a no-op while unchanged, a rolling update on a change, nothing on a first install) with its network policy in both flavors (templates/backstage/); with components.mcp-kubernetes on and muster on, the MCPServer CR that registers the server with muster — OAuth, forwardToken, requiredAudiences: [mcp-kubernetes.kubernetesAudience], the infrastructure tool-group label (templates/mcp-kubernetes/); with the new feature switch components.modelServing on (an entry without chart:: the loop renders no release for it and forwards its flag like every other; a top-level block named after a switch — modelServing: — travels with forwardAllValues only while the switch is on, so a live connectivity chart that predates the block never sees it), model serving on KServe with vLLM from the modelServing: block — the ClusterServingRuntime, the seven shipped serving presets and their discovery ConfigMap, the Hugging Face cache PVC, the Kyverno cache policies (modelServing.policies.enabled: auto, resolved with the other cluster-shape knobs) and the serving namespace’s network policies in both flavors (templates/model-serving/, files/model-serving/), plus the guard that a model-manager on the kserve backend agrees with the layer; the render fails with a clear message when components.modelServing is on without components.kserve-crd and components.kserve-resources (or a cluster that serves the serving.kserve.io APIs; modelServing.kserve.requireApi: false skips the check); and with components.kserve-resources / components.kserve-llmisvc-resources on, the controllers’ network policies and guards (templates/kserve/). The wiring’s own keys keep the standalone’s names minus components. — backstage.<hostname, parentRefs, installationName, extraScopes, startUrlSearchParams, enabledExtensions, disabledExtensions, skillsRepositories, catalogs, configReload> and mcp-kubernetes.kubernetesAudience live in the chart blocks and are dropped from the values forwarded to the strict component charts (components.backstage.omitKeys, components.mcp-kubernetes.omitKeys); modelServing.* is the standalone’s components.modelServing.* one-to-one; components.kserve.* maps onto the four kserve component toggles (README, “Turning on the standalone’s extras”). The seven values blocks of the extras are no longer held back from the connectivity release (components.agent-platform-connectivity.omitKeys is empty), the connectivity release dependsOn muster (the MCPServer CRD) and backstage dependsOn agent-platform-connectivity (its pod mounts the ConfigMap rendered there). The kagent UI route guard from the standalone lands too: a kagent.uiRoute.hostname override with an oauth2-proxy redirect-url still derived from global.domain fails the render. global.identity.ca (secretName, key) is declared by the connectivity chart and accepted by the meta chart (global.identity is additionalProperties: true there — no default, so the global block injected into every component release is unchanged). make verify-wiring (in CI) asserts off = no object, the objects and guards on, both flavors and the vanilla shape, and the meta chart’s forwarding. No installation needs to act: every toggle is off on the fleet; the connectivity HelmRelease’s values gain the seven blocks and the modelServing roster line, its dependsOn gains muster, and the connectivity chart renders byte-identical objects from them — one Helm revision of that release, no object change, no pod rolled.