1. Docs
  2. Changes and releases

agent-platform release v3.20.3

AI Agents agent-platform v3.20.3

Added

  • The ATS proves the product on every PR (roadmap#4348, PRD Q8; tests/ats/, README “Development”). The kind smoke is the quick start on a bare cluster: the Gateway API CRDs, a lab Dex (tests/ats/lab-dex.yaml, ported from the standalone chart — static users, the platform identity Secret, a self-signed CA, a CoreDNS rewrite; Dex terminates TLS itself, there is no edge Gateway on kind) and an in-cluster registry the candidate archive is pushed to (tests/ats/registry.yaml, helm push --plain-http); helm install --wait with the bundled engine, muster and its OAuth server, dicebear, connectivity, kagent and agent-manager (tests/test-values.yaml + tests/ats/values-kagent.yaml + tests/ats/values-round-trips.yaml) and self-management on against that registry at the candidate’s exact version (a branch build is a prerelease, which the derived range never matches — Masterminds semver). It asserts the install’s promises (deployed, FluxInstance Ready, every component HelmRelease Ready as agent-platform-flux, the operator on the Flux CRDs, the kagent namespace), the adoption (helm history = the install + one adoption revision), the auth round trip (401 with the RFC 9728 chain; a Dex user through the OAuth password grant with the cross-client audience, and through muster’s login flow — RFC 7591 registration, code + PKCE, the Dex form), the agent round trips (a declarative Agent Ready against the default ModelConfig with a placeholder key; agent-manager’s create_agent through muster as the Dex user with the forwarded token → OCIRepository + HelmRelease of the agent chart in kagent, executed as kagent-flux, Ready → the Agent Ready — the Flux write path the standalone smoke never had), the fixpoint two intervals after the adoption (history unchanged, the values Secret and helm get values equal to the values used), the refused helm upgrade (the admission policy’s message in Helm’s output, no revision) and the ordered teardown (helm uninstall --wait within budget, no Flux CRD left, the operator CRDs remaining, no controller, no Job of the release, no release, the policy gone; the agents’ HelmRelease objects gone with the CRDs, their Deployments and Agent objects orphaned in the kept kagent namespace). The own-Flux scenario (tests/ats/test_own_flux.py, the functional step) runs on the same cluster afterwards: Flux’s source-controller + helm-controller from the pinned upstream manifest, the chart through a HelmRelease from the in-cluster registry with components.flux.enabled: false — Ready, the platform HelmReleases Ready under that Flux without a serviceAccountName, no operator, no FluxInstance, one helm-controller, the Flux CRDs’ field managers exactly what flux install left — an agent through that Flux (OCIRepository + HelmRelease of the agent chart as kagent-flux, the Agent Ready), the render guard when the value is flipped on (the HelmRelease fails with this cluster runs Flux; set components.flux.enabled=false or install the chart through it; no operator, no FluxInstance, the platform and the agent still Ready, the Flux CRDs’ content unchanged — helm-controller applies a chart’s crds/ before it renders, so it joins the CRDs’ field managers with identical content, asserted and logged; flipped back it recovers) and the way back. .ats/main.yaml runs smoke and functional; upgrade stays skipped. The standalone chart’s tests/ats/test_smoke.py has no assertion this suite lacks (tests/ats/README.md, the parity table).
  • components.<name>.insecure (default absent): OCIRepository.spec.insecure: true for that component — a plain-HTTP registry, a lab’s in-cluster one; never a public registry. The ATS uses it to install the connectivity chart of the checkout from the in-cluster registry (components.agent-platform-connectivity.{repository,versionRange,insecure}), so a PR’s connectivity changes are tested on kind before they are released. make verify-insecure.

Fixed

  • The connectivity release’s Namespace for kagent (kagent.namespaceOverride) carries helm.sh/resource-policy: keep. Helm deleted it with the release — on helm uninstall of the platform, taking the agents’ workloads with it although the platform’s teardown is documented to leave them behind orphaned, and, worse, as the install remediation of a failed first install of the connectivity release: helm-controller uninstalls a failed first install before it retries, and that uninstall removed the kagent namespace and every kagent object in it while the kagent release believed itself installed (measured on the ATS kind smoke, where a PolicyException without its policy-exceptions namespace failed the connectivity install). Kept, the namespace survives both; the release adopts it on a reinstall as it adopts a namespace the cluster created. Management clusters see one annotation added to the kagent Namespace where kagent is on, nothing else.
  • The helm.sh/chart label of every object stays a valid label value at the versions the charts are actually installed under. helm-controller installs a chart with the OCI digest appended as build metadata (3.20.0+8c89e1be4cbf; the label helper turns + into _), and a branch build carries a long prerelease version (3.19.1-dev.<branch>.<date>.<time>.h<sha>, stamped by abs); the 63-character cut of <name>-<version> could land on that _, which the apiserver rejects (“must start and end with an alphanumeric character”) for every object of the release — measured on the self-management adoption of a branch build, whose failed revision then also poisoned helm uninstall (the hooks of the last revision carried the label). The chart helpers of both charts and of the flux-engine subchart trim _ after the cut as they trim - and .; make verify-labels (tests/verify-labels.py) packages both charts at versions whose cut lands on each separator and validates every label of the render. Published versions are short and were never affected; nothing changes in their render.