1. Docs
  2. Changes and releases

agent-platform release v4.1.0

AI Agents agent-platform v4.1.0

Changed

  • Connectivity 4.0 renders the kagent catalog at kagent.dev/v1alpha3 — kagent.modelConfigs[] (ModelConfig) and kagent.remoteMcpServers[] (RemoteMCPServer) in the kagent namespace, the spec fields unchanged; the only version the kagent line serves (#299). New make verify-kagent-crds (tests/verify-kagent-crds.py) validates every kagent.dev object of every ci/*.yaml shape and a catalog shape against the line’s CRDs at the pinned release (v0.11.0-gs.1: every field known to the CRD, the required fields, enums, the CEL rules the shapes can trip) and asserts no render of the chart carries kagent.dev/v1alpha2; a self-test proves the validator refuses an unknown field, a foreign provider block, a missing required field, a two-source header and a v1alpha2 object.
  • The muster MCP URL reaches the composers from one helper, agent-platform.musterMcpUrl (both charts: http://<muster.fullnameOverride>.<release namespace>.svc.cluster.local:<muster.service.port>/mcp while the muster component is on). The meta chart derives agent-manager’s chart value muster.url from it — next to flux.helmReleaseServiceAccount; a differing agent-manager.muster.url fails the render naming the source — and the connectivity chart renders it into the portal’s app-config as agentPlatform.musterMcpUrl. Both composers pass it to the Generic agent chart 1.x as muster.url, whose own default is the same URL on a default install (#299). make verify-identity, verify-wiring and verify-kagent-discovery assert it in both charts.
  • The connectivity chart is published on every branch push (push-connectivity-chart, in lockstep with the meta chart’s branch build: same commit, same version, gsoci and the test catalog), so a lab can follow a pull request’s connectivity chart through components.agent-platform-connectivity.versionRange + semverFilter; main publishes on tags only, as before.

Removed

  • The shared RemoteMCPServer agent-platform/muster (allowedNamespaces.from: All, the cross-namespace contract the Generic agent chart 0.x’s default serverRef depended on). On kagent API v2 an AgentTemplate binds a RemoteMCPServer of its own namespace and the binding carries no headers, so the Generic agent chart 1.x renders one per agent — muster’s URL, STREAMABLE_HTTP, the X-Muster-Toolset header, the kagent.dev/discovery: disabled label — and binds it (giantswarm/agent#25); Helm deletes the shared object with the connectivity release on the upgrade (#299). make verify-kagent-discovery is re-scoped: no RemoteMCPServer of the platform’s own targets muster, nothing the platform renders for muster carries a static header, the operator extras render v1alpha3 in the kagent namespace with tokenSecret as a Secret-sourced Authorization header and no opt-out label. docs/authentication.md describes the per-agent carrier and the opt-out label the agent chart sets.
  • The two Kyverno ClusterPolicies that mutated the kagent controller’s input — <release>-kagent-declarative-pod-security (spec.declarative.deployment.*SecurityContext on every Agent) and <release>-kagent-srt-settings (enableWeakerNestedSandbox into the per-agent srt-settings.json Secret) — and their README text: no Agent CR, no per-agent Deployment and no config Secret exists on kagent API v2 (#299). kyvernoPolicies keeps its keys — the seccomp PolicyException (re-targeted at the Substrate worker pods in #342), the CNPG exception and agentSandbox.podSecurity read them. make verify-modes asserts the two kyverno.io objects of the kagent + agent-sandbox shape and the absence of any Agent mutation; make verify-auto asserts it on every cluster shape.