agent-platform release v4.119.0

networkPolicy.mcpBackends: an in-cluster MCP backend reachable only through muster. A backend an installation registers with muster behind a ClusterIP admits every pod on the cluster unless something restricts it, and a direct call skips muster’s sign-in, audit trail and toolset scoping. Each entry (namespace, ports, optional podSelector, metrics, additionalPeers) renders agent-platform-connectivity-mcp-backend-<key> in the backend’s namespace, in the resolved flavour: on the entry’s ports it admits muster from the release namespace, networkPolicy.mcpBackendScrapers when metrics: true (default: alloy-metrics in kube-system) and the entry’s additionalPeers (e.g. the gateway in front of a backend with a public route); on every port it admits the namespace’s own pods; in the cilium flavour it also admits the kubelet’s probes (the host entity) on every port, since a backend may probe on another port than it serves. It is the ingress counterpart of networkPolicy.musterInClusterMcpPorts. make verify-mcp-backend-netpol asserts both flavours, and that nothing renders without entries or with networkPolicy.enabled: false.