agent-platform release v4.13.1

Fixed

• klaus-gateway’s egress reaches its stores: the platform’s Valkey and the Kubernetes API (giantswarm/agent-platform#443; a Cilium installation, 2026-09-14). The connectivity chart’s two policies selecting the gateway pod (-klausgateway-a2a-egress: DNS and the agentgateway data plane on 8080; -klausgateway-obo-egress: world / cluster on 443 and 10443) put it in Cilium default-deny egress and neither named the Valkey pods or the kube-apiserver entity — the API’s Service address is resolved by Cilium’s socket-LB before the policy applies, so the cluster port rule never matched it. Every installation ran the shapes that never leave the pod (memory routing, the bolt link store, no controller), so nothing showed it until klaus-gateway 1.3.0’s Secret link store (klausGateway.obo.store: secret, giantswarm/klaus-gateway#245) was switched on: the gateway crash-looped at start on read secret …/klaus-gateway-obo-links: … context deadline exceeded (not forbidden: the Role was there, the route was not) and was rolled back by hand after about 95 s of downtime; the Valkey routing store this release adds (klausGateway.routing.store: valkey, klaus-gateway 1.6.0, giantswarm/klaus-gateway#252) would have hung every binding write and the readiness probe the same way. A third policy, -klausgateway-store-egress, now renders exactly while a store or the controller reaches beyond the pod, one rule per store: the platform’s Valkey pods (agent-platform.valkey.podSelector, the release namespace) on valkey.valkey.service.port with routing.store: valkey and the valkey component on — an out-of-band Valkey (the component off) gets no rule, its egress is the installation’s; the kube-apiserver entity (cilium) / networkPolicy.kubernetes.apiServerCIDR (kubernetes) with obo.store: secret and OBO on, routing.store: configmap or crd, or controller.enabled; DNS as in the siblings (agent-platform.klausGateway.valkeyEgress / apiServerEgress; the keys are the klaus-gateway chart’s, forwarded by the meta chart and read with that chart’s defaults when unset). The default shape renders as before, byte for byte; the five policies selecting or targeting the pod now share one agent-platform.klausGateway.fullname helper. make verify-klausgateway-netpol asserts every gate (each store alone, both together, the port following the Service, the out-of-band Valkey, the Secret store with OBO off, the bolt routing store), both flavours, the selector following klausGateway.fullnameOverride and the off switches; ci/test-klausgateway-store-values.yaml lints the cilium render with both stores, ci/test-netpol-kubernetes-values.yaml the kubernetes one. Not reproducible in agentlab (networkPolicy.enabled: false, kind runs no Cilium): verified by render and the chart’s CI; the live proof is a store switch on a Cilium installation (hubble observe --verdict DROPPED on the gateway pod stays empty). No installation acts: every one runs the default shape; a switch to obo.store: secret or routing.store: valkey needs this release first — UPGRADE.md.