agent-platform release v4.139.0

Added

• A ModelConfig in an Organization namespace names only a tenant credential; the platform’s copied Secrets are written only by agent-manager. With kagent on, the ValidatingAdmissionPolicy agent-platform-tenant-model-credentials (Fail, bound with Deny) refuses, in every namespace labelled giantswarm.io/organization but the kagent namespace and for every requester, a ModelConfig (any served version) whose spec.apiKeySecret is not a tenant-credential-* Secret, the prefix an EgressPolicy’s secretKeyRef already keeps there. The exception is agent-manager’s tenant reconciler (agent-manager on and tenants.organizations.enabled), which writes the copy of the platform’s default ModelConfig. A ModelConfig without apiKeySecret is admitted. With agent-manager on and tenants.organizations.enabled, agent-platform-tenant-platform-secrets (Fail, Deny) lets only the reconciler’s ServiceAccount create, update or delete a Secret in those namespaces that carries its label agent-manager.giantswarm.io/tenant-object (before or after the write) or is named as the default ModelConfig’s key Secret (kagent.providers.<default>.apiKeySecretRef); the namespace and garbage collectors may delete one, so a namespace can still go. Every other Secret there, the tenant’s tenant-credential-* ones included, stays with RBAC. agent-platform-tenant-platform-secret-refs (Fail, Deny, same switches) refuses there, for every requester, an Agent or AgentTemplate whose skill or plugin git source names the copied model key Secret as credentialRef, and a RemoteMCPServer whose headersFrom names it as a Secret; other Secrets stay referable (agent-manager names the installation’s skills credential). A key Secret named with the tenant-credential- prefix fails the render. An installation with an Organization’s own ModelConfig on a Secret without the prefix renames that Secret to tenant-credential-<name> before the step; the existing ModelConfig keeps working until its next update. make verify-tenant-rbac asserts both policies’ shape. Needs Kubernetes 1.30 or later.

Fixed

• The kagent namespace’s EgressPolicies are no longer readable by every signed-in person. agent-platform:user read egresspolicies.api.kagent.dev in every namespace that binds it, and the kagent namespace binds it to tenants.platform.users (default system:authenticated), so the platform tenant’s egress origins and the names of the Secrets they use were listed to everyone. The kagent namespace now binds tenants.platform.users to the new ClusterRole agent-platform:platform-user, agent-platform:user without EgressPolicies, through the RoleBinding agent-platform:platform-user; the RoleBinding agent-platform:user there is removed by the step (a binding’s role cannot change in place). A tenant’s agent-platform:user, :editor and :admin keep the read in their namespace; the kagent namespace’s editors keep it there. make verify-tenant-rbac asserts it.