agent-platform release v4.14.0

Fixed

• postgres.imagePullSecrets and postgres.affinity, declared by both charts and rendered as Cluster.spec.imagePullSecrets and Cluster.spec.affinity on the platform Postgres Cluster (#311, gap 4). affinity is CNPG’s AffinityConfiguration, not a core Kubernetes Affinity: any other key fails the render, a core podAffinity or podAntiAffinity with a message of its own. Both render no field while unset.
• A network policy for the Backstage app pods, in both flavours, with components.backstage.enabled and networkPolicy.enabled (#311, gap 1). Ingress: the Gateway that serves the portal’s route — the proxy pods of the namespaces the route names as its parents (backstage.parentRefs, else global.gatewayApi.parentRefs), or the agentgateway data plane while the route attaches to it (backstage.parentRefs wins over gatewayApi.gateway.create for the policy as it does for the route) — and the kubelet’s probes, on backstage.port. Egress: DNS, the kube-apiserver, the identity provider, the edge, muster, the portal’s own CNPG cluster on backstage.database.engine: postgresql, and the scaffolder catalog location on backstage.catalogs.version. The egress leg to the edge follows the Gateways the routes the app-config calls attach to (ingress.parentRefs, kagent.controllerRoute.parentRef, modelManager.route.parentRef), not the portal’s own route, and is opened on 443 and 10443: an Envoy Gateway proxy binds the listener’s port plus 10000, so the pod behind a 443 listener listens on 10443.