agent-platform release v4.2.0

Changed

• The kagent controller route is a GRPCRoute with the JWT policy on by default (#345; kagent API v2, giantswarm/giantswarm#37705, bumblebee-plans#51 D4/D13/D16). kagent.controllerRoute renders the controller’s API through the agentgateway data plane matched by gRPC service and method — one rule per service, one exact match per RPC of kagent.api.v1alpha1.{AgentInstanceService, AgentTemplateService, ModelService, SystemService} and lf.a2a.v1.A2AService, 39 at the line’s pin, as the value kagent.controllerRoute.grpc.services (the agentgateway controller translates a service-only match into the exact path /<service>/, which no request has, and ignores type: RegularExpression, so a service-only route would fall through to the MCP catch-all; exact service/method matches are translated faithfully and outrank the catch-all’s PathPrefix: / — verified on the data plane’s config dump; reported to the agentgateway line) — on both hops: GRPCRoute kagent-controller on the data-plane Gateway (hostname-less, so the in-cluster authority agentgateway.<namespace>.svc.cluster.local:8080 matches) and GRPCRoute kagent-controller-public on the public Gateway for kagent.controllerRoute.hostname, which makes the outer Gateway carry HTTP/2 to the agentgateway Service; the AgentgatewayBackend kagent keeps policies.auth.passthrough, so the bearer reaches the controller and, through the Harness, the actor, and pins no protocol version: agentgateway infers HTTP/2 (h2c) for gRPC and keeps HTTP/1.1 for gRPC-Web, the split the controller’s one-port dispatcher needs (an HTTP/2 request with application/grpc-web+proto goes to its native gRPC server and is answered 415). Native gRPC over HTTP/2 end to end from the public hostname and from the in-cluster Service; gRPC-Web on the same route. kagent.controllerRoute.jwtAuthentication.enabled defaults to true, Strict, the issuer from global.identity.issuerUrl, the JWKS from jwtAuthentication.jwks (new jwks.tls.{enabled,caSecretName} for an issuer serving its keys over TLS, as modelManager.route has); the AgentgatewayPolicy kagent-controller-jwt targets the GRPCRoute and now also carries the identity transformation — x-user-id is set to jwt.<claim> with the claim from kagent.controller.auth.userIdClaim (email, the ONE value the controller’s AUTH_USER_ID_CLAIM reads too), replacing every inbound value — and an authorization rule that refuses a validated token without that claim (it would otherwise reach the controller as its default user). The kagent UI HTTPRoute gains a RequestHeaderModifier filter removing x-user-id (the UI’s nginx forwards it; the identity on that path is the bearer oauth2-proxy supplies). The controller’s network policy admits the agentgateway data-plane pods and the kagent UI only, in both flavours (the kubernetes flavour admitted the whole release namespace; the intra-namespace app: kagent admission is gone with the per-agent pods). A BackendTrafficPolicy kagent-controller-public on the public hop carries ingress.backendTrafficPolicy.timeout (a GRPCRoute rule has no timeouts; Envoy’s default would cut every A2A streaming turn). The Dev Portal’s app-config agentPlatform.kagent.installations.<inst>.apiBaseUrl is the gRPC origin https://<hostname> (no path); the meta chart’s klausGateway.a2a.url defaults to grpc://agentgateway.agent-platform.svc.cluster.local:8080. docs/authentication.md gains “The kagent controller route — two authentication layers” (the header contract, why agentgateway must stay the only path). make verify-kagent-route asserts all of it; ci/test-kagent-jwt-policy-values.yaml is the default shape and ci/test-kagent-jwt-off-values.yaml the off switch. An installation with the controller route on needs gateway.jwksEgress open (the render fails otherwise) and its clients on gRPC — see UPGRADE.md.

Removed

• The REST HTTPRoute on kagent.controllerRoute.pathPrefix (/kagent) and the pathPrefix key (#345): the kagent API v2 controller serves no REST and the route is a GRPCRoute matched by service, so there is no prefix to strip; a pathPrefix left in an installation’s values fails the render naming the key. With it goes the portal’s <hostname>/kagent/api REST base and klaus-gateway’s …/kagent/api/a2a/kagent A2A base — both are gRPC targets now (above).