agent-platform release v4.24.0

Changed

• model-manager ships with every installation by default, with no backend; the model-manager line moves to >=0.22.0 (giantswarm/agent-platform#329, bumblebee-plans#46 D3/D4/D5/D7, epic giantswarm/giantswarm#37639): components.model-manager.enabled defaults to true and the forwarded block names no backend — neither model-manager.backend nor model-manager.backends — so the release starts with zero backends (model-manager 0.22.0’s zero-backend start-up) and backends are registered at runtime as labelled ConfigMaps (the add_backend tool, the portal’s Serving page, cluster-manager for a GPU node pool; model-manager’s docs/backends.md). The connectivity guards demand an endpoint only for a backend that is listed statically, so backend: ollama / backends: [ollama] without ollama.endpoint fail as before; the static forms render as before (the golden holds them equal). Model-manager’s OAuth guard follows the muster guard’s convention exactly: a model-manager.oauth.dex.* / existingSecret value that disagrees with global.identity fails the render (one login provider), checked only where both sides are set; a missing input is reported by the child release as for muster, so a render that sets no global.identity (or global.domain / global.identity.issuerUrl alone) is untouched. With components.kagent off the meta chart derives kagent.disableWiring: true for the model-manager release (it must not wire ModelConfigs into a kagent the installation does not run), with components.muster off muster.mcpServer.enabled: false (the MCPServer CRD ships with muster, so the MCP surface follows it; the REST API stays), and with muster’s OAuth server off (muster.muster.oauth.server.enabled, the platform’s one login — the lab shape of examples/kind-lab-dex.yaml) oauth.enabled: false (no issuer to trust, the way the muster discovery label derives from the same toggle); tests/verify-components.py asserts all three, both ways, and the two connectivity guards that failed the render for those cases are gone. Opt out with components.model-manager.enabled: false. The network policy for a backend registered at runtime is giantswarm/agent-platform#478.