agent-platform release v4.25.0

Added

• The serving slice: components.kserve-runtime-configs, the models Gateway with one Dex JWT policy, examples/serving-slice.yaml, two 24 GB presets (giantswarm/agent-platform#326; bumblebee-plans#46, the plan’s D4/D6/D8/D9; epic giantswarm/giantswarm#37639). components.kserve-runtime-configs (giantswarm/kserve, 0.2.x, dependsOn: [kserve-llmisvc-crd], into the release namespace — where the llm-d controller resolves well-known configs from, besides the LLMInferenceService’s own) installs the well-known LLMInferenceServiceConfigs with kserve.llmisvcConfigs.enabled: true, kserve.servingruntime.enabled: false and no registry value (the chart’s gsoci default, giantswarm/kserve#78); its block is held back from connectivity. modelServing.modelsGateway (off by default — the Gateway is the slice’s) renders one agentgateway Gateway models on models.<global.domain> with the platform’s wildcard (or a Certificate from tls.issuerRef), the external-dns hostname, and one AgentgatewayPolicy (Strict, inheritance: Override, audience dex-k8s-authenticator, JWKS from the issuer’s host on 443); KServe’s kserve.controller.gateway.ingressGateway.kserveGateway is derived onto the kserve-resources release so every LLMInferenceService route attaches to it, and the discovery ConfigMap names the endpoint and the /<namespace>/<model>/v1 convention. examples/serving-slice.yaml is the one-release-per-target-cluster profile: the five kserve components and the switch, runtimeClassName: nvidia, agentgateway off beside the platform’s release and on for a workload cluster (nothing is detected). Presets qwen3-4b-instruct and qwen3-8b-fp8 (one L4-class GPU, tools on, no image; the schema gains spec.template). The default render is byte-identical but for the roster entry. make verify-serving-slice; README “The serving slice and the models Gateway”; docs/authentication.md section 6.