agent-platform release v4.28.1

Fixed

• The Hugging Face cache claim no longer fails the connectivity release under a WaitForFirstConsumer StorageClass (giantswarm/agent-platform#483; follows #326; epic giantswarm/giantswarm#37639). With components.modelServing on, modelServing.cache.pvc (hf-cache) rendered as a release resource with no consumer of its own: the first predictor (or download Job) that mounts it is what Binds it, so under kind’s standard and the fleet’s default gp3 it stayed Pending, helm-controller’s wait counted it as not ready and the release failed on every install and upgrade (timeout waiting for: [PersistentVolumeClaim/model-serving/hf-cache status: 'InProgress'], five attempts, then stalled) — with kserve-resources before it and substrate, kagent, agent-manager and model-manager behind it. The claim is now applied by a post-install,post-upgrade hook Job (templates/model-serving/cache-pvc.yaml; the chart’s hook include and its identity <release>-hooks, whose ClusterRole carries get, create, patch on persistentvolumeclaims while the claim is the chart’s — never delete): kubectl apply --server-side under the field manager agent-platform-connectivity, the log says created or present and the phase, and nothing waits for the claim to Bind — it binds where its first consumer schedules, which is what a zonal volume needs (the GPU pool’s zone). The applied spec is the one the chart rendered (hf-cache in the serving namespace, helm.sh/resource-policy: keep, accessModes, size, storageClassName incl. "-", volumeName), and so is what a cache.enabled flip or an uninstall does — the claim stays, now because it is not Helm’s. An installation upgrading from a chart that rendered the claim keeps it (the keep policy) and the hook takes its fields over (--force-conflicts); a size change is applied by the next upgrade’s hook (the StorageClass has to allow expansion); an immutable field (storageClassName, accessModes, volumeName) fails the hook naming it. Installations without the switch render byte-identically (make verify-modes); make verify-serving-slice asserts the hook, its claim and identity, the knobs, and that cache.enabled: false or an existingClaim render none of it; make verify-wiring the serving shape without a PersistentVolumeClaim object; make verify-gpu-pool compares both sides without the claim. Not taken: a consumer pod of the chart’s own (it would pin a zonal volume to its own zone and hold an RWO claim), an Immediate-binding class (the same zone lottery, and not the fleet’s default), a release-wide disableWait (blind to the platform’s dependency chain).