agent-platform release v4.28.14

Fixed

• The add-cache-init pod mutation is idempotent under Kyverno webhook reinvocation (giantswarm/agent-platform#514; proof 1 of giantswarm/giantswarm#37639). The connectivity chart’s model-serving pods policy added hf-cache-init with a JSON patch (add /spec/initContainers/0) and no guard against being applied twice. Kyverno’s pod mutation webhook is registered with reinvocationPolicy: IfNeeded, and the API server reinvokes it whenever another mutating webhook changed the pod after Kyverno ran — the case for every LLMInferenceService workload pod on a Giant Swarm cluster — so the rule inserted the container a second time and the pod was refused by validation: on gazelle (4.28.11) the ReplicaSet of the served preset failed nine times in a row with spec.initContainers[2].name: Duplicate value: "hf-cache-init" while the GPU node ran empty (the two redirect-model-storage-* rules, strategic merges, were idempotent; before #506 the rule never reached these pods). add-cache-init is now a strategic merge keyed by the container’s name: the container is added the first time and found on a reinvocation, and Kyverno’s strategic merge leads a list with the entries it patched, so hf-cache-init stays ahead of the storage-initializer the way the insert at index 0 put it — the rule stays last in the policy, since a later merge on the storage-initializer would move that one ahead again. Audit of the chart’s other mutation rules: agent-sandbox-pod-security’s add-controller-security-context merges by (name) and +(securityContext) anchors, and no rule of either chart appends to a list with a JSON patch; nothing else to change. make verify-model-serving-policies now applies the rendered policy to its own output for both pod shapes and asserts a no-op (one hf-cache-init, one hf-cache volume) — the check failed on the previous rule with exactly the duplicate seen on gazelle. The live half — the workload pod admitted on the first ReplicaSet attempt with hf-cache-init, the hf-cache mount and the 4Gi initializer limit — is the proof’s.