agent-platform release v4.28.3

model-manager reaches the Hugging Face Hub for a kserve backend cluster-manager registers at runtime (giantswarm/agent-platform#494): the hub egress of its network policy rendered only for a static modelManager.backends kserve entry; with components.cluster-manager on it renders as well — on gazelle check_fit hung on the hub lookup until muster’s deadline.
The models Gateway’s data plane passes the fleet’s admission policies and gets its DNS record (giantswarm/agent-platform#492): the Gateway references a models-specific AgentgatewayParameters (the platform’s gateway.parameters.podSecurityContext / containerSecurityContext — seccomp RuntimeDefault, non-root, no capabilities —, dataPlaneResources, agentgateway.proxy.image, modelServing.modelsGateway.replicas, a LoadBalancer Service); on gazelle the controller’s default Deployment was denied by restrict-seccomp-strict and the Gateway never programmed. Its infrastructure annotations carry modelServing.modelsGateway.externalDns.annotations (default giantswarm.io/external-dns: managed, the filter Giant Swarm’s external-dns selects Services by) next to the hostname, so models.<domain> is created instead of falling through to the wildcard edge.