agent-platform release v4.40.3
Changed
components.kserve-runtime-configs follows the 0.3.x line (giantswarm/kserve#82). kserve-runtime-configs 0.3.0 adds kserve.llmisvcConfigs.images.<preset>.<container>, a per-config image override beside imageRegistry; its default render is byte-identical to 0.2.4’s, and the meta chart’s kserve-runtime-configs: block passes nothing new. The BOM example pins 0.3.0.
Fixed
modelServing.prepull.nodeSelector set by an installation renders alone (giantswarm/agent-platform#562). Karpenter’s karpenter.k8s.aws/instance-gpu-manufacturer: nvidia was the values default in both charts, and Helm merges maps: a selector an installation set rendered next to the default key — a DaemonSet no node matched — and a null for the key was coalesced away when the meta chart forwarded its values, so the README’s “or another selector here” was not reachable, and an installation whose GPU nodes are not launched by Karpenter stripped the key with a post-renderer. Both values files now carry nodeSelector: {} and the template holds the default (agent-platform.modelServing.prepull.nodeSelector): empty renders Karpenter’s label, a set map renders alone, the pool’s label (gpuPool.nodeSelector) is merged under either; a non-string label value fails the render naming the key. tests/verify-mirrored-values.py counts an empty mapping as a leaf, so a copy that kept the map is drift; make verify-model-serving-policies asserts the selector cases, the guard, and a selector set on the meta chart reaching the DaemonSet alone. README “Pre-pulling the runtime image”; UPGRADE.md.- The pre-pull DaemonSet is a hook object: an image that cannot be pulled yet no longer fails the connectivity upgrade (giantswarm/agent-platform#563). As a release resource the DaemonSet was in the release’s wait, and a release’s wait counts a DaemonSet ready by its pods: helm-controller from 1.6 waits with the kstatus poller, which needs every pod of a DaemonSet Ready (Helm 3’s legacy waiter, still on helm-controller 1.4, takes
maxUnavailable: 100% as ready once the pods are scheduled — the fleet runs both). A pod whose image cannot be pulled is never Ready, so one listed image not yet pullable — a runtime image or a prepull.modelPresets image still being built, a registry outage — held the pods in ImagePullBackOff, timed the wait out and marked the whole connectivity release failed and retried, every other object applied. The DaemonSet now carries helm.sh/hook: post-install,post-upgrade,post-rollback (weight 0, before-hook-creation): created after the release’s objects are applied and waited for, waited for by nobody — a hook’s WatchUntilReady watches Jobs and Pods only, in Helm 3, Helm 4 and helm-controller alike — so a missing image leaves the pods retrying on the kubelet’s backoff and the release Ready; the next event replaces the DaemonSet and the pods come back on images already present. A hook object is not Helm’s to delete on uninstall, so a pre-delete hook Job (<release>-model-serving-prepull-cleanup, the hook include agent-platform.hooks.job; the identity <release>-hooks is created for that event too, with delete on exactly that DaemonSet) removes it. The deny-all policy stays a release resource. make verify-model-serving-policies asserts the hook shape, the cleanup Job, the identity’s rule and that prepull.enabled: false renders neither; verify-serving-slice holds the identity to the pre-delete event alone with the cache off; verify-gpu-pool leaves the DaemonSet out of the golden comparison while origin/main renders it as a release resource. README “Pre-pulling the runtime image”; UPGRADE.md.
