agent-platform release v4.41.0

Changed

• Every image default of both charts is a gsoci.azurecr.io reference, and modelServing.imageVerification defaults to the Giant Swarm signing identity (giantswarm/agent-platform#575; epic giantswarm/giantswarm#37853). The meta chart’s kubectl hook images (gitops.hooks.image, gitops.hooks.helmImage), the bundled Flux engine’s operator image (flux-engine.operator.image) and the connectivity chart’s hook images (hooks.kubectlImage, hooks.opensslImage) move to their gsoci copies — giantswarm/kubectl, giantswarm/alpine-k8s, giantswarm/alpine-openssl (mirrored by giantswarm/retagger#1228, the same digests as upstream) and giantswarm/flux-operator (the Renovate manager that moves the subchart’s appVersion with the operator tag names the gsoci image). modelServing.imageVerification gains defaults: images: [gsoci.azurecr.io/giantswarm/*] and one keyless attestor — issuer https://oidc.circleci.com, subject ^https://circleci\.com/api/v2/projects/[a-f0-9-]+/pipeline-definitions/[a-f0-9-]+$ — the identity the architect orb’s cosign keyless signing gives every image a Giant Swarm CircleCI project builds or re-signs (the certificate’s subject is the pipeline definition that ran; the orb verifies with the same pair), and a new type (SigstoreBundle, the default | Cosign): cosign 3 attaches the signature to the image as a Sigstore bundle in an OCI referrer and Kyverno reads one format per rule, so an orb-signed image verified with Kyverno’s default Cosign type fails with no signatures found (kyverno apply against a signed gsoci image: Cosign fails, SigstoreBundle passes with the attestor). The switch stays off in the defaults until the curated model images are published and signed (giantswarm/agent-platform#554); the runtime and the llm-d sidecars (the llm-d line signs every mirror and repack since v0.5.0) and every image retagger copies (giantswarm/retagger#1230) already carry the identity. New make verify-images (in CI through verify-all): every container image of every pod template, every OCIRepository url and every registry and reference the meta chart forwards in the rendered defaults of both charts — the engine and every component on — is on gsoci; the references whose copies are still being published are tolerated by name with the issue that lands each — the kagent and Substrate lines’ charts and images, the CloudNativePG chart and the Flux controllers (giantswarm/agent-platform#580, giantswarm/retagger#1229), the classic runtime’s vLLM image (giantswarm/agent-platform#574) — and a stale entry fails the check. The five KServe components (kserve-crd, kserve-resources, kserve-llmisvc-crd, kserve-llmisvc-resources, kserve-runtime-configs) move to 0.4.x, the giantswarm/kserve line whose every image default is a gsoci reference (giantswarm/kserve#81: the controllers, agent, router, storage-initializer, the local-model images, kube-rbac-proxy; the classic runtimes ship no image any more, which this chart’s servingruntime.enabled: false never rendered); 0.4.1 is the version the storage-initializer’s resources follow kserve.storage.resources from (giantswarm/kserve#86) — the BOM example pins it. The connectivity CI fixtures name the gsoci pgvector mirror. README: “Verifying the model images”. Lab proof (a fresh agentlab on the branch’s dev build, Kyverno 1.17.2): platform-test all PASS; every hook Job ran from gsoci.azurecr.io/giantswarm/alpine-k8s / alpine-openssl and the Flux operator from gsoci, the only images off gsoci the pending set; the rendered verifyImages policy with the defaults admitted the orb-signed kserve-controller:0.2.4 pinned to its digest (kyverno.io/verify-images … pass) and the retagger-signed kubectl:v1.37.0 likewise, left a docker.io image alone (no pattern matches), denied the unsigned alpine-k8s:1.37.0 and — with the subject pattern swapped for a foreign identity — denied the signed image (sigstore bundle verification failed: no matching signatures found). Installations act: none for the defaults — a hook Job is created per event, nothing rolls; an installation with modelServing.imageVerification.enabled: true and a signer of its own that writes cosign 2’s .sig tags sets type: Cosign (UPGRADE.md).