agent-platform release v4.43.0
Added
modelServing.imageVerification is on by default: a model pod’s images are verified at admission against the Giant Swarm signing identity (giantswarm/agent-platform#575; epic giantswarm/giantswarm#37853). 4.41.0 gave the block its defaults — images: [gsoci.azurecr.io/giantswarm/*], one keyless attestor for the identity the architect orb’s cosign keyless signing gives every image a Giant Swarm CircleCI project builds or re-signs (issuer https://oidc.circleci.com, subject the pipeline definition that ran), type: SigstoreBundle — and left the switch off until every image a model pod runs was signed. Every one is now, verified with cosign verify against that identity: the curated model image the shipped oci:// preset names, gsoci.azurecr.io/giantswarm/models/qwen3-8-flash-next-nvfp4:7c4f1bc1a2d6, which giantswarm/models builds, signs and publishes (giantswarm/agent-platform#554); the llm-d runtime and sidecars of the well-known LLMInferenceServiceConfigs at the llm-d-fast/ prefix (llm-d-cuda:v0.8.0, llm-d-router-disagg-sidecar:v0.9.0, the endpoint picker, tokenizer and latency-predictor images; giantswarm/llm-d signs every mirror and repack); the KServe storage-initializer:v0.20.0 and agent:v0.20.0 retagger copies (giantswarm/retagger#1230); the pre-pull DaemonSet’s pause:3.10.1; and the vllm-b12x:20260913 mirror an installation serves the flash-next preset with. Both charts’ defaults carry enabled: true, so a serving shape under Kyverno renders <release>-model-serving-image-verification without being asked: one verifyImages rule per pod shape over the model pods of the serving namespace at CREATE and UPDATE, every verified image pinned to its digest, a signature required, Enforce. A container image matching no pattern is left alone, so an installation serving from a registry of its own is untouched until it names its pattern and its signer; an installation whose model pods run an image under the platform’s namespace that none of these signed adds its signer or turns the switch off before it upgrades (UPGRADE.md). make verify-model-serving-policies asserts the default render carries the policy with its defaults and that the switch off or no Kyverno renders none; make verify-target holds the switch on both sides of the golden comparison until origin/main carries it. Proof: kyverno apply of the rendered default policy over a pod of the llm-d workload shape naming every image above admits it with every image rewritten to its digest, and denies a pod naming an unsigned image under the pattern with sigstore bundle verification failed; the same two cases on a lab’s Kyverno.
