agent-platform release v4.7.0

Added

• llmRouting.modelConfigPolicy.enabled (default true): a MutatingAdmissionPolicy and its binding that point a ModelConfig at the LLM listener when the object names no baseUrl of its own. It reaches the ModelConfigs this chart does not render — the ones Backstage, agent-manager or kubectl create — which until now called the provider directly and produced no token, cost or latency series at all; the chart’s own entries already carry the value, so the policy never touches them. It writes only when the object’s provider matches llmRouting.backend.provider and the baseUrl of that provider’s block is absent, on CREATE and UPDATE, scoped to the kagent namespace, with failurePolicy: Ignore — an unmetered model costs money, a refused write costs an outage. An object that names its own baseUrl is never touched, which is how a model reaches the provider directly. Rendered only where the API server serves admissionregistration.k8s.io/v1/MutatingAdmissionPolicy, Kubernetes 1.36 and later: on 1.34 and 1.35 the API is beta and its own feature gate is off by default, so the object would exist and mutate nothing, and an absent object is honest where a silent one is not. The three management clusters run 1.35 and render nothing; agentlab boots kindest/node:v1.36.1 and gets the policy today. Measured on a throwaway 1.36 kind cluster: a ModelConfig with no baseUrl is routed, one naming the provider URL keeps it across a later update, a non-Anthropic one is untouched, and a sibling field under spec.anthropic survives the merge. The policy renders only where the routed provider’s ModelConfigSpec block carries a baseUrl — Anthropic, OpenAI and SAPAICore; the seven other providers name their upstream through their own fields, and a block the CRD does not know is pruned at admission. The meta chart declares the key with the same default, so an installation sets it through the umbrella. make verify-llm-routing asserts the render on both API-server shapes and the toggle, and make verify-meta’s schema-symmetry check asserts the key travels.

Changed

• A chart-owned ModelConfig rides the LLM listener by default. kagent.modelConfigs[].baseUrl used to be the only way to route an entry, so an entry added without it called the provider directly and its usage never reached the gateway’s metrics, with no error to say so. With llmRouting.enabled the chart now fills the key in from gateway.name, the release namespace and llmRouting.listener.port; an explicit baseUrl still wins and is how an entry reaches any other upstream, the provider’s own URL included. The baseUrl goes under the block of the entry’s own provider rather than under kagent.providers.default lower-cased, which is the same key for a single-provider Anthropic catalog and the correct one for a mixed catalog — the block name is anthropic, openAI or sapAICore (agent-platform.modelConfigBaseUrlKey), the three the CRD gives a baseUrl, and the render fails when an entry names a baseUrl for any other provider instead of rendering a block the API server prunes; an entry whose provider differs from llmRouting.backend.provider stays direct either way, because the listener forwards to one provider. No installation needs to act: every ModelConfig on the fleet already names the listener explicitly and renders byte-identically. make verify-llm-routing asserts the default, the explicit override, the foreign provider and the provider without a baseUrl.