agent-platform release v4.73.1

Fixed

• The managers take their login from muster’s OAuth server block (giantswarm/agent-platform#484): model-manager — on by default — failed on every installation that set global.identity.issuerUrl alone (oauth.dex.clientSecret or oauth.existingSecret is required when oauth.enabled, the child release’s error), and a customer installation, whose muster logs in with its own Dex client, cannot take a fleet-wide global.identity.clientId. The meta chart now fills what a manager’s oauth block and global.identity leave unset from muster.muster.oauth.server (agent-platform.identity.apply, on the shaped values, so the connectivity release sees the same blocks): for model-manager, agent-manager, vm-manager and cluster-manager oauth.dex.issuerURL (dex.issuerUrl), oauth.dex.clientID with oauth.trustedAudiences: [<client>] (dex.clientId, the charts’ own default from global.identity.clientId) and oauth.existingSecret (existingSecret, key dex-client-secret), for the dex provider while muster’s OAuth server is on; for the two routed managers oauth.baseURL https://<route hostname><route.pathPrefix> under an agentgateway-* ingress.mode (modelManager.route.hostname / agentManager.route.hostname, else agentgateway.<global.domain>). A manager’s own value wins, and so does global.identity (nothing is filled then: the charts read it themselves). The connectivity chart’s model-manager guard gains its absence checks back once the installation names its login (muster’s OAuth server on with a Dex issuer): a missing issuer, client, secret or base URL fails the connectivity render naming the value to set; a render that names no login is untouched. make verify-managers asserts the four derivations, both winners, the one-login guard and the absence guard through the meta and connectivity renders. An installation that sets global.identity and the base URL explicitly renders byte-identically.