agent-platform release v4.74.1

model-manager reaches the workload clusters’ API servers its kserve backends target (giantswarm/agent-platform#687). A kserve backend cluster-manager registers calls a workload cluster’s apiserver as the caller, but model-manager’s egress policy had no rule for it, so under the cilium flavour list_backends timed out dialing the cluster’s API server and every tool naming that backend with it. modelManager.networkPolicy.workloadClusters (fqdns, cidrs, ports, the shape of cluster-manager’s) follows clusterManager.networkPolicy.workloadClusters when empty, the default, and replaces it as a whole when set. It renders in both flavours with a kserve backend (static, or cluster-manager on): names and blocks in the cilium flavour, the blocks or every public destination on the ports in the kubernetes flavour. make verify-cluster-manager holds it.