1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents agent-platform v4.133.2

    Changed

    • components.substrate.versionRange and components.substrate-crds.versionRange are >=1.11.4 <1.12.0 (were >=1.11.3 <1.12.0), the kagent WorkerPool’s worker image follows to ateom-gvisor:1.11.4, and the customer BOM pins Substrate 1.11.4: a CONNECT tunnel ends when the actor closes its connection (giantswarm/agent-platform#1034). atunnel, which runs in the worker’s ateom, kept a tunnel open after the actor closed or reset its connection for as long as the router held its request stream, so a gRPC call to such an actor waited out the client’s deadline instead of failing at once (giantswarm/substrate#451). Same minor, same upstream pin, no persisted-format change: the kagent release is unchanged, and the step resets no snapshot and needs no manual step (UPGRADE.md).
  • AI Agents muster v5.42.1

    Fixed

    • An expired token’s error reads token has expired for <server>, re-authenticate to refresh. A forwarded or exchanged token that was merely past its expiry ended its error in %!w(<nil>), and the connect log printed <nil> as its cause. The message now ends at re-authenticate to refresh; a token with no parseable expiry says it is unusable and carries the parse error. (#1511)
  • AI Agents muster v5.42.0

    Added

    • core_auth_status reads every server’s sign-in state, and issues the links that start the missing grants. A client that gets a person ready before the agent needs them (a chat front-end after its sign-in) needed one core_auth_login per server to learn a link, and auth://status named no link. The new read-only core tool answers the auth://status document for the caller; with auth_urls: true every server waiting for the person’s grant carries its sign-in link (auth_url), and a server whose grant the person already holds is connected and reported connected. Each entry of both now says how the person reaches the server (kind: grant, sso or none) and, for a grant, whom it belongs to (grant_scope: subject or session). (#1507)

    Fixed

    • A server that needs the person’s grant reports auth_required before its issuer is known. A pending-auth server rebuilt from its service’s own data carries no 401-time auth info until a login discovers it, and auth://status reported it disconnected with no auth_tool: a client listing what the person must connect left it out. An OAuth server that neither forwards nor exchanges the person’s token now reports auth_required with core_auth_login and, where the MCPServer pins one, its issuer. (#1507)
  • AI Agents agent-platform v4.133.1

    Fixed

    • (workspaces) Workspace-manager trusts the dex-k8s-authenticator audience like the other managers in #1026 by @teemow

    Full Changelog: https://github.com/giantswarm/agent-platform/compare/v4.133.0...v4.133.1

  • AI Agents agent-platform v4.133.0

    Fixed

    • A step that adds a connectivity values key no longer fails the connectivity release once on the previous chart (giantswarm/agent-platform#1019). Helm applies a HelmRelease before an OCIRepository, so a step handed its new values to helm-controller while the connectivity OCIRepository still held the previous chart, whose closed schema refused the added key (additional properties 'tenants' not allowed on the 4.131.1 → 4.132.0 step); the retry healed it, a release with no retry left stayed failed and its dependents not Ready. The connectivity OCIRepository is now named after its exact version (agent-platform-connectivity-<version>, agent-platform.sourceName), so the values and the chart version change in one HelmRelease spec change: helm-controller waits until the source of that name holds that version’s chart, then upgrades once; the previous source is pruned with the step. A dev channel or a range keeps the plain name. No installation needs to act.
  • AI Agents muster v5.41.0

    Fixed

    • An identity-provider outage during sign-in validation answers 503, not 401. When Dex’s userinfo or discovery endpoint answered 5xx or 429, timed out or refused the connection while muster validated a bearer, the request was answered 401 invalid_token: the client was told its token was dead, and a client that parsed the body as JSON-RPC saw a tool call with an empty answer. mcp-oauth v1.7.2 answers it 503 temporarily_unavailable with Retry-After, as it does a token-store outage; a userinfo rejection stays a 401. (#1501)
  • AI Agents agent-platform v4.132.0

    Added

    • (tenants) RBAC for agent tenants (roles, platform tenant, reconciler access) in #987 by @fiunchinho
    • (connectivity) The portal’s app-config switches the Agent Platform shell on in #1006 by @teemow

    Fixed

    • (kagent) A workspace Session’s directory lives 30 days, one TTL for kagent and workspace-manager in #1010 by @teemow

    Full Changelog: https://github.com/giantswarm/agent-platform/compare/v4.131.1...v4.132.0

  • AI Agents agent-platform v4.131.1

    Changed

    • The Substrate workers run above the default priority: PriorityClass agent-platform-worker-pool (giantswarm/agent-platform#999). The WorkerPool’s worker pods carried no class and ran at priority 0, so atelet’s ate-node-critical (PreemptLowerPriority) evicted a worker, and its actor with it, among the first pods of a full node. The connectivity chart renders the class kagent.substrateWorkerPool.priorityClass names (value 1000000: above 0, below the cluster’s monitoring, platform and atelet classes; preemptionPolicy: Never, not the global default), and the meta chart derives the pool’s template.priorityClassName from it; the ordinary workloads at 0 are evicted first. An installation’s own template.priorityClassName stands; enabled: false renders no class and names none; a value outside 1..999999999 or a system- name fails the render. The upgrade rolls the pool’s workers once, one at a time under the worker budget. make verify-workerpool asserts the class, the derived name and the guards.
  • AI Agents agent-platform v4.131.0

    Changed

    • atelet preempts lower-priority pods again: substrate.atelet.priorityClass.preemptionPolicy: PreemptLowerPriority (giantswarm/agent-platform#993). Under Never (#731), an atelet whose node another pod filled while atelet was Pending stays Pending for good: no autoscaler adds a node for a DaemonSet pod, and that node places no actor. atelet moves back to the PriorityClass ate-node-critical (value 1000000000, PreemptLowerPriority). On a node without room it evicts the lowest-priority pods first, the default-priority workloads before monitoring and the platform’s own classes, and honours PodDisruptionBudgets where it can. An installation that must never be evicted from keeps Never in its own values. The upgrade rolls atelet once onto the class. make verify-components asserts the forwarded value.
  • AI Agents agent-platform v4.130.1

    Fixed

    • kagent’s sign-in page loads again behind oauth2-proxy (giantswarm/agent-platform#989). kagent’s UI is a Vite build, so /login loads its bundle from /assets/, its settings from /env-config.js and its icon from /favicon.svg, but kagent.oauth2-proxy.extraArgs.skip-auth-regex still admitted the Next.js paths (/_next/static, …), so oauth2-proxy answered 403 for the page’s own files and the sign-in button never appeared. The regex now admits /login, /env-config.js, /favicon.svg and the bundle’s files directly under /assets/, anchored at the end: every other path needs a session, including the paths that only began with /login, which the old regex left open. make verify-kagent-login-public-paths matches both charts’ arguments against the paths the page fetches and the app’s own.