auth://status), as if it had ended. The session is now tracked when the retry is scheduled, and its teardown is what ends the retries. (#1377)muster auth login no longer waits for a callback another process received. The OAuth callback listened on 127.0.0.1:3000 only, while the browser resolves the redirect’s localhost to ::1 first: a local dev server on [::1]:3000 received the callback and the CLI waited for its full timeout, saying nothing. The callback now listens on the port on 127.0.0.1 and ::1 (127.0.0.1 alone on a host without IPv6 loopback), and a port held on either address stops the login at once with callback port <port> is already in use on <address> by: and the holder’s socket, pid and command line. muster auth login --callback-port sets the port, as MUSTER_OAUTH_CALLBACK_PORT does. (#1280)Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.5.0...v0.5.1
Failed (reason TokenExchangeEndpoint) with no retry, so MusterMCPServerFailed kept paging until a user’s session happened to exchange a token. Now the server is put on the reconnect backoff and each retry probes the token endpoint with the exchange’s client credentials and a subject token no issuer signed: while the probe gets no answer the server stays Failed (never Unreachable), and the first OAuth answer returns it to Awaiting Session, with no caller involved. invalid_client and an unknown connector are still not retried. A Failed server’s Ready message names the next attempt. (#1368)main @ 3528a428 with the carried patches replayed; 2.2.1 adds the Substrate resume refusal. The four tags (agentgateway.controller.image.tag and agentgateway.proxy.image.tag of the meta and the connectivity chart) move as one: agentgateway.controller.image names its registry, so Renovate’s helm-values manager finds the controller as it finds the data plane, renovate-custom.json5 groups both images into one agentgateway line PR, and verify-model-catalog holds all four tags equal. The built-in model catalog of 2.2.1 prices Claude Opus 5.5, so the llmRouting.modelCatalog overlay drops its entry; Claude Sonnet 5.5 stays.mcp-aggregator service failed; the kubelet restarted it until Valkey was up (five restarts in three minutes, a ContainerRestartingTooOften page, every MCP call a 503). Now muster keeps dialling with capped backoff (1 s doubling to 8 s), one Valkey for the session stores did not answer, retrying line per attempt, and binds its port once Valkey answers: the pod is not ready while it waits and ready within seconds after. The chart’s new startupProbe (/health, every 5 s, 60 failures) keeps the liveness probe off for up to 5 minutes of start. Only a configuration error ends the start: credentials or database refused, a malformed address, a certificate that does not verify. (#1364)MCPServer kagent in the agent-platform tool group and an in-cluster HTTPRoute kagent-mcp. The route serves /kagent/mcp on the data plane’s plaintext listener, rewrites it to the controller’s /mcp on the kagent backend, and sits behind kagent-mcp-jwt, a twin of the kagent-controller-jwt policy (the CRD takes one kind of target per policy). muster forwards the session’s IdP token, so every call runs as the person who ran the turn. Agents on the agent-platform toolset preset get x_kagent_list_agent_instances (the person’s other ready sessions) x_kagent_invoke_agent_instance (a message to one of them, answered when its turn ends; kagent.controllerRoute.mcp.timeout, default 300 s, the CRD’s maximum) and the checkpoint and fork tools, and the Dev Portal’s MCP servers page lists kagent in the Agent Platform group. kagent.controllerRoute.mcp.enabled: false turns it off. make verify-kagent-route asserts the route, the CR, the twin policy, the off switches and the path guard.Full Changelog: https://github.com/giantswarm/agent-platform/compare/v3.23.4...v3.23.5
Full Changelog: https://github.com/giantswarm/agent-platform/compare/v3.23.3...v3.23.4
Full Changelog: https://github.com/giantswarm/agent-platform/compare/v3.23.2...v3.23.3