1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents klausctl v0.4.12

    Changed

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.4.11...v0.4.12

  • AI Agents agent-platform v4.65.4

    Fixed

    • Every OCIRepository the chart renders selects the Helm chart layer: layerSelector: {mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip, operation: copy} (giantswarm/agent-platform#649). Without a selector, source-controller extracts the artifact’s first layer. A signed chart carries its provenance as a second layer, and helm push orders the two by digest, so on about every other signed release the provenance comes first. The upstream CloudNativePG chart 0.29.1 is such a release: with components.cloudnative-pg on, the OCIRepository failed with requires gzip-compressed body: gzip: invalid header, stayed on 0.29.0 and read Ready=False. The artifact revision (<tag>@<manifest digest>) is unchanged, and helm-controller derives the chart version from it, so the rollout upgrades no release. make verify-components-charts now requires the selector on every rendered OCIRepository and resolves the selected layer in each resolved artifact, at the range and at the BOM pin. helm pull finds the chart by media type wherever it sits, so the check could not see this failure before. No range or source changes.
  • AI Agents muster v5.31.4

    Fixed

    • A session on a forwarded bearer ends when the bearer expires. A caller that presents an IdP-issued token (an agent’s on-behalf-of token, a workload token of a trusted issuer) gets a session keyed by that token, with no refresh chain: the token is its only credential. The session outlived it. Its pooled backend connections kept forwarding the expired token on every capability poll and every listen-stream reconnect, each backend answered 401, and only the third rejection in a row evicted a connection, with a WARN for each – although the token’s exp was known the moment it arrived. muster now binds such a session to its bearer’s exp and ends it then, once: its backend connections are closed, its auth marks and capability entries dropped, and a server it held the last connection of goes back to Awaiting Session. The capability poll ends such a session instead of listing through it, and a forwarding connection whose session bearer reaches its expiry ends the session instead of counting strikes; the strike counter stays for undecodable tokens and for sessions that refresh (a person’s login). A trusted-issuer bearer never has a provider token in muster’s store, so that expected miss (SSO: Failed to get provider token from store: token not found, once per request) is logged at DEBUG; a miss for muster’s own access token and any store failure stay WARN. Scenario oauth-forwarded-bearer-expiry-ends-session; the harness gained test_get_mock_server_rejections, the backend’s count of 401s and of requests with an expired bearer. (#1323)
  • AI Agents agent-platform v4.65.3

    Fixed

    • The Substrate floor is 1.0.3 and substrate.images.agentgateway the agentgateway line’s 2.1.2: the gateways’ client certificates follow their rotation whatever order kubelet writes a pod’s bundles in (giantswarm/giantswarm#37915). 2.1.1 re-read a managed file on every fetch, but the certificate files a Substrate policy’s policies.backendTLS names are read at parse time and were never managed, so a rotation reached substrateEgressActorResolution and substrateIngress only when another resource’s event reloaded the config after the podidentity bundle was on disk — the egress pod when kubelet wrote both bundles in one sync, the router by the cadence of its servicedns rotation. 2.1.2 registers those files as managed dependencies, watched and re-read every 60 s (giantswarm/agentgateway-upstream#23). Substrate 1.0.3 (release-1.0) pins it; components.substrate*.versionRange is >=1.0.3 <1.1.0, the BOM pin and the derived worker image follow, and the gateway pods roll once onto the new data plane. The platform’s own controller and data planes move with it: agentgateway.controller.image.tag and agentgateway.proxy.image.tag are 2.1.2 in both charts (the packaging chart’s 2.7.0 carries the same), so the line is one release everywhere it runs.
  • AI Agents klaus-operator v0.0.167

    Changed

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.166...v0.0.167

  • AI Agents klaus-oci v0.0.77

    Changed

    Full Changelog: https://github.com/giantswarm/klaus-oci/compare/v0.0.76...v0.0.77

  • AI Agents klausctl v0.4.11

    Changed

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.4.10...v0.4.11

  • AI Agents agent-platform v4.65.2

    Fixed

    • The kagent floor is 1.0.2: a golden boot that failed Substrate’s boot bound is started over instead of failing the AgentTemplate for good (giantswarm/kagent-upstream#72). The controller retried only the unattributed GoldenActorCrashed. A GoldenActorNotReady from Substrate’s boot bound (three boots in a row whose workload missed its readiness probe, about a minute apart, which is every boot while a skill repository or the egress is unreachable) was final, so a template that booted during an egress restart stayed ActorTemplateFailed until someone deleted it. kagent 1.0.2 starts such a boot over within the crash retry’s budget: five retries per revision, backing off from 20 s to 2 min. Meanwhile it reports Ready=False ActorTemplateRetrying with Substrate’s message, and ActorTemplateFailed with the count once the budget is spent. components.kagent.versionRange and components.kagent-crds.versionRange are >=1.0.2 <1.1.0 and the BOM pins 1.0.2. The previous range already admitted 1.0.2; the floor keeps an installation from resolving 1.0.1.
  • AI Agents agent-platform v4.65.1

    Fixed

    • The Substrate floor is 1.0.2 and substrate.images.agentgateway the agentgateway line’s 2.1.1: the egress gateway’s client certificate follows its rotation (giantswarm/giantswarm#37915). atenet-egress and atenet-router authenticate to ate-api with the client certificate of a PodCertificate projected volume that kubelet rotates 30 minutes before its 24-hour expiry; agentgateway 2.0.0 read that file once, so a day after pod start every actor CONNECT was answered 403 Forbidden: actor identity check denied … CertificateExpired and every sandbox’s first outbound request was reset by peer — the Swarmgeist outage of 2026-09-23. The Substrate line’s 1.0.2 (its release-1.0 branch: 1.0.1 plus the pin and podCertificates.maxExpirationSeconds, unset by default) runs the agentgateway line’s 2.1.1, which re-reads a managed file resource on every fetch (giantswarm/agentgateway-upstream#20). components.substrate*.versionRange is >=1.0.2 <1.1.0: make verify-substrate-images checks the pin against every release the range admits, and 1.0.0 and 1.0.1 name 2.0.0; the BOM pin and the derived worker image follow, so the pool rolls once with the control plane. The agentgateway.controller.image and agentgateway.proxy.image of the platform’s own data planes are giantswarm/agent-platform#647’s. make verify-worker-image now admits a Substrate pin that leads the kagent build’s stamp by a patch of the same minor (kagent 1.0.1 is stamped against Substrate 1.0.0): a patch of the line changes no runtime contract, which is what the range shape >=X.Y.Z <X.(Y+1).0 already encodes, so a data-plane fix ships without a kagent rebuild; a stamp newer than the pin, or in another minor, still fails.
  • AI Agents muster v5.31.3

    Changed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.31.2...v5.31.3