AI Agents

  • Changed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.1.28...v0.1.29

  • Changed

    • The agentgateway line at 2.1.1 for the controller and the data planes (agentgateway.controller.image, agentgateway.proxy.image; giantswarm/giantswarm#37915). 2.1.1 is 2.1.0 plus the line’s carried patch that reads a file resource from disk on every managed fetch and re-reads it every minute besides its inotify watch, so a rotated projected-volume certificate reaches a backend TLS policy within a minute instead of staying in the resource cache until a restart — the defect that expired the Substrate egress gateway’s client certificate on one installation. Substrate’s egress gateway (substrate.images.agentgateway) still moves with the Substrate release (make verify-substrate-images).
  • Fixed

    • muster-crds accepts any CRD annotation, and CI runs its chart tests. The loader merges every key of crds.annotations into each CRD, but the generated values.schema.json admitted only helm.sh/resource-policy, so any other annotation failed the install with additional properties ... not allowed. The schema now takes any key with a string value and refuses a non-string one, which the API server would reject. make helm-unittest (the chart-test job) ran the muster chart’s suites only; it now runs the muster-crds suite as well, updated to the three CRDs the chart ships and the current Workflow CEL rules. NOTES.txt and UPGRADE.md name the WorkflowExecution CRD too. (#1324)
  • Changed

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.165...v0.0.166

  • Changed

    Full Changelog: https://github.com/giantswarm/klaus-oci/compare/v0.0.75...v0.0.76

  • Changed

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.4.9...v0.4.10

  • Changed

    • The agentgateway line at 2.1.0 for the controller and the data planes (agentgateway.controller.image, agentgateway.proxy.image; giantswarm/agent-platform#630). 2.1.0 is the line on upstream main @ 08f4563b (the 2026-09-22 re-pin, 229 commits past v1.5.0: the substrate egress credential injection the Substrate line’s pin was chosen for, upstream’s 413 with the limit for an oversized MCP request) plus the line’s carried patch that names an oversized MCP upstream answer’s size and the limit — upstream response body of N bytes exceeds the maximum buffer size of L bytes instead of body exceeded buffer limit — so a tool answer above gateway.http.maxBufferSize is refused with both numbers. Substrate’s egress gateway (substrate.images.agentgateway) stays on 2.0.0: it moves with the Substrate release whose egress configuration is written for it (make verify-substrate-images).
  • Changed

    • (golden) Drop the klaus-gateway floor hold — origin/main carries the 3.x range in #646 by @fiunchinho

    Full Changelog: https://github.com/giantswarm/agent-platform/compare/v4.63.0...v4.63.1

  • Fixed

    • muster rolls when its OAuth credentials or its Valkey password change. The pod template carries checksum/oauth-secret beside checksum/config: the SHA-256 of the chart-rendered <fullname>-oauth Secret’s data, or the new muster.oauth.server.existingSecretChecksum value verbatim when the credentials come from a Secret the chart cannot read, so whoever rotates that Secret changes the mark in the same change (a Flux HelmRelease can feed it through valuesFrom with targetPath); a Valkey password in a Secret of its own is marked by muster.oauth.server.storage.valkey.existingSecretChecksum as checksum/valkey-secret. Before, muster read the projected Secrets at start and never again, so a rotated Dex client secret, encryption key or Valkey password left the running pod on the old values until a hand-run restart, and muster disagreed with Dex (invalid_client) or its Valkey (WRONGPASS) as soon as one of them restarted. The Secret template and the annotation render the data from one helper, so the two cannot drift. Chart unit tests pin the annotations. (#1315)
  • Changed

    • components.klaus-gateway.versionRange admits the 3.x line (>=2.0.0 <4.0.0) (giantswarm/klaus-gateway#319). klaus-gateway 3.0.0 deletes the values keys the 2.x chart accepted as no-ops for the removed web and CLI channels; this chart forwards none of them since 4.62.0, so the installations roll to 3.x unchanged.