1. Docs
  2. Changes and releases
  3. AI Agents

AI Agents

  • AI Agents agent-platform v3.21.0

    Added

    • llmRouting (default enabled: false) in both charts: agent inference traffic through the installation’s agentgateway, so the data plane emits GenAI metrics — tokens by type, cost in USD, request duration, time to first token — for every model call. An installation that sets nothing renders byte-identically (the golden check pins this). When on, the connectivity chart renders an llm listener on the data-plane Gateway (llmRouting.listener, default port 8081), an AgentgatewayBackend for the provider, an HTTPRoute pinned to that listener by sectionName and matching the provider path prefixes (llmRouting.pathPrefixes, default /v1) so it outranks the agent-platform-mcps catch-all route, which attaches to every listener of the same Gateway and wins an equal match, one Gateway-scoped AgentgatewayPolicy carrying the route-type map (llmRouting.routes) and the agent attribution labels (llmRouting.metricLabels), and the model-price ConfigMap (llmRouting.modelCatalog) that the Gateway’s AgentgatewayParameters references. The gateway holds no provider credential: agent pods keep their own key and the client x-api-key header passes through, so reach to the listener grants no spend. Turning the listener on routes nothing by itself — the cutover is a second value, kagent.providers.anthropic.config.baseUrl, and rollback is its removal. The render fails when llmRouting.enabled is true without the agentgateway data plane, when the listener port collides with an existing one, or when llmRouting.pathPrefixes is empty or contains a bare /. See the connectivity chart README for the rollout.
    • A PodMonitor for the agentgateway data plane, gated on the agentgateway component and the shared metrics helper — not on llmRouting.enabled, so the MCP path is scraped too and the monitor exists before an LLM cutover. The data plane serves Prometheus text on pod port 15020; the controller-provisioned Service exposes listener ports only, so a ServiceMonitor would match nothing. It carries the same tenant label as the kagent ServiceMonitor, which alloy-metrics discovers monitors by.
    • kagent.modelConfigs[].baseUrl (optional): sends a chart-owned ModelConfig’s traffic through the LLM listener. Without it an extra ModelConfig calls the provider directly and its usage is unmetered.
  • AI Agents muster v5.14.4

    Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.14.3...v5.14.4

  • AI Agents klaus v0.1.3

    Changed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.1.2...v0.1.3

  • AI Agents klaus-operator v0.0.156

    Changed

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.155...v0.0.156

  • AI Agents muster v5.14.3

    Fixed

    Full Changelog: https://github.com/giantswarm/muster/compare/v5.14.2...v5.14.3

  • AI Agents klaus-operator v0.0.155

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.154...v0.0.155

  • AI Agents klaus v0.1.2

    Fixed

    Full Changelog: https://github.com/giantswarm/klaus/compare/v0.1.1...v0.1.2

  • AI Agents klausctl v0.4.2

    Fixed

    Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.4.1...v0.4.2

  • AI Agents agent-platform v3.20.4

    Fixed

    • gateway.parameters.dataPlaneResources is settable through the meta chart (#303). The connectivity chart reads the key (the agentgateway data-plane container’s ephemeral-storage requests and limits, merged onto the container through AgentgatewayParameters) and its schema declares it, but the meta chart’s values.yaml did not, so the meta chart’s generated values.schema.json (gateway.parameters is additionalProperties: false) refused it at render time — additional properties 'dataPlaneResources' not allowed — although forwardAllValues would have carried it to the connectivity release unchanged; an installation migrating from the standalone chart, whose umbrella accepted the key, hit it. The meta chart now declares the key with the connectivity chart’s defaults (requests.ephemeral-storage: 50Mi, limits.ephemeral-storage: 512Mi), so the rendered platform objects are unchanged until an installation overrides them. make verify-meta’s schema-symmetry check compared the two charts’ top-level keys only and missed the nested key; it is now tests/verify-schema-symmetry.py, which walks the connectivity schema’s properties (and array items) under every block the meta chart forwards and fails on any nested key the meta schema rejects — and the other way round, on any forwarded meta key the connectivity schema does not declare (the roster travels as components.<name>.enabled only) — with negative cases proving both directions fail, naming the path. The walk found no other gap.
  • AI Agents agent-platform v3.20.3

    Added

    • The ATS proves the product on every PR (roadmap#4348, PRD Q8; tests/ats/, README “Development”). The kind smoke is the quick start on a bare cluster: the Gateway API CRDs, a lab Dex (tests/ats/lab-dex.yaml, ported from the standalone chart — static users, the platform identity Secret, a self-signed CA, a CoreDNS rewrite; Dex terminates TLS itself, there is no edge Gateway on kind) and an in-cluster registry the candidate archive is pushed to (tests/ats/registry.yaml, helm push --plain-http); helm install --wait with the bundled engine, muster and its OAuth server, dicebear, connectivity, kagent and agent-manager (tests/test-values.yaml + tests/ats/values-kagent.yaml + tests/ats/values-round-trips.yaml) and self-management on against that registry at the candidate’s exact version (a branch build is a prerelease, which the derived range never matches — Masterminds semver). It asserts the install’s promises (deployed, FluxInstance Ready, every component HelmRelease Ready as agent-platform-flux, the operator on the Flux CRDs, the kagent namespace), the adoption (helm history = the install + one adoption revision), the auth round trip (401 with the RFC 9728 chain; a Dex user through the OAuth password grant with the cross-client audience, and through muster’s login flow — RFC 7591 registration, code + PKCE, the Dex form), the agent round trips (a declarative Agent Ready against the default ModelConfig with a placeholder key; agent-manager’s create_agent through muster as the Dex user with the forwarded token → OCIRepository + HelmRelease of the agent chart in kagent, executed as kagent-flux, Ready → the Agent Ready — the Flux write path the standalone smoke never had), the fixpoint two intervals after the adoption (history unchanged, the values Secret and helm get values equal to the values used), the refused helm upgrade (the admission policy’s message in Helm’s output, no revision) and the ordered teardown (helm uninstall --wait within budget, no Flux CRD left, the operator CRDs remaining, no controller, no Job of the release, no release, the policy gone; the agents’ HelmRelease objects gone with the CRDs, their Deployments and Agent objects orphaned in the kept kagent namespace). The own-Flux scenario (tests/ats/test_own_flux.py, the functional step) runs on the same cluster afterwards: Flux’s source-controller + helm-controller from the pinned upstream manifest, the chart through a HelmRelease from the in-cluster registry with components.flux.enabled: false — Ready, the platform HelmReleases Ready under that Flux without a serviceAccountName, no operator, no FluxInstance, one helm-controller, the Flux CRDs’ field managers exactly what flux install left — an agent through that Flux (OCIRepository + HelmRelease of the agent chart as kagent-flux, the Agent Ready), the render guard when the value is flipped on (the HelmRelease fails with this cluster runs Flux; set components.flux.enabled=false or install the chart through it; no operator, no FluxInstance, the platform and the agent still Ready, the Flux CRDs’ content unchanged — helm-controller applies a chart’s crds/ before it renders, so it joins the CRDs’ field managers with identical content, asserted and logged; flipped back it recovers) and the way back. .ats/main.yaml runs smoke and functional; upgrade stays skipped. The standalone chart’s tests/ats/test_smoke.py has no assertion this suite lacks (tests/ats/README.md, the parity table).
    • components.<name>.insecure (default absent): OCIRepository.spec.insecure: true for that component — a plain-HTTP registry, a lab’s in-cluster one; never a public registry. The ATS uses it to install the connectivity chart of the checkout from the in-cluster registry (components.agent-platform-connectivity.{repository,versionRange,insecure}), so a PR’s connectivity changes are tested on kind before they are released. make verify-insecure.

    Fixed

    • The connectivity release’s Namespace for kagent (kagent.namespaceOverride) carries helm.sh/resource-policy: keep. Helm deleted it with the release — on helm uninstall of the platform, taking the agents’ workloads with it although the platform’s teardown is documented to leave them behind orphaned, and, worse, as the install remediation of a failed first install of the connectivity release: helm-controller uninstalls a failed first install before it retries, and that uninstall removed the kagent namespace and every kagent object in it while the kagent release believed itself installed (measured on the ATS kind smoke, where a PolicyException without its policy-exceptions namespace failed the connectivity install). Kept, the namespace survives both; the release adopts it on a reinstall as it adopts a namespace the cluster created. Management clusters see one annotation added to the kagent Namespace where kagent is on, nothing else.
    • The helm.sh/chart label of every object stays a valid label value at the versions the charts are actually installed under. helm-controller installs a chart with the OCI digest appended as build metadata (3.20.0+8c89e1be4cbf; the label helper turns + into _), and a branch build carries a long prerelease version (3.19.1-dev.<branch>.<date>.<time>.h<sha>, stamped by abs); the 63-character cut of <name>-<version> could land on that _, which the apiserver rejects (“must start and end with an alphanumeric character”) for every object of the release — measured on the self-management adoption of a branch build, whose failed revision then also poisoned helm uninstall (the hooks of the last revision carried the label). The chart helpers of both charts and of the flux-engine subchart trim _ after the cut as they trim - and .; make verify-labels (tests/verify-labels.py) packages both charts at versions whose cut lands on each separator and validates every label of the render. Published versions are short and were never affected; nothing changes in their render.