Added
- (self-update) Install a release binary only after its cosign Sigstore bundle verifies in #1178 by @teemow
Full Changelog: https://github.com/giantswarm/muster/compare/v5.13.0...v5.14.0
Full Changelog: https://github.com/giantswarm/muster/compare/v5.13.0...v5.14.0
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.331...v0.1.0
Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.3.3...v0.4.0
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.330...v0.0.331
readOnlyHint, destructiveHint, idempotentHint, openWorldHint). Every core_* tool is classified where it is declared: the list/get/validate/probe tools are read-only (core_auth_login included — it issues a sign-in link for the caller and changes nothing on the platform), creates are additive writes, updates/deletes/stops are destructive writes. list_tools, filter_tools and describe_tool report them like a downstream server’s, so the built-in read-only toolset preset now includes the 16 read-only core tools and refuses the 13 writes without any tool: selector, and a workflow whose steps call a read-only core tool derives readOnlyHint: true. An agent on preset:read-only no longer needs tool:core_auth_login to connect SSO-protected servers. The table is in docs/reference/mcp-tools.md (“Core tool annotations”). (#1172)Full Changelog: https://github.com/giantswarm/muster/compare/v5.12.0...v5.12.1
muster.muster.toolsetPresets: the platform’s two toolset presets, forwarded into muster’s config. infrastructure selects every MCPServer labelled agent-platform.giantswarm.io/tool-group=infrastructure (the mcp-kubernetes, mcp-capi and mcp-prometheus families, stamped by agent-platform-mcps ≥ 0.9.0); agent-platform selects the agent-platform label (agent-manager ≥ 0.3.0, model-manager ≥ 0.18.0) plus muster’s core_* tools — the meta agent’s preset. Agents name them as preset:infrastructure / preset:agent-platform in their toolset; muster resolves the label live on every request, so a new manager or infrastructure family joins its preset with no values change. Installations add their own next to them (Helm merges the map). A preset named like a built-in (read-only, none, full) fails the meta render, naming it, instead of failing the muster pod’s start out of sight. Documented in docs/toolset-presets.md; make verify-presets asserts the presets on the muster HelmRelease (both engines), pulls the muster chart at the range floor and renders its ConfigMap from the forwarded values.components.muster.versionRange floors at 5.12.0 (>=5.12.0 <6.0.0, was 5.x): the muster chart version with the label: preset rule. An older muster refuses to start on the shipped presets, so the source must resolve a chart that has the rule before the release applies the values that need it. Minor releases keep rolling forward on their own. BOM-pinned installations pin muster at 5.12.0 or later (UPGRADE.md).examples/customer-bom.yaml is a fresh snapshot of the internal dogfooding track (muster 5.12.0, agent-platform-mcps 0.9.0, agent-manager 0.4.0, model-manager 0.18.0, agentgateway 2.0.7, kagent 0.1.48, klaus-gateway 0.39.0, agent-sandbox 0.2.31, dicebear 0.3.10, valkey 0.1.4, connectivity 3.10.0); the previous pins predated the chart’s current line.Full Changelog: https://github.com/giantswarm/muster/compare/v5.11.0...v5.12.0
Full Changelog: https://github.com/giantswarm/muster/compare/v5.10.3...v5.11.0
Full Changelog: https://github.com/giantswarm/klausctl/compare/v0.3.2...v0.3.3