Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.
gateway.jwksEgress now also opens egress on the agentgateway controller network policy
(Cilium and kubernetes flavors). The controller fetches remote JWKS centrally and distributes
keys to the data plane via xDS, so the data-plane-only rule left JWKS fetches timing out
(e.g. Dex on giantswarm/dex:5556 for extra JWT providers).agentgateway.jwt.extraProviders value lets the
inbound agentgateway JWT policy accept tokens from additional issuers (e.g. Dex-issued ID tokens
forwarded by Backstage AI chat alongside muster-issued JWTs, giantswarm#36840). Also fixes the
identityProviders values schema that rejected every populated provider map.templates/kagent/declarative-agent-pod-security.yaml: retarget the Kyverno mutate from Deployment (controller output) to Agent CR (controller input). The previous policy patched the Deployment after the kagent controller had already stamped privileged: true on the git-skills path, causing the API server to reject the Deployment as self-contradictory (privileged: true + allowPrivilegeEscalation: false). Mutating the Agent CR instead sets allowPrivilegeEscalation: false on the controller input, which trips the controller’s own guard and prevents privileged: true from being set in the first place. A (type): "Declarative" condition anchor scopes the mutation to Declarative agents only.coredns image to 1.14.4.audience parameter at /oauth/token for a token minted by the audience’s downstream Dex. New muster.oauth.server.tokenExchangeBroker values block (per-client audience allowlist, audience → downstream Dex target mapping); mcp-oauth bumped to v0.3.0. Inert by default.Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.200...v0.0.201
call_tool meta-tool and unwraps its result envelope.
See ./docs/releases/v0.135.3-changelog.md for more information.Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.94...v0.0.95
Full Changelog: https://github.com/giantswarm/muster/compare/v0.3.17...v0.4.0
aiChat.mcp[].timeoutMs); hanging servers degrade gracefully instead of blocking the chat. Also patch @ai-sdk/mcp to treat SSE events without an explicit event: field as message events per the SSE specification, fixing silently dropped responses from MCP servers behind agentgateway.
See ./docs/releases/v0.135.2-changelog.md for more information.Full Changelog: https://github.com/giantswarm/muster/compare/v0.3.16...v0.3.17