Changes and Releases
Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.
Changed
Fixed
- (connectivity) Delete the orphaned workspace-manager sign-in keys Secret on upgrade in #1099 by @teemow
- (components) Cap every component range at the line its values were proven against in #1100 by @teemow
- (components) Select kagent 1.15, the workspace write path in #1110 by @teemow
- (connectivity) The config-reload stamp carries its own field manager in #1101 by @teemow
- (muster) Do not wait for muster’s pods until Substrate is Ready in #1109 by @teemow
Full Changelog: https://github.com/giantswarm/agent-platform/compare/v4.145.0...v4.145.1
Changed
- Dex runs two replicas by default, spread one per node (
topologySpreadConstraints on kubernetes.io/hostname, DoNotSchedule, and on topology.kubernetes.io/zone, ScheduleAnyway; a preferred pod anti-affinity on kubernetes.io/hostname), behind a PodDisruptionBudget of minAvailable: 1: a node drain or consolidation waits until another replica is Ready, so the identity provider stays up. With dex.replicaCount: 1 and no autoscaling the budget stays maxUnavailable: 1.
Fixed
- (agent-platform) Workspace-manager sign-in is granted in muster by @teemow — Workspaces work with workspace-manager 0.10, which moved a person’s provider sign-in to muster: the portal reads the manager’s new sign-in instructions and no longer calls its removed connect and disconnect tools.
Full Changelog: https://github.com/giantswarm/backstage/compare/v3.9.4...v3.9.5
Fixed
- A pull request behind
main keeps its render goldens green (giantswarm/agent-platform#1093). The goldens of verify-modes and verify-wiring compare a branch’s render against GOLDEN_REF, which now defaults to the merge-base of HEAD and GOLDEN_BASE (origin/main), not main’s tip: a later main commit that changes an unrelated render no longer reads as the branch’s drift, and a branch whose own render is wrong still fails. An explicit GOLDEN_REF wins, GOLDEN_REF= still opts out. No chart change.
Fixed
- A subject-scoped issuer stays pinned while its MCPServer is down. An authorization server was pinned only once its MCPServer answered (connected, or 401 for a pending-auth entry), so after a muster restart with the issuer’s backend down,
FetchSecret and the token broker answered “the person holds no grant” although the grant was intact in the store; a connected issuer whose backend then failed lost its pin on deregistration in the same way. muster now pins every MCPServer definition’s authorization server whatever the backend’s state (at start, on every MCP service event and on the 5 s reconcile tick), retries a deferred pin (Secret missing, OAuth not ready), keeps the pin when a Failed backend deregisters, and releases it when the definition changes or is deleted; the pin is logged at registration (Pinned authorization server … subjectScoped=true). (#1553)
Changed
- The installation’s skills credential is never a tenant’s credential. agent-manager mints it as
agent-manager-skills-token, the installation’s own name outside the tenant-credential- prefix; agent-platform-tenant-credential-refs refuses it in every Organization namespace under each of its names (agent-manager.skills.gitAuthSecretName or the minted Secret, and their earlier names, tenant-credential-agent-manager-skills-token included), as a git credentialRef or a headersFrom Secret, for every requester. The platform’s agents keep naming it in the kagent namespace. The connectivity chart’s agent-manager migrate run moves every agent naming tenant-credential-agent-manager-skills-token to agent-manager-skills-token, which agent-manager keeps filled; the earlier Secret stays filled until no agent names it. make verify-migration and make verify-tenant-rbac assert both.
Fixed
- (agent-platform) Name the input and output tokens behind the cost estimate by @marians — The note under
Est. cost in a session’s cost popover and on the Usage page names the input and output tokens the estimate is based on, and how many other tokens, such as thinking, it leaves out. - (app, gs) Footnotes jump in template descriptions, step notes and access docs by @teemow — Footnote references jump to their notes in a template’s description, a template step’s note and an installation’s access docs. A step note’s text is now the same size as other markdown in the portal.
- (several plugins) One session-expired message instead of two by @teemow — An expired portal sign-in reads
Your session expired, sign in again. everywhere, including the Cluster access status, which had its own wording. A rejected one reads Your session was rejected, sign in again.
Development and CI/CD
Full Changelog: https://github.com/giantswarm/backstage/compare/v3.9.3...v3.9.4
Added
- The data plane’s access log carries the request id:
request_id (giantswarm/agent-platform#867). The <release>-access-log policy adds the x-request-id request header as request_id to every access log line, beside agent_instance_id. The Dev Portal’s backend sets that header on every call it makes through the data plane and names it in an error banner, so the banner’s id finds the gateway line of the failing call. The data plane generates no id: a request without the header logs none. The connectivity README’s “Access log attributes” lists the chart’s field set. make verify-access-log asserts both default fields. Every installation with the agentgateway data plane gets one more field on its access log; no pod rolls.
Changed
- The Substrate workers run the release the control plane runs (giantswarm/agent-platform#822). The chart sets
ateController.gvisorWorker.followRelease: true on the substrate release, so a Substrate patch within components.substrate.versionRange rolls the kagent worker pool with the atelet, with no chart release. The range is the one source of the Substrate version; the WorkerPool’s spec.workerImage stays the floor’s. An own followRelease: false fails the render. make verify-worker-image renders the substrate chart the range resolves to and fails when its ate-controller would run the workers on another release than its atelet.
