Changes and Releases
Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.
Added
tenants.organizations.enabled also turns on agent-manager’s tenant reconciler (giantswarm/agent-platform#1044). With agent-manager on, its release gets tenants.enabled: true (it starts with --multi-tenant), the kagent namespace’s default ModelConfig default-model-config with its key Secret (kagent.providers.<default>.apiKeySecretRef), the workers’ network policy (substrate-workers on Cilium, substrate-workers-ingress on the kubernetes flavor, none with networkPolicy.enabled off) and 1 warm worker for each tenant that holds an agent as tenants.workerPoolReplicas (agent-manager.tenants.workerPoolReplicas overrides it). The render fails, naming the key, with an agent-manager range below 2.1.0, kagent off, agent-manager’s OAuth or downstream OAuth off, an empty kagent.fluxServiceAccountName, a default provider without apiKeySecretRef, or agent-manager.tenants.enabled set against the switch. Off, agent-manager’s values do not change. make verify-tenant-reconciler.
Refactored
make verify-flux-crds, verify-substrate-store, verify-wiring and verify-metric-labels pass on macOS too. Their recipes no longer need GNU sed -i, GNU sed’s 0,/re/ address, grep -P or an unpadded wc -l, so they run with the BSD tools of a Mac as on CI. They check the same things.
Added
- (agent-platform) Show no Harness turn limits by @teemow — The new agent wizard’s runtime choice, its review step and the agent status card no longer show a Harness’s budget and turn cap, which kagent 1.12.0 removed from the Harness. A session’s cost still lists the cost the runtime reports.
Fixed
Full Changelog: https://github.com/giantswarm/backstage/compare/v3.4.0...v3.5.0
Added
- A codex Harness entry and its egress origins, per installation, off by default (giantswarm/giantswarm#38552). A
kagent.harnesses entry takes runtime: codex: the kagent chart renders a Harness on its codex-harness image at the published digest, with the entry’s own name, snapshot location and env and no limits, beside a claude one. The entry’s origins, the installation’s forge and git hosts, go under agent-manager.harness.egress.<Harness name>: agent-manager writes them into a codex agent’s spec.egress, the Substrate egress gate refuses every other origin with a 403, and kagent adds the model destination itself. kagent refuses a share of a Session on a codex Harness, as on every coding Harness. Nothing renders without the values. values.yaml shows the entry, ci/test-coding-agents-values.yaml carries a codex entry beside the claude one with both egress lists, and make verify-kagent-harness and make verify-components-charts assert the forwarded entries, the codex Harness at the chart’s codex-harness digest against the pinned Harness CRD, and agent-manager’s egress map with an entry for every coding Harness.
Changed
components.kagent.versionRange and components.kagent-crds.versionRange are >=1.13.0 <1.14.0 (were >=1.12.0 <1.13.0), and the customer BOM pins kagent 1.13.0: a harnesses[] entry runs the codex runtime (giantswarm/kagent-upstream#606). The kagent chart publishes the codex-harness image and stamps its digest into runtimeImages.codexHarness, and a harnesses[] entry takes runtime: codex; the 1.12 chart refused it. The codex runtime reports a turn’s usage on its final task status (giantswarm/kagent-upstream#610). The release also publishes the omp-harness image, which no harnesses[] runtime selects yet. Same upstream pin, no CRD, API or persisted-format change: Substrate stays on 1.11.4, and every conversation carries over (UPGRADE.md).
Added
- (agent-platform) Split the model page into Overview, Usage and Details tabs by @marians — A model’s page under Customize has
Overview, Usage and Used by tabs (no Details tab: Technical details sit at the foot of Overview). It names the tool that manages the model under Managed by, shows the HelmRelease behind a Helm-managed one, and a model agents cannot use says what is wrong and what to do under Agents cannot use this model. - (agent-platform) Attach images to a session message by paste, drop or picker by @marians — Paste a screenshot into a session’s message box, or drop image files onto it, to send them to the agent; they show in the conversation as thumbnails that open at full size. There is no button to pick a file. Agents on the Claude Code or Codex runtime, or on a provider kagent passes no images to, say they
cannot take images. - (muster) Name connectors by their display-name annotation by @marians — A connector with a
ui.giantswarm.io/display-name annotation shows that name wherever it is named: Customize’s Connectors list, connector and tool pages, the command palette, the agent wizard, agent and session pages, Usage, workflows and sign-in prompts. Search finds either name, and connectors that would read alike keep their technical names. - (ui-react) Check form fields on blur, re-check them live while in error by @marians — Agent Platform forms such as the new agent wizard’s Details step,
Connect a model, adding a skill and the connector wizard check a field when you leave it instead of only on Continue, and a shown error clears as soon as the field is fixed.
Fixed
Full Changelog: https://github.com/giantswarm/backstage/compare/v3.3.0...v3.4.0
Added
- A Responses API ModelConfig for codex through the LLM listener (giantswarm/giantswarm#38551). The codex runtime speaks OpenAI’s Responses API only, and the listener’s ModelConfigs followed the first
llmRouting.models entry’s provider alone, so a codex agent’s model calls went to the provider directly, unpriced and outside the rate limits. Every llmRouting.models provider now rides the listener: an OpenAI entry (baseURL: https://api.openai.com/v1, match: gpt-*) serves the Responses route the data plane classifies at /v1/responses, and a kagent.modelConfigs[] entry of that provider gets the listener URL with /v1, the base an OpenAI client appends /responses to. A new apiFormat key (chatCompletions or responses, OpenAI only, refused elsewhere naming the entry) sets openAI.apiFormat; with responses and no other OpenAI option the ModelConfig passes the codex compiler’s rules. The MutatingAdmissionPolicy renders once per served provider, so a codex ModelConfig agent-manager or Backstage creates rides the listener too (<release>-modelconfig-llm-routing-openai; the first provider’s keeps its name). llmRouting.rateLimits target the listener, so they cover the Responses route as every other. A codex call appears under its agent in the usage metrics once the codex runtime names its agent on its model calls (giantswarm/kagent-upstream#613); until then it reads unknown. make verify-llm-routing.
Changes compared to v35.2.0
Components
- cluster-cloud-director from v7.4.1 to v7.4.2
Changed
- Update resources to ensure compatibility with Flux 2.8.
Changes compared to v35.2.0
Components
- cluster-vsphere from v9.4.1 to v9.4.2
Changed
- Update resources to ensure compatibility with Flux 2.8.
Changes compared to v35.2.1
Components
- cluster-azure from v9.4.1 to v9.4.2
Changed
- Bump
OCIRepository resources from the source.toolkit.fluxcd.io/v1beta2 API to source.toolkit.fluxcd.io/v1.
Changes compared to v35.2.1
Components
- cluster-aws from v10.4.1 to v10.4.2
Changed
- Bump
OCIRepository resources from the source.toolkit.fluxcd.io/v1beta2 API to source.toolkit.fluxcd.io/v1.
Apps
- aws-pod-identity-webhook from v2.3.0 to v2.3.1
Added
- Build and publish
linux/arm64 images of aws-pod-identity-restarter.
Fixed
- Bump
golang.org/x/net to v0.61.0. - The
helm.sh/chart label is valid for long chart versions: the 63-character cut trims the whole trailing run of -, . and _.
Changed
components.agent-manager.versionRange is >=2.1.0 <3.0.0 (was >=1.13.0 <2.0.0), the connectivity release’s agent-manager migrate run takes agent-manager 2.1.0, and the customer BOM pins it. get_session answers a bounded summary by default (detail: full for every task) beside the new get_session_turn and delete_session (giantswarm/agent-manager#150, #155); get_info lists in namespaces.managed only the namespaces where the caller may create agents (giantswarm/agent-manager#71); an agent on a claude Harness without a harness.egress entry is refused, naming the entry (giantswarm/agent-manager#148). The tenant reconciler ships off (agent-manager.tenants.enabled). Supersedes giantswarm/agent-platform#1001.
