Changes and Releases
Updates on Giant Swarm workload cluster releases, apps, UI improvements and documentation changes.
Added
- Muster: support muster MCP servers behind per-user auth (
authProvider entries in aiChat.mcp). The muster frontend now forwards the user’s OAuth token to the muster backend proxy, which opens per-user MCP sessions. Previously such servers were reported as unconfigured and the Workflows page failed with a 503.
Changed
- The shared MCP client cache moved from the AI chat backend plugin to
@giantswarm/backstage-plugin-gs-node and is reused by the muster backend plugin.
Fixed
- Muster: an
aiChat.mcp entry without a name no longer crashes plugin registration; execution fetch errors are surfaced in the workflow detail UI instead of being silently swallowed; duplicate workflow step ids no longer drop nodes from the graph; query parameter validation rejects empty and repeated values.
See ./docs/releases/v0.135.0-changelog.md for more information.
Fixed
- (deps) Update module github.com/giantswarm/mcp-oauth to v0.2.200 in #325 by @renovate[bot]
Full Changelog: https://github.com/giantswarm/klaus/compare/v0.0.197...v0.0.198
Fixed
- (deps) Update module github.com/giantswarm/mcp-oauth to v0.2.200 in #829 by @renovate[bot]
Full Changelog: https://github.com/giantswarm/muster/compare/v0.3.13...v0.3.14
Added
- Muster: add workflow visualization. A new
muster page renders muster workflow definitions as flow diagrams (one node per step, dashed condition edges) with execution history and live per-step status overlay. Backed by a new muster backend plugin that proxies the muster MCP server’s core_workflow_* tools over REST, reusing the aiChat.mcp entry named muster for connection config.
See ./docs/releases/v0.134.0-changelog.md for more information.
Changed
- Release binaries now include darwin/amd64, darwin/arm64, windows/amd64, and windows/arm64 alongside the existing linux targets. Windows binaries are named
muster-windows-<arch>.exe.
Fixed
- Update mcp-oauth to v0.2.199: JWT access tokens issued for grants without an RFC 8707
resource parameter now carry an aud claim defaulting to the server’s resource identifier (RFC 9068 §2.2), instead of an empty audience that JWT-validating gateways (e.g. agentgateway) reject with 401 InvalidAudience. Existing grants self-heal on their next token refresh.
Added
- AllowedClaims in TrustedIssuer, drop KubernetesSATrusts, fix JWT signing key wiring (#772) (04b5bd2)
muster.oauth.server.dex.allowPrivateIPOIDC: allows Dex OIDC discovery to reach issuer URLs that resolve to private/loopback IPs (e.g. Azure internal load balancers). Requires mcp-oauth#427. Emits a CWE-918 startup warning.
Fixed
- deps: update module github.com/giantswarm/mcp-oauth to v0.2.186 (ca46984)
- deps: update module github.com/giantswarm/mcp-toolkit to v0.2.5 (#780) (bcce33a)
- CiliumNetworkPolicy egress now reaches an OIDC issuer (Dex) / HTTP MCP server fronted by a Cilium-managed ingress gateway VIP (LB-IPAM / L2, typical on-prem). New
networkPolicy.cilium.ingressGateway rule allows egress to the gateway backend endpoints on their target ports (default: 10080/10443, selector: app.kubernetes.io/name=envoy in envoy-gateway-system).
Changed
- attach release binaries to GitHub releases (#785) (77dbb0f)
- deps: update go toolchain directive to v1.26.4 (#783) (ba9c3fd)
Changed
Fixed
- (build) Use CI-built binary in container image instead of rebuilding in #142 by @teemow
Full Changelog: https://github.com/giantswarm/klaus-operator/compare/v0.0.92...v0.0.93
