feat: the kagent line and the Substrate line at 1.1.0 by QuentinBisson · Pull Request #665 · giantswarm/agent-platform

QuentinBisson · 2026-09-24T13:41:31Z

Problem

The kagent and Substrate lines re-pinned onto kagent-dev/kagent main@1069fd2 and kagent-dev/substrate v0.2.0-beta5 (giantswarm/giantswarm#37705) and released 1.1.0. The 1.1 lines inject credentials at the egress gateway, which needs the egress MITM CA pool, split the Substrate image registry from its repository, and take context compaction on the Harness; the Generic agent chart 1.5.0 stops rendering spec.context.compaction, which this kagent refuses. The golden actors boot in Substrate's atespace ate-golden and were denied the agents' Secrets. Substrate 1.1.0's credential-provider pod declares no seccompProfile, which the fleet's restricted Kyverno policy denies.

Change

The connectivity bootstrap hook mints egress-mitm-ca-pool (ECDSA P-256). The meta chart's substrate block and the derived worker image follow the registry/repository split. The platform Harness carries kagent.harness.compaction. The credential provider grants ate-golden the same namespaces as the kagent atespace, and a PolicyException substrate-credential-provider names check-seccomp-strict for its pod. components.kagent*.versionRange and components.substrate*.versionRange are >=1.1.0 <1.2.0, agent-manager.agentChart.semver is >=1.5.0 <2.0.0 (the cap of #668 lifted), the example BOM pins 1.1.0.

Proven on agentlab with the dev builds of the 2026-09-24 re-pin: platform-test 11/11, a2a-test 5/5, skills-test public and private, agents-test 6/6 (see the comments). The tags kagent 1.1.0, Substrate 1.1.0 and agent 1.5.0 exist; every installation with a private-skill agent must rewrite its skill Secret to base64("x-access-token:<token>") before this rolls (UPGRADE.md).

Checklist

Update changelog in CHANGELOG.md.
Make sure values.yaml and values.schema.json are valid.

QuentinBisson · 2026-09-24T15:39:03Z

agentlab gate of the 2026-09-24 re-pin (lab kind-agentlab, agentlab v0.57.9 with the #268 fix, this branch as platform.chartPath, overlay pinned to the three dev builds: agentgateway 2.1.2 for the platform and the Substrate data plane, Substrate 0.0.0-r588f3d76t20260924131333h6c6d012, kagent 0.9.11-r588f3d76t20260924141400h1f36e2c):

Proof	Result
`platform-test`	PASS 11/11
`a2a-test`	PASS 5/5 (GRPCRoute + JWT policy, forged x-user-id replaced, ListAgentTemplates, streamed turn, HITL approve/reject, CancelTask)
`skills-test` public (agent-self-awareness @ cb1fb768)	PASS — Ready in 22 s, the turn answered from the skill, nothing left behind
`skills-test` private (agent-skills-internal @ 21fdc063, `credentialRef` → Secret `private-skills-git`)	PASS — Ready in 12 s through the egress gateway's credential injection, the turn answered from the skill
`skills-test` private, wrong-token control (a Secret with a bogus pair)	FAILS as it must: the golden boot's fetch dies with `fatal: could not read Username for 'https://github.com'`, the template reports `ActorTemplateRetrying: golden boot 1 of 6 failed (GoldenActorNotReady …)`; the control template without the skill is Ready in 8 s
`agents-test`	not run: agentlab wants the Generic agent chart at 1.x and the lab pins the dev build `1.4.4-r2c5463b5t20260924092522h7d7c768` of giantswarm/agent#41; it runs once agent 1.5.0 is released

The ATS smoke on this PR fails as expected until the lines are tagged: the ranges still resolve Substrate and kagent 1.0.3, whose charts do not know this branch's values (the Substrate HelmRelease never becomes Ready, kagent and agent-manager wait on it). The ranges move to >=1.1.0 <1.2.0 pin-first with the tags.

…TM pool, the Substrate registry split, compaction on the platform Harness The Substrate line from 1.1.0 (kagent-dev/substrate v0.2.0-beta4) injects the agents' credentials at the egress gateway, which terminates and re-originates every TLS connection an actor opens. The gateway mints the per-host leaves from the CA pool egress-mitm-ca-pool and does not start without it, so the connectivity release's bootstrap hook mints it next to the other four, ECDSA P-256 because agentgateway signs its leaves with that key type. The Substrate chart splits image.registry into the registry host and image.repository (kagent-dev/substrate df5265f9) and refuses a registry that carries a path; the meta chart's substrate block and the derived worker image follow the split. kagent-dev/kagent#2790 moved context compaction from the AgentTemplate to Harness.spec.kagent.compaction; the platform Harness carries the values the Generic agent chart rendered per agent (kagent.harness.compaction).

The golden actor of every template boots in Substrate's atespace ate-golden and fetches the template's private git skills with the template's credential. The credential provider allowed only the kagent atespace, so that boot was denied (atespace "ate-golden" is not permitted to resolve secrets in namespace "kagent") and git answered 403. ate-golden is allowed the same namespaces as the agents.

…rt at 1.5 components.kagent*.versionRange and components.substrate*.versionRange are >=1.1.0 <1.2.0, agent-manager.agentChart.semver >=1.5.0 <2.0.0, the example BOM pins 1.1.0. The tags follow the agentlab gate of the 2026-09-24 re-pin; until they exist the chart test renders the ranges against the dev builds the gate ran on (UNRELEASED / RENDER_AGAINST), the golden comparison holds the ranges on both sides, and the ATS smoke expects the 1.5 floor.

…ovider

…he golden comparison

circleci-architect · 2026-09-24T21:14:29Z

Published Helm chart `agent-platform`

4.69.2-rafb1b3b8t20260924211302h52eef55


Chart	`agent-platform`
Version	`4.69.2-rafb1b3b8t20260924211302h52eef55`
OCI reference	`oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.69.2-rafb1b3b8t20260924211302h52eef55`
Digest	`sha256:d033354de88f3e7b12ecd060a478962a67ea846a741d1e0633ab06d84e42a6f0`
Registry	public — `gsoci.azurecr.io`
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.69.2-rafb1b3b8t20260924211302h52eef55

_{Posted by architect-orb · build 13452 · commit 52eef55 · updated in place on every push}

circleci-architect · 2026-09-24T21:15:02Z

Published Helm chart `agent-platform-connectivity`

4.69.2-rafb1b3b8t20260924211302h52eef55


Chart	`agent-platform-connectivity`
Version	`4.69.2-rafb1b3b8t20260924211302h52eef55`
OCI reference	`oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.69.2-rafb1b3b8t20260924211302h52eef55`
Digest	`sha256:290c3bd8d4cd5b1ca0b07b4a6568cec3406d59a08be69337101d80b86939bb3d`
Registry	public — `gsoci.azurecr.io`
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.69.2-rafb1b3b8t20260924211302h52eef55

_{Posted by architect-orb · build 13455 · commit 52eef55 · updated in place on every push}

* origin/main: feat: the kagent line and the Substrate line at 1.1.0 (#665) fix(model-manager): read served models wherever model-manager serves (#681) feat(model-serving): check every shipped preset's parsers by model family (#674) fix(backstage): drop the portal's dead agentPlatform.modelManager block (#677) fix(agent-manager): cap the Generic agent chart below 1.5.0 (#668) feat(observability): collect Substrate's and the kagent controller's metrics (#619) fix(connectivity): limit the substrate-bootstrap hook to 256Mi (#666) # Conflicts: # CHANGELOG.md

…ardown-527 * origin/main: feat: the kagent line and the Substrate line at 1.1.0 (#665) fix(model-manager): read served models wherever model-manager serves (#681) feat(model-serving): check every shipped preset's parsers by model family (#674) fix(backstage): drop the portal's dead agentPlatform.modelManager block (#677) # Conflicts: # CHANGELOG.md

…-oauth * origin/main: feat: the kagent line and the Substrate line at 1.1.0 (#665) fix(model-manager): read served models wherever model-manager serves (#681) feat(model-serving): check every shipped preset's parsers by model family (#674) fix(backstage): drop the portal's dead agentPlatform.modelManager block (#677) fix(agent-manager): cap the Generic agent chart below 1.5.0 (#668) feat(observability): collect Substrate's and the kagent controller's metrics (#619) # Conflicts: # CHANGELOG.md # UPGRADE.md

The holds #665 added are symmetric; the revert keeps them (reworded for either direction) and trims trailing blank lines in the credential-provider exception hold, so the render compares equal against a GOLDEN_REF that is on the 1.1 lines.

…i-580 * origin/main: fix(serving): tear the serving slice down in order, configs freed (#679) fix: derive the managers' OAuth login from muster's OAuth server (#678) feat(model-serving): stamp the cache claim's tier as annotations (#676) fix(substrate): the capz snapshot-store identity holds Storage Blob Delegator on the account (#686) fix(connectivity): the egress gateway reaches the Substrate credential provider (#685) feat(llm-routing): route the LLM endpoint by model, with API keys (#672) feat: the kagent line and the Substrate line at 1.1.0 (#665) fix(model-manager): read served models wherever model-manager serves (#681) feat(model-serving): check every shipped preset's parsers by model family (#674) fix(backstage): drop the portal's dead agentPlatform.modelManager block (#677) fix(agent-manager): cap the Generic agent chart below 1.5.0 (#668) feat(observability): collect Substrate's and the kagent controller's metrics (#619) fix(connectivity): limit the substrate-bootstrap hook to 256Mi (#666) fix: drift detection ignores the serving configs' defaulted spec (#680) # Conflicts: # CHANGELOG.md # tests/verify-target.py

…en-606 * origin/main: (28 commits) feat(dashboards): turn done (final flush) p50 and p95 on Klaus Gateway (#701) feat: the managers', the portal's and mcp-kubernetes' traces to the platform's OTLP gateway (#700) feat(kagent): compact agent histories only past 600000 tokens (#699) fix: keep the single-replica components drainable (maxUnavailable 1) (#697) feat(model-serving): export the model pods' traces to the platform's OTLP gateway (#695) fix(substrate): keep Substrate's metrics on the scrape path (#694) feat: one OTLP collector for every exporter (global.observability.traces.otlp) (#696) fix(netpol): admit the scrape of the kagent controller and atenet-egress ext-proc (#691) fix(serving): make the models Gateway an internet-facing NLB on AWS (#692) fix(model-manager): reach the workload clusters' API servers (#689) feat(components): the CloudNativePG operator chart and image from gsoci (#671) fix(serving): tear the serving slice down in order, configs freed (#679) fix: derive the managers' OAuth login from muster's OAuth server (#678) feat(model-serving): stamp the cache claim's tier as annotations (#676) fix(substrate): the capz snapshot-store identity holds Storage Blob Delegator on the account (#686) fix(connectivity): the egress gateway reaches the Substrate credential provider (#685) feat(llm-routing): route the LLM endpoint by model, with API keys (#672) feat: the kagent line and the Substrate line at 1.1.0 (#665) fix(model-manager): read served models wherever model-manager serves (#681) feat(model-serving): check every shipped preset's parsers by model family (#674) ... # Conflicts: # CHANGELOG.md # tests/verify-gpu-pool.py

…reset-597 * origin/main: (28 commits) feat(dashboards): turn done (final flush) p50 and p95 on Klaus Gateway (#701) feat: the managers', the portal's and mcp-kubernetes' traces to the platform's OTLP gateway (#700) feat(kagent): compact agent histories only past 600000 tokens (#699) fix: keep the single-replica components drainable (maxUnavailable 1) (#697) feat(model-serving): export the model pods' traces to the platform's OTLP gateway (#695) fix(substrate): keep Substrate's metrics on the scrape path (#694) feat: one OTLP collector for every exporter (global.observability.traces.otlp) (#696) fix(netpol): admit the scrape of the kagent controller and atenet-egress ext-proc (#691) fix(serving): make the models Gateway an internet-facing NLB on AWS (#692) fix(model-manager): reach the workload clusters' API servers (#689) feat(components): the CloudNativePG operator chart and image from gsoci (#671) fix(serving): tear the serving slice down in order, configs freed (#679) fix: derive the managers' OAuth login from muster's OAuth server (#678) feat(model-serving): stamp the cache claim's tier as annotations (#676) fix(substrate): the capz snapshot-store identity holds Storage Blob Delegator on the account (#686) fix(connectivity): the egress gateway reaches the Substrate credential provider (#685) feat(llm-routing): route the LLM endpoint by model, with API keys (#672) feat: the kagent line and the Substrate line at 1.1.0 (#665) fix(model-manager): read served models wherever model-manager serves (#681) feat(model-serving): check every shipped preset's parsers by model family (#674) ... # Conflicts: # CHANGELOG.md # tests/verify-gpu-pool.py

teemow mentioned this pull request Sep 24, 2026

fix(connectivity): limit the substrate-bootstrap hook to 256Mi #666

Merged

4 of 5 tasks

QuentinBisson mentioned this pull request Sep 24, 2026

fix(agent-manager): cap the Generic agent chart below 1.5.0 #668

Merged

2 tasks done

QuentinBisson added 5 commits September 24, 2026 22:28

test(kagent-tools): pass the chart URL to the components fallback

1c152d4

test(components): the 1.1.0 releases exist, the pin-first tables go

cc5fc8c

QuentinBisson force-pushed the repin/kagent-substrate-1-1 branch from 35c1322 to cc5fc8c Compare September 24, 2026 20:42

QuentinBisson added 3 commits September 24, 2026 22:54

feat(connectivity): a PolicyException for the Substrate credential pr…

0f292e2

…ovider

test(modes): Substrate on renders five PolicyExceptions

018e62d

test(target): hold the credential provider's PolicyException out of t…

52eef55

…he golden comparison

QuentinBisson marked this pull request as ready for review September 24, 2026 22:05

QuentinBisson requested a review from a team as a code owner September 24, 2026 22:05

QuentinBisson merged commit 92c540f into main Sep 24, 2026
13 checks passed

QuentinBisson deleted the repin/kagent-substrate-1-1 branch September 24, 2026 22:23

teemow mentioned this pull request Sep 24, 2026

fix: the kagent line and the Substrate line back to 1.0 (revert #665) #683

Closed

Navigation Menu

Repository navigation

feat: the kagent line and the Substrate line at 1.1.0 - #665

feat: the kagent line and the Substrate line at 1.1.0#665
QuentinBisson merged 8 commits into
mainfrom
repin/kagent-substrate-1-1

QuentinBisson commented Sep 24, 2026 •

edited

Loading

Uh oh!

QuentinBisson commented Sep 24, 2026

Uh oh!

circleci-architect Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

circleci-architect Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

QuentinBisson commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Change

Checklist

Uh oh!

QuentinBisson commented Sep 24, 2026

Uh oh!

circleci-architect Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Published Helm chart agent-platform

Uh oh!

circleci-architect Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Published Helm chart agent-platform-connectivity

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

QuentinBisson commented Sep 24, 2026 •

edited

Loading

circleci-architect Bot commented Sep 24, 2026 •

edited

Loading

Published Helm chart `agent-platform`

circleci-architect Bot commented Sep 24, 2026 •

edited

Loading

Published Helm chart `agent-platform-connectivity`