kagent changelog¶
0.5.1¶
Released 2026-10-25.
Changes¶
Tenant realm or shared realm¶
The README describes how a tenant's Application sends the login to the tenant's own Keycloak realm when it has one (the chart then owns the login client there) and to the shared realm otherwise, with the claim groups carrying the tenant prefix in both cases. No template changes.
0.5.0¶
Released 2026-10-25.
Changes¶
The login client as part of the release¶
With login.oidc.keycloakClient.create the chart writes the login client
as an EDP KeycloakClient in the release namespace: clientId
login.oidc.clientId, redirect https://
0.4.0¶
Changes¶
kagent 0.4.0: upstream kagent 0.10.4 and a tenant login boundary¶
The chart runs upstream kagent 0.10.4 with oauth2-proxy 7.15.5, and the upstream Route straight to the UI is off. With login.provider oidc the chart sets the scope, the Secret kagent-oidc and a login skip list of the login page and static assets only; upstream also skipped the substrate harness gateway with any suffix. Pods of every namespace that networkPolicy.agentNamespaceSelector selects reach the controller, so ServiceAccounts of the tenant use it like its people do. The README states who gets in. The platform's kagent CRDs must be 0.10.4 first.
0.3.0¶
Released 2026-10-24.
Changes¶
Roles a tenant can grant¶
Upstream's writer and getter Roles use wildcard rules that a project admin cannot grant, so a tenant's Argo CD could not sync the chart. The chart now renders them with explicit rules; the platform grants the full set.
Static MCP servers¶
remoteMCPServers defines the tenant's own RemoteMCPServers, with credentials from the tenant vault.
Example tool server¶
examples.enabled adds the tool server of the upstream example agents, bound to view in the release namespace only.
0.2.0¶
Released 2026-10-24.
Changes¶
kagent 0.2.0 on CloudNativePG with OIDC login (#43)¶
The controller's database is now a CloudNativePG Cluster in the release namespace instead of upstream's development PostgreSQL; the controller reads the URL from the generated app Secret. With login.provider oidc an ExternalSecret writes the oauth2-proxy Secret from the tenant's secret store, and oauth2-proxy runs under the project UID. NetworkPolicies admit the CloudNativePG operator and the HTTP-01 solver, which the default deny blocked.
The controller trusts the identity its callers send, so the team namespaces reach port 8083 from kagent-managed pods only.
0.1.0¶
Released 2026-10-24.
Changes¶
kagent 0.1.0: tenant controller and UI behind the OpenShift login (#41)¶
The tenant part of kagent: upstream controller and UI with namespaced RBAC, behind the OpenShift login (oauth-proxy, ServiceAccount as OAuth client). kmcp, kagent-tools and the built-in agents are off; the platform kagent-operator provides the CRDs and the access to team namespaces. NetworkPolicies keep the upstream UI Route without answer.
The chart refuses to render without upstream.rbac.namespaces, because
empty renders cluster-wide RBAC. ci/check.sh reads charts/
login.provider oidc uses the upstream oauth2-proxy and trusted-proxy mode, which gives each person their own sessions; the OpenShift login issues no JWT, so it runs the controller unsecure with one shared user. The chart refuses mismatched combinations. With upstream kmcp enabled it adds kmcp's leader-election Role.