Skip to content

fix: agentgateway controller at the line's 2.0.0 under its nested name - #613

Merged
teemow merged 1 commit into
release-v3.xfrom
fix/agentgateway-line-images-3x
Sep 21, 2026
Merged

teemow merged 1 commit into
release-v3.xfrom
fix/agentgateway-line-images-3x

Conversation

@teemow

@teemow teemow commented Sep 21, 2026

Copy link
Copy Markdown
Member

Problem

Packaging chart giantswarm/agentgateway 2.3.0 moved its image defaults to the agentgateway line's nested names, gsoci.azurecr.io/giantswarm/agentgateway-upstream/{controller,agentgateway}:2.0.0. The 3.x meta chart still overrides agentgateway.controller.image.repository with the flattened giantswarm/agentgateway-controller and follows 2.x. A value wins over a chart default, so the render is gsoci.azurecr.io/giantswarm/agentgateway-controller:2.0.0, a tag that exists only under the nested name (ErrImagePull). Every installation on this line has its agentgateway HelmRelease at Ready=False, Stalled=True RetriesExceeded, rolled back to 2.2.2; a fresh install of the chart fails on that HelmRelease.

Solution

The shape main took in #609 (4.49.0):

  • The meta chart names the line's release in full: agentgateway.controller.image giantswarm/agentgateway-upstream/controller:2.0.0, agentgateway.proxy.image giantswarm/agentgateway-upstream/agentgateway:2.0.0, so a packaging release cannot move the images.
  • components.agentgateway.versionRange is >=2.2.2 <3.0.0 (was 2.x): 2.2.2 is the first packaging release that renders a bare X.Y.Z tag as written.
  • The meta chart forwards the block to the connectivity release, whose AgentgatewayParameters render proxy.image into every data plane: controller and data planes move together to 2.0.0, which is built from the upstream pin (main@c1d24607) the fleet's v1.5.1-gs.4 controller already ran. The connectivity chart's defaults mirror the pin.
  • examples/customer-bom.yaml pins 2.2.2; tests/verify-agentgateway-wiring.py asserts the nested names and one bare tag; verify-modes' golden is origin/release-v3.x (origin/main is the 4.x line) and renders the data-plane pin on both sides; CHANGELOG, UPGRADE.md, the README tables.

Acceptance criteria

  • make verify-meta verify-components verify-modes green.
  • The forwarded values rendered through packaging chart 2.3.0 give gsoci.azurecr.io/giantswarm/agentgateway-upstream/controller:2.0.0, which exists on gsoci (sha256:19b896b1…).
  • agentlab proof on a 3.23.1 lab: this chart applied on top moves the agentgateway HelmRelease to 2.3.0, Ready=True, the controller on agentgateway-upstream/controller:2.0.0, the data plane on agentgateway-upstream/agentgateway:2.0.0, the platform's identity proofs through the edge green.
  • After the release, every installation inside <4.0.0 has its agentgateway HelmRelease Ready=True on agentgateway@2.3.0.

The merge is a rollout to every installation on the 3.x line: the controller and the edge data plane restart onto 2.0.0.

@teemow
teemow requested a review from a team as a code owner September 21, 2026 05:31
@circleci-architect

circleci-architect Bot commented Sep 21, 2026

Copy link
Copy Markdown

Published Helm chart agent-platform

3.23.2-dev.fix-agentg--e-images-3x.2026-09-21.05-53-42.hf2bb915
Chart agent-platform
Version 3.23.2-dev.fix-agentg--e-images-3x.2026-09-21.05-53-42.hf2bb915
OCI reference oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:3.23.2-dev.fix-agentg--e-images-3x.2026-09-21.05-53-42.hf2bb915
Digest sha256:7fc3b73ddda5205d450fe51895f2846fa4cb8c064ad6acc94ff17ea4fa546e99
Registry public — gsoci.azurecr.io
Git catalog giantswarm-test-catalog (index)
Pull this chart
helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 3.23.2-dev.fix-agentg--e-images-3x.2026-09-21.05-53-42.hf2bb915

Posted by architect-orb · build 10931 · commit f2bb915 · updated in place on every push

Packaging chart giantswarm/agentgateway 2.3.0 moved its image defaults to
the agentgateway line's nested names (giantswarm/agentgateway-upstream/
{controller,agentgateway}:2.0.0). This chart still overrode
agentgateway.controller.image.repository with the flattened
giantswarm/agentgateway-controller and followed 2.x; a value wins over a
chart default, so the render became agentgateway-controller:2.0.0, a tag
that exists only under the nested name, and every installation on this
line rolled its agentgateway HelmRelease back to 2.2.2 (Ready=False,
RetriesExceeded).

The meta chart now names the line's release in full: controller.image
giantswarm/agentgateway-upstream/controller:2.0.0 and proxy.image
giantswarm/agentgateway-upstream/agentgateway:2.0.0, with
components.agentgateway.versionRange >=2.2.2 <3.0.0 (the first packaging
release that renders a bare tag as written). The block is forwarded to
the connectivity release, whose AgentgatewayParameters render proxy.image
into every data plane, so controller and data planes move together to
2.0.0 -- built from the upstream pin (main@c1d24607) the fleet's
v1.5.1-gs.4 controller already ran; the connectivity chart's defaults
mirror the pin. examples/customer-bom.yaml pins 2.2.2;
verify-agentgateway-wiring asserts the nested names and one bare tag;
verify-modes' golden is origin/release-v3.x (origin/main is the 4.x line)
and renders the data-plane pin on both sides.

The shape main took in #609 (4.49.0).
@teemow

teemow commented Sep 21, 2026

Copy link
Copy Markdown
Member Author

Proof on a fresh 3.x lab (agentlab 0.54.4, chart 3.23.1 installed with components.agentgateway.versionRange: "2.2.2", the fleet's rollback state; the controller on agentgateway-controller:v1.5.1-gs.4, the data plane on agentgateway:v1.5.1-gs.1). This branch's helm/agent-platform applied on top with the lab's rendered values (helm upgrade --wait, 43 s):

  • The forwarded values: controller.image {repository: giantswarm/agentgateway-upstream/controller, tag: 2.0.0}, proxy.image {registry: gsoci.azurecr.io, repository: giantswarm/agentgateway-upstream/agentgateway, tag: 2.0.0}; the OCIRepository range >=2.2.2 <3.0.0.
  • The agentgateway HelmRelease: Ready=True UpgradeSucceeded … agentgateway@2.3.0+6007277cc303 ten seconds after the upgrade.
  • deploy/agentgateway-controller runs gsoci.azurecr.io/giantswarm/agentgateway-upstream/controller:2.0.0; the AgentgatewayParameters the connectivity release (3.23.1, unchanged) renders carry the forwarded proxy.image, and the data plane rolled onto gsoci.azurecr.io/giantswarm/agentgateway-upstream/agentgateway:2.0.0 (one pod, rolling update).
  • Every HelmRelease of the roster Ready=True (agent-manager, connectivity, mcps, agentgateway, kagent, mcp-kubernetes, mcp-prometheus, muster, valkey).
  • platform-test: Dex sign-in, MCP initialize, muster aggregating mcp-kubernetes, namespaces listed through the edge, the apiserver's Gateway API and Cilium APIs, the flux-multi-tenancy policy, the dex-localhost sidecars, the identity proof (admin lists kube-system Secrets, viewer forbidden, the forged x-user-id ignored) — all through the 2.0.0 data plane and controller. The run then stops at the kagent controller identity proof, which needs the GRPCRoute only connectivity 4.x renders (giantswarm/agentlab#236).
  • test (RBAC): 10/10.

Template proof: the forwarded values rendered through packaging chart 2.3.0 give gsoci.azurecr.io/giantswarm/agentgateway-upstream/controller:2.0.0 and AGW_PROXY_IMAGE_* = gsoci.azurecr.io / giantswarm/agentgateway-upstream/agentgateway / 2.0.0; the controller image resolves on gsoci to sha256:19b896b1467d796766470a71e130f0f38f3f421a8170f31bf2c1968050841626, whose index annotation io.giantswarm.upstream.version is main@c1d24607, the pin v1.5.1-gs.4 was built from.

@teemow
teemow merged commit e556aa3 into release-v3.x Sep 21, 2026
12 of 13 checks passed
@teemow
teemow deleted the fix/agentgateway-line-images-3x branch September 21, 2026 06:08
@teemow

teemow commented Sep 21, 2026

Copy link
Copy Markdown
Member Author

Rolled out. Tag v3.23.2 at 06:08Z; agent-platform:3.23.2 (sha256:e1bb7538…) and agent-platform-connectivity:3.23.2 (sha256:f1b99b6d…) on gsoci minutes later. Every installation on the 3.x line took it by its own Flux interval, no nudge: the agentgateway HelmRelease Ready=True on agentgateway@2.3.0 from 06:17Z, the meta chart Ready=True on 3.23.2, agent-platform-mcps out of DependencyNotReady, deploy/agentgateway-controller on gsoci.azurecr.io/giantswarm/agentgateway-upstream/controller:2.0.0 and the data plane on gsoci.azurecr.io/giantswarm/agentgateway-upstream/agentgateway:2.0.0 on all ten.

Follow-up outside this repo: giantswarm/agentlab#236, so the next 3.x fix can be proven with --chart-path again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant