feat(observability): turn on the mcp-kubernetes chart's own monitor and boards

[QuentinBisson]

Problem

giantswarm/mcp-kubernetes ships templates/servicemonitor.yaml over its dedicated metrics port and three Grafana boards (administrator, security, cluster-operator), all behind switches that default to off. This chart set none of them, so an installation that runs the Kubernetes MCP server collects nothing from it: no scrape, no board, and the tool-call, operation and auth-failure series its instrumentation records are served and thrown away.

Change

Two leaves in the mcp-kubernetes block, both auto and both following the resolved global.observability.metrics.serviceMonitor.enabled like every other monitor of this chart:

• mcpKubernetes.instrumentation.serviceMonitor.enabled, with observability.giantswarm.io/tenant: giantswarm on the monitor. Without that label Mimir routes the scrape to no tenant.
• grafanaDashboards.enabled, with folder: Agent Platform and giantswarm.organization: Shared Org, so the three boards land beside the platform's own instead of the chart's default folder named after the component.

mcpKubernetes.metrics.enabled and mcpKubernetes.instrumentation.enabled are already true in the chart, so the endpoint needs nothing here.

prometheusRules stays off. The chart's three alerts link to mcp-kubernetes-high-error-rate, mcp-kubernetes-operation-failures and mcp-kubernetes-auth-failures, and none of those runbook pages exists in giantswarm/giantswarm. Turning the rules on would page on-call with three dead links. The runbooks come first, in their own pull request.

No range moves

The floor 1.1.1 already renders both: pulled 1.1.1, 1.1.8 (the BOM pin) and 1.2.23 (what the range resolves) and templated each with these values. All three render one ServiceMonitor and three dashboard ConfigMaps, each carrying observability.giantswarm.io/organization.

Tests

• verify-target: the new block is held on both sides of the golden comparison, and dropped once GOLDEN_REF carries it.
• verify-components-charts: the chart accepts the forwarded values at the range resolution and at the BOM pin.
• verify-modes, verify-components and the pre-commit hooks (schema, helm-docs) pass.

Also restores the ## [Unreleased] heading in CHANGELOG.md. A sed replacement in #609 collapsed it into a literal \1, and #615 restored only the ### Added below it.

Part of giantswarm/giantswarm#36711.

[circleci-architect]

Published Helm chart agent-platform

4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa

Chart	agent-platform
Version	4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa
Digest	sha256:3af07e9435ccf9ab4b517e94a12ff80ed1eebc73f671fc1798ec1441603dcefd
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa

_{Posted by architect-orb · build 11069 · commit dd194fa · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa

Chart	agent-platform-connectivity
Version	4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa
Digest	sha256:cad70ea3d0198d7608021178fe4809852424cede9e47ca844de09bc87539d047
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.52.1-dev.feat-mcp-k--monitoring.2026-09-22.10-02-21.hdd194fa

_{Posted by architect-orb · build 11068 · commit dd194fa · updated in place on every push}