From 71594c2fc639976ccc0bf86af48418bf275261ac Mon Sep 17 00:00:00 2001
From: stxkxs <139715017+stxkxs@users.noreply.github.com>
Date: Mon, 10 Aug 2026 23:48:44 -0700
Subject: [PATCH] Pin the agent-platform operator to 0.6.7
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

0.6.5 is the operator built before two fixes to the code it runs.

The first is the one that matters. Tenant egress was a static allow-list
that never read spec.datastores, so a tenant declaring a relational store
got Aurora provisioned, an IAM policy scoped to reach it, and a
default-deny NetworkPolicy that dropped the packets. The Platform reports
Ready, the datastore is available, the credential is valid, and the
connection times out — nothing in the control plane disagrees with
itself, so nothing reports a problem. Every tenant declaring a datastore
has it, not one app.

0.6.7 derives the rules from the declaration: 5432, 6379 and 9098 for the
kinds that speak their own protocol, and toFQDNs naming s3, dynamodb and
sqs for the kinds that reach AWS on 443 — bounded by hostname because
Bedrock answers on that same port from the same VPC, and a port-scoped
rule there would give every application pod a direct route to the model
plane.

The second fix defaults a relational datastore to an Aurora major line
rather than a patch AWS can retire.

Chart 0.6.7 carries appVersion 0.6.1, so the image moves with it — the
CRDs and the binary reconciling them advance together. 0.6.6 was never
published; its contents moved before release, so the version was skipped
rather than overwritten.

The Application syncs automated with selfHeal, so this lands on the next
poll without a manual sync.
---
 applicationsets/addons-agent-operator.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applicationsets/addons-agent-operator.yaml b/applicationsets/addons-agent-operator.yaml
index 0070dd5..3cfe5e2 100644
--- a/applicationsets/addons-agent-operator.yaml
+++ b/applicationsets/addons-agent-operator.yaml
@@ -60,7 +60,7 @@ spec:
         # charts in addons-ai-platform use.
         - repoURL: oci://ghcr.io/nanohype/eks-agent-platform/charts/operator
           chart: operator
-          targetRevision: 0.6.5
+          targetRevision: 0.6.7
           helm:
             # Matches the Application name above so Application == release ==
             # Deployment (eks-agent-platform-operator) — one fully-qualified name