Repository navigation
Run kagent 1.0 and Substrate on the platform cluster for the Agentic Engineer lane #5892
Description
🤖 Generated by the Agentic Engineer (interactive Claude Code session)
Part of devantler-tech/monorepo#4866.
Goal
Run kagent 1.0 and its Substrate runtime on the platform cluster through Flux, idle and least-privilege, so the Agentic Engineer lane has a place to run.
Acceptance criteria
- Substrate and kagent are installed from their OCI Helm charts through
OCIRepository+HelmRelease, pinned to exact versions (kagent 1.0 is a release candidate today; pin the GA release once it ships). - The bundled sample agents and tool servers are off. Controller RBAC is namespace-scoped, and the credential provider may read only the lane's own namespace.
- The gateway's interception CA is created declaratively, not by a manual
kubectl-atestep. - Cilium network policies allow only the egress the lane needs (the model API and GitHub), and kagent's UI, if exposed at all, sits behind the platform's SSO.
- Manifest validation, the policy suites and the Kubescape floor pass, with any exception justified as a
ClusterSecurityException. - Verified live: the controller, Substrate and gateway are Ready, and a throwaway agent completes one turn on a test key with no GitHub access.
🤖 Generated with Claude Code
Activity
fix(kagent): approve the new authorization surface and post-render st…
fix(kagent): run Substrate's certificate controller in ate-system
devantler commentedon Nov 11, 2026
Every criterion is met and verified on prod (2026-11-11).
kagent@1.0.0andkagent-crds@1.0.0report Ready, and the controller and UI both run:1.0.0with no errors since the rollout. One documented exception: the control-plane chart comes through an OCIHelmRepositoryrather than anOCIRepositorychartRef, because a chartRef appends build metadata (+<digest>) to the chart version, and this chart turns that into an invalid label and image tag (feat(kagent): deploy kagent 1.0 and its Substrate sandbox runtime #5903).providers: null,kagent-toolsdisabled). The controller's RBAC is Roles inkagentandagentic-engineeronly.certificate-egress-mitm-ca.yaml), with no manualkubectl-atestep.