Repository navigation
Pin the egress gateway image to agentgateway-upstream 2.2.2 #109
Description
Activity
From Timo's agent: shipped in #111 and #113.
Release. agentgateway-upstream v2.2.2 was promoted from v2.2.2-rc.3. It carries giantswarm/agentgateway-upstream#35, which turns an unreachable policy service into a 503, and the revert in giantswarm/agentgateway-upstream#36. Substrate v1.3.1-rc.6 pins it and published both charts. v1.3.1-rc.5, from #111 alone, failed at
publish/charts: the CI'sagentgateway-imageparameter still said 2.2.1, and #113 moved it.Proof (kind test cluster, agent-platform chart 4.108.0-rc.1):
- With Substrate pinned to 1.3.1-rc.6,
atenet-egressrunsagentgateway-upstream/agentgateway:2.2.2, and atelet and the WorkerPool workers run 1.3.1-rc.6. The platform end-to-end suite passes 14 of 14. - The agent end-to-end suite does not pass on rc.6. Every golden actor stops with
mkdir /config: permission denied. This is not caused by the gateway. feat(atelet): carry the image USER and WORKDIR stack of agent-substrate/substrate#1918 #103 (imageUSERandWORKDIRhonored) is already in v1.3.1-rc.4, and its own description says the harness images must first declareUSER 0:0(feat(harness): run Claude Code as the image's unprivileged user when the harness runs as root kagent-upstream#125, still open), otherwise the harness starts as 65532. - With Substrate 1.3.0 and only the egress gateway image set to 2.2.2, the agent end-to-end suite passes 6 of 6: golden boot, a turn, refreshSkills with the git fetch through egress, and delete.
Still open: the line's agent-suite blocker from #103 and giantswarm/kagent-upstream#125. It decides when 1.3.1 can be promoted; this bump does not.
- With Substrate pinned to 1.3.1-rc.6,
Problem
The chart pins the egress gateway image
agentgateway-upstream/agentgateway:2.2.1. With it, an egress policy call whose request never reached its policy service (connection refused, service down) is answered403 denied, so an agent cannot tell a policy refusal from an outage. agentgateway-upstream v2.2.2 carries the fix that answers such a call503 unavailable.Proposed solution
Bump
images.agentgatewayincharts/substrate/values.yamlfrom 2.2.1 to the stable 2.2.2. Values only; no template change.Acceptance criteria
gsoci.azurecr.io/giantswarm/agentgateway-upstream/agentgateway:2.2.2, and the chart tests (images_test rejects pre-release tags) pass.