kagent-dev/kagent v1.0.0-rc3 on GitHub

What's Changed

Features

feat(models): suggest current Foundry Grok model IDs by @jayunit100 in #3513
feat(models): suggest Bedrock Grok inference profiles by @jayunit100 in #3523
feat(mcp): session lifecycle and read-back tools in the core MCP server by @QuentinBisson in #3339
feat(ui): manage EgressPolicies from the UI by @alan-bentley-pgh in #3542
feat(telemetry): record the trusted user as user.id by @krisztianfekete in #3552
feat(runtime): bootstrap revision configuration from durable bundles by @supreme-gg-gg in #3515

Bug Fixes

fix(cli): confirm before deleting self-managed WorkerPools on uninstall by @iplay88keys in #3511
fix(mcp): drop invoke_agent's top-level oneOf so Gemini accepts it by @jotacamou in #3534
fix(taskstore): finalize failed tasks after execution cancellation by @EItanya in #3541

Other Changes

session/lifecycle: support force deletion without suspension by @shashankram in #3530
chore(deps): upgrade Substrate to rc4 and install Atelet separately by @EItanya in #3548
chore(deps): upgrade Substrate to v1.0.0 by @EItanya in #3555

Upgrading from v1.0.0-rc2

This release moves Substrate from v1.0.0-rc2 to v1.0.0. kagent install now installs atelet as its own substrate-atelet release, so atelet can be upgraded before ate-api-server, as Substrate's version skew policy requires.

To upgrade an install from v1.0.0-rc2, upgrade Substrate first, moving atelet to substrate-atelet, then upgrade kagent. The steps need Helm 3.17 or later. The commands use the release names and namespaces that kagent install creates.

SUBSTRATE=oci://ghcr.io/kagent-dev/substrate/helm
KAGENT=oci://ghcr.io/kagent-dev/kagent/helm
helm get values substrate -n ate-system -o yaml > substrate-values.yaml
helm get values substrate-podcert -n podcertificate-controller-system -o yaml > podcert-values.yaml

Add GoldenEgressPolicy to the preview list in substrate-values.yaml. kagent v1.0.0-rc3 needs it, and kagent install sets it for new installs.

# substrate-atelet reads the RustFS credentials from a Secret.
rustfs_key() { helm get values substrate -n ate-system -a -o json | jq -r ".rustfs.$1"; }
kubectl create secret generic kagent-rustfs-credentials -n ate-system \
  --from-literal=AWS_ACCESS_KEY_ID="$(rustfs_key accessKey)" \
  --from-literal=AWS_SECRET_ACCESS_KEY="$(rustfs_key secretKey)"
cat > atelet-values.yaml <<EOF
objectStore:
  endpoint: http://rustfs.ate-system.svc:9000
  region: us-east-1
  pathStyle: true
  credentialsSecret: kagent-rustfs-credentials
EOF

ATELET=(substrate-atelet $SUBSTRATE/substrate-atelet --version 1.0.0 -n ate-system \
  -f substrate-values.yaml -f atelet-values.yaml)
atelet_objects() { helm template "${ATELET[@]}" | kubectl get -f - --ignore-not-found -o name; }

# 1. Upgrade the certificate controller.
helm upgrade substrate-podcert $SUBSTRATE/substrate-podcert --version 1.0.0 \
  -n podcertificate-controller-system -f podcert-values.yaml --wait
# 2. Keep the atelet objects when the substrate release stops rendering them.
kubectl annotate -n ate-system --overwrite $(atelet_objects) helm.sh/resource-policy=keep
# 3. Adopt atelet in its own release and upgrade it.
helm upgrade --install "${ATELET[@]}" --take-ownership --wait
kubectl rollout status daemonset/atelet -n ate-system --timeout=5m
# 4. Upgrade the worker image, still with the v1.0.0-rc2 kagent chart.
helm upgrade kagent $KAGENT/kagent --version 1.0.0-rc2 -n kagent --reuse-values \
  --set substrateWorkerPool.workerImage=ghcr.io/kagent-dev/substrate/ateworker-gvisor:v1.0.0 \
  --wait
# 5. Upgrade the Substrate CRDs and control plane without atelet.
helm upgrade substrate-crds $SUBSTRATE/substrate-crds --version 1.0.0 -n ate-system --wait
helm upgrade substrate $SUBSTRATE/substrate --version 1.0.0 -n ate-system \
  -f substrate-values.yaml --set atelet.enabled=false --wait
# 6. Remove the keep policy.
kubectl annotate -n ate-system $(atelet_objects) helm.sh/resource-policy-
# 7. Upgrade kagent.
helm get values kagent -n kagent -o yaml > kagent-values.yaml
helm upgrade kagent-crds $KAGENT/kagent-crds --version 1.0.0-rc3 -n kagent --wait
helm upgrade kagent $KAGENT/kagent --version 1.0.0-rc3 -n kagent -f kagent-values.yaml --wait

Step 2 is required. Without it, step 5 deletes the atelet DaemonSet even though substrate-atelet owns it, because Helm deletes every object the old release listed. atelet_objects lists only objects that exist, so it skips ones Substrate v1.0.0 adds.

Step 3 restarts atelet once, as a rolling update, because substrate-atelet reads the RustFS credentials from the Secret.

Upgrade kagent last. kagent v1.0.0-rc3 sets golden egress policies, which ate-api-server rejects until step 5 enables the GoldenEgressPolicy gate.

For microVM WorkerPools, use ateworker-microvm:v1.0.0 in step 4. Update any other WorkerPools through the configuration that owns them. If you set rustfs.enabled=false, skip the Secret and set objectStore for your store instead. See the substrate-atelet values.

New Contributors

@jayunit100 made their first contribution in #3513
@jotacamou made their first contribution in #3534

Full Changelog: v1.0.0-rc2...v1.0.0-rc3