kagent, Substrate, CloudNativePG and the bundled Flux controllers from gsoci

[teemow]

Problem

After #575 the rendered defaults of both charts still name images and chart sources off gsoci.azurecr.io in exactly these places, which make verify-images tolerates by name (its PENDING list) until this issue lands:

• components.kagent / kagent-crds: the chart source oci://ghcr.io/giantswarm/kagent/helm; the kagent line's images (kagent.registry: ghcr.io — the controller, the UI, and the Go ADK and Claude harness images the chart stamps by digest).
• components.substrate / substrate-crds: the chart source oci://ghcr.io/giantswarm/substrate/helm; the Substrate line's images (substrate.image.registry: ghcr.io/giantswarm/substrate — ateapi, atecontroller, atelet, atenet, podcertcontroller — and the derived worker image ghcr.io/giantswarm/substrate/ateom-gvisor:<pin>). The substrate chart's own third-party defaults (postgres, rustfs/rustfs, amazon/aws-cli from Docker Hub) are the line's and follow mirror the KServe serving images and sign every mirrored digest retagger#1227.
• components.cloudnative-pg: the upstream operator chart oci://ghcr.io/cloudnative-pg/charts.
• The bundled Flux engine: flux-engine.instance.distribution.registry: ghcr.io/fluxcd, the controller images the operator installs.

Proposed solution

• Images: retagger copies the two lines' release images and the Flux controllers to gsoci under their upstream paths (nested repositories — gsoci.azurecr.io/giantswarm/kagent/controller, …/substrate/ateom-gvisor, …/fluxcd/source-controller; the registry already holds nested names), digests preserved: mirror the kagent line, the Substrate line and the Flux controllers under their upstream paths retagger#1229 (feat(images): mirror the kagent line, the Substrate line and the Flux controllers under their upstream paths retagger#1235). The defaults then change one registry value each — kagent.registry: gsoci.azurecr.io, substrate.image.registry: gsoci.azurecr.io/giantswarm/substrate, flux-engine.instance.distribution.registry: gsoci.azurecr.io/giantswarm/fluxcd — and the repositories and stamped digests stay as the charts publish them: shipped in feat: the kagent line's images, the Substrate line's images and the Flux controllers from their gsoci copies #585 (agent-platform 4.42.0).
• Charts: the two lines publish natively to gsoci from CircleCI (multi-arch, signed with the org's identity, releases and dev builds alike) under their own paths, oci://gsoci.azurecr.io/giantswarm/<line>/helm (the ghcr.io path under the org's registry; charts/giantswarm/kagent is the 0.10 wrapper chart's repository) — giantswarm/giantswarm#37872 (kagent, first native release 0.11.0-gs.22), giantswarm/giantswarm#37873 (Substrate, 0.0.30-gs.5). components.kagent*.repository and components.substrate*.repository follow, with the floors at those releases (the gsoci chart paths hold nothing older) and the dev channel without a registry override: shipped in feat: the kagent line's and the Substrate line's charts from gsoci (#580) #592 (agent-platform 4.48.0). The retagger copies of the lines retire with retire the ghcr mirrors of the Giant Swarm lines retagger#1238.
• CloudNativePG: the Giant Swarm wrapper chart on gsoci wraps upstream 0.28 behind a different values shape and would move the operator line back (this component runs 0.29.x, CNPG 1.30). The switch waits for a wrapper release on the same line or a gsoci copy of the upstream chart, and is a values-shape change of the cloudnative-pg: block (UPGRADE.md).
• With each switch its PENDING entry in tests/verify-images.py goes (a stale entry fails the check); tests/verify-components.py, tests/verify-worker-image.py and the READMEs follow.

Acceptance criteria

• make verify-images passes with no pending entry.
• agentlab boots the platform — kagent, Substrate, the engine — pulling from gsoci only: crictl images on the node lists no ghcr.io image (the three lines' images: proven; the CloudNativePG operator image still comes with its upstream chart).

Related

#575 (the defaults and the check), giantswarm/retagger#1229 (the mirrors), giantswarm/retagger#1227 (the serving images), epic giantswarm/giantswarm#37853.

[teemow]

State as of tonight, split by what each switch waits for:

• Images (the kagent line, the Substrate line, the Flux controllers): the copies are being published by feat(images): mirror the kagent line, the Substrate line and the Flux controllers under their upstream paths retagger#1235 (nested repositories under the upstream paths, release tags only, digests preserved). feat: the kagent line's images, the Substrate line's images and the Flux controllers from their gsoci copies #585 (draft) switches the three registry values — kagent.registry, substrate.image.registry, flux-engine.instance.distribution.registry — and drops their PENDING entries; it stays a draft until every reference resolves on gsoci and the agentlab proof has run.
• Charts: retagger copies no charts. ci(tag): a release's charts are pushed to gsoci.azurecr.io as well kagent-upstream#51 and ci(publish): a release's charts are pushed to gsoci.azurecr.io as well substrate#44 (drafts) push a release's charts to oci://gsoci.azurecr.io/giantswarm/<line>/helm as well — the ghcr.io path under the org's registry, deliberately not charts/giantswarm/kagent, which is the 0.10 wrapper chart's repository — with repository secrets each line needs added. The alternative is moving the lines' primary registry; one decision, then a new tag of each line, then components.kagent*.repository and components.substrate*.repository follow in a later PR here.
• CloudNativePG: the Giant Swarm wrapper's latest release (0.1.0) wraps upstream 0.28.2; this component runs 0.29.x. Waits for a wrapper release on the same operator line; a later PR, with the cloudnative-pg: values re-nested (UPGRADE.md).

[teemow]

The gsoci copies this switch needs exist and resolve anonymously, with the index digest of their ghcr source (giantswarm/retagger#1229, shipped in giantswarm/retagger#1235; evidence):

• kagent line — gsoci.azurecr.io/giantswarm/kagent/{controller,ui,golang-adk,claude-harness} at 0.11.0-gs.16 … 0.11.0-gs.20. The digests the kagent chart 0.11.0-gs.20 stamps resolve as gsoci.azurecr.io/giantswarm/kagent/golang-adk@sha256:a4a3342d97edbef37367577064c9887ff120b81538dfd579ec47c07e0c3b19c8 and gsoci.azurecr.io/giantswarm/kagent/claude-harness@sha256:91720ca82eebc03799da0dcf7956a3ef113b6505e5fc32ffe060cb14d010da1d, so the registry value alone changes.
• Substrate line — gsoci.azurecr.io/giantswarm/substrate/{ateapi,atecontroller,atelet,atenet,podcertcontroller,ateom-gvisor}:0.0.30-gs.4.
• Flux controllers — gsoci.azurecr.io/giantswarm/fluxcd/source-controller:v1.9.0…v1.9.5 and gsoci.azurecr.io/giantswarm/fluxcd/helm-controller:v1.6.0…v1.6.4, for the FluxInstance's registry: gsoci.azurecr.io/giantswarm/fluxcd.
• The Giant Swarm agentgateway line the Substrate chart's images.agentgateway names is on gsoci flattened, gsoci.azurecr.io/giantswarm/agentgateway:v1.5.1-gs.4 (same digest as the ghcr tag); there is no nested agentgateway-upstream/agentgateway copy.

Every build_retag run on retagger's main (nightly, and on each merge) keeps the copies current. Like all images renamed through retagger run, these copies are not signed yet; an admission policy that verifies signatures on gsoci images needs that step first.

[teemow]

Lab proof of #585 (the image half), fresh agentlab on the branch's dev channel: platform-test PASS on every check; the kagent controller and UI (0.11.0-gs.20), all six Substrate images (0.0.30-gs.4, the kagent-default workers on ateom-gvisor included) and the Flux controllers (source-controller:v1.9.5, helm-controller:v1.6.4) run from gsoci.azurecr.io/giantswarm/…; atelet pulled the Harness images by the chart's stamped digests from gsoci and a raw AgentTemplate reached Ready=True (golden boot on the gsoci Go ADK image). crictl images on the node lists no ghcr.io/giantswarm/kagent, ghcr.io/giantswarm/substrate or ghcr.io/fluxcd image — the ghcr images left are the CloudNativePG operator (this issue's pending chart source), the Substrate chart's stamped agentgateway image (moving to its gsoci copy with the Substrate line and #588) and the lab's own fixtures. The copies themselves: every tag and both stamped digests resolve with the ghcr index digest (giantswarm/retagger#1235).

[teemow]

agent-platform 4.42.0 (#585) is out; the two installations following the range rolled within about twenty minutes of the tag: the meta and connectivity releases Ready on 4.42.0, the kagent release carrying registry: gsoci.azurecr.io and the substrate release image.registry: gsoci.azurecr.io/giantswarm/substrate, the kagent controller and UI, the Substrate control plane, every atelet and the kagent-default workers running from gsoci.azurecr.io/giantswarm/…. The one ghcr image left in those namespaces is the Substrate chart's stamped agentgateway image, which moves with the Substrate line's next release and #588.

[teemow]

Decision on the chart sources: the two lines publish to gsoci natively from CircleCI (multi-arch, signed with the org's identity), as the org publishes everything — not a second push from GitHub Actions and not a mirror of a ghcr publication; #51 and #44 in the line repositories are closed for that reason and each line has an issue for the move (https://github.com/giantswarm/giantswarm/issues/37872, https://github.com/giantswarm/giantswarm/issues/37873; the agentgateway line likewise: https://github.com/giantswarm/giantswarm/issues/37874). Once each line's first release is on gsoci, components.kagent*.repository and components.substrate*.repository follow here and the dev channel follows the dev builds from gsoci (the README's note about setting the registries back to ghcr goes with it); the retagger copies of the lines are retired then (giantswarm/retagger#1238).