Convert agentic-platform into an app-of-apps meta-package (#36875)

[teemow]

Implements giantswarm/giantswarm#36875. Supersedes #90 (which was a standalone sibling chart — not diffable against the umbrella, not meaningfully mergeable). This is the in-place change so the diff shows exactly how the umbrella becomes a meta-package.

What changes

The umbrella stopped being an umbrella. It no longer bundles components as pinned Helm subcharts (Helm bundles subchart .tgz at package time, which is why every component release cost a bump PR + umbrella re-release + gitops bump). Instead, templates/components.yaml renders one GitOps object per component:

• gitops.engine: flux (default) → OCIRepository (semver range) + HelmRelease
• gitops.engine: argo → argoproj Application

The version is a value (components.<name>.versionRange), not a Chart.yaml pin. Flux re-resolves it every reconcile, so a component release rolls forward with no PR to this chart.

Diff at a glance

• Chart.yaml: dependencies: block removed (+ Chart.lock deleted).
• values.yaml: new gitops (engine switch) + components (source coords + version range; filterTags for the klaus-gateway -dev stream).
• templates/components.yaml: the render loop.
• _helpers.tpl: musterServicePort made nil-safe (muster's service tree now lives in the muster HelmRelease, not merged into umbrella values).
• examples/customer-bom.yaml: pinned bill-of-materials.
• Makefile.custom.mk + .circleci/config.yml: make verify-meta.

Behaviour preserved

• On/off + per-component values unchanged — the existing muster:/agentgateway:/valkey:/kagent:/klausGateway:/agentic-platform-mcps: blocks and *.enabled toggles still drive each component; their values are forwarded to the rendered release (HelmRelease.spec.values / Argo valuesObject), with umbrella global injected (subcharts used to inherit it automatically; HelmReleases do not).
• CRD-before-CR ordering — agentic-platform-crds renders as a HelmRelease that consumers dependsOn (Flux) / order after via sync-wave 0 (Argo).
• Glue layer untouched — Gateway, AgentgatewayParameters, HTTPRoutes, NetworkPolicies, mcpServers list remain plain templates.
• make verify-modes (the ingress-mode guards) still passes unchanged.

Acceptance criteria (#36875)

• New component release reaches dogfooding clusters with no PR — Flux re-resolves the range.
• Internal wide ranges / customer pinned BOM (examples/customer-bom.yaml).
• CRD-before-CR ordering preserved (dependsOn / sync-wave).
• Per-component values passthrough unchanged.
• Render layer swappable (gitops.engine: flux|argo).

Test plan

• make verify-meta — asserts both engines render, ranges are values, CRD ordering, and the BOM pins (CI step added; no helm dependency build needed).
• make verify-modes — unchanged ingress guards still green.
• helm lint clean; renders verified for muster-direct, agentgateway-muster, all-enabled, kubernetes netpol flavor, argo engine, and the pinned BOM.
• Not yet deployed to a cluster — intended as discussion input for the honeybadger onsite.

Follow-ups (not in this POC)

• The README body below the new "Meta-package release flow" section still describes the old bundled-subchart model — needs a pass if accepted.
• Known caveat: glue-layer CRs are applied by this chart's own release while CRDs arrive via the crds HelmRelease; on first install the CRs may briefly precede the CRDs until that release reconciles (same "CRDs first" prerequisite as today, now via dependsOn/sync-waves).

Concept write-up: architecture/agentic-platform-meta-package.md (klaus-lab).

Made with Cursor

[QuentinBisson]

One blocker before this can go to a cluster: secrets land in HelmRelease specs.

components.yaml does index $root.Values <valuesFrom> and writes the whole block into HelmRelease.spec.values. Because konfigure merges the agentic-platform-konfiguration Secret into .Values at render time, the muster HelmRelease spec ends up with oauth.server.dex.clientSecret, jwtSigningKey, storage.valkey.password; kagent gets providers.anthropic.apiKey and oauth2-proxy.config.clientSecret; valkey its password — all cleartext in CRs persisted to etcd and visible in Flux logs. The umbrella passed these in-memory during one render; the meta-package persists them.

Fix: for each component with secret keys, render a Secret containing only that component's secret sub-tree, then wire the child HelmRelease with spec.valuesFrom pointing at it instead of inlining spec.values.