feat(connectivity): a VerticalPodAutoscaler for the agentgateway data plane and the controller behind one auto knob; the controller gets a PodDisruptionBudget and a hostname spread (agentgateway chart 2.1.2)

[paurosello]

Draft. 3.x line: a feat: on the fixes-only line — needs the team's agreement before it merges (migration guidance: the old line takes fixes unless agreed; a feat: releases 3.24.0, inside the fleet's range). Ported by hand from #375 onto #374's branch; stacks on #374 and waits for giantswarm/agentgateway#51 to release as 2.1.2 — make verify-components-charts is red until then (on this line the pull finds no version satisfying >=2.1.2 <3.0.0). Do not merge before 2.1.2 is in oci://gsoci.azurecr.io/charts/giantswarm/agentgateway: with the range floor unresolved, the agentgateway HelmRelease is not Ready and every release that depends on it (connectivity, agent-platform-mcps, everything behind connectivity) holds its next generation until it is.

What

Same change as #375, see its description: gateway.parameters.verticalPodAutoscaler (enabled: auto) renders a VerticalPodAutoscaler on the data-plane Deployment when autoscaling.k8s.io/v1 is served; the meta chart resolves the knob once and forwards it; the forwarded agentgateway: block gains controller.podDisruptionBudget: {maxUnavailable: 1}, a hostname topologySpreadConstraints entry and a requests-only controller.verticalPodAutoscaler (emptied to {} where the knob resolves false); components.agentgateway.versionRange is >=2.1.2 <3.0.0, the BOM example pins 2.1.2. New make verify-dataplane-vpa in this line's CI list, verify-auto gains the vpa-only shape, tests/verify-agentgateway-wiring.py holds the controller's budget and spread, tests/verify-components-charts.py gains agentgateway (this line's simpler roster: red on the pull until 2.1.2).

Why on the fleet

Every management cluster runs VPA 1.5.1 in Auto mode on its platform components already; the agentgateway data plane and controller are the exception, on the path every MCP and model call crosses. #374 could give the controller only a second replica: the packaging chart's schema rejected a budget, a spread and a VPA until #51.

Verified

• This line's full CI make list plus the new target green locally (golden against origin/release-v3.x); verify-components-charts red on agentgateway only, on the pull.
• The forwarded agentgateway block renders against the fixed chart of feat: add klausGateway as opt-in conditional dependency #51: fleet shape — PDB, spread, VPA (RequestsOnly); vanilla — PDB, spread, no VPA.
• Shared files (the VPA template, tests/pick-doc.py) byte-identical to feat(connectivity): a VerticalPodAutoscaler for the agentgateway data plane and the controller behind one auto knob; the controller gets a PodDisruptionBudget and a hostname spread (agentgateway chart 2.1.2) #375; the wiring-test assertions adapted to this line's indentation-keeping parser.

Checklist

• Update changelog in CHANGELOG.md.
• Make sure values.yaml and values.schema.json are valid.

[circleci-architect]

Published Helm chart agent-platform

3.23.2-dev.agentgatew--oller-ha-3x.2026-09-11.09-52-26.h365ffbd

Chart	agent-platform
Version	3.23.2-dev.agentgatew--oller-ha-3x.2026-09-11.09-52-26.h365ffbd
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:3.23.2-dev.agentgatew--oller-ha-3x.2026-09-11.09-52-26.h365ffbd
Digest	sha256:29f5b85c88743775a771af304ff15156b1a641d14da9f47f7addad0babb3aed0
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 3.23.2-dev.agentgatew--oller-ha-3x.2026-09-11.09-52-26.h365ffbd

_{Posted by architect-orb · build 5861 · commit 365ffbd · updated in place on every push}