Version and compatibility matrix¶
This page records the versions AgentWorkflows is pinned to for the v0.5.1
source version. No tag or published release is implied. It is a compatibility reference,
not a support SLA: the tables list what the platform ships
and what CI exercises, so you can reproduce a known-good state and reason about drift. Newer or
older versions may work but are outside what the release was validated on.
Every version below is extracted from this checkout: chart Chart.yaml /
values.yaml, the Argo CD Application manifests, the CI workflow, and the validation toolchain
descriptor. Where the platform deliberately delegates a version to the operator (the customer's
Kubernetes distribution, ingress, storage, secrets, and GPU stack), that is called out explicitly.
Product version¶
| Item | Version | Source |
|---|---|---|
| AgentWorkflows | v0.5.1 |
README.md |
| Helm chart version (all first-party charts) | 0.5.1 |
deploy/charts/*/Chart.yaml |
kubeVersion constraint (all charts) |
>=1.25.0 |
deploy/charts/*/Chart.yaml |
Maturity is a reference implementation and customer lab; a production handoff still requires current strict evidence, customer identity/secrets integration, capacity sizing, and backup validation. See Production readiness.
First-party components¶
The two application services (inference gateway, RAG service) are built from source in this repo;
their appVersion tracks the platform release and their images are published to GHCR and digest-pinned by
release CI. The runtime and datastore charts wrap upstream images and pin both a documentation tag
and an immutable manifest-list digest in values.yaml.
| Component | Chart appVersion |
Image | Tag | Notes |
|---|---|---|---|---|
| Inference gateway | 0.5.1 |
ghcr.io/ramazankara/agentworkflows/inference-gateway |
v0.5.1 |
First-party; release CI pins the published digest. |
| RAG service | 0.5.1 |
ghcr.io/ramazankara/agentworkflows/rag-service |
v0.5.1 |
First-party; release CI pins the published digest. |
| Ollama runtime | 0.24.0 |
ollama/ollama |
0.24.0 |
Optional self-hosted LLM runtime; digest-pinned. |
| vLLM runtime | 0.22.0 |
vllm/vllm-openai |
v0.22.0 |
GPU/production-style OpenAI-compatible runtime; digest-pinned. |
| Qdrant vector store | 1.18.1 |
qdrant/qdrant |
v1.18.1 |
Optional vector-RAG profile; single-instance; digest-pinned. |
| Budget Redis | 8.0 |
redis |
8.0-alpine |
Shared sandbox budget accounting store; digest-pinned. |
| Agent workspace | 0.5.1 |
(namespace/RBAC template, no image) | n/a | Tenant namespace scaffold; no workload image of its own. |
| Platform (umbrella) | 0.5.1 |
(aggregates the charts above) | n/a | Single-command dev/demo bring-up; GitOps remains recommended for multi-namespace installs. |
The first-party service container images are built on python:3.14-alpine
(src/inference-gateway/Dockerfile, src/rag-service/Dockerfile), digest-pinned in the Dockerfiles.
The current base resolves to Python 3.14.8 on Alpine 3.24.2. The final images remove
pip after installing locked dependencies; build a new image when changing dependencies.
Model revisions and evaluation status are documented in Model selection. The new GPU candidates have not been validated against the pinned serving runtimes; their upstream context sizes are not a runtime compatibility claim.
Local-profile add-ons¶
These third-party charts are referenced by the local Argo CD application set. The customer application list does not install them; customer clusters must provide compatible operators and observability services before syncing resources that depend on them.
| Add-on | Chart | targetRevision |
Repository | Defined in |
|---|---|---|---|---|
| kube-prometheus-stack | kube-prometheus-stack |
66.2.1 |
prometheus-community | deploy/observability/applications.yaml |
| Grafana Tempo | tempo |
1.23.3 |
grafana | deploy/observability/applications.yaml |
| Grafana Loki | loki |
6.24.0 |
grafana | deploy/observability/applications.yaml |
| Promtail | promtail |
6.16.6 |
grafana | deploy/observability/applications.yaml |
| Prometheus Pushgateway | prometheus-pushgateway |
2.15.0 |
prometheus-community | deploy/observability/applications.yaml |
| Kyverno | kyverno |
3.2.7 |
kyverno | deploy/clusters/local/apps.yaml |
| KEDA | keda |
2.16.1 |
kedacore | deploy/clusters/local/apps.yaml |
| External Secrets Operator | external-secrets |
0.11.0 |
external-secrets | deploy/clusters/local/apps.yaml |
| OpenCost | opencost |
1.41.0 |
opencost | deploy/clusters/local/apps.yaml |
Notes:
- Kyverno, KEDA, and External Secrets are grouped into the local multi-source
platform-operatorsApplication. The customer overlay assumes the required operators already exist and does not syncexternal-secrets.yamlautomatically. - OpenCost is pinned in the local overlay only (
cost-controlsApplication); the customer overlay leaves cost tooling to the operator's chargeback stack. - The kyverno
3.2.7value is the Helm chart version. The Kyverno CLI used for policy-as-code tests is pinned separately in the toolchain (see below). - Velero-based backup (
backup-velero) and the restore-drill workload are shipped from in-repo manifests rather than a pinned third-party chart. - The agent-sandbox workspace runtime is installed from vendored, checksummed release manifests
(
deploy/vendor/agent-sandbox/) by the local/customer Argo CD applications or, on the direct quickstart path, bymake agent-sandbox-install. It is not installed from a Helm chart. See ADR 0009 and the row below.
Runtime, Kubernetes, and toolchain¶
| Item | Version | Where it is pinned / tested | Notes |
|---|---|---|---|
| Kubernetes (chart floor) | >=1.25.0 |
kubeVersion in every Chart.yaml |
Minimum the charts declare compatible. |
| Kubernetes (local default) | kindest/node:v1.35.1 |
scripts/local-up.sh, deploy/clusters/local/kind-config.yaml |
Used on cgroup v2 unless overridden; not the CI E2E image. |
| Kubernetes (CI and cgroup-v1 fallback) | kindest/node:v1.31.4 |
.github/workflows/ci.yml, scripts/local-up.sh |
The version exercised by the local E2E job and selected automatically on cgroup v1. |
| Python (CI + images) | 3.14 |
.github/workflows/ci.yml, src/*/Dockerfile |
CI runs on 3.14; service images are python:3.14-alpine. |
| Python (documented local minimum) | 3.12+ |
quickstart.md, getting-started.md | Minimum for running local validation tooling. The validation-toolchain install hint recommends 3.14 or newer. |
| Python (SDK) | 3.11, 3.12, 3.13, 3.14 |
sdk-compatibility CI matrix; sdk/python/pyproject.toml |
All declared supported versions are exercised; requires-python remains >=3.11. |
| Helm | v4.2.0 bootstrap |
validation-toolchain.yaml; azure/setup-helm in CI |
The Linux/WSL bootstrap pins v4.2.0. Helm 3 is not exercised by a dedicated CI matrix. |
| Go | 1.26 |
.github/workflows/ci.yml; toolchain install hint |
Builds Go-based validation utilities (kubeconform, Kyverno CLI, restore-drill). |
| agent-sandbox controller | v0.5.0 |
deploy/vendor/agent-sandbox/ (SHA-256 in the vendor README) |
Standard coding-agent workspace runtime (ADR 0010, platform prerequisite); CRDs agents.x-k8s.io/v1beta1 + extensions.agents.x-k8s.io/v1beta1. v1beta1 API; re-verify spec fields on upgrade. |
| Calico (default local CNI) | v3.29.1 |
CALICO_VERSION in scripts/local-up.sh |
NetworkPolicy-enforcing local default; LOCAL_CNI=kindnet is an explicit non-enforcing compatibility escape hatch. |
Validation toolchain (pinned tool versions)¶
These are the tool versions the validation and evidence pipeline installs and runs
(platform/tools/validation-toolchain.yaml, defaults installed by
scripts/install-validation-tools.sh).
Each is overridable via the listed environment variable.
| Tool | Default version | Override env | Purpose |
|---|---|---|---|
| kubeconform | v0.7.0 |
KUBECONFORM_VERSION |
Kubernetes YAML schema validation. |
| Kyverno CLI | v1.18.1 |
KYVERNO_VERSION |
Policy-as-code tests (labels, pod security, resources, image tags, signatures). |
| restore-drill | v1.0.1 |
RESTORE_DRILL_VERSION |
Backup/restore-drill config validation and restore evidence. |
| k6 | v2.0.0 |
K6_VERSION |
Gateway load-test scenarios. |
| Syft | v1.44.0 |
SYFT_VERSION |
Filesystem and image SBOM generation. |
| Argo CD CLI | v3.4.3 |
ARGOCD_VERSION |
GitOps client compatibility checks. |
| Cosign | v3.0.6 |
COSIGN_VERSION |
Image / Helm OCI artifact signature verification. |
| Trivy | v0.70.0 |
TRIVY_VERSION |
Filesystem, secret, config, and image vulnerability scanning. |
Release-only distribution tooling is pinned separately: ORAS v1.3.1 publishes Artifact Hub
OCI metadata, mike==2.2.0 retains versioned documentation, and
pypa/gh-action-pypi-publish is pinned to the peeled commit for its v1.14.0 release, matching
the tag used by its runtime container. The exact action pins live in
.github/workflows/ci.yml, .github/workflows/docs.yml, and requirements-docs.txt.
What the platform does not pin¶
Consistent with the platform boundary, the following are the operator's responsibility and are intentionally not pinned here:
- The customer's Kubernetes distribution and its exact minor version (any conformant cluster at or above the chart floor).
- Ingress controllers,
StorageClass/ CSI drivers, and load balancers. - Secret backends and identity providers (the External Secrets operator is pinned; the backing secret store is not).
- GPU drivers, device plugins, and accelerator runtimes for NVIDIA / AMD nodes.
- Served model weights and revisions (governed via model provenance and the model catalog, not this matrix).
See Scope and non-goals for the full boundary and Release verification for how to verify the published artifacts against these pins.