Skip to main content

Release 0.5.7 — Keycloak PostgreSQL, AgentGateway Config-Bridge, and Setup Overhaul

Sri Aradhyula
Sri Aradhyula

Released: 2026-06-02 Chart: oci://ghcr.io/cnoe-io/charts/ai-platform-engineering:0.5.7 Previous release: 0.5.6

Highlights​

0.5.7 is a substantial release. Keycloak gains optional PostgreSQL persistence (database.enabled), the AgentGateway Helm chart wires in the config-bridge sidecar for dynamic MCP route management, and setup-caipe.sh is significantly overhauled to support public-domain SSO, optional GitHub social login, a unified LiteLLM front for chat and embeddings, shared Postgres for Keycloak and OpenFGA, and a creds command for reprinting local logins.

What's New​

Keycloak​

  • PostgreSQL support — database.enabled=true in the Keycloak subchart configures an external or in-chart Postgres database, replacing the default H2 file store for production deployments (#1683)
  • Overridable HTTP/hostname flags — KC_HTTP_ENABLED and KC_HOSTNAME_STRICT are now overridable via chart values; fail guards added for required database fields

AgentGateway​

  • Config-bridge sidecar — the AgentGateway Helm chart now wires the config-bridge sidecar for dynamic MCP route updates without restarting the gateway pod

Setup (setup-caipe.sh)​

  • Public-domain SSO wiring — configure a real OIDC IdP with a public domain in a single setup-caipe.sh run
  • GitHub social login — opt-in GitHub social login via --github-client-id / --github-client-secret
  • Unified LiteLLM front — --litellm flag wires a single LiteLLM proxy for both chat and embeddings models
  • Shared Postgres — --postgres flag provisions a shared Postgres instance for Keycloak and OpenFGA, replacing separate H2/SQLite stores
  • creds command — setup-caipe.sh creds reprints local login credentials without re-running the full setup
  • Azure embeddings hardening — fix fallback path detection and H2 Keycloak warnings for Azure-hosted deployments
  • Pre-create caipe-platform-secret — the secret is now pre-created before chart install to avoid race conditions on fresh installs

RAG​

  • OpenFGA HTTP URL — global.rag.openfga.httpUrl is now correctly wired as the default for OPENFGA_HTTP in rag-server

Bug Fixes​

  • keycloak: unset stale error field when migration completes successfully (#1680)
  • keycloak: use direct role endpoint to look up impersonation role ID in init-token-exchange to avoid pagination issues (#1679)
  • keycloak: reconcile bot OBO target on fresh local install without upstream IdP
  • skill-builder: handle wrapped builtin-tools API response shape that was causing the tool list to appear empty

Breaking Changes​

None. Existing values.yaml continues to work. To opt into Postgres or the config-bridge, add the new chart values.

Upgrade​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/cnoe-io/charts/ai-platform-engineering \
  --version 0.5.7 \
  -f your-values.yaml

Upgrade Guide: 0.5.6 → 0.5.7​

No mandatory values.yaml changes. No data migrations required.

Optional: Enable Keycloak PostgreSQL​

Add to your values file:

keycloak:
  database:
    enabled: true
    vendor: postgres
    host: <your-postgres-host>
    port: 5432
    database: keycloak
    username: keycloak
    existingSecret: keycloak-db-secret  # key: password

Optional: Enable AgentGateway config-bridge​

The sidecar is enabled by default in the updated chart. If you pin agentgateway.configBridge.enabled=false to disable it, dynamic MCP route changes require a pod restart.