fix: keep the single-replica components drainable (maxUnavailable 1)

[teemow]

Written by Timo's agent.

Problem

These PodDisruptionBudgets are minAvailable: 1, each on a single replica:

• muster
• klaus-gateway
• agent-manager
• muster-valkey
• the kagent controller

That refuses every voluntary eviction. A cluster upgrade that rolls its machines drains each node, and the drain waits for its timeout on every node where one of these pods runs. The budgets came with #431 to keep Karpenter's consolidation off the streaming pods. But their karpenter.sh/do-not-disrupt annotation already covers that, and the budget additionally blocks every drain.

Change

Budgets: each is now maxUnavailable: 1. A drain evicts the single replica and goes on, with the usual restart gap. Karpenter's consolidation still stays away through the pods' do-not-disrupt annotation, which is unchanged.

Component	Where the budget is set	New shape
muster	meta muster.podDisruptionBudget → muster chart	minAvailable: "" (clears the chart's default of 1), maxUnavailable: 1
klaus-gateway	meta klausGateway.podDisruptionBudget → klaus-gateway chart	minAvailable: "", maxUnavailable: 1
kagent controller	meta kagent.controller.pdb → kagent chart	the override is dropped, so the chart's own default applies: maxUnavailable: 1
agent-manager	agentManager.podDisruptionBudget (meta and connectivity)	maxUnavailable: 1
muster-valkey	valkey.podDisruptionBudget (meta and connectivity)	maxUnavailable: 1

Platform Postgres: with postgres.instances: 1, the CNPG Cluster renders enablePDB: false. The operator's budget on a lone primary has no replica to switch over to and would hold a drain. With two or more instances (the default is three), the operator's budgets stay and it switches the primary over when its node drains.

Unchanged: vm-manager's minAvailable: 1. Evicting its pod ends every VM on the node, so it is a deliberate choice outside this change.

Test

• make verify-disruption passes. It now asserts maxUnavailable: 1 on each budget and no minAvailable next to it, the guards (both fields, neither, a lone minAvailable passes through), and enablePDB: false at one Postgres instance only.
• make verify-components-charts: every component chart renders the forwarded values, at the range resolution and at the BOM pin. muster, klaus-gateway and kagent render their budget as maxUnavailable: 1.
• The helm-docs and schema hooks are regenerated and clean.

Checklist

• Update changelog in CHANGELOG.md.
• Make sure values.yaml and values.schema.json are valid.

[circleci-architect]

Published Helm chart agent-platform

4.76.1-re950fef2t20260925110702hd55a40c

Chart	agent-platform
Version	4.76.1-re950fef2t20260925110702hd55a40c
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform:4.76.1-re950fef2t20260925110702hd55a40c
Digest	sha256:461dc3b534ec3e4447e13576102a26549c0ae37ba9f7f211b0c4ba66ff87c150
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform --version 4.76.1-re950fef2t20260925110702hd55a40c

_{Posted by architect-orb · build 14336 · commit d55a40c · updated in place on every push}

[circleci-architect]

Published Helm chart agent-platform-connectivity

4.76.1-re950fef2t20260925110702hd55a40c

Chart	agent-platform-connectivity
Version	4.76.1-re950fef2t20260925110702hd55a40c
OCI reference	oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity:4.76.1-re950fef2t20260925110702hd55a40c
Digest	sha256:3282f527bd0673ce97586a70d7fea6fb4a8a01a72f2d58c1c9ab09e5ffbc391f
Registry	public — gsoci.azurecr.io
Git catalog	giantswarm-test-catalog (index)

Pull this chart

helm pull oci://gsoci.azurecr.io/charts/giantswarm/agent-platform-connectivity --version 4.76.1-re950fef2t20260925110702hd55a40c

_{Posted by architect-orb · build 14338 · commit d55a40c · updated in place on every push}

[teemow]

From Timo's agent: released as v4.76.1, rolled onto a production installation, and every HelmRelease there is Ready.

• The budgets of muster, klaus-gateway, agent-manager, muster-valkey and the kagent controller are maxUnavailable: 1, each with disruptionsAllowed 1 for its one pod.
• A server-side dry-run drain of each node that runs one of those pods exits 0, evicts the pod, and no budget refuses it.
• That installation's platform Postgres runs 3 instances, so the operator's budgets are kept, as intended.