[teemow]

Part of #299.

What

While muster runs with OAuth on (muster.muster.oauth.server.enabled, the default), the connectivity chart labels the shared RemoteMCPServer agent-platform/muster with kagent.dev/discovery: disabled — the opt-out from controller-side tool discovery contributed upstream in kagent-dev/kagent#2752 (main) and kagent-dev/kagent#2753 (release/v0.10.x). A kagent controller that knows the label reports Accepted=True (DiscoveryDisabled, empty inventory) instead of Accepted=False (ReconcileFailed … Unauthorized); an older controller ignores the label and behaves as before. With OAuth off (dev installs) the controller lists tools anonymously and no label is rendered. Derived from the existing toggle: no new value, no schema change, no omitKeys change.

Why not a controller credential (option 1 of #299)

spec.headersFrom is the only way a RemoteMCPServer carries a header, it reads a Secret/ConfigMap literal only, and it is not discovery-only: the kagent translator resolves every headersFrom value into each agent's rendered config, and the Go ADK runtime applies static headers last, after the propagated caller token (headerRoundTripper.RoundTrip in go/adk/pkg/mcp/registry.go at v0.10.0: "static headers … take precedence over all dynamic sources"). A controller token on the shared server would make every agent call muster as system:serviceaccount:kagent:kagent-controller, copy the token into every agent's config Secret, and roll every agent on each rotation. The template comment, docs/authentication.md ("Tool discovery by the kagent controller: no identity, opted out") and UPGRADE.md say so, so nobody adds it as a shortcut.

Verification

• New make verify-kagent-discovery (wired into the CircleCI test-ingress-modes job): label present by default and absent with muster.muster.oauth.server.enabled=false; no headersFrom on the muster server; operator-defined kagent.remoteMcpServers keep tokenSecret → headersFrom and get no label; nothing renders with kagent off.
• make verify-modes verify-global verify-kagent-netpol verify-kagent-discovery green locally. The golden render (verify-modes) now sets the OAuth toggle off on both sides, the documented pattern for an intended default-render change (comment on KYVERNO_GOLDEN).
• Live: after the release rolls through the fleet OCIRepository (>=1.0.0), kubectl -n agent-platform get remotemcpserver muster -o jsonpath='{.metadata.labels}' shows the label; the condition itself turns green only once the installation runs a controller with the upstream change (tracked in Connectivity 4.0: ModelConfig and RemoteMCPServer templates at kagent.dev/v1alpha3; the shared cross-namespace muster RemoteMCPServer is retired — the Generic chart renders one per agent — and the Kyverno Agent/srt-settings mutations go (kagent API v2, bumblebee-plans#51 D7) #299).

Operator action

None (UPGRADE.md). CHANGELOG entry under Unreleased / Fixed.