Repository navigation
feat(homepage): add an Artificial Intelligence group - #5962
Conversation
The maintainer asked for kagent to sit in its own "Artificial Intelligence" group on the Homepage dashboard, together with the web portals of Claude, ChatGPT and GitHub Copilot. Declare the group in the Homepage layout and in the Kyverno allow-list and its deny message, which test-restrict-homepage-service-groups keeps in agreement. Move the kagent route's card into it, and list the three portals statically, with their dashboard-icons logos. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
✅
|
✅
|
The Kyverno group policy and the kagent route both apply in the infrastructure layer. In one deploy, the route's new group would reach admission before Kyverno has loaded the widened allow-list, so the update would be denied and the layer would fail. Ship the group and the three portals first; kagent's route moves into the group in a follow-up once the group is admitted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
devantler
left a comment
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer (interactive Claude Code session)
Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)
Reviewed commit: a4a8396
- CodeRabbit: its included allowance on this repository is 1 review per hour. It used it on #5961 at 19:32Z and stated "0 remain after this review".
- Codex: usage limit since 2026-11-09T14:35:07Z; only the maintainer can lift it.
- Cursor Bugbot: usage limit since 2026-11-09T14:35:39Z; only the maintainer can lift it.
Scope. The Homepage layout gains an Artificial Intelligence group, three static services are listed under it, and the Kyverno group policy's allow-list and deny message both include the group.
Findings:
- Correctness: the layout, allow-list and deny message agree.
test-restrict-homepage-service-groupsreports 19 groups, and the policy still denies an undeclared group. The three hrefs are the official portals, and all three dashboard-icons resolve on the CDN. - Rollout: adding a group to the allow-list is safe on its own; static services do not pass through admission. Moving kagent's route into the group was taken out of this PR (a4a8396). The policy and the route both apply in the
infrastructurelayer, so in one deploy the route update could reach admission before Kyverno loads the widened list, and it would be denied. - nit: the layout and services comments already speak of kagent "beside" the tools. That becomes true with the follow-up PR that moves kagent's card.
Verdict: no P0/P1 findings
🤖 Generated with Claude Code
GitHub Copilot now has its own card in the Artificial Intelligence service group (#5962), so the "Copilot Agents" bookmark in Internal Developer Platform duplicates it. The maintainer asked for it removed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Why
The maintainer asked for kagent to sit in its own Artificial Intelligence group on the Homepage dashboard, together with the web portals of Claude, ChatGPT and GitHub Copilot.
What
homepage/config-map.yaml): a newArtificial Intelligencegroup with anmdi-robot-outlineicon, placed after Data.https://claude.ai/), ChatGPT (https://chatgpt.com/) and GitHub Copilot (https://github.com/copilot). Each uses its full-colour dashboard-icons logo, all three of which resolve on the CDN.restrict-homepage-service-groupslists the new group in both its allow-list and its deny message.Deferred: moving kagent's card into the group. That is a follow-up PR once this one has deployed. The group policy and the kagent route both apply in the
infrastructurelayer. In one deploy, the route's new group would reach admission before Kyverno has loaded the widened allow-list, the update would be denied, and the layer would fail. Earlier group additions only had routes in the laterappslayer, so they never hit this ordering.The existing "Copilot Agents" bookmark in Internal Developer Platform is unchanged.
Validation
test-restrict-homepage-service-groups: the layout, allow-list and deny message agree on 19 service groups, and the policy denies.test-validate-homepage-bookmarks,test-trivyignore-configmap-content-boundary, and the authorization tests, whose surface is unchanged.ksail --config ksail.prod.yaml workload validatepasses, and the changed files appear in its output. The Homepage chart render was skipped locally for lack of a registry credential helper; CI renders it.🤖 Generated with Claude Code