PaletteAI 1.2.2 Release Notes
Summary
PaletteAI 1.2.2 is a patch release that strengthens tenant isolation and access control, improves workload and compute-pool reliability, and resolves a set of edge-networking, image-mirroring, and console issues on top of the 1.2.1 release.
-
Tenant isolation - Per-tenant identity connectors keep group-based trust scoped to each tenant, and creation of projects, settings, compute configurations, and secrets is now restricted to the owning tenant.
-
Access control - Actions that modify profile bundles, compute pools, and AI workloads now require the corresponding update permission before they can run.
-
Workload and compute reliability - Workloads owned by a compute pool are no longer removed unexpectedly, transient control-plane errors are retried instead of surfacing as failures, and workloads wait for the compute pool to settle rather than reporting a premature failure. Infrastructure-only add-on variants are excluded from AI workloads.
-
Edge networking - Edge hosts with multiple network interfaces and a DHCP address are supported on non-overlay pools, and hosts assigned an address by DHCP keep it instead of having their inventory address reapplied as static.
-
Large model images - Mirroring large machine learning image layers into the internal registry is now reliable.
-
Console - This release applies consistent PaletteAI branding across the interface, gives clearer explanations for disabled delete actions, saves and persists Day-2 deployment changes reliably, corrects single-node control plane and worker resource handling, and shows per-integration last-modified timestamps.
For the complete list of changes in each component, refer to Full Component Release Notes.
Upgrade Notes
- You must upgrade the
mural-crdschart to 0.7.17-hotfix.2 before upgrading themuralchart to 1.2.2. For detailed instructions on how to upgrade PaletteAI, refer to the PaletteAI upgrade guide.
Component Versions
The following core component versions are pinned for this PaletteAI release.
| Component | Version |
|---|---|
| brush | 0.5.24-hotfix.2 |
| canvas | 0.6.18-hotfix.2 |
| hue | 0.12.28-hotfix.2 |
| mural-crds | 0.7.17-hotfix.2 |
Mural Helm values
The following diff lists changes to mural/charts/mural/values.yaml between PaletteAI 1.2.1 and 1.2.2. Review it before upgrading if you maintain custom Helm values.
values.yaml changes between 1.2.1 and 1.2.2
values.yaml
diff --git a/mural/charts/mural/values.yaml b/mural/charts/mural/values.yaml
index 8b920b337..b2157125e 100644
--- a/mural/charts/mural/values.yaml
+++ b/mural/charts/mural/values.yaml
@@ -72,7 +72,7 @@ global:
# - use a custom FleetConfig controller image with the `gke-gcloud-auth-plugin` installed
kubernetesProvider: "Generic"
certManagerVersion: "v1.19.1"
- muralVersion: "1.2.1"
+ muralVersion: "1.2.2"
dns:
domain: "replace.with.your.domain"
rootIngress:
@@ -120,7 +120,7 @@ global:
username: ""
password: ""
basicAuthSecretName: ""
- muralCrdsVersion: "0.7.17-hotfix.1"
+ muralCrdsVersion: "0.7.17-hotfix.2"
## @section certificates
## @param certificates.clusterIssuer.spec.selfSigned The spec for the ClusterIssuer used by cert-manager to issue the Mural root CA certificate.
@@ -1509,7 +1509,7 @@ brush:
## @param brush.image.pullPolicy The pull policy to use for the image
image:
repository: public.ecr.aws/mural/brush
- tag: v0.5.24-hotfix.1
+ tag: v0.5.24-hotfix.2
pullPolicy: IfNotPresent
## @param brush.imagePullSecrets The pull secrets to use for the image
imagePullSecrets: []
@@ -1804,7 +1804,7 @@ canvas:
## @param canvas.image.pullPolicy canvas image pull policy
image:
repository: public.ecr.aws/mural/canvas
- tag: v0.6.18-hotfix.1
+ tag: v0.6.18-hotfix.2
pullPolicy: IfNotPresent
## @param canvas.imagePullSecrets Image pull secrets
imagePullSecrets: []
@@ -1941,12 +1941,14 @@ canvas:
## @param canvas.oidc.issuerK8sService The Kubernetes service URL for the Dex server from the perspective of the Canvas pod.
## @param canvas.oidc.skipSSLCertificateVerification Whether to skip SSL certificate verification when interacting with Dex. Set to true to skip verification. Skipping verification is not recommended but needed when using self-signed certificates.
## @param canvas.oidc.redirectURL The redirect URL for the Canvas application. The path is required to end with /callback.
+ ## @param canvas.oidc.extraScopes Additional Dex OAuth scopes requested at login (e.g. `federated:id` for per-tenant connector isolation).
oidc:
sessionSecret: ""
sessionDir: "/app/sessions"
issuerK8sService: ""
skipSSLCertificateVerification: true
redirectURL: "https://replace.with.your.domain/ai/callback"
+ extraScopes: []
## @param canvas.impersonationProxy.enabled [default: false] Whether to enable impersonation proxy. Only use if your Mural Hub Kubernetes cluster is not configured to trust Dex as an OIDC provider. Requires `serviceAccount.create` to be `true`.
## @param canvas.impersonationProxy.userMode [default: passthrough] The mode to use for user impersonation. The `userMap` specifies a 1:1 mapping between external users, such as local Dex users or OIDC users, to [Kubernetes users](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes). If `userMode` is `map`, it is used to identify values for Impersonate-User headers. If `userMode` is `passthrough`, the Impersonate-User header automatically uses the current user's email address as the value. Valid options are `map` or `passthrough`.
## @param canvas.impersonationProxy.userMap [default: {}] If `userMode` is `map`, the provided mapping is used to identify values for Impersonate-User headers. For example `"bob@example.com": "bob@kubernetes.com"`. This is only used for mapping external users to an [actual Kubernetes user](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes). The syntax is `<external-user>: <'local-kubernetes-user'>`.
@@ -2046,7 +2048,7 @@ curator:
## @param curator.image.pullPolicy Image pull policy for curator.
image:
repository: public.ecr.aws/mural/curator
- tag: v0.0.2-hotfix.1
+ tag: v0.0.2-hotfix.2
pullPolicy: IfNotPresent
## @param curator.imagePullSecrets Image pull secrets for curator.
imagePullSecrets: []
@@ -3320,6 +3322,8 @@ hue:
webhookWaitTimeout: 5s
## @param hue.garbageCollectorServiceAccount The service account used by Kubernetes garbage collector for owner reference deletions
garbageCollectorServiceAccount: "system:serviceaccount:kube-system:generic-garbage-collector"
+ ## @param hue.canvasServiceAccount The full "system:serviceaccount:<namespace>:<name>" username of Canvas's system K8s client, exempted from the tenant-scoped Secret admission webhook.
+ canvasServiceAccount: ""
## @param hue.definitionUpsert.ociRegistryInterval The interval at which each spoke cluster will upsert mural-definitions Flux artifacts to account for OCI registry configuration changes
## @param hue.definitionUpsert.syncInterval The interval at which each spoke cluster will sync mural-definitions from the OCI registry
definitionUpsert:
@@ -3424,7 +3428,7 @@ hue:
## @param hue.image.pullPolicy Image pull policy
image:
repository: public.ecr.aws/mural/hue
- tag: v0.12.28-hotfix.1
+ tag: v0.12.28-hotfix.2
pullPolicy: IfNotPresent
## @param hue.resources.requests.cpu hue controller deployment's cpu request
## @param hue.resources.requests.memory hue controller deployment's memory request
@@ -3518,6 +3522,7 @@ hue:
# verbs: ["get", "list", "watch"]
## @param hue.admissionWebhooks.enabled Whether to enable admission webhooks
## @param hue.admissionWebhooks.failurePolicy The failure policy for admission webhooks
+ ## @param hue.admissionWebhooks.secretsWebhookRegister.image kubectl image for the post-install TLS bootstrap wait hook
## @param hue.admissionWebhooks.certificate.mountPath The mount path for the certificate
## @param hue.admissionWebhooks.certManager.revisionHistoryLimit The revision history limit for the cert-manager
## @param hue.admissionWebhooks.resources.requests.cpu hue webhook deployment's cpu request
@@ -3527,6 +3532,8 @@ hue:
admissionWebhooks:
enabled: true
failurePolicy: Fail
+ secretsWebhookRegister:
+ image: public.ecr.aws/mural/third-party/kubectl:v1.35.5
certificate:
mountPath: /etc/k8s-webhook-certs
certManager:
@@ -3600,7 +3607,7 @@ hue:
enabled: true
image:
repository: public.ecr.aws/mural/hue-definitions
- tag: v0.12.28-hotfix.1
+ tag: v0.12.28-hotfix.2
pullPolicy: IfNotPresent
pullSecrets: []
job:
Full Component Release Notes
The following table lists all changes made to core components in this PaletteAI release.
Per-component changes in 1.2.2
| Component | Tag | Notes |
|---|---|---|
| brush | brush/v0.5.24-hotfix.2 | Bug Fixes
|
| canvas | canvas/v0.6.18-hotfix.2 | Features
Bug Fixes
|
| hue | hue/v0.12.28-hotfix.2 | Includes paletteai CLI binaries. Bug Fixes
|
| mural-crds | mural-crds/v0.7.17-hotfix.2 | Features
|