PaletteAI 1.1.7 Release Notes

Summary

PaletteAI 1.1.7 is a patch release on 1.1.6 that ships a coordinated hotfix.6 image train for brush, canvas, hue, and mural-crds. It backports Compute Pool and control-plane scheduling improvements, Profile Bundle and airgap tooling enhancements, and Tenant enablement defaults from the 1.1 release line.

Tenant-scoped App Deployments and Model Deployments are now enabled by default. The enableTenantScopedDeployments feature flag defaults to true, so the Canvas UI exposes the App Deployments and Model Deployments navigation menus at the Tenant level without manual configuration. This resolves the known issue documented in 1.1.6 that required editing the mural HelmRelease. In addition, the default Dex user group is now granted permission to create Tenants.

Compute Pool and control-plane scheduling are more robust. PaletteAI now supports worker-eligible control planes with no worker pools, allows compute configs and compute pools with a control-plane-only node layout, deprioritizes GPU hosts when selecting control-plane nodes, and hardens ComputePool orphan cleanup. Single-node clusters benefit from improved mode derivation, machine-pool rebuilds from allocated hosts without spare capacity, and node-metadata synchronization.

Profile Bundle handling improves with in-place sharedWith updates, controller backfill of addon variant names, and parsing of profileBundle.content for mirror pull and sync. The paletteai CLI adds a support-bundle subcommand and an --extra-pack flag for Artifact Studio Pack content bundles, and the installer no longer generates Alertmanager credentials.

AIWorkload reconciliation is more correct: AIWorkloads now fail when their WorkloadDeploymentConfigs cannot deploy, and settings comparisons use the spec instead of the generation to detect changes. Canvas surfaces the stack trace on 500 errors and disables the two-node option when the Kubernetes distribution is incompatible. The Mural umbrella chart restores the Zot serviceHeadless.enabled default to false.

Upgrade Notes

1. You must upgrade the mural-crds chart to 0.7.8-hotfix.6 before upgrading the mural chart to 1.1.7. For detailed instructions on how to upgrade PaletteAI, refer to the PaletteAI upgrade guide.

Component Versions

The following core component versions are pinned for this PaletteAI release.

Component	Version
brush	0.5.18-hotfix.6
canvas	0.6.9-hotfix.6
hue	0.12.12-hotfix.6
mural-crds	0.7.8-hotfix.6

Mural Helm values

The following diff lists changes to mural/charts/mural/values.yaml between PaletteAI 1.1.6 and 1.1.7.

values.yaml

diff --git a/mural/charts/mural/values.yaml b/mural/charts/mural/values.yaml
index 9c6f98262..f36de48e9 100644
--- a/mural/charts/mural/values.yaml
+++ b/mural/charts/mural/values.yaml
@@ -11,6 +11,7 @@
 ## @param global.featureFlags.enableDeployAppToSharedComputePool Whether to enable the deployment of an app to a shared compute pool.
 ## @param global.featureFlags.enableDeployModelToDedicatedComputePool Whether to enable the deployment of a model to a dedicated compute pool.
 ## @param global.featureFlags.enableDeployModelToSharedComputePool Whether to enable the deployment of a model to a shared compute pool.
+## @param global.featureFlags.enableTenantScopedDeployments Whether to enable Tenant-scoped App Deployments and Model Deployments. When enabled, the Canvas UI exposes the App Deployments and Model Deployments navigation menus at the Tenant level.
 ## @param global.featureFlags.systemDefaultResources Whether to automatically create a default Tenant and Settings, ComputeConfig, and Project resources in the default namespace.
 ## @param global.featureFlags.versioningType Version naming scheme. Accepted values are "basic" (v0, v1, ...) or "semantic" (v0.0.1, v0.1.0, ...)
 ## @param global.featureFlags.deploymentMode The deployment mode for Mural. Valid values: "connected", "airgap". Default is "connected".
@@ -56,6 +57,7 @@ global:
     enableDeployAppToSharedComputePool: true
     enableDeployModelToDedicatedComputePool: true
     enableDeployModelToSharedComputePool: true
+    enableTenantScopedDeployments: true
     systemDefaultResources: true
     versioningType: semantic
     deploymentMode: "connected"
@@ -67,7 +69,7 @@ global:
   # - use a custom FleetConfig controller image with the `gke-gcloud-auth-plugin` installed
   kubernetesProvider: "Generic"
   certManagerVersion: "v1.19.1"
-  muralVersion: "1.1.6"
+  muralVersion: "1.1.7"
   dns:
     domain: "replace.with.your.domain"
     rootIngress:
@@ -108,7 +110,7 @@ global:
     username: ""
     password: ""
     basicAuthSecretName: ""
-  muralCrdsVersion: "0.7.8-hotfix.5"
+  muralCrdsVersion: "0.7.8-hotfix.6"

 ## @section certificates
 ## @param certificates.clusterIssuer.spec.selfSigned The spec for the ClusterIssuer used by cert-manager to issue the Mural root CA certificate.
@@ -1513,7 +1515,7 @@ brush:
   ## @param brush.image.pullPolicy The pull policy to use for the image
   image:
     repository: public.ecr.aws/mural/brush
-    tag: v0.5.18-hotfix.5
+    tag: v0.5.18-hotfix.6
     pullPolicy: IfNotPresent
   ## @param brush.imagePullSecrets The pull secrets to use for the image
   imagePullSecrets: []
@@ -1802,7 +1804,7 @@ canvas:
   ## @param canvas.image.pullPolicy canvas image pull policy
   image:
     repository: public.ecr.aws/mural/canvas
-    tag: v0.6.9-hotfix.5
+    tag: v0.6.9-hotfix.6
     pullPolicy: IfNotPresent
   ## @param canvas.imagePullSecrets Image pull secrets
   imagePullSecrets: []
@@ -3319,7 +3321,7 @@ hue:
   ## @param hue.image.pullPolicy Image pull policy
   image:
     repository: public.ecr.aws/mural/hue
-    tag: v0.12.12-hotfix.5
+    tag: v0.12.12-hotfix.6
     pullPolicy: IfNotPresent
   ## @param hue.resources.requests.cpu hue controller deployment's cpu request
   ## @param hue.resources.requests.memory hue controller deployment's memory request
@@ -3479,7 +3481,7 @@ hue:
     enabled: true
     image:
       repository: public.ecr.aws/mural/hue-definitions
-      tag: v0.12.12-hotfix.5
+      tag: v0.12.12-hotfix.6
       pullPolicy: IfNotPresent
       pullSecrets: []
     job:
@@ -4866,10 +4868,9 @@ zot:
     # The name of the service account to use.
     # If not set and create is true, a name is generated using the fullname template
     name: ""
-  # Required for StatefulSet serviceName when persistence is enabled (upstream zot chart).
   serviceHeadless:
     # Enable headless service, only for statefulset
-    enabled: true
+    enabled: false
     # Headless service port
     port: 5000
     # Annotations to add to the headless service

Full Component Release Notes

The following table lists all changes made to core components in this PaletteAI release.

Component	Tag	Notes
brush	brush/v0.5.18-hotfix.6	Other brush: configure spoke HelmRelease to retry without deletion
canvas	canvas/v0.6.9-hotfix.6	Bug Fixes canvas: allow compute config and compute pool with control-plane-only node layout canvas: disable two-node option whenever the K8s distro is incompatible canvas: display stack trace on 500 error
hue	hue/v0.12.12-hotfix.6	Includes paletteai CLI binaries. Features hue: add support-bundle CLI subcommand hue: add --extra-pack for Artifact Studio Pack content bundles hue: parse profileBundle.content for mirror pull/sync Bug Fixes hue: compare spec instead of generation in SpecUnchanged hue: support worker-eligible control plane with no worker pools hue: deprioritize GPU hosts for control plane selection hue: allow in-place sharedWith updates for Profile Bundles hue: fail AIWorkload when WorkloadDeploymentConfigs cannot deploy hue: derive single-node mode from builder input; rebuild machine pools from allocated hosts without spare capacity; sync node-metadata changes to machine pools and single-node clusters hue: harden ComputePool orphan flows hue: backfill ProfileBundle addon variant names in controller paletteai: don't generate Alertmanager credentials in installer
mural-crds	mural-crds/v0.7.8-hotfix.6	Bug Fixes mural: enable Tenant-scoped deployments feature flag by default mural: grant default Dex users permission to create Tenants mural: restore Zot serviceHeadless.enabled default to false