PaletteAI 1.3.0 Release Notes

Summary

PaletteAI 1.3.0 is the first stable release in the 1.3 line. It introduces network isolation across every scope, per-scope inference quotas and API keys, day-2 model deployment operations with usage metering and pricing, per-tenant identity isolation, and permission-driven navigation, on top of broad improvements to edge networking, single-node clusters, and deployment reliability.

• Network isolation - A new network isolation experience lets administrators govern connectivity and resource sharing at the system, tenant, compute pool, and project scopes, including a dedicated settings page, compute pool create and day-2 views, a tenant Projects view, and per-integration allow toggles that respect parent-scope governance. This feature is backed by a new frisket controller, a subchart that is deployed by default on the hub (see Upgrade Notes and Component Versions).
• Inference quotas and API keys - Administrators can manage inference quotas, limits, and API keys per scope. Quotas are created automatically when a scope is created, scope-total quotas are protected from deletion, model deployments select an inference quota, and workloads are flagged when a quota is out of policy or exhausted.
• Model deployment day-2 and pricing - Model deployments support day-2 changes with in-place saves and clearer save feedback, token usage metering, install-wide model pricing management, and price federation for model-as-a-service workloads.
• Per-tenant identity isolation - Tenants can be configured with their own identity connector references, with per-tenant identity connector isolation enforced so group-claim trust and inherited OIDC groups stay scoped to the correct tenant.
• Permission-gated navigation and access control - Sidebar navigation and routes are shown based on each user's resource view permissions, administrators can edit built-in personas and add custom ones, and create, update, and delete actions across compute pools, workloads, profile bundles, repositories, definitions, quotas, and projects are enforced against a user's permissions.
• Edge networking and single-node clusters - Multi-NIC edge hosts are handled more reliably with static and DHCP IP addresses, single-node control-plane clusters are better supported for day-1 and day-2 operations, and edge host tags are surfaced in compute status.
• Deployment and profile bundle reliability - Day-2 profile bundle saves are streamlined, infrastructure-only add-on variants are filtered out of bundles and workloads, expired sessions are redirected to the login page instead of showing opaque errors, and pushing large model image layers to the built-in mirror is more resilient.

For the complete list of changes in each component, refer to Full Component Release Notes.

Upgrade Notes

1. You must upgrade the mural-crds chart to 0.7.23 before upgrading the mural chart to 1.3.0. For detailed instructions on how to upgrade PaletteAI, refer to the PaletteAI upgrade guide.
2. This release deploys a new frisket network-isolation controller. The frisket subchart is enabled by default (frisket.enabled: true) and runs on the hub cluster; it is disabled automatically on spoke installs. No action is required for a default upgrade, but if you manage a trimmed set of subcharts, account for the new workload.
3. The curator.ocm.addon.managedClusters Helm value has been removed. If you previously overrode it (for example, a hub-as-spoke managedClusters entry), remove that override before upgrading, as the option no longer exists.

Component Versions

The following component versions are pinned for this PaletteAI release. Alongside the four core components, 1.3.0 ships the new frisket network-isolation subchart (deployed by default).

Component	Version
brush	0.5.30
canvas	0.6.27
frisket	0.1.6
hue	0.12.35
mural-crds	0.7.23

Mural Helm values

The following diff lists changes to mural/charts/mural/values.yaml between PaletteAI 1.2.2 and 1.3.0. Review it before upgrading if you maintain custom Helm values.

values.yaml changes between 1.2.2 and 1.3.0

values.yaml

diff --git a/mural/charts/mural/values.yaml b/mural/charts/mural/values.yaml
index b2157125e..40db0a037 100644
--- a/mural/charts/mural/values.yaml
+++ b/mural/charts/mural/values.yaml
@@ -18,7 +18,7 @@
 ## @param global.kubernetesClusterDomain Kubernetes cluster domain
 ## @param global.kubernetesProvider Kubernetes provider of the cluster that mural will be installed on. Valid values are "Generic", "EKS", "GKE-Ingress"
 ## @param global.certManagerVersion The cert-manager version passed to sub charts - do NOT edit
-## @param global.muralVersion Umbrella chart version passed to sub charts - do NOT edit
+## @param global.muralVersion Umbrella chart version passed to sub charts - do NOT edit <!-- x-release-please-version -->
 ## @param global.dns.domain The primary domain to use for the deployment. For example, acme.internal.org.
 ## @param global.dns.rootIngress.enabled Whether to create a root ingress for the domain that routes to the primary application. For example, if you want the root domain to automatically route to `/mural`. Disable if traefik is not used.
 ## @param global.dns.rootIngress.ingressClassName The ingress class name for the root ingress
@@ -72,7 +72,7 @@ global:
   # - use a custom FleetConfig controller image with the `gke-gcloud-auth-plugin` installed
   kubernetesProvider: "Generic"
   certManagerVersion: "v1.19.1"
-  muralVersion: "1.2.2"
+  muralVersion: "1.3.0" # x-release-please-version
   dns:
     domain: "replace.with.your.domain"
     rootIngress:
@@ -120,7 +120,7 @@ global:
     username: ""
     password: ""
     basicAuthSecretName: ""
-  muralCrdsVersion: "0.7.17-hotfix.2"
+  muralCrdsVersion: "0.7.23"

 ## @section certificates
 ## @param certificates.clusterIssuer.spec.selfSigned The spec for the ClusterIssuer used by cert-manager to issue the Mural root CA certificate.
@@ -1505,11 +1505,11 @@ brush:
   ## @param brush.replicaCount The number of replicas to use for the deployment
   replicaCount: 1
   ## @param brush.image.repository The repository to use for the image
-  ## @param brush.image.tag x-release-please-version
+  ## @param brush.image.tag The version to use for the image
   ## @param brush.image.pullPolicy The pull policy to use for the image
   image:
     repository: public.ecr.aws/mural/brush
-    tag: v0.5.24-hotfix.2
+    tag: v0.5.30
     pullPolicy: IfNotPresent
   ## @param brush.imagePullSecrets The pull secrets to use for the image
   imagePullSecrets: []
@@ -1800,11 +1800,11 @@ canvas:
   ## @param canvas.imageRegistry Image registry
   imageRegistry: ''
   ## @param canvas.image.repository canvas image repository
-  ## @param canvas.image.tag canvas image tag x-release-please-version
+  ## @param canvas.image.tag canvas image version
   ## @param canvas.image.pullPolicy canvas image pull policy
   image:
     repository: public.ecr.aws/mural/canvas
-    tag: v0.6.18-hotfix.2
+    tag: v0.6.27
     pullPolicy: IfNotPresent
   ## @param canvas.imagePullSecrets Image pull secrets
   imagePullSecrets: []
@@ -2034,21 +2034,16 @@ curator:
       name: curator
       ## @param curator.ocm.addon.installNamespace Namespace on the managed cluster where the curator agent is installed.
       installNamespace: mural-system
-      ## @param curator.ocm.addon.managedClusters Managed clusters to enable the curator addon on.
-      ## Each entry creates a ManagedClusterAddOn in the managed cluster namespace on the hub.
-      managedClusters: []
-      # - namespace: hub-as-spoke
-      #   installNamespace: mural-system
   ## @section curator agent parameters

   ## @param curator.replicaCount Number of curator replicas on each spoke cluster.
   replicaCount: 1
   ## @param curator.image.repository Image repository for curator.
-  ## @param curator.image.tag Image tag for curator.
+  ## @param curator.image.tag Image version for curator.
   ## @param curator.image.pullPolicy Image pull policy for curator.
   image:
     repository: public.ecr.aws/mural/curator
-    tag: v0.0.2-hotfix.2
+    tag: v0.0.8
     pullPolicy: IfNotPresent
   ## @param curator.imagePullSecrets Image pull secrets for curator.
   imagePullSecrets: []
@@ -3302,6 +3297,65 @@ fluxcd-manager:
       image: us-docker.pkg.dev/palette-images-fips/palette/spectro-flux-bcfips/source-controller
       tag: v1.7.2

+## @section frisket
+frisket:
+  ## @param frisket.enabled Whether to enable the frisket chart. Default is true.
+  enabled: true
+  # Default values for the frisket operator chart.
+
+  ## @section frisket operator parameters
+
+  ## @param frisket.image.repository Image repository for frisket.
+  ## @param frisket.image.tag Image version for frisket.
+  ## @param frisket.image.pullPolicy Image pull policy for frisket.
+  image:
+    repository: public.ecr.aws/mural/frisket
+    tag: v0.1.6
+    pullPolicy: IfNotPresent
+  ## @param frisket.imagePullSecrets Secret names used to authenticate the private image registry (leave empty for public ECR).
+  imagePullSecrets: []
+  ## @param frisket.nameOverride Override for the chart name segment of resource names.
+  nameOverride: ""
+  ## @param frisket.fullnameOverride Override for the fully qualified app name.
+  fullnameOverride: "frisket"
+  ## @param frisket.replicaCount Number of manager replicas. Leader election guarantees only one is active at a time; >1 is only useful for HA.
+  replicaCount: 1
+  ## @param frisket.serviceAccount.create Whether to create the operator's ServiceAccount.
+  ## @param frisket.serviceAccount.annotations Annotations for the operator's ServiceAccount.
+  ## @param frisket.serviceAccount.name Name of the operator's ServiceAccount. Generated when empty.
+  serviceAccount:
+    create: true
+    annotations: {}
+    name: ""
+  ## @param frisket.resources.limits.cpu CPU limit for the frisket manager.
+  ## @param frisket.resources.limits.memory Memory limit for the frisket manager.
+  ## @param frisket.resources.requests.cpu CPU request for the frisket manager.
+  ## @param frisket.resources.requests.memory Memory request for the frisket manager.
+  resources:
+    limits:
+      cpu: 500m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 128Mi
+  ## @param frisket.leaderElection Whether to enable leader election for multi-replica coordination.
+  leaderElection: true
+  ## @param frisket.metrics.bindAddress Bind address for the metrics endpoint.
+  ## @param frisket.metrics.secure Whether to serve metrics over HTTPS.
+  metrics:
+    bindAddress: ":8443"
+    secure: true
+  ## @param frisket.podAnnotations Annotations for frisket manager pods.
+  podAnnotations: {}
+  ## @param frisket.podLabels Labels for frisket manager pods.
+  podLabels: {}
+  ## @param frisket.nodeSelector Node selector for frisket manager pods.
+  nodeSelector: {}
+  ## @param frisket.tolerations Tolerations for frisket manager pods.
+  tolerations: []
+  ## @param frisket.affinity Affinity rules for frisket manager pods.
+  affinity: {}
+
 ## @section hue
 hue:
   ## @param hue.enabled Whether to enable the hue chart. Default is true.
@@ -3424,11 +3478,11 @@ hue:
   ## @param hue.imageRegistry Image registry
   imageRegistry: ""
   ## @param hue.image.repository Image repository
-  ## @param hue.image.tag x-release-please-version
+  ## @param hue.image.tag Image version
   ## @param hue.image.pullPolicy Image pull policy
   image:
     repository: public.ecr.aws/mural/hue
-    tag: v0.12.28-hotfix.2
+    tag: v0.12.35
     pullPolicy: IfNotPresent
   ## @param hue.resources.requests.cpu hue controller deployment's cpu request
   ## @param hue.resources.requests.memory hue controller deployment's memory request
@@ -3607,7 +3661,7 @@ hue:
     enabled: true
     image:
       repository: public.ecr.aws/mural/hue-definitions
-      tag: v0.12.28-hotfix.2
+      tag: v0.12.35
       pullPolicy: IfNotPresent
       pullSecrets: []
     job:

Full Component Release Notes

The following table lists all changes made to core components in this PaletteAI release.

Per-component changes in 1.3.0

Component	Tag	Notes
brush	brush/v0.5.24	Bug Fixes brush: grant brush get/list/watch on namespaces Performance brush: early return when system-scope
brush	brush/v0.5.25	Bug Fixes hue, brush: use watch feedback scrape type for Workload status in OCM topology policies and in brush's HelmRelease
brush	brush/v0.5.26	Other brush, curator, hue, test: bump hue-apis and span in brush, curator, hue, test Refactoring frisket: rename network-isolation component to frisket
brush	brush/v0.5.27	Bug Fixes brush: disable frisket on spoke mural installs
brush	brush/v0.5.28	Bug Fixes brush: INFO-log transient ManagedCluster absence during OCM registration brush: pin log level in tests, drop fake-client-only subtest, document NotFound log divergence hue: treat transient WLD failed as convergence wait on ComputePool Other main: bump go to 1.27.0; resolve sneaky gosecs Refactoring hue-apis: repoint consumers to hue/apis, delete hue-apis/ (PR 2 of 4)
brush	brush/v0.5.29	Bug Fixes brush: update package to bump brush version
brush	brush/v0.5.30	Dependency Updates deps: update brush - other go dependencies (brush) deps: update ginkgo (ginkgo)
canvas	canvas/v0.6.18	Bug Fixes hue: report a Processing phase for ProfileBundles while converging (PAD-3520)
canvas	canvas/v0.6.19	Features canvas: add install-wide model pricing management canvas: inference quota selection for model deployments canvas: network isolation settings page + service canvas: warn when multi-NIC hosts need static IP (PAD-3463) hue-apis: add effectiveInferenceQuotaRef to aiwl status hue-apis: add network isolation CRD fields for Aviz Bug Fixes canvas: align Access Endpoints button with design system (PAD-2877) canvas: allow cloning project-scoped compute configs (PAD-3404) canvas: Authenticated users see the log in page again when they access /ai/login canvas: clarify Infrastructure details on Compute Pool overview (PAD-2894) canvas: clear stale worker resource groups on single-node mount, not just on transition canvas: complete Day-2 profile bundle save redirect cleanup and await action results canvas: consistent breadcrumbs with nav icons across all scopes (PAD-3448) canvas: dedupe workload profile React keys (PAD-3218) canvas: disable Add Integration when all integration types are configured canvas: disallow resource name "new" to avoid create-route collisions (PAD-2908) canvas: edit untyped Helm fields as YAML in workload profile builder (PAD-2817) canvas: explain why Palette auth config resolution failed on Profile Bundle create/clone canvas: fix project list scrolling in Tenant Settings User Access canvas: gate project settings on projects:update permission canvas: handle missing System CR gracefully in resolveSettingsForSystem (PAD-3546) canvas: hide View All when no deployments exist (PAD-2878) canvas: honor Table minHeight so fill-height panels can shrink (PAD-3447) canvas: inference quota follow-ups from Tyler review canvas: keep sticky page header above Fleet Overview progress bars (PAD-3552) canvas: normalize resource description reads across overviews canvas: project labeling in mock-crs canvas: reduce layout revalidation fan-out on in-scope form saves canvas: remove Palette tenant field; Hue resolves the tenant (PAD-2862) canvas: rename Fleet Overview to Palette Fleet Overview across all scopes (PAD-3418) canvas: reorder app deployment wizard compute pool setup sections canvas: replace Tags terminology with Labels and annotations canvas: restore page after idle re-login (PAD-3439) canvas: restore Palette product link with TLS-aware health checks canvas: revalidate layout after settings ref and mutation saves canvas: settings tables fill container height (PAD-2874) canvas: ship server bootstrap modules and align chart-testing base canvas: show per-integration last modified from Secret timestamps (PAD-3423) canvas: show save notification, remove redirects, & fix persistence for Day-2 deployment changes canvas: single-node control plane resource groups canvas: strip owning scope Settings prefix for inherited integration names canvas: unblock Profile Bundle version when cluster has no GPU inventory (PAD-3468) canvas: use correct Compute Pools icon (PAD-2884) canvas: use project namespace for definition wizard render sample (PAD-3467) canvas: validate workload name + namespace length in deploy wizard (PAD-3002) hue,canvas: enforce tenant-prefixed role-mapping group strings hue: allow multi-NIC edge hosts with DHCP IP on non-overlay pools hue: enforce tenant-scoped Secret creation via admission webhook Other canvas: Add Should revalidate for settings canvas: copy form components and utilities from gamut canvas: move modal and wizard components from gamut to canvas canvas: Move Profile Layer, Notification, Theme Toggle canvas: Move Rbac folder from gamut to canvas canvas: Move Tabs from gamut to canvas canvas: Remove drawer and use inline form in compute pool canvas: skip canvas impersonation RBAC unless required canvas: Update Imports of migrated gamut components hue: align devspace instance name with canvas make dev main: document canvas + local hue dev workflow Refactoring canvas: add k8s, palette, and security modules from gamut canvas: copy gamut server modules into canvas canvas: Move table from gamut to canvas canvas: move theme from gamut canvas: move Tooltip, Stack, and Typography from gamut canvas: move types from gamut canvas: Move utils from gamut to canvas canvas: nest mock-crs menu by category canvas: Remove migrated code from gamut hue-apis: make quota limit field a pointer hue-apis: move key secret ref from spec to status hue-apis: rename apikey, quota -> inference<apikey|quota>
canvas	canvas/v0.6.20	Features canvas: settings for inference quotas, limits, and API keys canvas: token metering and model deployment day 2 Bug Fixes canvas: address review follow-ups (navigation guard and bundle-manager test coverage) canvas: PAD-3674 - follow up updates for inference quota - text updates Other canvas: Improve model table UX
canvas	canvas/v0.6.21	Features canvas: configure Tenant identityConnectorRefs canvas: gate sidebar nav and routes by resource view permissions canvas: network isolation UI improvements (PAD-3645) Bug Fixes canvas: bounce stale sessions to login instead of an opaque root error canvas: css for identity connector ref button canvas: full height table layouts via wrapping parents canvas: Model deployment Day 2 fixes canvas: remove minHeight prop from model deployments page hue: per-tenant Dex connector isolation admission enforcement Docs canvas: Kubelogin guide for local dev-env-setup Refactoring hue: split OOP models into 2 different conditions
canvas	canvas/v0.6.22	Features canvas: compute pool NI create empty state (PAD-3675) canvas: compute pool NI Day 2 settings view canvas: tenant NI Projects view gaps (PAD-3662) Bug Fixes canvas: remove 'shared' field from AvizTenant form and tests canvas: stop restoring the previous page after re-login canvas: use canonical description annotation when creating CP canvas: use PaletteAI brand consistently across UI
canvas	canvas/v0.6.23	Features canvas: add Network Isolation tenancy allow-integration toggles with parent gating canvas: close NI sharing visibility gaps (PAD-3679) canvas: duplicate Aviz host validation on NI integrations (PAD-3672) canvas: gate quota settings tabs and handle forbidden quota loads canvas: NI integration UX improvements (PAD-3695) canvas: RBAC permission CRUD (edit OOTB personas, add/edit custom personas) canvas: show operator credential health in Integrations status column paletteai: migrate post-infra deploy from bash to Go test deploy Bug Fixes canvas,hue: whitelist sibling <comp>/apis dirs used by Dockerfile.local canvas: add disabled reason for default compute config deletion canvas: enforce aiworkloads:update RBAC on mutation actions canvas: enforce computepools:update RBAC on mutation actions canvas: enforce profilebundles RBAC on mutation actions canvas: enhance API key backfill with new InferenceQuota canvas: explain disabled delete actions (PAD-2883) canvas: filter infrastructure-only addon variants in profile bundle manager canvas: fix API key copy in Safari canvas: improve visibility handling for table bounding box canvas: keep column reorder drag within the settings menu scroll area canvas: keep compute pool settings footer visible (PAD-3039) canvas: PAD-3688 - fix settings quota findings canvas: remove double scrollbar and truncate long scope labels canvas: show inherited OIDC groups and confirm quota limit oop modal canvas: show inherited OIDC groups as informational canvas: tighten Model Pricing layout Other canvas: Remove Tabs from Compute Pool, AI Workload, Profile bundle Refactoring hue-apis: introduce hue/apis Go module hue, canvas: consume curator/apis for SpokeNodes
canvas	canvas/v0.6.24	Bug Fixes canvas: break computepool barrel circular import to unblock release build
canvas	canvas/v0.6.25	Bug Fixes canvas: address compute pool RBAC review feedback canvas: break k8s server import cycle and drop vite-plugin-circular-dependency canvas: do not count missing AIWorkloads as app deployments canvas: enforce Helm/OCI repository mutation RBAC canvas: show MIG section in deployment new-pool wizard canvas: show the correct variables for pinned profile bundle versions in the App and Model deployment wizards
canvas	canvas/v0.6.26	Features canvas: wire Network Isolation governance to enforceForSubScopes SharedWith selector
canvas	canvas/v0.6.27	Features canvas: enforce RBAC on workload profile mutations Bug Fixes canvas: add default suffix to default nic in dropdown canvas: add table filters to select profile bundle drawer canvas: align Network Isolation UI gates with RBAC canvas: defer MIG profile validation in deployment wizards canvas: derive shared-with column labels from resource namespace canvas: enforce project create RBAC canvas: enforce project patch RBAC on 4 project-settings intents canvas: enforce RBAC on inference quota create/edit canvas: enforce server-side RBAC for definition saves canvas: fix button label for Add Model Quota canvas: let tables size to their content instead of forcing fixed-height shells canvas: redirect to login when an expired session swallows the quota save redirect canvas: seed Project networkIsolationEnforced in inline NI e2e mock canvas: truncate long status condition messages with ellipsis canvas: truncate long workload profile layer labels and align layer card layout
frisket	frisket/v0.1.1	Refactoring frisket: rename network-isolation component to frisket
frisket	frisket/v0.1.2	Bug Fixes curator: add real helm-doc-gen target and regen drifted README frisket: correct the frisket chart description Refactoring hue-apis, frisket: use common APIs from span
frisket	frisket/v0.1.3	Features frisket: drop shared field from AvizTenant spec
frisket	frisket/v0.1.4	Features hue: populate compute status with edge host tags Bug Fixes canvas,hue: whitelist sibling <comp>/apis dirs used by Dockerfile.local frisket: treat already-on-own-tenant GPU alloc as idempotent success Other frisket: adds devspace setup main: bump go to 1.27.0; resolve sneaky gosecs Refactoring frisket-apis: split frisket/apis into its own Go module (PR 3 of 4) frisket: consume frisket/apis; delete frisket/api (PR 5 of stack) hue-apis: repoint consumers to hue/apis, delete hue-apis/ (PR 2 of 4)
frisket	frisket/v0.1.5	Features frisket: adds compute ctrlr with write_net_iso_tags_step frisket: adds server and gpu alloc and dealloc for tenants Other frisket: remove dead code, consolidate aviz, wire slog Refactoring frisket: use reconcile chain pattern and add span/slog
frisket	frisket/v0.1.6	Bug Fixes frisket: resolve Compute Settings for net-iso tag sync Other frisket: remove all net-iso-* tag functionality by disabling friskets compute controller release: add frisket Dockerfile.local and use for hotfix builds
hue	hue/v0.12.28	Bug Fixes hue: report a Processing phase for ProfileBundles while converging (PAD-3520)
hue	hue/v0.12.29	Features hue: coerce budget reductions to lower scoped quotas hue: enable deletionPolicy migrations for cps and aiwls hue: network isolation chain steps + policy check hue: out-of-policy budget detection with transitive cascade hue: PAD-3351 federate prices for model-as-service AIWorkloads hue: reintroduce Quota/APIKey controllers hue: set effectiveInferenceQuotaRef during aiwl reconcile Bug Fixes hue, brush: use watch feedback scrape type for Workload status in OCM topology policies and in brush's HelmRelease hue,canvas: enforce tenant-prefixed role-mapping group strings hue: allow multi-NIC edge hosts with DHCP IP on non-overlay pools hue: allow tenant-admin CREATE in unlabeled namespace when spec tenant matches hue: block co-located Workloads from contesting the same resource hue: block worker pools during day-2 ops, cooldown only once settled (PAD-3214) hue: default Placement tolerations in topology-ocm so OCM taints don't drain workloads (PAD-3482) hue: detach a shared ComputePool before the AIWorkload that created it disappears hue: dont fail federation on missing refs; reduce kustomization interval hue: dont ignore effectiveModelSettings in aiwl informers hue: dont ignore tenancy readiness flip in AIWL/CP informers hue: enforce tenant-scoped CREATE for Project, Settings, and ComputeConfig hue: enforce tenant-scoped Secret creation via admission webhook hue: isolate project spoke definitions from sibling projects hue: keep core persona tiers in catalog on duplicate-tier conflict (PAD-3484) hue: keep DHCP hosts on DHCP instead of reapplying inventory IP as static hue: keep ns stubs updated with newly added/removed projects hue: keep secrets admission webhook alive after Helm install hue: read EnvironmentReady from the ComputePool instead of the per-cluster status hue: scope platform denylist to tenant admins only hue: set correct ref name when adopting kind spoke hue: shorten composite OCI artifact tags exceeding the 128-char limit hue: skip immutable and hidden cluster profile variables hue: use watch instead of poll in ModelGroupQuota manifest config Other hue: align devspace instance name with canvas make dev hue: get rid of all ptr() helpers that can be swapped with new() hue: pause label for WLD/AIWL; sort CP vars before diff hue: run modernize on hue Refactoring frisket: rename network-isolation component to frisket hue: consume InferenceQuotaStatus.Status rename from hue-apis hue: generate token as part of api key reconcile hue: make quota limit field a pointer hue: rename apikey, quota -> inference<apikey|quota> hue: swap Quota field names in controller
hue	hue/v0.12.30	Features hue: auto-create scoped InferenceQuotas on scope create hue: block deletion of scope-total InferenceQuotas hue: configure defaulting webhook for InferenceQuotas hue: mark AIWL OOP if quota is OOP/exhausted hue: store launchpad URL on model AIWL status Bug Fixes hue: create iquota rbac; dont prune iapikey rbac; use new apikey name in role spec hue: make paletteai mirror push resilient to large ML image layer uploads Other brush, curator, hue, test: bump hue-apis and span in brush, curator, hue, test
hue	hue/v0.12.31	Bug Fixes hue: gate AIL ops on ail annotation; use AIL domain var for chat endpoint hue: per-tenant Dex connector isolation admission enforcement hue: rewrite legacy tenant admin groups in mutating webhook Other hue: configure default pricing in system upsert Refactoring hue: paitest reuses controller code instead of reimplementing it hue: split OOP models into 2 different conditions
hue	hue/v0.12.32	Features hue: cascade-delete apikeys when quota deleted paletteai: migrate post-infra deploy from bash to Go test deploy Bug Fixes hue: filter infrastructure-only addon variants from AIWorkloads
hue	hue/v0.12.33	Features hue: adopt sharedWith for network isolation hue: copy NetworkIsolation to inline ComputePool (PAD-3741) hue: populate compute status with edge host tags Bug Fixes canvas,hue: whitelist sibling <comp>/apis dirs used by Dockerfile.local hue: address builtin bundle sync nil pointer & improve docs hue: create apikey rbac for inherited oidc groups hue: remove ComputePool Failed streak from paitest wait hue: requeue workload dispatch/status on transient API errors hue: revert speculative revision advance on transient dispatch requeue hue: select CPU-only control-plane hosts for single-node clusters (PAD-3697) hue: treat Built-in bundle Palette pack rejections as non-fatal during project reconcile hue: treat transient WLD failed as convergence wait on ComputePool Other main: bump go to 1.27.0; resolve sneaky gosecs Docs hue: document progress-vs-failure condition invariant Refactoring hue-apis: repoint consumers to hue/apis, delete hue-apis/ (PR 2 of 4) hue, canvas: consume curator/apis for SpokeNodes
hue	hue/v0.12.34	Features paitest: add VMO infrastructure backend for PaletteAI deploy Bug Fixes hue: prevent AIWL controller from GCin CP-owned WLD Other hue: update profilebundles ref to 1.7.0
hue	hue/v0.12.35	Features hue: allow using local packs in mirror; add continue-on-error flag Bug Fixes hue: clear Deleting hosts when Palette machine pool is not found (PAD-3639) hue: distinguish HelmRelease Ready=False from Ready=Unknown hue: drain and delete worker pools when enabling single-node cluster on Day 2 (PAD-3615) hue: drop ProfileBundle finalizer when namespace terminating and Settings gone (PAD-3761) hue: isolate GOMODCACHE in verify-definition-versions hue: keep Initial hosts valid during Palette lag Docs main: document PAIL integration Dependency Updates deps: update ginkgo (ginkgo) deps: update hue - go core packages (hue go-core)
mural-crds	mural-crds/v0.7.17	Features hue-apis: add Processing to the ProfileBundle status enum (PAD-3520)
mural-crds	mural-crds/v0.7.18	Features hue-apis: add OutOfPolicy field to QuotaStatus hue-apis: reintroduce Quota/APIKey/pricing API
mural-crds	mural-crds/v0.7.19	Features hue-apis,docs: per-tenant Dex connector isolation for group-claim trust hue-apis: add AIL url to AIWorkload status hue-apis: add effectiveInferenceQuotaRef to aiwl status hue-apis: add kubebuilder validation rule to prevent use of deprecated deletionPolicy field hue-apis: add network isolation CRD fields for Aviz Refactoring hue-apis: make quota limit field a pointer hue-apis: move key secret ref from spec to status hue-apis: rename apikey, quota -> inference<apikey|quota> hue-apis: rename InferenceQuotaStatus.State to .Status hue-apis: update Quota APIs to use new field names
mural-crds	mural-crds/v0.7.20	Refactoring hue-apis, frisket: use common APIs from span
mural-crds	mural-crds/v0.7.21	Features hue-apis: flag to omit infra-only addons from AIWorkloads
mural-crds	mural-crds/v0.7.22	Features frisket/apis: add net iso tag data to aviztenant status hue-apis: add configurable WorkloadConvergenceTimeout to ProfileBundleSpec hue-apis: update compute API to include tags in the status hue-apis: use sharedWith for network isolation hue/apis: add NetworkIsolation to AIWorkloadSpec (PAD-3741) Refactoring frisket-apis: split frisket/apis into its own Go module (PR 3 of 4)
mural-crds	mural-crds/v0.7.23	Bug Fixes hue/apis: use string for Expires column in iapikey