PaletteAI 1.4.1 Release Notes

Summary

PaletteAI 1.4.1 is a stable patch release on the 1.4 line that extends AI Virtual Machines to single-cluster Shared Compute Pools, hardens profile bundle and access-control handling, and resolves a set of console issues.

• AI Virtual Machines - AI VMs can now run on a Shared Compute Pool that resolves to a single Palette cluster, not only on Dedicated pools. The create wizard shows AI VM limits on the control plane when it runs workloads, and VmTemplate defaults are refreshed. KubeVirt and VmTemplate custom resource definitions are now installed on the hub only, so spoke clusters keep accepting VM changes after a certificate rotation.
• Console - Compute pool resources are presented as tables, the AI VM allocation view is easier to scan, and cluster profile versions are backfilled when Palette omits them. Built-in profile bundles no longer appear in creation flows, single-node control plane shape fields are locked after creation, and a long-standing hydration error on tabbed pages is fixed.
• Profile bundles and variables - Credential-shaped variable values are masked in the variables UI, a bundle override can be reverted to the existing Project or System value, profile bundles are attributed to the VariableSet scope that owns each variable name, and deleting a synced bundle copy no longer leaves the delete waiting.
• Access control and sign-in - Project roles can read Aviz fabrics and Tenant Admins can manage Aviz tenants and fabrics, tenant copies of deleted RBAC persona templates are pruned, and a timed-out single sign-on attempt returns to the sign-in page with a clear message instead of an error.
• Platform - All component images are rebuilt with Go 1.27.3, which mitigates the eMudhra root certificate issue. The cleanup job moves to the FIPS image from the PaletteAI registry, covers more Mural custom resources on uninstall, and fleetconfig-controller is updated to 0.3.6. Curator no longer derives meaningless sum claims from numeric labels such as device IDs or driver versions.

For the complete list of changes in each component, refer to Full Component Release Notes.

Upgrade Notes

1. You must upgrade the mural-crds chart to 0.7.26-hotfix.1 before upgrading the mural chart to 1.4.1.
2. For detailed instructions on how to upgrade PaletteAI, refer to the PaletteAI upgrade guide.

Component Versions

The following component versions are pinned for this PaletteAI release:

Component	Version
brush	0.5.34-hotfix.1
canvas	0.6.30-hotfix.1
curator	0.0.11-hotfix.1
frisket	0.1.10-hotfix.1
hue	0.12.38-hotfix.1
mural-crds	0.7.26-hotfix.1

Mural Helm values

The following diff lists changes to mural/charts/mural/values.yaml between PaletteAI 1.4.0 and 1.4.1. Review it before upgrading if you maintain custom Helm values.

values.yaml changes between 1.4.0 and 1.4.1

values.yaml

diff --git a/mural/charts/mural/values.yaml b/mural/charts/mural/values.yaml
index 44d11cfab9..8c2dce980e 100644
--- a/mural/charts/mural/values.yaml
+++ b/mural/charts/mural/values.yaml
@@ -72,7 +72,7 @@ global:
   # - use a custom FleetConfig controller image with the `gke-gcloud-auth-plugin` installed
   kubernetesProvider: "Generic"
   certManagerVersion: "v1.21.0"
-  muralVersion: "1.4.0" # x-release-please-version
+  muralVersion: "1.4.1" # x-release-please-version
   dns:
     domain: "replace.with.your.domain"
     rootIngress:
@@ -120,7 +120,7 @@ global:
     username: ""
     password: ""
     basicAuthSecretName: ""
-  muralCrdsVersion: "0.7.26"
+  muralCrdsVersion: "0.7.26-hotfix.1"

 ## @section certificates
 ## @param certificates.clusterIssuer.spec.selfSigned The spec for the ClusterIssuer used by cert-manager to issue the Mural root CA certificate.
@@ -151,7 +151,7 @@ certificates:
 ## @param cleanup.deletionIntervalSeconds Cleanup deletion interval seconds.
 ## @param cleanup.deletionTimeoutSeconds Cleanup deletion timeout seconds.
 cleanup:
-  image: quay.io/spectrocloud-labs/spectro-cleanup:v1.8.0
+  image: us-docker.pkg.dev/palette-images-fips/palette/spectro-cleanup-bcfips/cleanup:v1.9.0
   imagePullPolicy: IfNotPresent
   deletionIntervalSeconds: 2
   deletionTimeoutSeconds: 300
@@ -1562,7 +1562,7 @@ brush:
   ## @param brush.image.pullPolicy The pull policy to use for the image
   image:
     repository: public.ecr.aws/mural/brush
-    tag: v0.5.34
+    tag: v0.5.34-hotfix.1
     pullPolicy: IfNotPresent
   ## @param brush.imagePullSecrets The pull secrets to use for the image
   imagePullSecrets: []
@@ -1857,7 +1857,7 @@ canvas:
   ## @param canvas.image.pullPolicy canvas image pull policy
   image:
     repository: public.ecr.aws/mural/canvas
-    tag: v0.6.30
+    tag: v0.6.30-hotfix.1
     pullPolicy: IfNotPresent
   ## @param canvas.imagePullSecrets Image pull secrets
   imagePullSecrets: []
@@ -2096,7 +2096,7 @@ curator:
   ## @param curator.image.pullPolicy Image pull policy for curator.
   image:
     repository: public.ecr.aws/mural/curator
-    tag: v0.0.11
+    tag: v0.0.11-hotfix.1
     pullPolicy: IfNotPresent
   ## @param curator.imagePullSecrets Image pull secrets for curator.
   imagePullSecrets: []
@@ -2572,16 +2572,18 @@ fleetconfig-controller:
     ## Do not disable the feature gates that are enabled by default.
     ##
     ## Available Spoke Feature Gates:
-    ## - **AddonManagement** (ALPHA - default=true) - Enables addon management functionality
+    ## - **AddonManagement** (BETA - default=true) - Enables addon management functionality
     ## - **AllAlpha** (ALPHA - default=false) - Enables all alpha features
     ## - **AllBeta** (BETA - default=false) - Enables all beta features
-    ## - **ClusterClaim** (ALPHA - default=true) - Enables cluster claim functionality
+    ## - **ClusterClaim** (BETA - default=true) - Enables cluster claim functionality
+    ## - **ClusterProperty** (ALPHA - default=false) - Enables cluster property functionality
     ## - **ExecutorValidatingCaches** (ALPHA - default=false) - Enables executor validating caches
+    ## - **MultipleHubs** (ALPHA - default=false) - Enables multiple bootstrap kubeconfigs connecting to different hubs
     ## - **RawFeedbackJsonString** (ALPHA - default=false) - Enables raw feedback JSON string support
     ## - **V1beta1CSRAPICompatibility** (ALPHA - default=false) - Enables v1beta1 CSR API compatibility
     ## @descriptionEnd
     spokeFeatureGates:
-      ## @param fleetconfig-controller.fleetConfig.spokeFeatureGates.ClusterClaim ClusterClaim feature gate (ALPHA - default=true). Enables cluster claim functionality.
+      ## @param fleetconfig-controller.fleetConfig.spokeFeatureGates.ClusterClaim ClusterClaim feature gate (BETA - default=true). Enables cluster claim functionality.
       ClusterClaim: true
       ## @param fleetconfig-controller.fleetConfig.spokeFeatureGates.RawFeedbackJsonString RawFeedbackJsonString feature gate (ALPHA - default=false). Enables raw feedback JSON string support.
       RawFeedbackJsonString: true
@@ -2636,11 +2638,13 @@ fleetconfig-controller:
         ## Feature gates for the Hub's Cluster Manager. Do not disable the feature gates that are enabled by default.
         ##
         ## Available Hub Cluster Manager Feature Gates:
-        ## - **AddonManagement** (ALPHA - default=true) - Enables addon management functionality
+        ## - **AddonManagement** (BETA - default=true) - Enables addon management functionality
         ## - **AllAlpha** (ALPHA - default=false) - Enables all alpha features
         ## - **AllBeta** (BETA - default=false) - Enables all beta features
         ## - **CloudEventsDrivers** (ALPHA - default=false) - Enables cloud events drivers
-        ## - **DefaultClusterSet** (ALPHA - default=false) - Enables default cluster set functionality
+        ## - **ClusterImporter** (ALPHA - default=false) - Enables auto import of managed clusters for certain cluster providers
+        ## - **ClusterProfile** (ALPHA - default=false) - Enables syncing of ManagedCluster to ClusterProfile
+        ## - **DefaultClusterSet** (ALPHA - default=true) - Enables default cluster set functionality
         ## - **ManagedClusterAutoApproval** (ALPHA - default=false) - Enables automatic managed cluster approval
         ## - **ManifestWorkReplicaSet** (ALPHA - default=false) - Enables manifest work replica set functionality
         ## - **NilExecutorValidating** (ALPHA - default=false) - Enables nil executor validation
@@ -2844,7 +2848,7 @@ fleetconfig-controller:
   ## @param fleetconfig-controller.image.pullPolicy Image pull policy
   image:
     repository: us-docker.pkg.dev/palette-images-fips/palette/spectro-ocm-bcfips/fleetconfig-controller
-    tag: v0.3.5
+    tag: v0.3.6
     pullPolicy: IfNotPresent
   ## @param fleetconfig-controller.imagePullSecrets Image pull secrets
   imagePullSecrets: []
@@ -3410,7 +3414,7 @@ frisket:
   ## @param frisket.image.pullPolicy Image pull policy for frisket.
   image:
     repository: public.ecr.aws/mural/frisket
-    tag: v0.1.10
+    tag: v0.1.10-hotfix.1
     pullPolicy: IfNotPresent
   ## @param frisket.imagePullSecrets Secret names used to authenticate the private image registry (leave empty for public ECR).
   imagePullSecrets: []
@@ -3584,7 +3588,7 @@ hue:
   ## @param hue.image.pullPolicy Image pull policy
   image:
     repository: public.ecr.aws/mural/hue
-    tag: v0.12.38
+    tag: v0.12.38-hotfix.1
     pullPolicy: IfNotPresent
   ## @param hue.resources.requests.cpu hue controller deployment's cpu request
   ## @param hue.resources.requests.memory hue controller deployment's memory request
@@ -3763,7 +3767,7 @@ hue:
     enabled: true
     image:
       repository: public.ecr.aws/mural/hue-definitions
-      tag: v0.12.38
+      tag: v0.12.38-hotfix.1
       pullPolicy: IfNotPresent
       pullSecrets: []
     job:

Full Component Release Notes

Per-component changes in 1.4.1

All component images in this release are rebuilt with Go 1.27.3, which mitigates the eMudhra root certificate issue.

Component	Tag	Notes
brush	brush/v0.5.34-hotfix.1	Disables the KubeVirt and VMO custom resource definition groups in spoke mural-crds installs so KubeVirt keeps ownership of its own definitions and certificate rotation continues to work.
canvas	canvas/v0.6.30-hotfix.1	Features AI Virtual Machines are supported on Shared Compute Pools with a single cluster. Bug Fixes Show AI Virtual Machine limits on the control plane when it runs workloads. Present compute pool resources as tables and preselect the only cluster of a dedicated pool. Backfill cluster profile version options when Palette omits the version list. Hide built-in profile bundles in creation flows. Lock single-node control plane shape fields in the Modify Nodes drawer and reject the change server-side. Mask credential-shaped variable values in the variables UI. Allow a profile bundle variable override to revert to the existing Project or System value. Attribute profile bundles to the VariableSet scope that owns each variable name. Resolve network isolation scope from labels and membership instead of the namespace name prefix. Return a timed-out single sign-on attempt to the sign-in page with a clear message. Skip loader revalidation after a create-tenant submission so the redirect completes. Prevent a nested button in tab title tooltips that caused a hydration error. Align padding across create-project wizard steps. Use one AI Virtual Machine icon across list, wizard, and overview views.
curator	curator/v0.0.11-hotfix.1	Bug Fixes Stop inferring sum aggregation from numeric label values, which produced meaningless fleet cluster claims for device IDs and driver versions.
frisket	frisket/v0.1.10-hotfix.1	Dependency refresh, including an OpenTelemetry update for a reported vulnerability.
hue	hue/v0.12.38-hotfix.1	Features Allow AI Virtual Machines on Shared Compute Pools that resolve to a single cluster. Bug Fixes Keep a ComputePool in provisioning while its hosts are still joining. Prune tenant copies of deleted RBAC persona templates instead of recreating them. Requeue owners when a synced profile bundle copy is deleted. Grant Aviz tenant and fabric permissions to project and tenant roles. Speed up profile bundle deletion by reducing the finalizer cleanup requeue and watching child resources. Other Update VmTemplate defaults and bundled profile content to 1.8.0.
mural-crds	mural-crds/v0.7.26-hotfix.1	Group the KubeVirt VirtualMachine and VMO VmTemplate definitions so they install on the hub only, and toggle the groups through new kubevirt and vmo chart values.