Skip to main content

Release Notes

tip

Looking for breaking changes that might impact your Palette upgrade? Visit the Find Breaking Changes page for a filtered view of relevant updates.

To view release notes for a specific Palette version, use the version selector below.

Select...

July 9, 2026 - Release 4.9.27​

Bug Fixes​

  • Fixed an issue that prevented new CloudStack clusters from being provisioned using a CloudStack PCG.
  • Fixed an issue that caused the Palette Edge Interactive Installer TUI to incorrectly select the installer boot media for disk-wiping when booting an Edge host from a physical USB drive flashed with the installer ISO.

July 3, 2026 - Component Updates​

The following components have been updated for Palette version 4.9.5 - 4.9.24.

ComponentVersion
Artifact Studio4.9.12
Spectro Cloud Terraform provider0.29.7
Spectro Cloud Crossplane provider0.29.7
Palette Management Appliance4.9.24
VerteX Management Appliance4.9.24

Improvements​

  • Palette now generates build attestation documents for all packs as part of the secure supply chain initiative. Attestation records when and how software was produced, on which systems, and by which users, providing a complete audit trail of the software development lifecycle.
  • Palette now generates a Software Bill of Materials (SBOM) for all downloadable artifacts. Each downloadable component includes an associated SBOM in CycloneDX format, augmented with metadata such as author, supplier, repository location, license, and copyright. SBOMs are signed and can be downloaded from Artifact Studio and reviewed before deploying software to your environment.
  • SBOMs and attestations for packs are now available in Artifact Studio. Users can download the SBOM for every appliance and pack directly from the Artifact Studio interface. Attestation documents are built with each image and are accessible once packs are uploaded to registries.

Bug Fixes​

  • Fixed a Terraform issue that caused newly added profile variables to be silently dropped when bumping the version of a spectrocloud_cluster_profile resource with the immutable-clusterprofiles feature preview enabled. The terraform apply operation reported success and created the new profile version, but the newly declared variables did not appear in Palette.
  • Fixed a Terraform issue where the skip_k8s_upgrade field was incorrectly sent for MAAS, vSphere, and Edge Native cluster worker machine pools, causing an API rejection. This field is only supported for AWS clusters, and the provider now correctly omits it for non-AWS cloud types.

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
argo-cdaddon✅❌10.0.0
calico-network-policyaddon✅❌3.32.1
cni-antreacni✅❌2.6.2
cni-aws-vpc-eks-helmcni❌✅1.21.2
cni-calicocni✅❌3.32.1
cni-calico-azurecni✅❌3.32.1
cni-cilium-osscni❌✅1.19.4
external-secrets-operatoraddon✅❌2.7.0
headlampaddon✅✅0.43.0
istioaddon✅❌1.30.2
prometheus-agentaddon✅❌29.14.0
prometheus-operatoraddon✅❌87.4.0
tigera-operatorcni✅❌3.32.1

July 1, 2026 - Release 4.9.24​

The following component updates are applicable to this release:

Improvements​

  • While bootstrapping Edge hosts, the Palette Edge Interactive Installer TUI now checks all disks for partitions left behind by previous installations, preventing stale partitions from causing unpredictable installation behavior. Affected disks are flagged and pre-selected for wiping on the prerequisites screen. Wiping disks is optional and must be confirmed on the follow-up screen.
  • Content authors can now bundle a custom UI into Edge content using the --custom-ui flag of the Palette CLI content build command. When the content is uploaded to a Slim ISO-bootstrapped Edge host, Local UI detects the bundle and renders the custom configuration screens, allowing you to ship tailored configuration experiences alongside your Edge content.

Bug Fixes​

  • Fixed an issue where upgrading Palette could also upgrade the Edge host agent on some nodes of a multi-node cluster even when agent upgrades were paused, leaving the cluster with mismatched agent versions across nodes and causing continuous pod restarts.

June 29, 2026 - Release 4.9.23​

The following component updates are applicable to this release:

Bug Fixes​

  • Fixed a bug that caused the Edge Agent version 4.9.19 to incorrectly enforce password strength validation on profile variables for non-VMO Edge clusters, blocking cluster updates when weak passwords were present. Password strength checks are now restricted to VMO profile variables only, restoring the update behavior from previous Palette versions.

June 28, 2026 - Release 4.9.22​

The following component updates are applicable to this release:

Security Notices​

Palette Enterprise​

Breaking Changes​

  • Palette now validates the ProjectUid header on all API requests. Requests that send a project that does not exist or that you cannot access now return a validation error, such as ResourceNotFound, ProjectNotFoundInTenant, or ResourceAccessDenied. To avoid errors, remove the ProjectUid header when accessing tenant-level resources, or provide a valid project. Existing resources are not affected.

Features​

  • Spectro Cloud is transitioning to the use of security-hardened images. As a result, retrieving images from Spectro Cloud OCI registries will require a Spectro Cloud image pull secret. This secret is intended for long-term use and is configured once.

    This change primarily affects non-airgap environments that do not configure mirror registries or image swap; it does not apply to airgapped environments, which pull images from their own registries. While configuring an image pull secret is not required for the current version of Palette, it is an upcoming breaking change and will be mandated in a future release. We recommend that affected environments configure an image pull secret as soon as possible to prevent service disruptions later.

    To obtain your image pull secret, contact your customer support representative. Refer to Configure Image Pull Secret for more information.

  • Technical preview feature badgeTechnical preview feature badge Overriding Cluster API (CAPI) properties is now supported on AWS EKS, Azure IaaS, and CloudStack clusters. This allows you to configure advanced provider-specific settings not natively exposed by Palette by supplying YAML that targets the underlying CAPI provider objects directly. For more information, refer to Override Cluster API (CAPI) Properties.

    • Using CAPI override, you can now apply AWS custom tags at the node pool level on EKS clusters. Node-pool tags are additive to cluster-level tags and propagate to the pool's managed node group and Auto Scaling group. For more information, refer to Node Pool AWS Tags.
  • Palette now supports overriding Cluster API Machine Health Check (MHC) settings per node pool on Palette eXtended Kubernetes (PXK) infrastructure clusters. This capability does not apply to EKS, AKS, or GKE clusters. For more information, refer to Node Pools.

Improvements​

  • Palette now supports the configuration of audit trails with Splunk. Refer to the Audit Logs guide for more information.
  • The Cluster Endpoint Access tooltip for Amazon EKS clusters now clarifies how the Private option behaves. For fully private endpoint access, use a self-hosted Private Cloud Gateway (PCG). If you select Private without a PCG, Palette initially creates the cluster in Private & Public mode and changes it to Private after cluster provisioning completes. For more information, refer to Create and Manage AWS EKS Cluster.
  • The MinIO backup location provider has been renamed to S3 Compatible Storage to reflect that it supports any S3-compatible object storage, such as MinIO or NetApp StorageGRID. The S3 URL field is now labeled Endpoint URL. Existing backup locations continue to work and appear under the new label with their settings preserved. For more information, refer to Backup and Restore.
  • Palette now provides the /v1/tenants/{tenantUid}/idp/palette/config API endpoint that allows tenant administrators to retrieve the Palette identity provider (IdP) configuration for their tenant in self-hosted Palette environments.
  • The View K8s Certificates page now displays every control plane PKI certificate that Palette includes in its renewal cycle, instead of only the core API server and certificate authority (CA) entries. The expanded list adds the kubeconfig-embedded client certificates, the etcd peer and health-check certificates, and the kubelet client and serving certificates for each control plane node. This applies to Palette eXtended Kubernetes (PXK), RKE2, K3s, and Canonical Kubernetes clusters. For more information, refer to Renew Cluster PKI Certificates.
  • Palette now publishes consistent cluster events for Container Network Interface (CNI) and Container Storage Interface (CSI) pack installations and upgrades across all cloud types. Palette adds a CNI install success event to match the existing CSI event, recording the source and target versions in a single upgrade event. For more information, refer to Event Stream.
  • The Pause Agent Upgrades setting now applies to all internal components of a Private Cloud Gateway (PCG), including those used to manage the PCG cluster itself. This applies to MAAS, vSphere, and self-hosted PCGs.
  • Palette now generates build attestation documents for Spectro Cloud components as part of the Supply chain Levels for Software Artifacts (SLSA) Level 2 secure supply chain initiative. These documents provide an audit trail of when, how, and where the software was produced.
  • The Palette AI Studio detail view now displays the full contents of the README.md file associated with Palette AI content, which makes extended documentation directly accessible from the details tab.

Deprecations and Removals​

  • The v1/projects Palette API endpoint is now deprecated. Use the /v1/dashboard/projects endpoint instead.

Bug Fixes​

  • Fixed an issue where the expanded certificate list did not appear on the View K8s Certificates page for newly provisioned AWS and GCP clusters.
  • Fixed an issue that caused AWS IaaS clusters using Cilium as the CNI to receive incorrect security group rules, which silently dropped cross-node pod traffic and disrupted DNS resolution, pod-to-pod communication, and API server webhook calls. Palette now applies the correct security group rules based on the configured CNI, with no manual security group changes required.
  • Fixed an issue where the API Endpoint field was disabled when adding a MAAS cloud account with a self-hosted Private Cloud Gateway (PCG), which prevented you from entering the endpoint manually.
  • Fixed an issue where a scheduled OS patch could loop indefinitely and leave a node cordoned. The patch no longer stalls on an unnecessary package signing key fetch, so it completes and the node is returned to service.
  • Fixed an issue where the apply-scheduled-os-patch pod could continue to start after the OS Patching Schedule was set to Never, which could leave a node cordoned. Setting the schedule to Never now removes the scheduled task.
  • Fixed an issue where the per-cluster capa-controller-manager pod was intermittently created without the EKS Pod Identity credential environment variables when provisioning Amazon EKS clusters with a Pod Identity cloud account, which could stall provisioning with a VPC reconciliation failure.
  • Fixed an issue where EKS Pod Identity associations were not removed when workload clusters were deleted or pivoted, which caused the list of associations to grow over time.
  • Fixed an issue where Amazon EKS cluster provisioning could stall at the worker node launch phase because of a race condition while updating the aws-node DaemonSet.
  • Fixed an issue where the Palette agent could delete a Role-Based Access Control (RBAC) managed namespace during a reconciliation cycle when a transient Kubernetes API error occurred, which briefly disrupted the workloads in that namespace.
  • Fixed an issue where requests to retrieve cluster namespace information could time out and return an HTTP 500 ClusterFeatureTimeoutError.
  • Fixed an issue where GET /v1/cloudaccounts/azure/{uid} returned a masked tls.cert value for AzurePublicCloud accounts that were created without a certificate, causing false drift detection in the Terraform provider.
  • Fixed an issue where Helm-based cert-manager installations did not receive image-swap labels, which could prevent container images from being redirected to a local registry in airgapped environments.
  • Fixed an issue where upgrading the Palette Management Appliance did not preserve previously configured settings during the review step. The upgrade introduced a new profile instead of a new version of the existing profile, which reset all values to their defaults and prevented a side-by-side comparison of the incoming and existing configuration values.

Edge​

info

The CanvOS version corresponding to the 4.9.22 Palette release is 4.9.19.

Features​

  • Connected (centrally managed) Edge Native clusters now support upgrading the control plane independently from worker pools. Enable the Skip worker node update toggle on a worker pool to defer its Kubernetes upgrade while the control plane advances. Palette enforces the Kubernetes N-3 minor version skew to prevent unsupported drift between the control plane and worker nodes. For more information, refer to Skip Worker Node Update and Edge Cluster Upgrade Behavior.
  • The Palette TUI now includes a Management Interface drop-down menu on the Network Adapter screen. You can use this option during initial Edge host setup to pin Local UI and host-to-host traffic to a specific network adapter. For more information, refer to Initial Edge Host Configuration with Palette TUI.
  • Edge clusters now support the DisableWorkerNodeCapReconcile feature gate. For clusters with Allow worker capability disabled, add this value to stylus.featureGate in the OS pack to prevent the Palette Edge node agent from automatically re-adding control plane taints to nodes in the control plane pool after the taint has been manually removed. For more information, refer to Feature Gates.

Bug Fixes​

  • Fixed an issue where k3s.service could enter a permanent crash loop with a no bootstrap data found in datastore error during the initial bootstrap of single-node Edge clusters.
  • Fixed an issue where Day-2 updates to the reconcile stages in an Edge OS or Kubernetes pack did not reliably replace the existing node configuration in /oem/85_cluster_config.yaml. Stale stage entries were retained and newly added entries under an existing stage were dropped.
  • Fixed an issue where reusing an Edge host for a new cluster could leave the cluster stuck in provisioning because the RKE2 state from the previous cluster was not fully removed. This caused the leftover bootstrap data to conflict with the new cluster token.
  • Fixed an issue where Canonical Kubernetes 1.35 was missing from the k8s_version.json file in CanvOS v4.8.18, which prevented building Canonical provider images for Edge deployments.

Launchpad for VMs​

Features​

  • Launchpad for VMs Appliance version 4.9.8 is now available. If upgrading from version 4.9.3 to 4.9.8, a pre-upgrade script is required. To obtain the pre-upgrade script, contact your customer support representative.

  • The Launchpad for VMs Appliance now supports live updates to running VMs. You can hot-plug memory and hot-update CPU sockets on a running VM without a reboot.

  • Running VMs can now be paused and resumed.

  • The appliance now displays live-migration progress so you can track a VM's migration between nodes.

  • VMs can now be created using custom YAML files.

  • VMs can now be created using golden images and templates across namespace boundaries using the Create VM flow.

Improvements​

  • MetalLB load-balancer images now use the hardened, distroless image variant.

  • The default password policy for the VMO Manager profile now requires a minimum of 15 characters, aligning with Security Technical Implementation Guide (STIG) compliance.

  • VMO profile password fields now enforce complexity requirements at input time. passwords before submission.

  • Fixed an issue where users could delete the account they were currently signed in with.

  • The user-creation form now validates email format and rejects malformed email addresses.

  • VM instance types can now be changed after the VM is built using the edit-configuration flow.

  • The VM creation flow now surfaces the underlying DataVolume status, allowing you to monitor disk-provisioning progress during VM creation.

Bug Fixes​

  • Fixed an issue where updating a VM's CPU sockets displayed a spurious "restart required" message for a change that does not require a restart.

  • Fixed an issue where VMs that failed to start or be scheduled could not be deleted through the UI.

VerteX​

Features​

  • Includes all Palette features, improvements, breaking changes, and deprecations in this release. Refer to the Palette section for more details.

Improvements​

  • The system console now displays the installed product version for Helm-based installations of Palette VerteX.

Bug Fixes​

  • Fixed an issue where deploying a FIPS-enabled Amazon EKS cluster could fail with a chart installation error because the aws-node service account in the kube-system namespace already existed and could not be imported into the Helm release for the cni-aws-vpc-eks-helm-fips pack.

Automation​

info

Check out the CLI Tools page to find the compatible version of the Palette CLI.

Features​

Improvements​

  • The Spectro Cloud Terraform provider now supports Cluster API (CAPI) property overrides for Amazon EKS, Azure IaaS, and CloudStack clusters. You can supply key-value overrides for the underlying CAPA or CAPC properties at the cluster and node pool level.
  • The spectrocloud_cluster_eks Terraform resource now supports custom AWS tags at the node pool level. These tags are applied in addition to any cluster-level tags.
  • The Spectro Cloud Terraform provider now supports overriding Machine Health Check (MHC) configuration at the node pool level for Palette eXtended Kubernetes (PXK) infrastructure clusters.
  • The Spectro Cloud Terraform and Crossplane providers now support decoupled upgrades for worker node pools on Edge clusters. This allows you to upgrade the control plane and worker nodes independently for Canonical Kubernetes (CK8s) and Palette eXtended Kubernetes Edge (PXK-E) clusters.
  • The Spectro Cloud Terraform provider now supports configuring audit log export to both Amazon CloudWatch and Splunk for Palette deployments. Refer to Audit Logs for more information.

Bug Fixes​

  • Fixed an issue in the Palette Go SDK where removing all tags from a cluster profile was not applied, because the omitempty annotation on the labels field caused an empty map to be omitted from the API request payload.

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
argo-cdaddon✅❌9.6.0
cert-manageraddon✅✅1.20.2
csi-aws-ebscsi✅❌1.62.0
csi-gcp-drivercsi✅❌1.26.0
csi-local-path-provisioner-addonaddon✅❌0.0.36
csi-local-path-provisionercsi✅❌0.0.36
csi-vsphere-csicsi✅❌3.7.2
karpenteraddon✅❌1.13.0
kongaddon✅❌3.4.0
piraeus-operator-addonaddon❌✅2.10.7
piraeus-operatorcsi❌✅2.10.7
prometheus-operatoraddon✅❌87.1.0
registry-connectaddon✅❌0.2.0
traefikaddon✅❌41.0.0

Pack Notes​

  • Palette support for the Headlamp pack has exited Tech Preview and is now ready for production workloads. Refer to the Headlamp guide for more information.

June 19, 2026 - Component Updates​

The following components have been updated for Palette version 4.9.5 - 4.9.18.

Improvements​

Bug Fixes​

  • Fixed an issue in Artifact Studio that prevented profile bundle cards from being correctly paginated and displayed.

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
argo-cdaddon✅❌9.5.21
aws-albaddon✅❌3.4.0
cni-aws-vpc-eks-helmcni✅❌1.21.2
cni-calicocni❌✅3.32.0
cni-calico-azurecni❌✅3.32.0
cni-flannelcni❌✅0.28.5
csi-aws-ebscsi✅❌1.61.1
csi-vsphere-csicsi❌✅3.7.1
external-secrets-operatoraddon✅❌2.6.0
istioaddon✅❌1.30.1
piraeus-operatorcsi✅❌2.10.7
registry-connectaddon✅❌0.2.0
piraeus-operator-addonaddon✅❌2.10.7
vaultaddon✅❌0.33.0
zot-registryaddon✅✅0.1.117

June 12, 2026 - Component Updates​

The following components have been updated for Palette version 4.9.5 - 4.9.18.

ComponentVersion
Spectro Cloud Terraform provider0.29.5
Spectro Cloud Crossplane provider0.29.5
Palette Management Appliance4.9.18
VerteX Management Appliance4.9.18

Bug Fixes​

  • Fixed an issue that caused ImagePullBackOff errors in the csi-local-path-provisioner FIPS pack version 0.0.32 due to incorrectly referencing the non-FIPS palette-images image registry instead of the palette-imagesfips FIPS registry.

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
cni-flannelcni✅❌0.28.5
csi-aws-ebscsi✅✅1.60.1
csi-azurecsi✅✅1.34.4
csi-portworx-genericcsi✅❌3.6.1
csi-vsphere-csicsi✅❌3.7.1
portworx-add-onaddon✅❌3.6.1
reloaderadd-on✅❌1.4.17
traefikadd-on✅❌40.3.0
volume-snapshot-controlleraddon✅❌8.6.0

June 11, 2026 - Release 4.9.18​

The following component updates are applicable to this release:

Bug Fixes​

  • Fixed an issue that caused the two-node liveness server to expose the database password endpoint without authentication, TLS, or access controls.
  • Fixed an issue that caused the removal of the built-in ubuntu user during SSH key injection for MAAS clusters.
  • Fixed an issue that prevented the pack lifecycle stages from executing during a Kubernetes upgrade due to the configuration file being inaccessible inside the upgrade container.
  • Fixed an issue that caused the debug/pprof profiling interface to be unintentionally exposed on ports 9443, 7443, and 5082.
  • Fixed an issue that caused the Palette message broker to stop functioning as expected, leading to timeouts and degraded platform responsiveness.
  • Fixed an issue that caused excessive memory utilization in Hubble pods due to high goroutine counts resulting from message broker call patterns.
  • Fixed redundant cluster status cache broadcasts by limiting eviction to cluster state changes, significantly reducing unnecessary cache reloads.

June 8, 2026 - Release 4.9.16​

The following component updates are applicable to this release:

Breaking Changes​

  • Authentication is now required for the following Palette API endpoints, which are used for imported clusters and Private Cloud Gateways (PCGs).

    EndpointRequired Permissions
    /cluster/{uid}/manifestcluster.delete permission
    /v1/pcg/{uid}/services/ally/manifestTenant Admin role
    /v1/pcg/{uid}/services/jet/manifestTenant Admin role
    /v1/spectroclusters/{uid}/import/manifestcluster.delete permission

    This change does not affect existing imported clusters and PCGs; it affects new cluster import and PCG workflows, as well as any automation that retrieves manifests from the affected endpoints. As a result, the process of importing clusters and creating PCGs on existing Kubernetes clusters has been updated, requiring the manifests to be downloaded locally before being applied.

Features​

  • Palette now supports selecting the node pool operating system for Azure AKS clusters through a new OS SKU field. When the OS type is Linux, you can choose Ubuntu or Azure Linux; when the OS type is Windows, the node pool uses Windows 2022.

Bug Fixes​

June 5, 2026 - Component Updates​

The following components have been updated for Palette version 4.9.5 - 4.9.14.

ComponentVersion
Artifact Studio4.9.3
Spectro Cloud Terraform provider0.29.4
Spectro Cloud Crossplane provider0.29.4

Improvements​

  • Terraform cluster resources now support triggering manual control plane Kubernetes Public Key Infrastructure (PKI) certificates for Palette clusters using the new renew_k8s_certificates_now field.

Bug Fixes​

  • Fixed a Terraform issue where updating the cluster_profile list on the spectrocloud_cluster_eks Terraform resource triggered an erroneous deletion of the removed profile and incorrectly updated the Terraform state.
  • Fixed a Terraform issue where imported spectrocloud_cluster_edge_native resources would repeatedly show Terraform plan differences for sensitive cluster profile variables.

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
Amazon EBS CSICSI❌✅1.60.0
Azure DiskCSI❌✅1.34.3
CalicoCNI✅❌3.32.0
External SecretsAdd-on✅❌2.5.0
FlannelCNI❌✅0.28.4
HeadlampAdd-on✅❌0.42.0-rev1
IstioAdd-on✅❌1.30.0
KarpenterAdd-on❌✅1.12.1
MetalLBAdd-on✅❌0.16.1

Pack Notes​

  • The Crossplane pack version 2.3.0 is now available in the Palette Community Registry.

May 31, 2026 - Release 4.9.14​

Security Notices​

Palette Enterprise​

Breaking Changes​

  • Palette now uses IAM Roles for Service Accounts (IRSA) instead of kube2iam for Velero backup operations on EKS clusters that use AWS Security Token Service (STS) credentials.

    To prevent backup disruptions, pause agent upgrades on your EKS clusters before upgrading to Palette 4.9.14 and update the backup IAM role's trust policy by adding the EKS cluster's OpenID Connect (OIDC) provider as a federated principal and allowing the sts:AssumeRoleWithWebIdentity action. Refer to Add Backup Location using Dynamic Credentials for detailed instructions on updating the trust policy.

Features​

  • Technical preview feature badgeTechnical preview feature badge Palette now supports overriding Cluster API (CAPI) properties on AWS IaaS and Azure AKS clusters. This allows you to configure advanced provider-specific settings not natively exposed by Palette by supplying YAML that targets the underlying CAPI provider objects directly. For more information, refer to Override Cluster API (CAPI) Properties.

  • Palette now supports deployment of Generation 2 (Gen 2) Azure VMs on AKS clusters. When you select an instance type that supports Gen 2 (for example, Standard_D8ds_v6), Azure automatically provisions the nodes as Gen 2 VMs instead of Gen 1 VMs. Changing a node pool's instance type between Gen 1 and Gen 2 variants on a running cluster triggers a node pool repave. For more information, refer to Create and Manage Azure AKS Cluster.

    • For further upgrade guidance, review the Azure documentation. This covers supported size families and the move to UEFI-based boot architecture.

Improvements​

  • Technical preview feature badgeTechnical preview feature badge You can now use a pre-built Docker image to import a MAAS-compatible CentOS Stream CoreOS (SCOS) image when preparing the CoreOS image required for OpenShift workload clusters on MAAS using HyperShift. This provides a faster alternative to building a custom Red Hat Enterprise Linux CoreOS (RHCOS) image from source.
  • The ability to Force sync registries has been added to Tenant Settings > Registries. Use this option to interrupt and restart ongoing synchronization processes that have been in progress for at least one hour.

Deprecations and Removals​

  • The internal Ingress Nginx controller used by Palette and Palette VerteX management plane services has been fully removed. Traefik, introduced in 4.8.47, is now the sole management cluster ingress controller. The management plane removes leftover Ingress Nginx objects automatically at startup (such as Deployments, Services, Secrets, and more), preventing the need for manual cleanup. Self-hosted installations retain the ingress-nginx namespace and default-ssl-certificate Secret due to the the cert-bridge introduced in 4.8.47, which continues to copy the uploaded Transport Layer Security (TLS) certificate from that Secret into Traefik.

    • Google Kubernetes Engine (GKE) pre-upgrade requirement - The principal running helm upgrade must have the container.roles.delete, container.roleBindings.delete, container.clusterRoles.delete, and container.clusterRoleBindings.delete Cloud Identity and Access Management (IAM) permissions. Refer to Upgrade Palette on Kubernetes for details.
    • Recommended values.yaml hygiene - The ingress.type and ingress.ingress.internal fields have been removed from the Palette Helm chart. Any references that remain in your override file are ignored; however, we recommend removing both fields for hygiene purposes. Refer to Helm Configuration Reference for the current set of supported parameters.
    • Recovery - If the configserver is not Ready after upgrading due to leftover Ingress Nginx pods holding host ports, refer to our Troubleshooting guide for the manual cleanup procedure.
  • EKS Hybrid Nodes are now deprecated in Palette and Palette VerteX. We recommend that customers deploy their workloads to EKS clusters instead.

Bug Fixes​

  • Fixed an issue that caused strict YAML validators and GitOps tools to reject self-hosted Palette deployment templates due to a duplicate securityContext configuration block in the Helm chart.
  • Fixed an issue that caused scheduled OS patching to run only once instead of on the configured recurring schedule.
  • Fixed an issue that caused the Clusters page to hang indefinitely when accessed by users with a custom tenant role that lacked virtual cluster permissions.
  • Fixed an issue that caused multi-line formatting in cluster profile and cluster description fields to be lost after saving.
  • Fixed an issue that caused changes to additional security groups on AWS IaaS node pools to be silently ignored when replacing one security group with another without changing the total count.
  • Fixed an issue that caused the Cluster Settings > Cluster Configuration page to display a generic error when attempting to show SSH key names for users whose role lacked the permission sshKey.list.
  • Fixed an issue that caused MAAS cluster node pools configured with multiple placement tags to match machines using only the last tag instead of all specified tags.
  • Fixed an issue that caused EKS cluster add-on packs to appear as not ready in the Palette UI, even though the packs were deployed successfully and the cluster was running.
  • Fixed an issue that caused add-on Helm charts that entered an uninstalling state to remain stuck indefinitely, preventing the pack from being redeployed.

  • Fixed an issue that caused virtual clusters deployed on EKS 1.34 and 1.35 host clusters to fail or have add-on packs permanently stuck in a not ready state.

  • Fixed an issue that prevented virtual clusters from being deployed on EKS host clusters when the Kubernetes version on the virtual cluster and host cluster did not match.

Edge​

info

The CanvOS version corresponding to the 4.9.14 Palette release is 4.9.10.

Features​

  • The Palette agent can now be uninstalled from Edge hosts deployed with Agent Mode using the palette-agent uninstall command. Refer to our Install Palette Agent guide for more information.
  • Network Time Protocol (NTP) values can now be configured per Edge host via user data using stylus.site.ntpServers, the Edge TUI, or Local UI. NTP values used during cluster creation override the servers configured on individual hosts.

Bug Fixes​

  • Fixed an issue on Edge clusters with image swap enabled that caused cluster upgrade tasks to get stuck due to the image-swap webhook interfering with Kubernetes Job completion.
  • Fixed an issue that caused Kubernetes upgrades on Edge clusters to fail when the host OS root password had expired.
  • Fixed an issue that caused systemd-networkd-wait-online.service to fail on the first boot of Edge hosts with managementMode: local and includeTui: true, even after configuring network settings through the TUI.
  • Fixed an issue that allowed a Kubernetes upgrade to proceed on Edge clusters even when a previous upgrade had not completed successfully, potentially leaving the cluster in an inconsistent state.

VerteX​

Features​

  • Includes all Palette features, improvements, breaking changes, and deprecations in this release. Refer to the Palette section for more details.

Automation​

info

Check out the CLI Tools page to find the compatible version of the Palette CLI.

Deprecations and Removals​

  • The Palette Edge CLI has been deprecated and there will be no further releases. For continued functionality, use the Palette CLI instead. Refer to the Palette CLI documentation for more information.

Features​

Improvements​

  • The spectrocloud_cluster_maas Terraform resource now supports the injection of SSH keys into MAAS nodes using the ssh_keys field.

Bug Fixes​

Docs and Education​

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
Amazon EFSCSI✅❌3.2.0
CiliumCNI✅❌1.19.4
HeadlampAdd-on✅❌0.42.0
KarpenterAdd-on✅❌1.12.1
Portworx with OperatorCSI✅❌3.6.0
Volume Snapshot ControllerAdd-on✅❌8.5.0-rev1

Pack Notes​

The Volume Snapshot Controller version 8.5.0-rev1 supports the snapshot conversion webhook.

The following community packs have been released:

May 22, 2026 - Component Updates​

The following components have been updated for Palette version 4.9.5 - 4.9.8.

ComponentVersion
Artifact Studio4.9.2
Spectro Cloud Terraform provider0.29.2
Spectro Cloud Crossplane provider0.29.2

Bug Fixes​

  • Fixed a Terraform issue where terraform apply failed to reconcile add-on cluster profile drift in clusters when the add-on cluster profile is managed in Terraform but updated in the Palette UI.

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
Amazon EBS CSICSI✅❌1.60.0
Amazon EFSCSI✅❌3.1.0
Calico Network PolicyAdd-on✅❌3.32.0
ExternalDNSAdd-on✅❌0.21.0
GCE Persistent Disk CSICSI✅❌1.25.2
Spectro ProxyAdd-on❌✅1.5.6
Tigera OperatorCNI✅❌3.32.0
TraefikAdd-on✅❌40.2.0

Community Packs​

Pack NameLayerNew Version
ECK OperatorAdd-on3.4.0
ECK StackAdd-on0.19.0

May 15, 2026 - Component Updates​

The following components have been updated for Palette version 4.9.5 - 4.9.8.

ComponentVersion
Artifact Studio4.9.1
Palette Management Appliance4.9.8
VerteX Management Appliance4.9.8

Improvements​

  • The Artifact Studio pack version dropdown now displays expanded version information, distinguishing between the pack component version and the Palette compatibility version. A tooltip also helps users clarify the difference between these version types.

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
AWS Application LoadbalancerAdd-on✅❌3.3.0
Cilium TetragonAdd-on✅❌1.7.0
External SecretsAdd-on✅❌2.4.1
HarborAdd-on✅❌1.19.0
KarpenterAdd-on✅❌1.12.0
Open Policy AgentAdd-on✅❌3.22.2
TraefikAdd-on✅❌40.0.0

May 14, 2026 - Release 4.9.8​

The following component updates are applicable to this release:

Improvements​

  • The Palette TUI now supports changing the root user's password.

Bug Fixes​

  • Fixed an issue in the vCluster template that caused vCluster deployments to fail for both k3s and generic Kubernetes configurations.
  • Fixed an issue that caused MAAS Clusters Using LXD VMs to fail with "no eligible LXD host found" due to storage availability being incorrectly parsed as zero, even when hosts had sufficient free disk space.
  • Fixed an issue where Kubernetes and kube-vip continue running with stale certificates after a certificate renewal.
  • Fixed an issue that caused EKS clusters configured with static placement or private endpoint access to fail to deploy due to EC2 permission errors.

May 11, 2026 - Release 4.9.6​

The following component updates are applicable to this release:

Improvements​

  • Local UI now supports dropdown profile variables for locally managed Edge clusters.

Bug Fixes​

  • Fixed an issue that caused Palette to register 429 rate limit errors due to excessive calls on the /v1/edgehosts API endpoint.
  • Fixed an issue that caused Azure IaaS clusters using Palette eXtended Kubernetes (PXK) version 1.32.13 or earlier to get stuck when upgrading to a PXK version in 1.33.x series.
  • The dependencies of the mongo-enterprise Palette image were updated to the latest versions, ensuring that it has the latest security patches.
  • The Spectro Cloud Ubuntu images were rebuilt to ensure that they contain the latest security patches.
  • The dependencies of the Palette agent were updated to the latest versions, ensuring that it has the latest security patches.

May 8, 2026 - Component Updates​

The following components have been updated for Palette version 4.9.5.

ComponentVersion
Spectro Cloud Terraform provider0.29.1
Spectro Cloud Crossplane provider0.29.1
Palette Management Appliance4.9.6
VerteX Management Appliance4.9.6
Palette Management Appliance4.8.54
VerteX Management Appliance4.8.54
Palette Management Appliance4.7.40
VerteX Management Appliance4.7.40

Improvements​

Bug Fixes​

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
Amazon EBS CSICSI✅❌1.59.0
Amazon EBS CSICSI❌✅1.58.0
Amazon EFSCSI✅❌3.0.1
AWS Application LoadbalancerAdd-on✅❌3.22.2
Azure DiskCSI✅❌1.34.3
K3sKubernetes✅❌1.35.3
K3sKubernetes✅❌1.34.6
K3sKubernetes✅❌1.33.10
Palette Optimized RKE2Kubernetes✅✅1.35.3
Palette Optimized RKE2Kubernetes✅✅1.34.6
Palette Optimized RKE2Kubernetes✅✅1.33.10
TraefikAdd-on✅❌39.0.8

Pack Notes​

May 3, 2026 - Release 4.9.5​

The following component updates are applicable to this release:

Security Notices​

Palette Enterprise​

Breaking Changes​

Features​

  • The iam:ListRoleTags permission has been added to the Core IAM Policies as part of the PaletteDeploymentPolicy. This permission allows Palette to propagate tags to IAM Roles for Service Accounts (IRSA) roles it creates.
  • Kubeconfig file contents for workload clusters can now be copied to the clipboard by selecting the Copy icon beside the Kubeconfig File or Admin Kubeconfig File download link. Refer to our Kubeconfig and Kubectl guides for more information.
  • GitHub Container Registry (GHCR) is now a supported Open Container Initiative (OCI) Helm registry in Palette. Refer to Add OCI Helm Registry for details on how to add GHCRs to Palette and Add a Helm Chart for how to use GHCR-sourced Helm charts in your clusters.
  • The compute.zoneOperations.get and compute.zoneOperations.list permissions have been added to GCP Required IAM Permissions. These permissions allow Palette to optimize the cluster creation process.

  • Palette now supports the option to skip worker node upgrades on MAAS and VMware vSphere clusters. For example, if you have worker pools running critical databases or real-time processing services, you can enable this option to maintain service continuity during control plane upgrades, then schedule worker node updates during planned maintenance windows.

    The version difference between the control plane and worker nodes must not exceed the N-3 minor version skew supported by Kubernetes. Palette enforces this during cluster profile updates and blocks you from updating if you attempt to exceed the N-3 threshold.

Improvements​

  • The Cloud Type options for imported clusters have been updated for clarity (AWS IaaS, Azure IaaS, GCP IaaS, and Generic). Users should now select Generic when importing AWS EKS-Anywhere, OpenShift, and VMware vSphere clusters.
  • The Context field on the cluster Overview tab now contains a hyperlink to the cluster's parent project. This link is available from the Tenant Admin scope only.

Deprecations and Removals​

  • Amazon Linux 2 (AL2) AMIs have been disabled in Palette. You will not be able to create new EKS clusters with AL2 worker nodes. For existing EKS clusters, you must create new worker nodes using AL2023 AMIs. Existing AL2 AMI worker nodes will no longer receive bug fixes or security patches. Refer to our Scenario - Unable to Upgrade EKS Worker Nodes from AL2 to AL2023 guide for help with migrating workloads.

    • In addition, Kubernetes upgrades to v1.33 and later are not supported on EKS clusters with AL2 worker nodes. If you want to upgrade your cluster to v1.33 or later, you must first migrate your workloads to AL2023 worker nodes.

  • Support for Red Hat Enterprise Linux (RHEL) 8.x in Edge workflows has been deprecated, including FIPS-enabled configurations. Use RHEL 9.x or RHEL 10.x instead.

  • Support for Ubuntu 20.04 in Edge workflows has been deprecated, including FIPS-enabled configurations. Use Ubuntu

  • Support for Ubuntu 20.04 in Edge workflows has been deprecated. We recommend using either Ubuntu 22.04 (when requiring FIPS 140-3 certification) or Ubuntu 24.04 (when FIPS 140-3 compliance is sufficient). Ubuntu 24.04 FIPS certification is still in progress at the vendor-level and cannot be relied upon to meet auditory compliance until certification is reached.”

  • The internal Ingress Nginx controller used by Palette management plane services is now deprecated. Traefik replaced Nginx as the default management cluster ingress controller starting with Palette 4.8.47. For self-hosted Palette environments installed using Helm charts, set ingress.type to traefik to avoid service disruptions. Refer to Helm Configuration Reference for more information.

    If you have made custom modifications to the Ingress Nginx configuration in your self-hosted environment, such as custom annotations, load balancer settings, or Transport Layer Security (TLS) configurations, these customizations may not carry over automatically and could affect your deployment. Review your ingress configuration before upgrading and contact our Support team if you need assistance migrating custom ingress settings to Traefik. For installations configured to use DNS, you must also update your records to point to the new Traefik LoadBalancer service after upgrading. Refer to the Upgrade Palette on Kubernetes guide for details.

  • The /clusterprofilesAPI endpoint is now deprecated. Use the /dashboard/clusterprofiles endpoint instead, which includes improved data retrieval capabilities.

Bug Fixes​

  • Fixed an issue that prevented clusters from being deployed when gRPC ports are blocked and WebSocket is used as a fallback.
  • Fixed an issue that prevented clusters from being deployed or managed using cluster templates if the cluster was scoped to a project different from the one the template was created in.
  • Fixed an issue that caused cluster profile updates to fail with Manifest <UID> is not found in the project errors.
  • Fixed an issue that caused the Palette UI to crash when creating or editing cluster profiles with empty or missing version fields.
  • Fixed an issue that caused the Save Changes button to remain disabled when editing an imported cluster profile containing an empty manifest.
  • Fixed an issue that caused the Velero Helm release to fail when enabling cluster backups using Azure as the backup storage location.
  • Fixed an issue that prevented backup storage location credential and configuration updates from being propagated to workload clusters, causing backups to fail.
  • Fixed an issue that caused creating or updating VMware vSphere node pools after initial cluster deployment to lose cluster-level datacenter, folder, and image template folder settings.
  • Fixed an issue that caused EKS Pod Identity job failures in clusters using image swap.
  • Fixed an issue that caused repeated false pack update notifications on cluster profiles when no changes were made to the pack or profile.
  • Fixed an issue that caused cluster status fields to display Go pointer values instead of actual values.

Edge​

info

The CanvOS version corresponding to the 4.9.5 Palette release is 4.9.4.

Improvements​

  • Pluggable Authentication Modules (PAM) policy enforcement is now enabled, including password expiry checks, which can be set using the stylus.site.users[*].passwordExpiry user data field. For examples of configuring PAM via the Dockerfile, refer to Build Edge Artifacts - Advanced workflow.
  • kube-vip is now automatically disabled if the virtual IP (VIP) address assigned to the cluster during cluster creation is the same as the Edge host's IP address (for example, in the case of single-node clusters).

Bug Fixes​

  • Fixed an issue that caused nodes deleted via kubectl to remain visible in the Palette UI, resulting in duplicate entries when the node rejoined the cluster.

VerteX​

Features​

  • Includes all Palette features, improvements, breaking changes, and deprecations in this release. Refer to the Palette section for more details.

Bug Fixes​

  • Fixed an issue that caused upgrading self-hosted Palette VerteX installations earlier than 4.6.12 to fail due to legacy MongoDB values.

Automation​

info

Check out the CLI Tools page to find the compatible version of the Palette CLI.

Features​

Improvements​

  • The Palette CLI content build command now supports the environment variable INCLUDE_COMPLIANCE_IMAGES. When the variable is set to true, the resulting content bundle includes additional container images required for compliance scanning.

Bug Fixes​

Docs and Education​

Packs​

Pack NameLayerNon-FIPSFIPSNew Version
CalicoCNI❌✅3.31.5
Calico Network PolicyAdd-on✅❌3.31.5
CiliumCNI✅❌1.19.3
External SecretsAdd-on✅❌2.3.0
FlannelCNI✅❌0.28.4
Flux2Add-on✅❌2.18.3
IstioAdd-on✅❌1.29.2
Open ObserveAdd-on✅❌0.70.3
Palette eXtended KubernetesKubernetes✅✅1.35.3
Palette eXtended KubernetesKubernetes✅✅1.34.6
Palette eXtended KubernetesKubernetes✅✅1.33.10
Prometheus AgentAdd-on✅❌29.2.1
Prometheus OperatorAdd-on✅❌83.5.0
vSphere CSICSI❌✅3.7.0

Pack Notes​

  • Technical preview feature badgeTechnical preview feature badge Headlamp is now available. It provides a web-based Kubernetes UI for cluster management and monitoring. Refer to the Headlamp guide for more information.

  • The KubeVirt and KubeVirt-CDI packs are now deprecated.