Release Notes

tip

Looking for breaking changes that might impact your Palette upgrade? Visit the Find Breaking Changes page for a filtered view of relevant updates.

To view release notes for a specific Palette version, use the version selector below.

Select release notes version

Select...

January 30, 2026 - Release 4.8.25

Breaking Changes

• The number of IP addresses allocated for autoscaling VMware vSphere clusters is now based on the Maximum size of the worker pool instead of the number of worker nodes currently deployed. This ensures enough IP addresses are reserved upfront for the maximum possible scale of the cluster. As a result, updates to existing VMware vSphere clusters may fail if the IP pool cannot accommodate the Maximum size, and enabling autoscaling on new clusters may fail if the IP capacity is insufficient.

Improvements

• Autoscaling is now supported for VMware vSphere clusters using an IP Address Management (IPAM) node pool with static placement configured.

• Resource limits for core system components can now be adjusted for Day-1 operations by editing the palette-agent-config ConfigMap in the cluster namespace.

• Palette Management Appliance and VerteX Management Appliance version 4.8.25 is now available.

• Manual disk selection has been enabled for Palette Management Appliance and VerteX Management Appliance installations.

Bug Fixes

• Fixed an issue where node groups in EKS clusters were configured with different Classless Inter-Domain Routing (CIDR) values in their launch templates.

• Fixed an issue where Azure and GCP clusters using Kubernetes version 1.34.2 and later experienced Kubelet failures due to the upstream removal of the --cloud-config flag.

• Fixed an issue where worker nodes in static AKS clusters were assigned IP addresses from the control plane subnet instead of worker subnet.

• Fixed an issue where self-hosted Palette and Palette VerteX users with the Tenant Viewer role could access password reset links via the Palette API.

• Fixed an issue where namespace-scoped RoleBindings could not be created in the Palette UI for clusters with Palette as an identity provider (IdP) and automatic role binding disabled.

• Fixed a UI issue where pagination did not work when attempting to replace a cluster profile on a cluster.

January 30, 2026 - Component Updates

The following components have been updated for Palette version 4.8.6 - 4.8.24.

Component	Version
Spectro Cloud Terraform provider	0.27.2
Spectro Cloud Crossplane provider	0.27.2

• The spectrocloud_registry_oci Terraform resource now supports registry imports using either the registry ID or the registry name.

Packs

Pack Notes

• The Antrea pack version 2.5.1 is now Verified and available in the Palette Registry.

Pack Name	Layer	Non-FIPS	FIPS	New Version
Antrea	CNI	✅	❌	2.5.1
Argo CD	Add-on	✅	❌	9.2.4
AWS Application Loadbalancer	Add-on	✅	❌	2.17.1
Azure Disk	CSI	✅	❌	1.34.0
Flannel	CNI	✅	❌	0.28.0
Flux2	Add-on	❌	✅	2.17.0
Karpenter	Add-on	✅	❌	1.8.5
Kong	Add-on	✅	❌	3.0.2
Kubernetes (EKS)	Kubernetes	✅	❌	1.34
Kubernetes (GKE)	Kubernetes	✅	❌	1.34
Palette eXtended Kubernetes	Kubernetes	✅	✅	1.34.2
Prometheus Agent	Add-on	✅	❌	28.2.1
Prometheus Operator	Add-on	✅	❌	80.13.3
Vault	Add-on	✅	❌	0.32.0

January 23, 2026 - Component Updates

The following components have been updated for Palette version 4.8.6 - 4.8.24.

Component	Version
Spectro Cloud Terraform provider	0.27.1
Spectro Cloud Crossplane provider	0.27.1
Palette Management Appliance	4.8.23
VerteX Management Appliance	4.8.23

Improvements

• The spectrocloud_cluster_aws, spectrocloud_cluster_custom_cloud, and spectrocloud_cluster_maas Terraform resources now provide the cluster_type field, which can be set during cluster provisioning. This improvement facilitates cluster migration between cloud providers.

• The Spectro Cloud Terraform provider now provides the spectrocloud_cluster_brownfield resource to support cluster import operations.

Bug Fixes

• Fixed an issue that caused Terraform updates to fail on EKS clusters configured with Karpenter managed machine pools.

Packs

Pack Notes

• The Spectro Kubernetes Dashboard pack version 7.14.0 now provides Custom access mode. This mode allows you to provide custom networking values.

Pack Name	Layer	Non-FIPS	FIPS	New Version
Argo CD	Add-on	✅	❌	9.2.0
Amazon EBS CSI	CSI	✅	❌	1.54.0
Amazon EFS	CSI	✅	❌	3.3.0
Calico	CNI	❌	✅	3.31.3
Calico Network Policy	Add-on	✅	❌	3.31.3
External DNS	Add-on	✅	❌	1.20.0
External Secrets	Add-on	✅	❌	1.2.1
GCE Persistent Disk CSI	CSI	✅	❌	1.23.3
Karpenter	Add-on	❌	✅	1.8.3
Kong	Add-on	✅	❌	3.0.1
Kubernetes Dashboard	Add-on	✅	❌	7.14.0
RKE2	Kubernetes	✅	✅	1.33.6
RKE2	Kubernetes	✅	✅	1.32.10
RKE2	Kubernetes	✅	✅	1.31.14
Prometheus Agent	Add-on	✅	❌	27.52.0
Prometheus Operator	Add-on	✅	❌	80.6.0

January 23, 2026 - Release 4.8.24

The following component updates are applicable to this release:

• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Bug Fixes

• Fixed an issued the caused the /clusterprofiles API endpoint to respond slowly.

January 21, 2026 - Release 4.8.23

The following component updates are applicable to this release:

• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Bug Fixes

• Fixed an issue that prevented cluster role bindings configured with the Group subject type from being correctly applied.

• Fixed an issue that prevented the Virtual Machines tab on clusters configured with the Virtual Machine Orchestrator from displaying correctly.

• Fixed an issue that prevented cluster profile versions from being displayed correctly on the Profile tab of Palette clusters.

• Fixed an issue that prevented Palette from correctly loading the Events tab on Edge hosts when the Tenant Admin scope is selected.

January 19, 2026 - Release 4.8.22

The following component updates are applicable to this release:

• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Features

• Palette Management Appliance and VerteX Management Appliance version 4.8.22 is now available. This version uses the following components internally:
  • Palette eXtended Kubernetes 1.33.5
  • Calico 3.31.2
  • Piraeus CSI 2.10.1
  • Zot Registry 0.1.89

Bug Fixes

• Fixed an issue that caused Palette deployments and cluster updates to become stuck due to incorrectly configured default resource limits.

January 18, 2026 - Release 4.8.21

The following component updates are applicable to this release:

• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Security Notices

• Review the Security Bulletins page for the latest security advisories.

Palette Enterprise

Breaking Changes

• Users with the cluster.delete permission are no longer allowed to download the cluster admin kubeconfig file. This operation is now controlled using the cluster.adminKubeconfigDownload permission, giving system administrators fine-grained control over cluster admin access.

  The cluster.adminKubeconfigDownload permission is part of the following system roles:

  • Tenant Admin
  • Tenant Project Admin
  • Project Admin
  • Cluster Admin
  • Resource Cluster Admin

  Existing users with system roles that include the cluster.delete permission automatically receive the new cluster.adminKubeconfigDownload permission. System administrators must grant the new permission manually to existing users granted access through custom roles.

Features

• Cluster templates provide a new way to enforce consistent configurations and prevent drift across multiple clusters. With cluster templates, you define and enforce the desired state and lifecycle of clusters by combining cluster profiles with operational policies into a single, reusable governance blueprint, allowing you to deploy, manage, and upgrade a synchronized fleet of clusters with minimal effort. Refer to our Cluster Templates guide for more information.

• AWS Dedicated Hosts are now supported for AWS IaaS clusters. This feature allows you to launch your cluster nodes on physical servers that are dedicated for your use, providing additional isolation and compliance benefits. Refer to the Create and Manage AWS IaaS Cluster and AWS Architecture guides for more information.

• Worker node pools now support configuring custom maxSurge and maxUnavailable values for rolling updates, offering more flexibility in managing cluster capacity during updates.

• Zarf OCI registries now support synchronization, allowing public Zarf packages to be automatically imported into Palette. This setting is only available for new OCI registries and is disabled by default on existing registries. This setting is immutable and cannot be changed once the OCI registry is added to Palette.

• Clusters now support using either the built-in Palette integrated cert-manager feature or the Cert Manager 1.19.1 add-on pack. This provides a more flexible and modular approach to certificate management.

Improvements

• You can now add OCI Helm registries that do not require authentication to Palette. This allows you to leverage publicly available OCI Helm Charts in your cluster profiles. Refer to the Add OCI Helm Registry guide to learn more.

• CloudStack Clusters now support the template names for machine image configuration, allowing users to customize machine images for individual node pools, similar to how Amazon EKS clusters handle AMI selections.

• All infrastructure providers now support adding annotations to either control plane or worker nodes (infrastructure dependent), allowing system administrators to provide node-level customization.

• All infrastructure providers now support kubeadm overrides for worker node pools, allowing workloads to meet specific operational or environmental requirements.

• Velero has been upgraded to version 1.17, which is used internally by Palette for backing up and restoring clusters. Existing clusters with backups configured will be automatically updated to Velero version 1.17, ensuring continuous access to backup and restore functionality. Refer to the Backup and Restore page to learn more about backup and restore tools in Palette.

• Palette's internal database, MongoDB, has been upgraded to version 7.0.28.

• The nginx.ingress.kubernetes.io/proxy-body-size field allows you to configure the request body size limit of the Nginx ingress controller deployed by Palette.

Bug Fixes

• Fixed an issue that caused the Palette API to fail to update the metadata.machineUid field after nodes are repaved during Kubernetes upgrades.

• Fixed an issue that caused Palette to fail to update the controlPlaneEndpoint field when applying updates on MAAS clusters.

• Fixed an issue that prevented Palette from removing cert-renewal-plan resources that are no longer required for automatic resource upgrades.

• Fixed an issue that caused deployment failures for EKS clusters with both ImageSwap enabled and the AWS VPC CNI (Helm).

• Fixed an issue that prevented Palette from correctly assigning users to teams if the team was not listed on the first page in Users & Teams > Teams.

• Fixed an issue that prevented Palette from correctly applying configuration updates specified in manifest files for ally and palette-controller-manager resources on newly created clusters.

• Fixed an issue that prevented Palette from masking API responses containing cloud account fields.

• Fixed an issue that prevented AKS clusters with static placement from deploying with custom VNets.

• Fixed an issue where cluster profile changes were intermittently not propagated to workload clusters due to a race condition in the image resolution process.

• The image imageswap-init:v1.5.3-spectro-4.7.a was recreated due to a missing dependency.

Edge

info

The CanvOS version corresponding to the 4.8.21 Palette release is 4.8.8.

Features

• Local UI now supports network settings configuration without needing to restart the cluster. You can configure network interface controllers (NICs), virtual local area network (VLAN) interfaces, bonds, and bridges. Refer to the Configure Network Interfaces in Local UI for more information.

• The EdgeForge workflow now enables the creation of MAAS-compatible images. Refer to Build MAAS Image to learn how to create custom MAAS images for Palette Edge and Deploy Edge Hosts on MAAS for step-by-step instructions on uploading images to MAAS and deploying Edge hosts using the MAAS UI.

• The EdgeForge workflow now supports the creation of images that support Edge cluster deployment on Amazon EC2. The aws-cloud-image target takes a CanvOS raw disk image and imports it into AWS, creating and registering an Amazon Machine Image (AMI) that can be used to launch EC2 instances. Refer to the Build AWS Cloud Images guide for further information.

Improvements

• Trusted Boot has exited Tech Preview and is now ready for production workloads.

• The Canonical Kubernetes versions 1.32.8 and 1.33.3 have been updated to use etcd as the datastore, replacing k8s-dqlite.

• The Edge Terminal User Interface (TUI) has been upgraded to Kairos version 3.5.9. The TUI now allows you to customize the color scheme and disable advanced settings, such as user accounts and SSH keys.

• The Edge Terminal User Interface (TUI) now allows IP address updates after cluster creation, including changing from static IP to DHCP.

• Graphics Processing Unit (GPU) specifications for Edge hosts can now be retrieved for non-Nvidia devices and devices without the nvidia-smi command-line interface (CLI) installed. Palette automatically displays GPU information for Edge hosts with certain GPU vendor-model combinations; for other GPUs, Palette sources the information using the vendor-specific driver or CLI installed on the Edge host. If GPU information cannot be pulled automatically, users can provide GPU information manually via the user-data file (Appliance and Agent mode) or with a custom-hardware-specs-lookup.json file (Appliance mode only). Refer to Prepare User Data and Argument Files for more information.

• A new FORCE_INTERACTIVE_INSTALL flag has been added to the .arg file. When enabled, the Palette Edge Interactive Installer is selected by default in the GRUB menu on first boot, allowing manual disk selection for ISO-based installations.

Deprecations and Removals

• The stylus.installationMode Edge Installer Configuration flag is no longer available. Use the stylus.managementMode flag instead, which has two allowed values: central, which means the Edge host is connected to Palette, and local, which means the Edge host has no connection to a Palette instance. Refer to the Prepare User Data guide for further information.

Bug Fixes

• Fixed an issue that caused Local UI to display a Running status while pack updates were still being applied.

• Fixed an issue that caused some CoreDNS pods to enter the CrashLoopBackOff state on Edge clusters whose hosts run Ubuntu 24.04 with a Unified Kernel Image (UKI).

• Fixed an issue that caused stale User Data Protocol (UDP) sessions to appear in the conntrack table on Edge hosts that have been disconnected and reconnected from the Local Area Network (LAN) cable.

• Fixed an issue that prevented registry mapping rules from working with local registries.

• Fixed an issue that prevented Palette from applying priority classes on critical upgrade pods, leading to scheduling errors during cluster upgrades.

• Fixed an issue that caused Edge reset operations to fail on nodes whose COS_PERSISTENT partition is LUKS-encrypted.

• Fixed an issue that caused the Edge Terminal User Interface (TUI) to display the Local UI address with the http prefix instead of https.

VerteX

Features

• Includes all Palette features, improvements, breaking changes, and deprecations in this release. Refer to the Palette section for more details.

• Palette VerteX now supports deploying Azure IaaS clusters to Azure Government Secret cloud, providing flexibility for organizations that need to meet stringent security requirements. Refer to the Register and Manage Azure Cloud Account and Create and Manage Azure IaaS Cluster guides for more information.

Virtual Machine Orchestrator (VMO)

Improvements

• The KubeVirt version has been upgraded to v1.7. Other components of the VMO pack have also been upgraded, enhancing system reliability and security.

• The Virtual Machine Orchestrator (VMO) now supports the persistent EFI parameter, enhancing support for airgapped use cases. Previously, VM creation only supported Secure Boot under bootloader.efi and omitted persistent.

Bug Fixes

• Fixed an issue that caused VM migration to fail due to Missing smm: true errors on VMs with secure boot enabled.

• Fixed an issue that prevented private CA Certificate configurations from being correctly applied.

Automation

info

Check out the CLI Tools page to find the compatible version of the Palette CLI.

Features

• Terraform version 0.27.0 of the Spectro Cloud Terraform provider is now available. For more details, refer to the Terraform provider release page.
• Crossplane version 0.27.0 of the Spectro Cloud Crossplane provider is now available.

Improvements

• Palette CLI version 4.8.5 now includes the --acknowledge-banner flag on the login command, allowing CI/CD environments to skip manual banner acceptance.

• The cluster resources of the Spectro Cloud Terraform provider now support configuring additional annotations and labels, as well machine pool update strategies. Additionally, the cluster resources now support time zone configuration, ensuring that maintenance tasks like upgrades execute at the appropriate local time for the cluster.

• The spectrocloud_cluster_apache_cloudstack resource now supports template names for machine image configuration, allowing users to customize machine images for individual node pools.

• The spectrocloud_registry_oci resource now includes the wait_for_sync field, allowing you to wait for the OCI registry to complete its initial synchronization before marking the resource as created or updated. This operation is supported for Zarf and Helm registries.

Packs

Pack Notes

• The Spectro Kubernetes Dashboard pack is now supported on AWS EKS clusters.

• Kubernetes (AKS) version 1.34 now supports the configuration of pod CIDR and service ClusterIP ranges.

Pack Name	Layer	Non-FIPS	FIPS	New Version
Amazon EBS CSI	CSI	✅	❌	1.53.0
AWS Application Loadbalancer	Add-on	✅	❌	2.17.0
AWS Cluster Autoscaler	Add-on	✅	❌	1.35.0
Argo CD	CSI	✅	❌	9.1.7
Argo CD	CSI	✅	❌	9.1.6
Argo CD	CSI	✅	❌	9.1.4
Calico	CNI	✅	❌	3.31.3
Cert Manager	Add-on	✅	❌	1.19.1
Cilium	CNI	✅	❌	1.18.4
Crossplane	Add-on	✅	❌	2.1.1
External DNS	Add-on	✅	❌	0.19.0
External Secrets	Add-on	✅	❌	1.2.0
External Secrets	Add-on	✅	❌	1.1.1
Flux2	Add-on	✅	❌	2.17.2
GCE Persistent Disk CSI	CSI	✅	❌	1.22.5
Istio	Add-on	✅	❌	1.28.2
Karpenter	Add-on	✅	❌	1.8.3
Kubernetes (AKS)	Kubernetes	✅	✅	1.34
Local Path Provisioner	CSI	✅	✅	0.0.32
Reloader	Add-on	✅	❌	1.4.12
Reloader	Add-on	✅	❌	1.4.11
Nginx	Add-on	✅	❌	1.14.1
Palette eXtended Kubernetes - Edge	Kubernetes	✅	✅	1.33.6
Palette eXtended Kubernetes - Edge	Kubernetes	✅	✅	1.32.10
Palette eXtended Kubernetes - Edge	Kubernetes	✅	✅	1.31.14
Prometheus Agent	Add-on	✅	❌	27.51.0
Prometheus Operator	Add-on	✅	❌	80.4.2
Zot Registry	Add-on	✅	✅	0.1.89-rev1

Deprecations and Removals

• Cert Manager pack versions 1.1.0, 1.7.1, and 1.9.1 are now deprecated. Upgrade your workloads to use Cert Manager pack version 1.19.1 or later.
• The Spectro Kubernetes Dashboard and Kubernetes Dashboard packs are now deprecated. This is due to the archiving of upstream projects.

December 30, 2025 - Release 4.8.16

The following component updates are applicable to this release:

• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Improvements

• The process of deploying AWS EKS clusters using Cilium has been streamlined. Users no longer need to disable the kube-proxy and aws-node DaemonSets or update the charts.cilium.k8sServiceHost parameter during deployment. Refer to Create and Manage AWS EKS Cluster for the updated deployment process.

• Two subnets can now be configured for MAAS LXD workload clusters using the Kubernetes layer of your MAAS cluster profile. One subnet is designed for the preboot execution environment (PXE), which is used for the initial booting and provisioning of LXD virtual machines. The other subnet is used to configure static IP addresses for workload traffic. Refer to Create and Manage MAAS Clusters Using LXD VMs for more information.

Bug Fixes

• Fixed an issue where cluster profile updates were not applied to clusters until restarting the cluster-management-agent pod.

• Fixed an issue where CoreDNS entered a crash loop after node reboots in Rocky Linux RKE2 FIPS clusters.

• Fixed a compatibility issue between the Virtual Machine Orchestrator (VMO) and Palette eXtended Kubernetes - Edge (PXK-E) packs.

Packs

Pack Notes

• Kubernetes (EKS) pack version 1.33 is now available. Due to a known issue, if configuring Palette as your Identity Provider (IdP), you must add identityProviderConfigName: "eks-oidc" to the Kubernetes layer of your cluster profile.

  managedControlPlane:
    oidcIdentityProvider:
      identityProviderConfigName: "eks-oidc"

December 19, 2025 - Component Updates

The following components have been updated for Palette version 4.8.6 - 4.8.12.

Component	Version
Spectro Cloud Terraform provider	0.26.2
Spectro Cloud Crossplane provider	0.26.2
Palette Management Appliance	4.8.12
VerteX Management Appliance	4.8.12

Bug Fixes

• Fixed an issue that caused duplicate cluster packs errors to appear when Terraform spectrocloud_cluster_profile updates triggered API validation errors.

• Fixed an issue that caused certain Day-2 cluster operations to fail for clusters with the Terraform spectrocloud_addon_deployment resource.

Packs

Pack Notes

• Harbor pack version 1.18.1 now supports configuring HTTP access. Refer to the pack Additional Details tab for further information.

• Users can now use Ubuntu 22.04 on VMware, Azure, and MAAS clusters using the FIPS Palette eXtended Kubernetes pack version 1.33.5.

Pack Name	Layer	Non-FIPS	FIPS	New Version
Calico	CNI	❌	✅	3.31.2
Harbor	Add-on	✅	❌	1.18.1
Istio	Add-on	✅	❌	1.28.1
Kong	Add-on	✅	❌	3.0.0
Prometheus Agent	Add-on	✅	❌	27.49.0
Prometheus Operator	Add-on	✅	❌	79.11.0
Spectro Kubernetes Dashboard	Add-on	✅	❌	7.13.0
Ubuntu (Azure)	OS	❌	✅	22.04
Ubuntu (MAAS)	OS	❌	✅	22.04
Ubuntu (vSphere)	OS	❌	✅	22.04

December 17, 2025 - Release 4.8.12

The following component updates are applicable to this release:

• December 19, 2025 - Component Updates
• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Features

• Palette now supports the cluster provisioning and management of CloudStack clusters. Refer to the CloudStack section for further information. Review the active known issues that affect CloudStack on the Known Issues page.

• Terraform version 0.26.1 of the Spectro Cloud Terraform provider is now available. For more details, refer to the Terraform provider release page.

• Crossplane version 0.26.1 of the Spectro Cloud Crossplane provider is now available.

• The Spectro Cloud Terraform provider and Spectro Cloud Crossplane provider now support CloudStack.

  • The spectrocloud_cloudaccount_apache_cloudstack data source supports the creation of CloudStack cloud accounts.
  • The spectrocloud_cluster_apache_cloudstack resource supports configuration and deployment of CloudStack clusters.

Improvements

• The KubeVirt version used by the Palette Virtual Machine Orchestrator is now v1.6.2.

• The virt-v2v version used by the Palette Virtual Machine Migration Assistant is now v2.9.0.

  As part of the upgrade, the VMware Virtual Disk Development Kit (VDDK) image is now a requirement for migrations. This image was previously optional but is now necessary for the migration process. Refer to the Create Source Providers guide for more information.

• The default timeout of Local UI JWT tokens has been reduced to 15 minutes. Additionally, tokens are now revoked upon log out.

• The dependencies of the imageswap and imageswap-init Palette images were updated to the latest versions, ensuring that they have the latest security patches. Additionally, the ubuntu-systemd image has been removed from Palette.

• The performance of the /clusterprofiles Palette API endpoint has been improved.

Bug Fixes

• Fixed an issue that caused EKS clusters to fail to provision due to missing retry logic for trust policy ConfigMaps.

• Fixed an issue that caused Day-2 operations to fail on Palette Edge clusters configured with external provider registries in the Palette eXtended Kubernetes Edge (PXK-E) pack.

• Fixed an issue that caused add-on deployments provisioned through the Spectro Cloud Crossplane provider to remain in an unrecoverable, unhealthy state following a deployment error, even after fixing the root cause.

• Fixed an issue that prevented the Bring Your Own OS (BYOOS) pack from being available to CloudStack clusters.

• Fixed an issue that prevented agent mode from retaining network configurations after boot.

• Fixed an issue that caused the Virtual Machine Migration Assistant plans to fail due to PodSecurity violation errors.

• Fixed an issue that caused content bundle builds configured on encrypted partitions to become stuck.

• Fixed an issue that caused multiple versions of the spectro-reach image to be installed in Palette Management Appliance and VerteX Management Appliance.

• Fixed an issue that caused an incorrect version of the palette-agent image to be referenced by the Palette ally service.

• Fixed an issue that prevented the Delete action from correctly displaying for cluster templates in the Palette UI.

• Fixed an issue that caused Windows 25 server VMs to become inaccessible after being migrated using the Virtual Machine Migration Assistant.

• Fixed an issue that caused the CloudStack PCG type to appear under Tenant Settings even though it was disabled using a system administration feature flag.

Packs

Pack Notes

• The following packs support CloudStack deployment:
  • Ubuntu 24.04
  • Palette eXtended Kubernetes versions 1.31.14, 1.32.10, and 1.33.6
  • Calico 3.30.3-rev1
  • CloudStack CSI 2.5.0

Pack Name	Layer	Non-FIPS	FIPS	New Version
Azure Disk	Storage	✅	❌	1.33.7
External Secrets Operator	Add-on	✅	❌	1.1.0
GCE Persistent Disk CSI	Storage	✅	❌	1.22.4
Nvidia GPU Operator	Add-on	✅	❌	25.10.1
Palette eXtended Kubernetes	Kubernetes	✅	✅	1.33.6
Palette eXtended Kubernetes	Kubernetes	✅	✅	1.32.10
Palette eXtended Kubernetes	Kubernetes	✅	✅	1.31.14
Prometheus Agent	Add-on	✅	❌	27.47.0
Prometheus Operator	Add-on	✅	❌	79.8.2
Volume Snapshot Controller	Add-on	✅	❌	8.4.0
vSphere CSI	Storage	✅	✅	3.6.0

December 12, 2025 - Component Updates

The following components have been updated for Palette version 4.8.6 - 4.8.9.

Component	Version
Palette Management Appliance	4.8.10
VerteX Management Appliance	4.8.10

Review the active known issues that affect this component update on the Known Issues page.

Bug Fixes

• Fixed an issue that caused stylus to incorrectly map some image references.

December 5, 2025 - Component Updates

The following components have been updated for Palette version 4.8.6 - 4.8.9.

Improvements

• The Piraeus CSI version used in the Palette Management Appliance and VerteX Management Appliance has been upgraded to 2.10.1.

Packs

Pack Notes

• The Azure CNI pack now supports the overlay networking model using the Overlay preset.
• The Kubernetes (EKS) pack now supports the configuration of custom service CIDRs. Refer to the pack Additional Details tab for further information.
• The AWS VPC CNI (Helm) pack now supports the configuration of custom pod CIDRs. Refer to the pack Additional Details tab for further information.

Pack Name	Layer	Non-FIPS	FIPS	New Version
Amazon EFS	Add-on	✅	❌	2.1.15
AWS Application Loadbalancer	Add-on	✅	❌	2.16.0
AWS VPC CNI	Add-on	❌	✅	1.20.4
Azure Disk	CSI	✅	❌	1.33.6
Calico	CNI	✅	❌	3.31.2
Calico Network Policy	Add-on	✅	❌	3.31.2
KAI Scheduler	Add-on	✅	❌	0.10.0
KubeRay Operator	Add-on	✅	❌	1.5.1
Open Policy Agent	Add-on	✅	❌	3.21.0
Prometheus Agent	Add-on	✅	❌	27.45.0
Prometheus Operator	Add-on	✅	❌	79.5.0
Ubuntu (GCP)	OS	✅	❌	24.04
Zot Registry	Add-on	✅	✅	0.1.89

December 5, 2025 - Release 4.8.9

The following component updates are applicable to this release:

• December 5, 2025 - Component Updates
• December 12, 2025 - Component Updates
• December 19, 2025 - Component Updates
• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Bug Fixes

• Fixed an issue that caused Palette's cluster-management-agent service to continually restart on data center clusters due to a duplicate CloudStack cloud type introduced by Palette 4.8.6.

November 28, 2025 - Component Updates

The following components have been updated for Palette version 4.8.6 - 4.8.8.

Packs

Pack Name	Layer	Non-FIPS	FIPS	New Version
Amazon EFS	CSI	✅	❌	2.1.14
Argo CD	CSI	✅	❌	9.1.0
External Secrets Operator	Add-on	✅	❌	1.0.0
GCE Persistent Disk CSI	CSI	✅	❌	1.21.0
GCE Persistent Disk CSI	CSI	✅	❌	1.20.2
Istio	Add-on	✅	❌	1.28.0
Karpenter	Add-on	✅	❌	1.8.2
Nginx	Add-on	✅	❌	1.14.0
Piraeus Operator	CSI	✅	✅	2.10.1

November 26, 2025 - Release 4.8.8

The following component updates are applicable to this release:

• November 28, 2025 - Component Updates
• December 5, 2025 - Component Updates
• December 12, 2025 - Component Updates
• December 19, 2025 - Component Updates
• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Improvements

• The VerteX UI has been upgraded to use Nginx 1.29.2.

Bug Fixes

• Fixed an issue that caused errors with the internal MongoDB database when upgrading the self-hosted Palette or VerteX installation from 4.7.29 to 4.8.6.
• Fixed an issue that prevented Edge cluster events from being displayed in the Palette Events tab.
• Fixed an issue that caused VerteX 4.8.6 to fail to install due to crashing LINSTOR pods.
• Fixed an issue that caused a duplicate CloudStack cloud type to appear in the custom cloud types API endpoint after upgrading Palette to 4.8.6, resulting in API and validation conflicts.

November 22, 2025 - Release 4.8.0 - 4.8.6

The following component updates are applicable to this release:

• November 28, 2025 - Component Updates
• December 5, 2025 - Component Updates
• December 12, 2025 - Component Updates
• December 19, 2025 - Component Updates
• January 23, 2026 - Component Updates
• January 30, 2026 - Component Updates

Security Notices

• Review the Security Bulletins page for the latest security advisories.

Palette Enterprise

Breaking Changes

• When creating EKS clusters, the default Amazon Machine Image (AMI) Type is now Amazon Linux 2023 (AL2023) Standard AMI. This change aligns with the upcoming deprecation of Amazon Linux 2 (AL2) AMIs. A deprecation warning now appears for AL2 AMIs in the Amazon Machine Image (AMI) Type drop-down menu within Cloud Configuration Settings.

• System configuration API endpoints can now only be accessed using privileged authorization tokens. These API endpoints expose critical system details, so access to them is strictly enforced. Users with general access authorization tokens are no longer able to access these endpoints.

• All Palette and VerteX Clouds API endpoints now require authorization tokens for all requests. Existing integrations must be updated to provide valid authorization tokens, as unauthenticated API calls will now fail.

Features

• EKS Pod Identity is now a supported authentication method for AWS cloud accounts. This secure authentication mechanism allows Kubernetes pods to assume IAM roles with temporary, automatically refreshed credentials, eliminating the need for long-lived AWS credentials.

  This method is only available for self-hosted Palette and Palette VerteX instances deployed on Amazon EKS clusters. Refer to the Add AWS Accounts guide for more information.

• Cluster profile variables now support the multiline input type and the Base64 format. This improvement allows users to leverage cluster profile variables for use cases such as saving multiline YAML specifications and storing encoded keys for use during cluster creation.

Improvements

• Project tags are now displayed in the Project Overview page and the Tenant Admin > Projects page in Palette. This improvement allows users to identify projects based on their tags. Refer to the Project Tags section for more information.

• Palette now provides the ability to upgrade the vCluster version of your virtual clusters, allowing you to leverage newly introduced features without having to create new cluster groups or migrate workloads. Refer to the Upgrade Cluster Groups guide for further information.

• Palette has now implemented a mechanism for evacuating and migrating the control planes for MAAS clusters using LXD VMs, reducing high-availability risks during host repaves. This improvement is critical for Day-2 lifecycle operations such as upgrades or repaves.

• The Palette Management Appliance and VerteX Management Appliance now include the latest Terminal User Interface (TUI). For more details, refer to Initial Edge Host Configuration with Palette TUI.

• Certificate renewal for clusters provisioned using Palette Optimized K3S and RKE2 can now be triggered externally from Kubernetes. This is applicable for both Edge and public cloud clusters.

Bug Fixes

• Fixed an issue that caused Palette Management Appliance and VerteX Management Appliance to sometimes create an inconsistent number of LINSTOR resources.

• Fixed an issue that caused some self-hosted Palette and VerteX installations to fail to due to a Helm template rendering error.

• Fixed an issue that caused Palette UI errors related to YAML marshalling when accepting cluster profile updates for cluster profiles configured using the Spectro Proxy pack.

• Fixed an issue that prevented ipclaim resources from being deleted when repaving VMware clusters.

• Fixed an issue that prevented the Palette UI from displaying metrics for EKS clusters due to incorrect security group rules.

• Fixed an issue that prevented rotated IAM keys in AWS cloud accounts from being updated on deployed AWS clusters.

Edge

info

The CanvOS version corresponding to the 4.8.6 Palette release is 4.8.1.

Improvements

• The Terminal User Interface (TUI) is now always enabled and features a new landing page that displays system information. It also adds support for configuring Virtual Local Area Networks (VLANs). The stylus.includeTui flag in user-data has been deprecated as a result of these changes. For more details, refer to Initial Edge Host Configuration with Palette TUI.

• CanvOS now provides support for FIPS-compiled Ubuntu 22.04. This is important for users who want to enforce FIPS 140-3 compliance.

Bug Fixes

• Fixed an issue that caused pack reconciliation to fail in locally managed Edge clusters provisioned with cluster profiles containing duplicate packs.

VerteX

Features

• Includes all Palette features, improvements, breaking changes, and deprecations in this release. Refer to the Palette section for more details.

Automation

info

Check out the CLI Tools page to find the compatible version of the Palette CLI.

Features

• Terraform version 0.26.0 of the Spectro Cloud Terraform provider is now available. For more details, refer to the Terraform provider release page.

• Crossplane version 0.26.0 of the Spectro Cloud Crossplane provider is now available.

• The Spectro Cloud Terraform provider now supports cluster templates.

  • The spectrocloud_cluster_config_policy data source implements maintenance policies.
  • The spectrocloud_cluster_config_template data source implements cluster templates.
  • Cluster resources now have the cluster_template field to support the configuration of cluster templates.

• The spectrocloud_cloudaccount_aws Terraform resource now supports EKS Pod Identities.

Bug Fixes

• Fixed an issue that caused the spectrocloud_cluster_group Terraform resource to fail to save cluster state when a Loadbalancer was configured.

Docs and Education

• The new Find Breaking Changes for Palette Upgrades page contains an interactive component that allows users to list breaking changes between two Palette releases. Use it as guidance for upgrading dedicated SaaS or self-hosted Palette and Palette VerteX installations.

Packs

Deprecations and Removals

• The Nginx pack is now deprecated. Use the Kgateway pack as an alternative. Refer to the Ingress NGINX Retirement: What You Need to Know blog for further information.

Pack Notes

• The Spectro RBAC pack version 1.0.1 now supports CPU, memory, and storage resource quota specifications.

Pack Name	Layer	Non-FIPS	FIPS	New Version
Amazon EBS CSI	CSI	✅	❌	1.51.0
Calico	CNI	❌	✅	3.31.0
Crossplane	Add-on	✅	❌	2.0.1
External Secrets Operator	Add-on	✅	❌	0.20.4
Flux2	Add-on	✅	❌	2.17.1
Kgateway	Add-on	✅	❌	2.2.1
Prometheus Agent	Add-on	✅	❌	27.42.1
Prometheus - Grafana	Add-on	✅	❌	79.0.1
Reloader	Add-on	✅	❌	1.4.10
Spectro RBAC	Add-on	✅	❌	1.0.1
Ubuntu (Azure)	OS	✅	❌	24.04
Ubuntu (vSphere)	OS	✅	❌	24.04