Skip to main content

Release 1.1.1: Helm and Service Account Fixes

Erik Lutz
Erik Lutz
Kevin Kantesaria
Kevin Kantesaria
Sri Aradhyula
Sri Aradhyula

Highlights​

CAIPE 1.1.1 corrects the Helm security defaults that stopped Milvus and Keycloak initialization jobs from starting after the 1.1.0 upgrade. It also makes large service-account datasource grants easier to manage.

What's New​

  • Collection-based datasource grants — Administrators can select a collection and add its member datasources directly to a service account (#2744).
  • Large service accounts — Service-account creation now batches large scope selections instead of rejecting them at the request limit (#2751).

Bug Fixes​

  • Helm workloads: the stock Milvus containers and Keycloak initialization jobs start with image-compatible identities while keeping the security settings those images support (#2749).
  • Deployment guide: Helm and EKS examples use the current chart registry and version, include the required secret wiring, and document the MongoDB connection used by the bundled deployment (#2747).

Security​

  • Dependency updates clear the reported npm audit findings and update the RAG ingestor's content scanner (#2742).

Breaking Changes​

No breaking changes. Deployments already on 1.1.0 can upgrade without changing Helm values.

Known Issues​

The extraDeploy list removed in 1.1.0 is not restored in this release. Custom resources must use extraDeployMap.

Upgrade Guide: 1.1.0 → 1.1.1​

Overview​

This is a drop-in patch for deployments already on 1.1.0. No existing values keys are removed or renamed, and the corrected Milvus and Keycloak defaults require no manual changes.

Helm Values Changes​

Key1.1.0 default1.1.1 defaultReason
rag-stack.milvus.securityContextforced UID/GID 1000{}The stock image can only start as root.
rag-stack.milvus.containerSecurityContextforced UID/GID 1000UID-independent hardeningKeep capability, privilege-escalation, and seccomp controls without blocking startup.
keycloak.jobPodSecurityContextnon-root without a numeric identityUID/GID 65532Let Kubernetes verify the image's nonroot account.
keycloak.jobSecurityContextnon-root without a numeric identityUID/GID 65532Start all Keycloak initialization jobs with the image's numeric identity.

Upgrade Runbook​

1. Update the chart​

helm upgrade ai-platform-engineering \
  oci://ghcr.io/caipe-io/charts/ai-platform-engineering \
  --version 1.1.1 \
  -f your-values.yaml

2. Verify Milvus and Keycloak​

kubectl get pods -n <namespace>
kubectl get jobs -n <namespace>
kubectl get events -n <namespace> --sort-by=.lastTimestamp

Confirm that the Milvus pods are running and the Keycloak initialization jobs complete.

Personal Impact Analysis​

No values.yaml was supplied for a deployment-specific comparison. Deployments using the 1.1.0 defaults need no values changes. Keep intentional Milvus or Keycloak security context overrides only if they are compatible with the deployed images.