|Index|Introduction to SUSE AI Factory|Release notes
Applies to SUSE AI Factory

A Release notes

 

A1 Release 2.2.0

 

This release builds on the 2.1.x line with enhanced support for air-gapped deployments, recovery operations for blueprint workloads, an NVIDIA AI Enterprise application catalog that is generated and refreshed automatically, and a range of reliability fixes in the operator’s Helm lifecycle.

A1.1 What’s new

 

A1.1.1 Application catalog

 

  • Generated NVIDIA AI Enterprise catalog: The NVIDIA AI Library is generated from the NVIDIA GPU Cloud (NGC) catalog and gated on NVIDIA AI Enterprise support, replacing the previously hand-maintained label refresh #223.

  • Automated catalog refresh: A scheduled job regenerates the catalog weekly, so the Supported labels on NVIDIA applications stay current between releases #232.

  • NGC repository classification: NGC repository paths are classified as organization, public, gated or excluded. Gated repositories are provisioned with the authentication secret, and unrecognized paths fall back to anonymous access #223.

  • NGC image pull secret injection: NVIDIA charts receive the ngc-secret image pull secret under both supported chart value conventions, which resolves 403 errors caused by an empty default suppressing the injection #223.

  • Catalog scoped to managed repositories: The Apps page lists applications only from ClusterRepo resources that SUSE AI Factory created. Previously, an unrelated ClusterRepo could add applications to the SUSE AI or NVIDIA libraries #182.

A1.1.2 Air-gapped deployments

 

  • Private chart and Git sources: Blueprints reference a chart repository by its identity, while the registry endpoints in Settings determine where that repository is hosted. The same blueprints therefore deploy unchanged against a local mirror. Private HTTPS Git is supported for both blueprint input and GitOps output #224.

  • Private CA certificate propagation: You can select a CA certificate secret for SUSE Application Collection, SUSE Registry and NVIDIA in Settings. The operator propagates it to Rancher Prime and Fleet, and handles CA certificate and credential rotation #200.

  • NVIDIA blueprint repository in mirrored mode: Both the NVIDIA application and NVIDIA blueprint repository identities are preserved when mirrored and pointed at your private OCI URL, so NVIDIA blueprints continue to resolve #201.

  • Image registry override: A single global.imageRegistry value redirects every image shipped by the operator and UI extension charts #209.

A1.1.3 Workload recovery

 

  • Upgrade, roll back and retry: Blueprint workloads can be upgraded to a new blueprint version, rolled back, or retried after a failed deployment directly from the UI. Application workloads do not support these operations #214.

  • Verified rollback target: A blueprint version becomes a rollback target only after it has been fully rolled out across all target clusters, so a workload cannot be rolled back to a version that never reached a healthy state #214.

  • Per-component and per-pod status: Workloads report their status for each component and pod, including while a deployment is failing, which makes it easier to identify the component that is blocking the rollout #214.

A1.1.4 Usability improvements

 

  • Open workloads in Rancher Prime: Each workload row provides an Open in Rancher action that opens the corresponding Helm release or namespace, with a cluster selector for multi-cluster workloads #206.

  • Library filter is preserved: Cancelling an application installation returns you to the library you were browsing, and filtered catalog views can be bookmarked and shared #215.

  • Catalog metadata for the UI extension: The extension is listed as SUSE AI Factory with the correct metadata in the Rancher Prime Apps and Marketplace views #230.

  • Clearer confirmation dialogs: The upgrade and rollback confirmation dialogs explain the effect of the operation #229.

A1.1.5 Packaging

 

  • CRD lifecycle: CRDs are installed natively on first installation, and a hook job applies schema upgrades. The new crds.rbac.create and crds.serviceAccountName values support restricted environments where the installer cannot create cluster-scoped RBAC #202.

  • Per-component Helm release names: Blueprint components accept an optional releaseName value that pins the Helm release name of a component. It defaults to the chart name #202.

  • UI extension installed by the operator: The operator installs the UI extension itself, so aif-ui is no longer installed as a separate Helm chart #233.

A1.2 Key fixes

 

  • Restarting the operator no longer leaves the UI extension’s Helm release in a failed state without recovering #199.

  • The UI extension no longer remains on an incorrect version after consecutive upgrades and downgrades #177.

  • Deleting an application workload now uninstalls the underlying Helm chart instead of leaving the release in the Uninstalling state with orphaned resources #193.

  • The operator no longer downloads the UI extension chart on every reconcile, which previously caused continuous registry traffic and could exhaust public registry rate limits #185.

  • Attaching image pull secrets no longer removes other service account fields, such as labels, annotations, owner references and finalizers #192.

  • Several user interface strings and tooltips that previously displayed raw translation keys now render correctly #211.

  • Long Helm release names no longer prevent the UI extension from installing. The generated service name could exceed the Kubernetes 63-character limit and be rejected #210.

A1.3 Upgrade notes

 

  • CRDs are retained on uninstall: helm uninstall no longer removes CRDs or the Settings resource. Bundled blueprints and the UI extension are still removed. Schema upgrades are applied by a pre-install and pre-upgrade hook job #202.

  • Mirror the kubectl image for air-gapped installations, because the CRD hook job requires it. Alternatively, set crds.manageWithJob=false and apply the CRDs manually with kubectl apply --server-side -f crds/ before each upgrade #202.

  • The UI extension is no longer installed separately: If your automation installs the aif-ui chart as a separate step, remove that step and the aiExtension.enabled: false override #233.

  • Deleting workloads outside the UI requires a Rancher Prime token: Deleting an AIWorkload resource with kubectl or through GitOps only uninstalls the chart when a token is configured in Settings > Rancher API Access. Without a token, the deletion is held rather than orphaning the Helm release #193.

  • Manually created chart repositories are ignored: Only ClusterRepo resources created by SUSE AI Factory contribute to the application catalog #182.

  • Git authentication requires a user name: The authentication type setting is deprecated. Existing configurations continue to work, but new configurations must specify a Git user name. SSH is not supported #224.

  • Unused settings were removed: The SUSE Application Collection API endpoint, catalog discovery and image rewrite settings, and the Advanced section of Settings were removed #224.

  • New workload validation: Review existing AIWorkload resources before upgrading. The deployment strategy is now immutable, blueprint workloads require at least one target cluster, and GitOps workloads cannot combine the local cluster with downstream clusters #214.

  • Image overrides for air-gapped installations: The global.imageRegistry and global.imagePullSecrets values of the aif-operator chart are now forwarded to the managed aif-ui chart. Existing nested overrides take precedence #209.

A1.4 Known issues and limitations

 

  • Air-gap support covers private chart repositories, private Git repositories, repository credentials and CA trust. Preparing the cluster remains a separate task: node and containerd registry mirrors, DNS, host proxies and operating system repositories are not configured by SUSE AI Factory.

  • Container image references inside blueprint values are not rewritten. Your containerd registry mirrors must resolve them transparently.

  • Git over SSH is not supported. Use HTTPS with credentials and, where required, a private CA certificate.

  • Upgrade, rollback and retry apply to blueprint workloads only. A workload that has never reached a healthy, fully rolled out state has no rollback target.

Full Changelog: aif-operator-2.1.0…​aif-operator-2.2.0

A2 Release 2.1.0

 

This release builds on the 2.0.x line with an operator-served application catalog that is now the default, git-backed Rancher Prime catalog support, expanded NVIDIA integration, hardened extension chart delivery, and a range of workload/UI reliability fixes.

A2.1 What’s new

 

A2.1.1 Application catalog

 

  • Operator-served catalog, now the default: The operator serves the application catalog through a static catalog configuration and a CRD lifecycle job, and the UI now loads applications from this bundled catalog by default (useStaticCatalog=true). Runtime discovery from live chart repositories remains available by setting the flag to false #145, #172.

  • NVIDIA AI Enterprise library: The NVIDIA AI Library is populated with NVIDIA AI Enterprise-supported Helm charts, and the default catalog ships the org-level NVIDIA repositories out of the box #155, #172.

  • Application sorting and support labels: The Apps page sorts supported applications first (default) or by name, shows NVIDIA support status through labels, and defaults the library filter to all libraries. The sort control is shared across the Apps, Blueprints, and Workloads screens #155, #172.

  • NGC team repositories: The operator supports NVIDIA NGC team repositories with gated authentication. The default catalog currently ships only the org-level NVIDIA repositories, so team-repository provisioning is dormant until the catalog expands #163.

A2.1.2 Git-backed Rancher Prime catalogs and Rancher Prime API access

 

  • Git-backed ClusterRepo support: Blueprint components and application workloads can now be deployed from git-backed Rancher Prime ClusterRepo resources (spec.gitRepo/spec.gitBranch), including the built-in rancher-charts and rancher-ui-plugins repositories, which previously failed. The operator fetches the chart from the Rancher Prime catalog API on the management cluster and ships it as an embedded Fleet Bundle, so air-gapped downstream clusters deploy without each cluster needing to reach Rancher Prime or hold an API token. Identical reconciles are skipped through a chart fingerprint #156.

  • {*ranchera} API access settings*: A new Settings > Rancher API Access section manages the Rancher Prime catalog credential end to end. Selecting Authorize mints a Rancher Prime API token as the signed-in user, Test validates a token before saving, and the section shows the granted expiry and warns before it lapses. When the token expires, select Authorize again to renew it. The Rancher Prime CA certificate is discovered automatically when none is configured, so TLS verification stays enabled by default. The configuration is hot-reloaded without an operator restart #156.

  • Oversized git charts fail fast: Charts whose unpacked Fleet Bundle would exceed the Kubernetes object-size limit fail terminally with ChartTooLarge and guidance to host them in an OCI or HTTP ClusterRepo instead, rather than retrying indefinitely #156.

A2.1.3 Extension delivery and security

 

  • Authenticated and TLS registries: InstallAIExtension can pull the UI extension chart from authenticated and TLS-enabled registries. The aif-operator Helm chart exposes the corresponding Helm authentication and TLS settings for the bundled extension #162.

  • Registry hardening: A registry-host allowlist guards against confused-deputy requests (with a startup warning when the allowlist is empty), insecure registry TLS is gated behind two explicit opt-ins, plain-HTTP OCI chart pulls are no longer performed, and https+tls chart URLs that are not a direct .tgz are rejected. Terminal reconcile failures now correctly set Ready=False #162.

A2.1.4 Workload and blueprint management

 

  • Pre-flight credential checks: Blueprint credentials are validated before installation, so missing credentials are reported up front instead of surfacing as a failed deployment #148.

  • Clearer failure reporting: Workload failure reasons are shown on the AI Workloads list, and ClusterRepo resolution failures are surfaced on the AIWorkload status #148.

  • Protected bundled blueprints: Deletion of bundled blueprints is rejected by the API, and the delete action is hidden for them in the UI #122.

  • Updated blueprint: The simple-chatbot-with-rag blueprint is updated to version 1.0.2. The default model changes from gemma:2b to qwen2.5:3b (larger context window); qwen2.5:3b is provided for research use only under the Qwen Research License #154.

A2.2 Key fixes

 

  • Rancher Prime and operator index caches are refreshed when the extension version changes, self-healing a stale index cache after an extension upgrade #152.

  • InstallAIExtension status is patched to avoid resourceVersion conflicts #140.

  • The family label is preserved when saving an edited blueprint as a new version #139.

  • Pull-secret namespaces are no longer created on the management cluster for downstream-only workloads #130.

  • The UI clarifies that the blueprint installation namespace is only a default #141.

  • Deployment type cards are aligned to equal height #129.

A2.3 Upgrade notes

 

  • CRD lifecycle on upgrade: The operator chart applies and upgrades its custom resource definitions (CRDs) through a pre-upgrade job (crds.manageWithJob=true), which only creates or updates CRDs and never deletes them. In restricted environments where the job cannot run, set crds.manageWithJob=false and apply the CRDs from the chart’s crds/ directory manually before upgrading #145.

  • Git-backed catalogs require a Rancher Prime token: To deploy from git-backed ClusterRepo resources, authorize a Rancher Prime API token under Settings > Rancher API Access after upgrading. Charts too large to ship as a Fleet Bundle fail with ChartTooLarge; host those in an OCI or HTTP ClusterRepo instead #156.

  • Chatbot default model change: After upgrading simple-chatbot-with-rag to 1.0.2, new chats default to qwen2.5:3b (gemma:2b is removed); existing chats remain readable #154.

Full Changelog: aif-operator-2.0.1…​aif-operator-2.1.0

A3 Release 2.0.1

 

This is the 2.0.1 release of SUSE AI Factory, bringing comprehensive AI workload management capabilities to Rancher Prime.

A3.1 Key improvements and fixes

 

  • Fixed pull secrets not being delivered to certain downstream clusters, which left workloads stuck in ImagePullBackOff. The pull-secret bundle now targets the downstream cluster by the management.cattle.io/cluster-name label instead of clusterName #107.

  • Published simple-chatbot-with-rag and simple-chatbot-with-rag-vllm 1.0.1 with updated image revisions (#132):

    • open-webui: 0.6.41-14.20 to 0.6.41-15.2

    • vllm-openai: 0.19.0 to 0.19.0-5.29

  • Reduced resource requests for the Phi-3-mini-4k-instruct model.

  • Marked the 1.0.0 simple-chatbot-with-rag, simple-chatbot-with-rag-vllm, and suse-inference-endpoint blueprints as deprecated as their 1.0.0 have blocking issues.

Full Changelog: aif-operator-2.0.0…​aif-operator-2.0.1

A4 Release 2.0.0

 

This is the first official release of SUSE AI Factory, bringing comprehensive AI workload management capabilities to Rancher Prime.

SUSE AI Factory is a Rancher Prime UI Extension for managing AI workloads and applications across Kubernetes clusters. This extension provides a unified interface for installing, managing and monitoring AI applications in Rancher Prime-managed clusters.

Note
Note

This extension requires an active SUSE AI Factory subscription to access the application catalog.

A4.1 What’s new

 

A4.1.1 Core features

 
A4.1.1.1 AI workload management
 

  • Multi-cluster AI workload deployment: Deploy and manage AI applications across multiple Rancher Prime-managed Kubernetes clusters from a single interface

  • Blueprint-based application templates: Preconfigured application blueprints for common AI use cases:

    • Simple Chatbot with RAG (Retrieval-Augmented Generation)

    • Simple Chatbot with RAG using vLLM

    • NVIDIA RAG Minimal deployment

    • SUSE Inference Endpoint

  • Declarative workload definition: Kubernetes-native Custom Resource Definitions (CRDs) for AI workloads, blueprints, and settings

  • GitOps integration: Fleet-based GitOps workflow support for managing AI workload configurations

A4.1.1.2 User interface
 

  • Unified dashboard: Overview page with at-a-glance statistics and recent activity

  • Application catalog: Browse and install AI applications from SUSE AI Factory and NVIDIA AI Library

  • Multi-step installation wizard: Guided workflows for deploying applications and blueprints

  • Application instance management: Monitor and manage deployed AI workloads and their metrics

  • Blueprint management: Create, edit, and manage custom blueprints

  • Settings management: Helm and Git repositories configuration

A4.1.1.3 Operator and backend
 

  • SUSE AI operator: Kubernetes operator managing the lifecycle of AI extensions and workloads

  • Custom resource definitions:

    • AIWorkload: Defines AI application instances

    • Blueprint: Defines reusable application templates

    • InstallAIExtension: Manages UI extension installation

    • Settings: Centralized configuration management

  • Multiple deployment strategies: Helm for simple deployments to local clusters, Fleet integration for GitOps for downstream and multi-cluster deployments

  • Multi-vendor support: Seamless integration with both SUSE and NVIDIA AI components

  • Credential management: Automatic injection of registry credentials and pull secrets

A4.1.1.4 Integration and connectivity
 

  • SUSE application collection integration: Access to curated AI application catalog

  • NVIDIA NGC integration: Direct access to NVIDIA AI applications and models

  • Fleet integration: GitOps-based deployment workflows

  • Multi-cluster support: Deploy to local and downstream Rancher Prime clusters

A4.2 Known issues and behaviors

 

A4.2.1 Installation and deployment

 

  • Fleet must be installed before deploying the AIF operator, the installation of the AIF operator may fail.

  • Standalone UI extension installation through Rancher Prime Extensions interface is not supported. Use the AIF operator default values to install it.

  • Images are distributed via GitHub Container Registry (ghcr.io). In the following releases, images will be distributed via the SUSE Registry.

A4.2.2 NVIDIA blueprints

 

  • RAG v2.5.1+: rag-server image version 2.5.1 does not exist in the registry. See #618.

  • RAG v2.5.0+: nv-ingest deployment renders duplicate OTEL_EXPORTER_OTLP_ENDPOINT environment variable, causing Fleet/ArgoCD deployments to fail. See #687.

  • RAG v2.6.0: NIM embedding and reranking charts do not pass model.profiles to NIMCache, causing all profiles (~11) to download instead of the selected one. See #681.

  • RAG v2.5.1+: Service names use hardcoded nvidia-blueprint-rag prefix and ignore nameOverride/fullnameOverride values. See #662.

  • RAG v2.6.0: Critical - NIMs cannot be deployed in air-gapped environments; chart missing spec.storage.pvc.name field to use existing PVC. See #693.

  • AIQ v2.1.0: Chart hardcodes ns-aiq namespace, ignoring release namespace; incompatible with Fleet/ArgoCD. See #290.

  • AIQ v2.1.0+: Local inference configuration requires manual ConfigMap creation; not documented or exposed via Helm values. See #302.

A4.2.3 NVIDIA AI Library

 

  • Not all NVIDIA Helm charts in the catalog are NVIDIA AI Enterprise supported; verify support status at the NGC Helm catalog.

A4.2.4 Blueprint customization

 

  • Bundled blueprints cannot be modified directly during the deployment. Users must create a copy to customize configuration or component versions.

A4.2.5 Deprecations

 

SUSE AI Deployer and SUSE AI Lifecycle Manager are now superseded by SUSE AI Factory. Update as soon as possible.