odh-v3.5

What's Changed

• feat(webhook): migrate ConnectionsAPI injection to odh-model-controller (#827) by @pierDipi in #849
• fix(release): add go build smoke test after kserve dep update by @jlost in #850
• chore: remove kserve and vllm version by @zdtsw in #855
• feat(webhook): migrate HardwareProfile injection to odh-model-controller by @israel-hdez in #851
• feat(server): add GET /api/v1/llm-d/samples endpoint for LLMInferenceServiceConfig templates by @pierDipi in #852
• [RHOAIENG-68180] Add kustomize overlays for fast-1 and fast-2 vLLM ServingRuntime templates by @jira-autofix[bot] in #837
• Sync incubating to main by @pierDipi in #857
• fix: update endpoint in docs by @pierDipi in #858
• ci: protect against skills/context poisoning by @bartoszmajsak in #823
• feat : Add AutoGluon ServingRuntime template for tabular and time series models by @Snomaan6846 in #844
• Merge incubating to main by @github-actions[bot] in #866
• Add disconnected readiness workflow by @odh-drs-automation-bot[bot] in #865
• RHOAIENG-75487: add fast-version annotation to fast-1 and fast-2 by @pierDipi in #867
• Create Gateway PodMonitor to scrape Istio/Envoy inference metrics by @pierDipi in #871
• fix: correct JSON field path for HardwareProfile scheduling spec lookup by @israel-hdez in #875
• feat: add MLServer NVIDIA GPU (CUDA) ServingRuntime template by @Snomaan6846 in #873
• Merge incubating to main by @github-actions[bot] in #877
• build: derive envtest K8s version from go.mod instead of hardcoding by @bartoszmajsak in #879
• feat(llmisvc): warn on auth posture mismatch across routing group members by @bartoszmajsak in #880
• feat: add publisher-path authorization rules and cross-tenant deny to gateway AuthPolicy by @bartoszmajsak in #881
• RHOAIENG-76656: Update vLLM version from v0.21.0 to v0.24.0 in runtime templates by @Deepali1999 in #885
• fix: extend deny-misrouted rule to cover /v1/ paths besides batch by @bartoszmajsak in #884
• [RHOAIENG-69082] Add xKS webhook-only mode for OMC by @mholder6 in #872
• [RHOAIENG-63480] Add canary traffic splitting via Route alternateBackends by @maskarb in #860
• fix(webhook): reject InferenceService with connection Secret missing connection-type-protocol by @israel-hdez in #878
• Merge incubating to main by @github-actions[bot] in #889
• [RHOAIENG-76473] Fix e2e-kserve-ocp post-KServe CI failures by @mholder6 in #874
• feat: add sync-branches workflow and align tekton pipelines for incubating by @pierDipi in #876
• Sync incubating to main by @github-actions[bot] in #891

New Contributors

• @odh-drs-automation-bot[bot] made their first contribution in #865
• @Deepali1999 made their first contribution in #885

Full Changelog: odh-v3.5-EA2...odh-v3.5

What's Changed

• Bump model-registry to v0.1.1 by @lampajr in #165
• [Feature] Integrated OpenDataHub Centralized Custom Certificate by @Jooho in #166
• [Fix] for integration ca cert, role change needed by @Jooho in #168
• update a logic to find data connection list by @Jooho in #167
• support no reconciliation for rawdeployments by @VedantMahabaleshwarkar in #164
• Update kubebuilder to update role.yaml by @Jooho in #173
• Disable starting of monitoring reconciler by @VedantMahabaleshwarkar in #162
• [RHOAIENG-4191] - odh-model-controller should tolerate missing Authorino by @spolti in #177
• Remove GOARCH from the go build by @mkumatag in #182
• Prevent creation of KSVC if its namespace is not in the Mesh by @israel-hdez in #181
• fix(test): pins k8s env test to concrete version by @bartoszmajsak in #184
• feat: dynamically include authorino label selector by @aslakknutsen in #178
• chore(reconciler): refactors Reconciler to simplify handling dependent resources by @bartoszmajsak in #185
• [RHOAIENG-5125] - Wrong err assignment at controller utils VerifyIfCo… by @spolti in #187
• feat(authz): soft opt-in for authz capability by @bartoszmajsak in #183
• [RHOAIENG-5305] - golang.org/x/net Allocation of Resources Without Li… by @spolti in #190
• [RHOAIENG-5299] github.com/containerd/containerd Container Breakout (… by @spolti in #194
• Fix Authorization capability detection for manual setups by @israel-hdez in #198
• Create Workflow for release and tag with Changelog by @rpancham in #201
• Modify Regular Expression for the support of tag suffix with latest/fast by @rpancham in #202
• [RHOAIENG-6877] - odh-model-controller breaks Knative if KServe-Serve… by @spolti in #203
• Refactor kserve metrics solution to work with prometheus annotations by @spolti in #200
• [RHOAIENG-7299] - Infinite loop in JSON unmarshaling in google.golang… by @spolti in #205
• Add runtime templates by @heyselbi in #189
• Auth race condition mitigation by @israel-hdez in #213
• bug: Webhook is blocked by networkpolicy by @Jooho in #214
• Upgrade kserve version to v0.12.1 in odh-model-controller by @vaibhavjainwiz in #210
• [RHOAIENG-7484] - make container builder configurable for odh-control… by @spolti in #207
• Use ServiceMeshMember resources to enroll namespaces to the service mesh by @israel-hdez in #219
• Fix performance issues in odh model controller by @vaibhavjainwiz in #217
• Adding JSON files for Prometheus queries for Runtimes. by @KillianGolds in #209
• Add Caikit Standalone template by @christinaexyou in #218
• fix vllm template by @dtrifiro in #222
• Kserve Dashboard Reconciler by @ashley-o0o in #220
• runtime templates: set vllm tag to fast by @dtrifiro in #227
• Feature: Create cert Secret and update KServe local gateway by @Jooho in #221
• Internal hostname gateway follow up by @Jooho in #229
• add a new gitaction to verify odh-model-controller image tag per branch by @Jooho in #235
• Remove configmap filter and watch by @VedantMahabaleshwarkar in #240
• add watch object 'configMap' for metrics dashboard configmap by @Jooho in #243
• update namespace of webhook to be set dynamically by @Jooho in #237
• add sanity check on regex match results while determining runtime image by @VedantMahabaleshwarkar in #245
• Update ENVTEST_K8S_VERSION for s390x by @satyamg1620 in #247
• Updated kustomize labels to kustomize v5 syntax by @KillianGolds in #253
• [RHOAIENG-9411] - Update odh-model-controller's istio dependencies to 1.21 by @mholder6 in #242
• Use a more fine-grained SAR for Authorino by @israel-hdez in #255
• [RHOAIENG-11527] - [backend] Incorrect values for number of requests … by @spolti in #256
• Ensure functions use inherited context by @lburgazzoli in #251
• RHOAIENG-1044: Update hardcoded constants as environment variables by @mholder6 in #254
• runtimes: remove distributed executor backend option from vllm by @dtrifiro in #257
• [RHOAIENG-9746] - Missing log entry in StorageConfig controller of od… by @spolti in #263
• [RHOAIENG-12726] - odh-model-controller crashes with empty isvc.model field by @spolti in #264
• Multi-arch Build support by @Nash-123 in #262
• [RHOAIENG-7034] Updated manifests to have 1 replica of odh-model-controller pods by @mholder6 in #268
• Add 2.14(2024.3) image of ovms by @rpancham in #272
• [RHOAIENG-14595] Updated the OWNERS file by @mholder6 in #275
• [RHOAIENG-14595] Updated the OWNERS - alphabetical by @mholder6 in #277
• [RHOAIENG-15179] remove wrong fields in manifests by @Jooho in #282
• [RHOAIENG-15188] Error with Kustomize: Webhook Client Namespace Failing to Update by @Jooho in #283
• Create API for NIM enablement by @xieshenzh in #281
• Add runtime template of vLLM ROCM by @vaibhavjainwiz in #280
• Add runtime template of vLLM ROCM by @vaibhavjainwiz in #287
• [RHOAIENG-15386] add a new servingruntime vllm-multinode-template by @Jooho in #284
• Add runtime template of vLLM Gaudi by @vaibhavjainwiz in #290
• Add runtime template of vLLM Gaudi by @vaibhavjainwiz in #285
• Fix ServingRuntime args by @Jooho in #291
• [Cherry-Pick] vLLM multi-node template by @Jooho in #292
• [RHOAIENG-15763] Enhance probe to support rollingUpgrade by @Jooho in #293
• [Cherry-Pick] Enhance probe to support rollingUpgrade (#293) by @Jooho in #294
• Create webhook for NIM enablement by @xieshenzh in #288
• [RHOAIENG-15763] Enhance template not to use query for checking model health by @Jooho in #295
• [Cherry-pick] enhance template not to use query for checking model health by @Jooho in #296
• Task/NVPE-10: Create NIM Account controller by @TomerFi in #289
• fix typo by @Jooho in #297
• [cherry-pick] fix typo by @Jooho in #298
• fix: nim configmap name by @TomerFi in #301
• [RHOAIENG-15207] Removed the $(mesh_namespace) variable from manifests by @mholder6 in #300
• fix: template serving runtime for nim missing gvk and has wrong pull secret name by @TomerFi in #303
• Update caikit-tgis and ovms stable image by @rpancham in #299
• fix: fetching gvk from scheme requires error handling by @TomerFi in #305
• Pin vLLM images for Gaudi and ROCM by @israel-hdez in #304
• fix: dashboard require an existing array of supported models in the s… by @TomerFi in #306
• Sync main -> release-0.12.0: Preparing ODH release by @israel-hdez in #302
• update global ca bundle logic and storage-config logic by @Jooho in #308
• [Cherry-Pick] update global ca bundle logic and storage-config logic by @Jooho in #309
• [RHOAIENG-16263]Disable dashboard and fix servingruntime display name by @Jooho in #318
• [Cherry-Pick] disable dashboard and fix servingruntime display name by @Jooho in #319
• Use the main branch to build stable image tags, incubating for latest… by @hdefazio in #316
• [RHOAIENG-13638] - Do not allow isvc creation in protected isvc by @spolti in #311
• small changes on git action by @Jooho in #322
• [Cherry-Pick] update gitaction based on branch strategy change (#322) by @Jooho in #323
• Use the stable image tags on the main branch by @hdefazio in #315
• feat: added performance metric grpahs config for nvidia nim by @TomerFi in #320
• Add NIM flag logic by @trujillm in #312
• Grab the old release tag based on creation date by @hdefazio in #327
• Updated the checkout code command by @mholder6 in #328
• Updated the checkout code command by @mholder6 in #329
• Add reconciliation for Kserve Raw by @VedantMahabaleshwarkar in #274
• chore: added pagination support for nim catalog response by @TomerFi in #332
• feat(mr): enable by default model registry inferenceservice reconcile by @Al-Pragliola in #326
• Add metadata with upstream release versions by @heyselbi in #333
• Add upstream community release version metadata by @heyselbi in #338
• Migration to kubebuilder v4 by @israel-hdez in #324
• chore: use naming convention for resources created by nim by @TomerFi in #340
• chore: set nim runtime api call page size to 1000 by @TomerFi in #344
• Nim enablement change default to managed and add clean up job by @trujillm in #342
• chore: added new graph object for nim runtimes by @TomerFi in #334
• Update ovms to current build by @RH-steve-grubb in #343
• Automatically inject expected ODH annotations to InferenceGraph and InferenceServices by @israel-hdez in #339
• Authorization for InferenceGraph (Serverless) by @israel-hdez in #345
• [RHOAIENG-10293] add metrics resources for rawdeployment by @VedantMahabaleshwarkar in #347
• [RHOAIENG-16851] rawdeployment route bug fixes by @VedantMahabaleshwarkar in #341
• fix null pointer error (RHOAIENG-18228) by @Jooho in #349
• 20250116-Main sync from incubating by @Jooho in #350
• Revert "20250116-Main sync from incubating" by @Jooho in #351
• 20250117-Main sync from incubating by @Jooho in #353
• Fix CVE-2024-45338 by @Jooho in #354
• [Cherry-Pick] Fix CVE-2024-45338 by @Jooho in #355
• Update all runtime stable images by @heyselbi in #356
• Fix for ModelMesh-only setups - Start InferenceGraph controller only if the CRD is present by @israel-hdez in #358
• Prevent InferenceGraphs to refer to other namespaces by @israel-hdez in #357
• fix: added accept header to nim manifest pull requests accepting oci by @TomerFi in #362
• Fix: Ensure odh-model-controller Deployment Waits for ConfigMap by @trujillm in #361
• fix: nim containers terminated prematurely by @TomerFi in #363
• fix: cherry picking appeng fixes for 2.18 by @TomerFi in #367
• [RHOAIENG-16435] Fixed error that was caused when deleting an ISVC using RawDeployment and ServiceMesh is not installed by @andresllh in #365
• [RHOAIENG-13566] Configure SSL for the communication between head and worker by @Jooho in #346
• Adding devspace files by @andresllh in #366
• Move kserve and MM release metadata to corresponding repos by @heyselbi in #359
• 2/13/2025 Sync main with ODH v2.24 by @hdefazio in #370
• [Not squashed version] 2/13/2025 Sync main with ODH v2.24 by @hdefazio in #371
• fix: cleanup fails for disabled NIM by @TomerFi in #368
• fix: cleanup fails for disabled NIM (#368) by @TomerFi in #373
• add kserve-state and modelmesh-state as args by @VedantMahabaleshwarkar in #374
• only create CRB for raw if isvc has auth by @VedantMahabaleshwarkar in #364
• adding brettmthompson as approver and reviewer in OWNERS file by @brettmthompson in #376
• [RHOAIENG-20323] fix condition in multi-node servingruntime by @Jooho in #378
• Update status post frequency for NIM account controller by @trujillm in #360
• Update OWNERS by @andresllh in #375
• fix: when in Raw Mode as no Authorino is available, should not own AuthConfig by @zdtsw in #377
• [Cherry-Pick:377] fix: when in Raw Mode as no Authorino is available, should not own by @Jooho in #379
• Use annotation instead of label to enable auth for RawDeployment by @VedantMahabaleshwarkar in #382
• Add an image to params.env for init container for ray-tls-generator by @Jooho in #381
• revert: revert "Update status post frequency for NIM account controll… by @TomerFi in #380
• ODH v2.25 sync with main by @hdefazio in #385
• Fix the ODH 2.25 sync so it is not squashed by @hdefazio in #387
• feat(mr): re-enable model registry reconciler and add svc annotation to it by @Al-Pragliola in #369
• chore: added logs for nim api responses by @TomerFi in #383
• chore: filter events for the nim controller by @TomerFi in #384
• Move arguments from 'args' to 'command' for vllm multinode SR by @Jooho in #388
• fix: legally blocked content should not break NIM integration by @TomerFi in #390
• Updating README and adding devspace README by @andresllh in #372
• Inject volume/volumeMounts of ray-cert by webhook by @Jooho in #386
• Upgrade Authorino Package Version to v0.20.0 by @brettmthompson in #395
• ODH 2.26 sync by @brettmthompson in #397
• [RHOAIENG-20597] vLLM Serving Runtime Template naming changes by @Snomaan6846 in #398
• Deprecate TGIS from ODH and future RHOAI releases by @rpancham in #399
• fix: TGIS image removal not completely done by @zdtsw in #401
• [RHOAIENG-19955] - [UBI 9 upgrade] OpenDataHub - ODH Model Controller by @spolti in #389
• chore: nim account controller should trigger all secret changes by @TomerFi in #402
• chore: nim account controller should trigger all secret changes by @TomerFi in #403
• chore: nim setup should use the setup logger by @TomerFi in #391
• chore: refactor hack script for verifying nim integration by @TomerFi in #392
• Update approvers in owners file with runtimes team members by @heyselbi in #400
• fix: nim integration tries to deserialize empty bodies by @TomerFi in #406
• Change Account spec to support NIM model list selection by @xieshenzh in #405
• correct tgis deprecation changes by @heyselbi in #404
• Sync/250408 incubation main by @andresllh in #408
• New automerge gitaction by @andresllh in #409
• Restore code removed by mistake by @israel-hdez in #410
• Adding Both Custom and Trusted Certs to Kserve CA Configmap by @brettmthompson in #413
• [Cherry-Pick]Restore code removed by mistake (#410) by @Jooho in #415
• ✨ added huggingface detector runtime template by @m-misiura in #412
• Add volume to servingRuntime template by @trujillm in #416
• [Cherry-pick] Add volume to servingRuntime template (#416) by @trujillm in #417
• Extract runtime image reference from params.env file by @vaibhavjainwiz in #418
• ✨ added huggingface detector runtime template (#412) by @spolti in #420
• add powerz mentions in vllm cpu template by @edwardquarm in #422
• Refactor the Account Controller by @TomerFi in #419
• revert previous pull request to add vLLM cpu template by @edwardquarm in #427
• 250502 sync incubating by @spolti in #426
• fix(make): ensures tools are always in the correct version by @bartoszmajsak in #429
• Revert "250502 sync incubating" by @spolti in #443
• 250502 sync incubating by @spolti in #445
• upgrade to go 1.23 by @VedantMahabaleshwarkar in #424
• add repo specific PR template by @VedantMahabaleshwarkar in #448
• RHOAIENG-25652: Bump KServe to 0.15 by @pierDipi in #447
• Aggregate code coverage for make test by @pierDipi in #449
• Consistent and automated KServe CRDs download by @pierDipi in #450
• Add bartoszmajsak and pierDipi to OWNERS by @pierDipi in #451
• chore: updated the account api print columns by @TomerFi in #446
• [RHOAIENG-25522] Route that is not managed by the InferenceService gets deleted by @spolti in #459
• fix: model selection should update the account status for failurs by @TomerFi in #444
• Update OVMS image by @rpancham in #461
• RHOAIENG-25111: Add KEDA reconciler for raw deployment mode by @pierDipi in #452
• Separate HF Detector into its own params.env file by @RobGeada in #463
• Sync/250528 incubation main by @andresllh in #467
• Adding Timeout To Openshift Routes Created For Inference Services by @brettmthompson in #465
• update openshift template with a runtime version by @edwardquarm in #469
• Cherry pick: Bring separate HF Detector runtime params file from incubating into main by @RobGeada in #470
• Update HF detector image to modh repo by @RobGeada in #471
• Sync/250617 incubation main by @brettmthompson in #472
• chore(deps): Bump github.com/expr-lang/expr from 1.16.9 to 1.17.0 by @dependabot[bot] in #464
• Sync/250620 incubation main by @brettmthompson in #474
• Add runtime template for IBM Spyre by @vaibhavjainwiz in #475
• feat: update mr inferenceservice controller dep to latest commit by @Al-Pragliola in #453
• [RHOAIENG-16147] with kserve 0.15 bump, updated multi node checker with WorkerSpec by @Jooho in #478
• Sync/250701 incubation main by @andresllh in #479
• feat: add support for personal keys for NIM by @TomerFi in #480
• feat: add support for personal keys for NIM by @TomerFi in #481
• remove vllm-spyre-template from odh by @edwardquarm in #483
• Update Tekton files to version odh-v2.32 by @odh-devops-app[bot] in #485
• Add Openshift Serving and Global Certificate CA Bundles to odh-kserve-customt-ca-bundle configmap by @brettmthompson in #486
• Updating the secret controller to limit model mesh certificates by @brettmthompson in #487
• Odh v2.32 release by @mholder6 in #488
• Sync/2025 7 24 incubation main by @mholder6 in #489
• chore: removed validation-skip annotation for NIM by @TomerFi in #482
• Odh v2.33 release by @mholder6 in #493
• Sync/250812 incubation main by @mholder6 in #497
• Add Power/z runtime template by @vaibhavjainwiz in #477
• Upgrade to go 1.24 by @hdefazio in #498
• Replace the upstream kserve dependency with the latest odh release by @hdefazio in #501
• Update golangci-lint to be compatible with go 1.24 by @hdefazio in #503
• [RHOAIENG-31975] - Onboard metrics to the centralized metrics platform by @spolti in #502
• Include "modelType" in servingRuntimeTemplate by @vaibhavjainwiz in #504
• Sync 250901 incubation main by @spolti in #506
• [RHOAIENG-32568] - Model serving builds for ODH community 2.34 by @spolti in #507
• [RHOAIENG-32568] - Model serving builds for ODH community 2.34 by @spolti in #509
• extend reconciler interfaces for LLM support and add llmisvc reconciler by @Jooho in #510
• Consolidate .env files for odh-model-controller by @vaibhavjainwiz in #511
• Cherry-pick : Consolidate .env files for odh-model-controller by @vaibhavjainwiz in #513
• fix manifests generation for llmisvc by @Jooho in #516
• feat: add authPolicy resource by @Jooho in #514
• feat: add authPolicy comparator by @Jooho in #515
• refactor: use constants for AuthType by @Jooho in #521
• Add Konflux ODH tag bump automation to our existing release workflow. by @KillianGolds in #520
• Add vllm-spyre-template configurations by @edwardquarm in #517
• cherry-pick: vllm-spyre-template by @edwardquarm in #523
• feat: implement AuthPolicyStore interface following AuthConfig Store by @Jooho in #522
• refactor: use kuadrant api by @Jooho in #524
• refactor: clean up unused scheme and update authpolicy test by @Jooho in #525
• fix flaky test(sync secret) by @Jooho in #527
• chore: pins go version using go.mod by @bartoszmajsak in #531
• feat: implement AuthPolicyMatcher interface for LLM service discovery and add authPolicy watcher by @Jooho in #528
• ci(manifests): validates kustomize manifest by @bartoszmajsak in #532
• remove cache for authPolicy by @Jooho in #535
• test(utils): temporarily accept 'Standard' and 'Knative' deploymentMode by @vivekk16 in #533
• Odh v2.35 release by @mholder6 in #536
• feat: add config parameter to llisvc reconciler and update authPolicy naming by @Jooho in #537
• feat: add comprehensive test suite infrastructure for LLM controller by @Jooho in #538
• ci: uses go version from go.mod by @bartoszmajsak in #539
• chore(image): corrects builder image syntax by @bartoszmajsak in #540
• fix issue with with startup probe when --served-model-name is set by @strangiato in #496
• feat: implement AuthPolicy reconciliation for LLMInferenceService by @Jooho in #541
• change the authorinzation key name to avoid conflict with maas by @Jooho in #544
• add standard labels to authPolicy and use it to check if objects are managed by odh-model-controller by @Jooho in #543
• update: set default value for modelmesh to removed by @zdtsw in #545
• feat: add envoyfilter comparator/resources by @Jooho in #542
• feat: add MaaS Role and RoleBinding for LLMInferenceService by @israel-hdez in #534
• feat: Remove ModelMeshServing support from odh-model-controller by @ugiordan in #546
• chore: Removing service mesh related checks from the inferenceservice webhook by @ugiordan in #555
• feat: implement EnvoyFilter reconciler and refactor test helper functions by @Jooho in #547
• fix: update or delete MaaS RBAC only when managed by @israel-hdez in #549
• feat: prioritize Authentication.spec.serviceAccountIssuer for ROSA support by @Jooho in #556
• [Sync 251015] From incubating to main branch by @Jooho in #558
• rename spyre accelerator identifier by @edwardquarm in #557
• feat: add annotation to gateway to opt-out of management by @jland-redhat in #559
• feat: add BaseRefs support for LLMInferenceService gateway resolution by @pierDipi in #561
• #491 resolve infinite loop in ray-tls-generator init container by @strangiato in #492
• feat(vllm-spyre-z): Onboard vllm spyre Z template on RHOAI by @edwardquarm in #563
• Add LLMInferenceServiceConfig read access by @pierDipi in #564
• Move MergeSpec to main reconciler by @pierDipi in #565
• feat: Remove Serverless/ServiceMesh support from odh-model-cont… by @ugiordan in #554
• [RHOAIENG-30424] - Remove caikit standalone runtime from incubating by @RobGeada in #553
• refactor: improve resource management utility functions by @Jooho in #562
• Sync incubating to main by @brettmthompson in #567
• odh-v3.0 release prep by @brettmthompson in #569
• bump release tag to odh-v3.1 in push job by @brettmthompson in #570
• Sync incubating for odh v3.0 by @brettmthompson in #571
• Add vivekk16 to OWNERS by @vivekk16 in #572
• Delete network policies, rely on ODH operator ones by @pierDipi in #568
• Fix Prometheus metrics port for HF Detector Runtime by @RobGeada in #577
• Write the HF Detector pod name into an env var for the container by @RobGeada in #578
• deprecate(caikit-tgis-serving): remove caikit-tgis template by @edwardquarm in #579
• update sync gitaction by @Jooho in #581
• cherrypick-pr-579: remove caikit-tgis template by @edwardquarm in #580
• [SYNC] 20251024 from incubating to main branch by @Jooho in #582
• update sync gitaction for incubating to main only by @Jooho in #583
• [s390x] IBM Spyre Z template supports only VF and continuous batching by @edwardquarm in #586
• [s390x] update Z template by @nikheal2 in #587
• cherrypick-587: [s390x] Z template supports only VF and continuous batching by @edwardquarm in #588
• Revert 588 by @brettmthompson in #589
• Sync incubating to main 102825 by @brettmthompson in #590
• [RHOAIENG-37686] - Metrics not available in the Dashboard due image name mismatch in runtime detection logic by @spolti in #591
• odh-v3.1 release by @mholder6 in #597
• Reject isvcs that have a name longer than 53 characters by @VedantMahabaleshwarkar in #598
• resolve race condition in raw crb when 2 isvcs using the same SA have… by @VedantMahabaleshwarkar in #595
• Do not require a controller restart for LLMInferenceService reconciler by @pierDipi in #599
• RHOAIENG-39326: feat: add dynamic Kuadrant detection for EnvoyFilter by @pierDipi in #600
• Add to scheme Kuadrant and Authorino by @pierDipi in #604
• odh 3.1 release tag bump by @mholder6 in #609
• fix(workflow): comply with branch protection by using PR-based tag updates by @KillianGolds in #575
• RHOAIENG-31669 - fix Route TargetPort selection for RawDeployment isvcs by @mholder6 in #601
• Revert " fix(workflow): comply with branch protection by using PR-based tag updates" by @KillianGolds in #613
• drop not needed default deployment parameters in ovms by @dtrawins in #605
• Reject isvcs that have a name longer than 53 characters (#598) by @spolti in #614
• Improvements to Release Workflow and MLServer support by @brettmthompson in #620
• Update the namespace for the MaaS Config to be configurable by @jland-redhat in #616
• added cache mount and volume by @trujillm in #607
• Add MLServer ServingRuntime template in odh-model-controller by @Snomaan6846 in #615
• Fix flaky test in Secret controller by @pierDipi in #603
• [RHOAIENG-31808] fix(controller): pod controller failing to reconcile ray-tls pods by @mholder6 in #624
• update runtime versions to be displayed in rhoai dashboard [3.2] by @edwardquarm in #625
• [RHOAIENG-41648] - Sync ODH and RHOAI for RHOAI 3.2 Code Freeze by @spolti in #627
• 251215 incubation main by @spolti in #628
• chore(konflux): Bump release tag to odh-v3.3 by @github-actions[bot] in #629
• Fix Erroneous Tag Creation in Release Workflow by @brettmthompson in #631
• Fix flaky tests by @pierDipi in #566
• chore(deps): bump github.com/kedacore/keda/v2 from 2.16.1 to 2.17.3 by @dependabot[bot] in #634
• Update maas namespace from maas-api to opendatahub by @chaitanya1731 in #641
• [RHOAIENG-42308] Fix CVE-2025-68156: Update expr-lang/expr to v1.17.7 by @mholder6 in #639
• [RHOAIENG-42296] Fix CVE-2025-68156: Update expr-lang/expr to v1.17.7 by @mholder6 in #638
• chore: removes unused reconciler by @bartoszmajsak in #643
• [RHOAIENG-38500] Add unified odh release github actions workflow automation by @vivekk16 in #608
• Update ODH release workflow secret key by @vivekk16 in #648
• Update odh release workflow secret key and appID for release step by @vivekk16 in #649
• [RHOAIENG-44930] Update KServe tag to odh-v3.3 by @vivekk16 in #650
• [RHOAIENG-44930] Model serving builds for ODH community 3.3 by @odh-release-bot[bot] in #651
• [RHOAIENG-44930] Sync incubating to main 01132026 by @vivekk16 in #653
• vllm cpu x86 template by @edwardquarm in #655
• [RHOAIENG-38500] Remove deprecated create-release workflow by @vivekk16 in #656
• feat(llmisvc): add opt-in annotation for Authorino TLS EnvoyFilter on unmanaged gateways by @bartoszmajsak in #657
• cherry-pick pr 655 vLLM CPU x86 template by @edwardquarm in #660
• feat: Adding validating webhook to prevent duplicate tier levels in tier-to-group-mapping ConfigMap by @dmytro-zaharnytskyi in #642
• Adding ppc64le template for spyre vLLM by @Shafi-Hussain in #663
• Adding ppc64le template for spyre vLLM by @Shafi-Hussain in #652
• fix: remove valid tier info from validation error message by @liangwen12year in #662
• feat(rbac): reconcile RBAC on tier ConfigMap change by @bartoszmajsak in #661
• add pipelinerun for odh ci builds by @MohammadiIram in #644
• Code sync - Jan 20th 2026 by @israel-hdez in #664
• update component name by @MohammadiIram in #665
• [RHOAIENG-46342] fix: UID mismatch error when updating ray-tls secrets across namespaces by @mholder6 in #622
• fix(maas): use downward API for MAAS_NAMESPACE to support dynamic namespace configuration by @liangwen12year in #669
• RHOAIENG-48076: fix ppc64le spyre template by @Shafi-Hussain in #672
• RHOAIENG-48076: fix ppc64le spyre template by @Shafi-Hussain in #673
• feat: configure HTTP client with explicit TLS 1.2 minimum version by @maskarb in #676
• fix: uses kustomize action to avoid rate limits by @bartoszmajsak in #681
• cherrypick pr 683 - single spyre image manifest by @edwardquarm in #684
• replace arch-specific vLLM Spyre images with single manifest-list entry by @edwardquarm in #683
• chore: update regex for release tag validation by @israel-hdez in #686
• chore: release preparation for odh-3.4-ea1 by @israel-hdez in #687
• chore(konflux): Bump ODH tag to odh-v3.4-EA2 by @odh-release-bot[bot] in #688
• feat: configure HTTP client with explicit TLS 1.2 minimum version (#676) by @maskarb in #682
• Air gapped nim supported by @trujillm in #677
• Add K8s probes for MLserver template by @Snomaan6846 in #685
• Sync incubating->main for 3.4-EA1 release by @israel-hdez in #689
• RHOAIENG-47114: feat(llm): support flow control for LLMInferenceService by @pierDipi in #668
• Adding workflows to update runtime and component version by @brettmthompson in #671
• fix: reduce NIM ConfigMap size by storing only required model fields by @TomerFi in #690
• fix: reduce NIM ConfigMap size by storing only required model fields by @TomerFi in #692
• update runtime versions on rhoai-3.4ea1 branch by @edwardquarm in #694
• cherrypick pr 694 update runtime versions by @edwardquarm in #695
• Make LLMISVC AuthPolicy auth rules apply as OR by @jlost in #693
• Reduce RBAC permissions scope for odh-model-controller by @spolti in #710
• [RHOAIENG-46368] FIPS Compliance: replace math/rand with crypto/rand by @spolti in #711
• [RHOAIENG-30165] - fix: eliminate flaky tests in core controller suite by @mholder6 in #698
• Revert "Reduce RBAC permissions scope for odh-model-controller" by @spolti in #716
• Restore odh-stable tag in tekton push job by @brettmthompson in #717
• Update kserve dependency by @jlost in #718
• fix: removing maas-realted webhooks, authpolicy and tiers by @dmytro-zaharnytskyi in #713
• Add ONNX model format in MLServer ServingRuntime Template by @Snomaan6846 in #679
• Sync/260306 incubation main by @jlost in #722
• Update tekton for ODH 3.4 by @jlost in #723
• Adding metrics support for mlserver runtime by @brettmthompson in #728
• Update tekton pipeline for ODH 3.4 by @jlost in #729
• chore(devspace): update dev image to Go 1.25 and fix OpenShift SCC env vars by @jlost in #727
• feat: switch LLMInferenceService controller to v1alpha2 hub version by @bartoszmajsak in #731
• update runtime versions on rhoai-3.4ea2 branch by @Raghul-M in #733
• update runtime versions on rhoai-3.4ea2 branch by @Raghul-M in #732
• Sync incubating into main (2026-03-13) by @jlost in #737
• Update servingruntime template for RHAIIS-spyre s390x by @nikheal2 in #738
• RHOAIENG-51603: Gateway discovery server by @pierDipi in #700
• fix: use proper TLS cert verification in unit tests by @maskarb in #745
• fix: update kserve to release-v0.17 by @spolti in #747
• Bump server base image to Go 1.25 by @pierDipi in #749
• Sync incubating into main by @jlost in #750
• feat: add allow_existing_tag option to release workflow for re-releases by @jlost in #751
• fix: fetch remote branch before force-with-lease push in release workflow by @jlost in #753
• Fix server metrics e2e tests by @pierDipi in #754
• feat: increate server resource limits by @pierDipi in #755
• Add Makefile targets to prepare running e2e tests by @pierDipi in #756
• workaround: publish odh-model-serving-api under odh-model-controller repo by @pierDipi in #758
• Sync incubating to main by @pierDipi in #762
• fix(auth): decouples EnvoyFilter from LLMISvc lifecycle by @bartoszmajsak in #680
• [main] Include API Server in bundle by @pierDipi in #763
• feat: cleanup for migration 3.3 to 3.4 (MaaS related) by @dmytro-zaharnytskyi in #724
• RHOAIENG-55730: Inject server image by @pierDipi in #765
• CI: Tekton pipeline sync by @odh-devops-app[bot] in #766
• Remove build platforms from CI configuration by @pierDipi in #768
• RHOAIENG-54696: Support Batch /v1/files and /v1/batches by @pierDipi in #709
• add MLSERVER_MODEL_IMPLEMENTATION to env by @Jooho in #703
• [main] add MLSERVER_MODEL_IMPLEMENTATION to env by @openshift-cherrypick-robot in #772
• chore: bump opendatahub-io/kserve to odh-v3.4 by @vivekk16 in #775
• Sync main from incubating by @pierDipi in #769
• chore(konflux): Bump ODH tag to odh-v3.5-EA1 by @odh-release-bot[bot] in #776
• update runtime versions to be displayed in rhoai dashboard [3.4 GA ] by @Raghul-M in #778
• update runtime versions to be displayed in rhoai dashboard [3.4 GA ] by @Raghul-M in #779
• Add spyre-scheduler to vLLM spyre runtime templates by @brettmthompson in #764
• Cherry Pick Add spyre-scheduler to vLLM spyre runtime templates by @brettmthompson in #780
• chore: update kserve version to odh-v3.4 by @vivekk16 in #782
• Sync/260409 incubation main by @vivekk16 in #783
• Switch vLLM multinode runtime from Ray to the multiprocessing (mp) by @Jooho in #784
• fix: replace direct push with PR-based sync for protected main branch by @Jooho in #785
• fix: remove auto-merge and add tide/merge-method-merge label by @Jooho in #788
• fix: add MASTER_PORT env var to vllm multinode template by @Jooho in #789
• fix: wait for all workers before assigning NODE_RANK in multinode template by @Jooho in #791
• Merge incubating to main by @github-actions[bot] in #792
• RHOAIENG-58209: fix(server): change metrics port from 9090 to 8080 by @pierDipi in #794
• RHOAIENG-46780: feat(gateway): filter gateway refs based on listener allowedRoutes by @pierDipi in #771
• fix: add required writable volume mounts for NIM 2.x compatibility by @TomerFi in #802
• fix(metrics): fix vLLM REQUEST_COUNT metric query for dashboard by @mwaykole in #806
• fix: read prometheus.io/path annotation for ServiceMonitor endpoint path by @TomerFi in #808
• ci(release): [RHOAIENG-58438] enable tag-push Konflux builds by @jlost in #807
• [RHOAIENG-56859] - Fix Go JOSE DoS (CVE-2026-34986) by @spolti in #811
• fix(release): [RHOAIENG-58438] split git add to prevent staging failure by @jlost in #812
• chore: update OWNERS by @jlost in #813
• chore: switch params.env to Konflux-built images (RHOAIENG-53839) by @jlost in #814
• chore: bump kserve dependency to odh-v3.5 by @jlost in #816
• Merge incubating to main by @github-actions[bot] in #817
• feat(release): [RHOAIENG-58438] pin kserve dep at release time, add MLServer by @jlost in #815
• [RHOAIENG-60685] aggregate NIM Account roles to admin, edit, and view… by @spolti in #820
• Updated 3.5ea1 Runtime Templesversion by @Raghul-M in #818
• Updated 3.5ea1 Runtime Templates version by @Raghul-M in #821
• fix: guard nil Model to prevent panics by @bartoszmajsak in #828
• add agents.md and architecture.md by @VedantMahabaleshwarkar in #829
• chore: update OWNERS -- add KillianGolds as approver and reviewer by @KillianGolds in #830
• feat: migrate from kubeflow/model-registry to kubeflow/hub by @Al-Pragliola in #831
• [RHOAIENG-60245] - CVE-2026-31837 - Istio Information disclosure and … by @spolti in #834
• Early-gate: add early-gate CI pipelines by @odh-devops-app[bot] in #840
• Updated Runtime Templates version for 3.5 ea2 by @puneetsharma21 in #838
• feat(webhook): migrate ConnectionsAPI injection to odh-model-controller by @israel-hdez in #827
• Sync incubating to main 06162026 by @brettmthompson in #843
• fix(release): exclude llm-d images from params.env update in kserve by @vivekk16 in #845
• RHOAIENG-56131: odh-model-controller reconciliation fails when LLMInferenceService is stopped - AuthPolicy targets deleted HTTPRoute by @jira-autofix[bot] in #822
• fix: update gateway ref types for kserve v1alpha2 and fix e2e image injection by @vivekk16 in #846
• Revert "feat(webhook): migrate ConnectionsAPI injection to odh-model-controller" by @pierDipi in #848
• chore: sync incubating branch to main by @vivekk16 in #847
• feat(webhook): migrate ConnectionsAPI injection to odh-model-controller (#827) by @pierDipi in #849
• fix(release): add go build smoke test after kserve dep update by @jlost in #850
• chore: remove kserve and vllm version by @zdtsw in #855
• feat(webhook): migrate HardwareProfile injection to odh-model-controller by @israel-hdez in #851
• feat(server): add GET /api/v1/llm-d/samples endpoint for LLMInferenceServiceConfig templates by @pierDipi in #852
• [RHOAIENG-68180] Add kustomize overlays for fast-1 and fast-2 vLLM ServingRuntime templates by @jira-autofix[bot] in #837
• Sync incubating to main by @pierDipi in #857
• fix: update endpoint in docs by @pierDipi in #858
• ci: protect against skills/context poisoning by @bartoszmajsak in #823
• feat : Add AutoGluon ServingRuntime template for tabular and time series models by @Snomaan6846 in #844
• Merge incubating to main by @github-actions[bot] in #866
• Add disconnected readiness workflow by @odh-drs-automation-bot[bot] in #865
• RHOAIENG-75487: add fast-version annotation to fast-1 and fast-2 by @pierDipi in #867
• Create Gateway PodMonitor to scrape Istio/Envoy inference metrics by @pierDipi in #871
• fix: correct JSON field path for HardwareProfile scheduling spec lookup by @israel-hdez in #875
• feat: add MLServer NVIDIA GPU (CUDA) ServingRuntime template by @Snomaan6846 in #873
• Merge incubating to main by @github-actions[bot] in #877
• build: derive envtest K8s version from go.mod instead of hardcoding by @bartoszmajsak in #879
• feat(llmisvc): warn on auth posture mismatch across routing group members by @bartoszmajsak in #880
• feat: add publisher-path authorization rules and cross-tenant deny to gateway AuthPolicy by @bartoszmajsak in #881
• RHOAIENG-76656: Update vLLM version from v0.21.0 to v0.24.0 in runtime templates by @Deepali1999 in #885
• fix: extend deny-misrouted rule to cover /v1/ paths besides batch by @bartoszmajsak in #884
• [RHOAIENG-69082] Add xKS webhook-only mode for OMC by @mholder6 in #872
• [RHOAIENG-63480] Add canary traffic splitting via Route alternateBackends by @maskarb in #860
• fix(webhook): reject InferenceService with connection Secret missing connection-type-protocol by @israel-hdez in #878
• Merge incubating to main by @github-actions[bot] in #889
• [RHOAIENG-76473] Fix e2e-kserve-ocp post-KServe CI failures by @mholder6 in #874
• feat: add sync-branches workflow and align tekton pipelines for incubating by @pierDipi in #876
• Sync incubating to main by @github-actions[bot] in #891
• fix: bump golang.org/x/net to v0.57.0 by @maskarb in https://github.com/opendatahub-io/odh-model-controller/pull/896
• feat: enable SecureServing, TLS profile watcher, and cert provisioning by @ugiordan in https://github.com/opendatahub-io/odh-model-controller/pull/863
• RHOAIENG-64703: ISVC finalizer is removed despite cleanup errors, leaving cluster-scoped resources orphaned by @jira-autofix[bot] in https://github.com/opendatahub-io/odh-model-controller/pull/826
• RHOAIENG-64701: Fix sub-reconcilers failing when optional CRDs not installed by @jira-autofix[bot] in https://github.com/opendatahub-io/odh-model-controller/pull/825
• RHOAIENG-64702: Fix manager startup in odh-model-controller by @jira-autofix[bot] in https://github.com/opendatahub-io/odh-model-controller/pull/824
• RHOAIENG-64708: Fix raw KServe Route silently skipped when backing Service is missing by @bartoszmajsak in https://github.com/opendatahub-io/odh-model-controller/pull/898
• RHOAIENG-65224: Fix ISVC finalizer MergePatch dropping concurrent finalizer changes by @bartoszmajsak in https://github.com/opendatahub-io/odh-model-controller/pull/899
• fix: flaky auth posture and ReconcileError event tests by @bartoszmajsak in https://github.com/opendatahub-io/odh-model-controller/pull/901
• RHOAIENG-65223: Bound NIM HTTP response body reads and close connections by @bartoszmajsak in https://github.com/opendatahub-io/odh-model-controller/pull/900
• [RHOAIENG-62462] - TLS infrastructure for transformer-to-predictor co… by @spolti in https://github.com/opendatahub-io/odh-model-controller/pull/903
• [RHOAIENG-78139] Add xKS smoke negative webhook tests by @mholder6 in https://github.com/opendatahub-io/odh-model-controller/pull/892
• Sync incubating to main by @github-actions[bot] in https://github.com/opendatahub-io/odh-model-controller/pull/897

New Contributors

• @mkumatag made their first contribution in #182
• @KillianGolds made their first contribution in #209
• @dtrifiro made their first contribution in #222
• @satyamg1620 made their first contribution in #247
• @lburgazzoli made their first contribution in #251
• @Nash-123 made their first contribution in #262
• @xieshenzh made their first contribution in #281
• @hdefazio made their first contribution in #316
• @trujillm made their first contribution in #312
• @RH-steve-grubb made their first contribution in #343
• @zdtsw made their first contribution in #377
• @Snomaan6846 made their first contribution in #398
• @m-misiura made their first contribution in #412
• @pierDipi made their first contribution in #447
• @RobGeada made their first contribution in #463
• @dependabot[bot] made their first contribution in #464
• @strangiato made their first contribution in #496
• @ugiordan made their first contribution in #546
• @jland-redhat made their first contribution in #559
• @nikheal2 made their first contribution in #587
• @dtrawins made their first contribution in #605
• @github-actions[bot] made their first contribution in #629
• @chaitanya1731 made their first contribution in #641
• @odh-release-bot[bot] made their first contribution in #651
• @dmytro-zaharnytskyi made their first contribution in #642
• @Shafi-Hussain made their first contribution in #663
• @liangwen12year made their first contribution in #662
• @MohammadiIram made their first contribution in #644
• @Raghul-M made their first contribution in #733
• @openshift-cherrypick-robot made their first contribution in #772
• @puneetsharma21 made their first contribution in #838
• @jira-autofix[bot] made their first contribution in #822
• @odh-drs-automation-bot[bot] made their first contribution in #865
• @Deepali1999 made their first contribution in #885

Full Changelog: v0.11.1.2...odh-v3.5