DPS 0.10 Release Notes#

  • Previous release: DPS 0.9.0

DPS 0.10.0 enables DSX Exchange integration including DSX Flex, DPS agent authentication, Nautobot import, and deployment routing. It also improves power-allocation recovery and component-policy handling.

Upgrade Information#

Review Optional External Authentication#

External authentication is opt-in through dps.auth.external.enabled. This mode delegates authentication and authorization to an independently installed proxy and binds the DPS gRPC backend to loopback. It disables DPS token issuance.

Install and configure the proxy, Service routing, certificates, and UI login before enabling this mode. The Helm chart does not install the authorization proxy for you. The HTTP gateway connects to the local proxy through dps.auth.external.proxyPort.

Added#

This release candidate adds the following capabilities:

  • Added support for DSX Exchange integration & DSX Flex integrations via DSX Exchange

  • Added Nautobot manual import support for DSX

  • Added shared DPS client authentication to the DPS agent and DSX Agent, including OAuth2 client credentials, DPS login, and bearer-token files to support DSX Launch Layer integration.

  • Added OAuth2 client-credentials and token-file authentication for the DSX Agent MQTT connection to DSX Exchange.

  • Added a configurable JWS signing key ID for DSX Agent messages.

  • Added GraphQL transport for Nautobot entity imports, with REST fallback when the GraphQL endpoint is unavailable. Authentication errors and GraphQL query errors do not trigger fallback.

  • Added support for an independently supplied authentication and authorization sidecar to support DSX Launch Layer integration.

Improved#

This release candidate includes the following improvements:

  • Allowed Kubernetes Ingress and Gateway API routes to coexist for DPS and the UI. Coordinate DNS, certificates, controllers, and authentication across both entry paths before enabling them together.

  • Updated the embedded Power Steering Helm dependency to version 2.2.1.

  • Improved DSX Agent Flex command handling and signed-message validation.

  • Improved GPU-only Node Manager policy handling by completing required CPU and memory component policies from available hardware policy information.

Fixed#

This release candidate includes the following fixes:

  • Corrected power give-back recovery and allocation synchronization.

  • Preserved shared-GPU recovery state and completed GPU and give-back state when an update is acknowledged.

  • Corrected deadlocks in topology activation and deactivation, resource-group release, and GPU policy updates.

  • Created the ServiceAccount required by agent-only Helm deployments.

Important DSX Configuration Information#

Using DSX Agent Connection Settings#

The DSX Agent uses the shared DPS client configuration. Update custom Helm values and externally supplied configuration files before upgrading.

The following settings replace the previous agentConfig.dps fields in Helm values. JSON application configuration uses the same field names under dps:

Previous Setting

DPS 0.10 Setting

host and port

serverAddr, in host:port form

caCertPath

tls.certs.caFile

insecure: true

tls.transportSecurity: insecure

insecure: false

tls.transportSecurity: tls

insecureTLSSkipVerify

tls.insecureSkipVerify

Standalone YAML application configuration uses dps.server_addr, dps.tls.transport_security, dps.tls.insecure_skip_verify, and dps.tls.certs.ca_file for the corresponding settings. These YAML field names differ from the Helm values, which the chart renders as JSON.

For mutual TLS, use tls.transportSecurity: mtls and set tls.certs.caFile, tls.certs.certFile, and tls.certs.keyFile to the mounted CA, client certificate, and client key. Their standalone YAML names are tls.certs.ca_file, tls.certs.cert_file, and tls.certs.cert_key_file. In Helm values, you can instead set agentConfig.dps.tls.secretRef.name to a Secret containing ca.crt, tls.crt, and tls.key. Authenticated connections require verified TLS. Plaintext authentication requires an explicit development override; authenticated TLS connections cannot skip certificate verification.

Configure DPS authentication under agentConfig.dps.auth and broker authentication under agentConfig.mqtt. Broker credentials and DPS credentials serve separate connections. Review JSON Web Signature (JWS) signing and verification keys independently of those connection credentials.

The chart removes dpsCredentials.existingSecret and dpsCredentials.mountPath. For DPS password login, set agentConfig.dps.auth.dps.username, and reference the password Secret through agentConfig.dps.auth.secretRef.name and agentConfig.dps.auth.secretRef.key. You can reuse the previous Secret’s password key. The chart mounts the selected file and configures auth.dps.passwordFile; it no longer reads a username file from the previous credential directory.

For externally supplied JSON configuration, move dps.username to dps.auth.dps.username and replace dps.secretMountPath with dps.auth.dps.passwordFile, pointing to a mounted password file. Move an existing inline dps.password to dps.auth.dps.password if you retain that credential source. YAML configuration uses password_file instead of passwordFile. Configure exactly one password source.

DSX MQTT Topics#

DPS 0.10 changes the Exchange MQTT topics for these message paths. The agent, publishers, and consumers need matching broker access-control permissions:

Message Path

Previous Topic

DPS 0.10 Topic

Outbound power state

grid/v1/poweragent/<agent-id>/powerstate/status

grid/v1/dsx-flex-agent/<agent-id>/powerstate/status

Incoming load targets

grid.setloadtarget.v1

grid/v1/isv/<isv-id>/loadtarget/set

Power-state consumers must subscribe to the new outbound topic, and the agent needs permission to publish to it. Load-target publishers use their concrete ISV topic. The agent subscribes to grid/v1/isv/+/loadtarget/set and retains the legacy grid.setloadtarget.v1 subscription for migration compatibility. Permit both subscriptions in the broker configuration. Power state is published on the new outbound topic. Consumers still subscribed only to grid/v1/poweragent/<agent-id>/powerstate/status receive no new power-state updates after the upgrade.

Refer to Managing NvGrid for feed metadata, load targets, and status.

Nautobot Import Configuration#

Nautobot entity generation selects GraphQL by default when the request omits the transport. REST is an explicit option. Review custom import clients and allowed query parameters before upgrading: parameters must map to supported Nautobot device-query arguments.