> This page is for NVIDIA Infra Controller.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/infra-controller/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/infra-controller/_mcp/server.

# Release Notes

Release history for NVIDIA Infra Controller, including new capabilities, compatibility information, upgrade requirements, and fixes.

> **Tip**
>
> Refer to the [Release Policy](/infra-controller/documentation/reference/release-policy) for more information on how new releases are created, versioned, and supported. For issue-testing workflow, see the [QA Process](/infra-controller/documentation/reference/qa-process). To move an existing installation to a new release, follow the [Upgrading NICo](/infra-controller/documentation/operations-day-2/upgrading-nico) guide.

## October 19, 2026

## Expected Switch NVOS declarations — unreleased

### REST API compatibility exception

The Expected Switch primary-port change tracked in [issue #7310](https://github.com/dsx-ai-factory/infra-controller/issues/7310) intentionally tightens the REST create and replace-all contracts:

* `POST /v2/org/{org}/nico/expected-switch` requires a non-empty `nvosInterfaces` array.
* `PUT /v2/org/{org}/nico/expected-switch/all` requires a non-empty `nvosInterfaces` array in every `expectedSwitches` entry. An empty top-level `expectedSwitches` array still clears the inventory.

Omitting a port set or supplying an empty one returns HTTP 400. This is a breaking-change exception: zero-port declarations cannot initialize successfully because Site Explorer no longer fills or overwrites operator-declared NVOS ports. Existing zero-port records are not repaired automatically.

Before deploying this change, update clients and inventory templates to send `nvosInterfaces` entries with `macAddress` and select the primary (eth0) port with `isPrimary: true`. REST defaults the first entry to primary if none is marked; a single port is always primary. For example, the port field can be:

```json
{
  "nvosInterfaces": [
    { "macAddress": "02:00:00:00:00:01", "isPrimary": true }
  ]
}
```

The deprecated `nvosMacAddresses` request field remains accepted but ignored regardless of its JSON value; it does not satisfy the new requirement. This also breaks clients that relied on that field to configure ports. Sending both fields is allowed, but only `nvosInterfaces` takes effect. PATCH requests may omit `nvosInterfaces` to preserve stored ports; an explicit empty array is rejected.

### Client and inventory-file migration

Update automation that uses the old NVOS names:

| Surface                                           | Old name             | Replacement and behavior                                                                                                                                                                          |
| ------------------------------------------------- | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| REST requests                                     | `nvosMacAddresses`   | Use `nvosInterfaces` objects with `macAddress` and `isPrimary`. The old field is ignored, including on PATCH; an otherwise valid legacy-only PATCH can succeed without changing ports.            |
| REST responses                                    | `nvosMacAddresses`   | Read `nvosInterfaces` for primary selection. Responses still include the deprecated flat `nvosMacAddresses` list; it has not been removed.                                                        |
| `nico-admin-cli expected-switch add` and `update` | `--nvos-mac-address` | Use repeated `--nvos-interface MAC[,primary]` flags. Append `,primary` to the eth0 MAC. The old flag has no alias and is rejected.                                                                |
| `nico-admin-cli expected-switch replace-all` JSON | `nvos_mac_addresses` | Use `nvos_interfaces` objects with `mac_address` and `is_primary`. An old-only file is rejected for missing `nvos_interfaces` before the replacement RPC is sent; it does not clear stored ports. |

The CLI replacement file uses snake_case, not the REST API's camelCase. Its top-level object contains an `expected_switches` array. Each entry requires `bmc_mac_address`, `bmc_username`, `bmc_password`, `switch_serial_number`, and a non-empty `nvos_interfaces` array. For example:

```json
{
  "expected_switches": [
    {
      "bmc_mac_address": "02:00:00:00:00:10",
      "bmc_username": "admin",
      "bmc_password": "REPLACE_WITH_BMC_PASSWORD",
      "switch_serial_number": "SWITCH-001",
      "nvos_interfaces": [
        { "mac_address": "02:00:00:00:00:01", "is_primary": true },
        { "mac_address": "02:00:00:00:00:02", "is_primary": false }
      ]
    }
  ]
}
```

Protect this file because it contains credentials. `is_primary` defaults to `false`; if no entry is marked, the CLI selects the first port. More than one marked primary is rejected. The optional top-level `expected_switches_count` must equal the array length when supplied. Replacement removes records omitted from the file; `{"expected_switches": []}` clears the entire expected-switch inventory.

## DPF provisioning: Site Explorer suppression

[PR #7775](https://github.com/dsx-ai-factory/infra-controller/pull/7775) pauses periodic Site Explorer scans during DPF provisioning. Report-refresh requests are saved and return the cached report marked as pending. Periodic scans and queued refreshes run after all Site Explorer suppressions are cleared. Re-exploration requests are rejected rather than queued; operators must retry them after suppression clears.

### Upgrade compatibility

Older `nico-api` binaries cannot decode suppression rows with source `dpf_provisioning`. While these rows exist, an older replica fails its Site Explorer suppression read and cannot complete exploration cycles.

Upgrade every `nico-api` replica before starting DPF provisioning. At sites already using DPF, plan an API maintenance window: stop all old replicas before starting updated replicas. The default rolling update can overlap old and new binaries and does not meet this requirement.

When upgrading from a version without this feature, machines already provisioning are not retroactively suppressed. Suppression is created when a managed host transitions from having no DPU in `WaitingForReady` or `HandleReboot` to having at least one DPU in either state. Existing suppression rows remain effective across restarts.

### Downgrading to a binary without DPF suppression support

Stop all updated `nico-api` replicas first, so their controllers cannot recreate the suppression rows. Then run this statement against the NICo Core database before starting older replicas:

```sql
DELETE FROM bmc_suppressions
WHERE source = 'dpf_provisioning';
```

This preserves suppression rows owned by other workflows. Removing these rows clears the DPF exploration pause; it does not stop provisioning by the DPF operator.

## October 2, 2026

## NVIDIA Infra Controller v2.2 Current

NICo v2.2 expands site-scale provisioning, rack and NVLink domain operations, health history, and REST administration. It adds Discovery OS cloud-init, more control over DPU service rollout, and an opt-in path to manage Max-Q power through DPS.

### Before upgrading from v2.1

> **Flow deployment change**
>
> The Flow chart no longer bundles PSM or NSM. If the existing `flow/flow` Deployment or an active Flow Pod still contains either container, `setup.sh` stops before changing the cluster, even with `--skip-flow` or `--skip-rest`. Move any manager roles in use to RMS or an externally managed endpoint, follow the [manual Flow-only upgrade procedure](https://github.com/dsx-ai-factory/infra-controller/blob/release/v2.2/helm-prereqs/README.md#upgrading-deployments-that-bundled-psm-and-nsm), and verify its rollout before rerunning setup.

The REST PostgreSQL StatefulSet now requests a 10Gi volume instead of 1Gi. On an existing installation, `setup.sh` recreates the StatefulSet when Kubernetes rejects the changed volume claim template, while preserving its running pod and PVC. The existing PVC remains 1Gi unless you expand it on a StorageClass that supports expansion. Follow the [2.1-to-2.2 upgrade note](/infra-controller/documentation/operations-day-2/upgrading-nico#21--22-nico-rest-postgres-volume-size) before upgrading.

### Deployment and credentials

* `helm-prereqs/setup.sh` can reconcile both a new installation and a supported in-place upgrade. The setup flow now provisions RMS, and the [upgrade guide](/infra-controller/documentation/operations-day-2/upgrading-nico) covers prerequisites, backups, verification, and rollback.
* Temporal and Keycloak can optionally use dedicated databases on the shared `nico-pg-cluster`. Both `temporal.useHaPostgres` and `keycloak.useHaPostgres` default to `false`, so existing sites keep the standalone PostgreSQL target until they opt in. Existing data requires the [database migration procedure](https://github.com/dsx-ai-factory/infra-controller/blob/release/v2.2/helm-prereqs/README.md#consolidating-temporalkeycloak-onto-nico-pg-cluster).
* The standard deployment can use a HashiCorp Vault namespace for Kubernetes authentication, token refresh, KV, and PKI requests through `VAULT_NAMESPACE`. Existing deployments without a namespace remain unchanged.

### Host and DPU lifecycle

* Discovery OS supports optional [cloud-init customization](/infra-controller/documentation/provisioning-day-0/discovery-os-cloud-init-scout) for site-specific discovery and validation steps. Scout reports can also validate and reconcile boot-interface selection when Redfish UEFI PCI data is unavailable.
* Managed switches and power shelves now have decommissioning workflows alongside the existing managed-host path. The workflows move hardware out of normal lifecycle management as a site is retired or rebuilt.
* DPF-managed DPU service updates can wait for NICo confirmation that the DPU is running the expected software. Operators can inspect and release maintenance holds when automatic rollout is disabled or a host cannot reach Ready.
* Site Explorer raises its default ingestion concurrency to values measured in a 4,500-host simulation. Sites with explicit values retain those settings.

### Rack, power, and NVLink operations

* REST clients can target one or several NVLink domains for power control and firmware updates. Flow resolves each domain to its current racks and creates the rack tasks; callers no longer need to enumerate those racks themselves.
* Deployments without an external power coordinator can opt in to direct, authenticated DPS Max-Q power management. NICo then manages VPC resource groups and allocated machines' power profiles; direct DPS calls remain disabled by default.
* Switch, power-shelf, rack, and machine health history is available through `nico-admin-cli`, and the Admin UI shows history for switches, power shelves, and racks. NMX-C domain state can also raise `NmxControllerHealth` alerts.

### REST API and observability

* Provider administrators can list DPU Machines at a site or look up one by ID. The direct lookup includes DPU network configuration only when `includeNetworkConfig=true`.
* The site-wide Task endpoint lists tasks across racks and trays with stable pagination. REST instance creation can restrict placement by machine labels, and rack or tray firmware updates can include file-access authentication data.
* Hardware-health collection adds optional switch leak-sensor gNMI telemetry, endpoint TCP reachability, NVIDIA OEM metrics, and switch last-reboot reasons.

### Reliability fixes

* The NVLink Manager can rotate a switch certificate that has already expired, closing the certificate-monitor limitation noted in v2.1.
* DHCP uses a stable server identifier across pod restarts, and DPF provisioning recovers a reboot handshake that could stall the second DPU on a host.
* Fleet-scale fixes reduce database connection pressure during ingestion, increase the PostgreSQL default for large sites, and give the REST site worker more memory headroom.

\
\


Deploy NVIDIA Infra Controller

## August 31, 2026

## NVIDIA Infra Controller v2.1 Maintenance

NICo v2.1 adds Lenovo GB300 NVL72 support, runtime firmware management, site-scale rack operations, expanded REST and CLI administration, and new operator visibility into lifecycle progress. It also strengthens credential management and delivers a packaged bare-metal simulator for repeatable large-scale testing.

### Hardware platform and host lifecycle support

* Lenovo GB300 NVL72 systems now support BMC detection, lifecycle controls, hardware discovery, leak-sensor monitoring, and chassis-based BlueField DPU discovery and pairing.
* Multi-node NVLink capability detection now covers GB300, VR, and future platforms without relying on vendor-specific DMI product names.
* Missing GPUs produce health alerts based on expected SKU inventory.
* [Expected Machine interface declarations](/infra-controller/documentation/provisioning-day-0/configure-expected-machine-interfaces) persist managed-host boot-interface selection as durable desired state and synchronize it across DPU, SuperNIC, integrated-NIC, and zero-DPU hosts.
* Zero-DPU administration now includes CLI creation of flat VPCs and network segments, plus in-place updates to expected-machine host NICs.
* The [managed-host decommission command](../../docs/manuals/nico-admin-cli/commands/managed-host/managed-host-decommission.md) can mark BMC MAC addresses as ignored so DHCP and Site Explorer do not immediately rediscover or reingest removed hardware during tenant-release and decommissioning workflows.
* [DPU LLDP collection](/infra-controller/documentation/operations-day-2/dpu-management/dpu-configuration#dpu-lldp-collection) now configures LLDP-MED for systemd-managed DPUs and uses a bounded, freshness-checked sidecar snapshot for DPF-managed DPUs, keeping physical uplink discovery available in both deployment modes.
* [Scout boot NIC selection](/infra-controller/documentation/operations-day-2/playbooks/stuck-objects/network-connectivity-issues#scout-boot-nic-selection) now keeps discovery networking on the interface named by NICo's boot MAC and removes DHCP, router advertisements, global addresses, and routes from other default-managed Ethernet interfaces. The selection is MAC-based, fail-open, and does not depend on NIC vendor.
* [Image-based operating systems](/infra-controller/documentation/configuration-day-1/image-based-operating-systems) can select `smallest`, an NVMe or SCSI whole-disk path, or a stable `/dev/disk/by-id/` target. Imaging rejects ambiguous filesystem identities on other disks, selects architecture-appropriate EFI shims deterministically, and exposes the disk selector through REST create/update and `nico-admin-cli os-image create`.

### Rack, power, and firmware operations

* NICo can form NMX-C clusters during rack ingestion through RMS and record the active switch.
* Site-wide Flow operations can roll out changes such as firmware updates in controlled phases, limiting each phase to a configurable portion of eligible racks.
* Power-shelf on and off requests can run asynchronously through the power-shelf state controller with lifecycle tracking and per-shelf results.
* Operators can use the [runtime firmware catalog](/infra-controller/documentation/operations-day-2/firmware-updates/configure-firmware-versions) to create, update, and delete host firmware configuration. Firmware objects carry artifact metadata, including URLs and optional checksums, without requiring a NICo redeployment.
* The Core Helm chart now includes the BMC proxy and the defaults described in [RMS configuration](/infra-controller/documentation/configuration-day-1/rms-configuration) for rack and DPS-based power operations.

### REST API, networking, and administration

* The REST API can create, update, and delete SKUs, configure targeted instance creation for tenants, and expose the operations in the [site setup API parity guide](/infra-controller/documentation/provisioning-day-0/site-setup-api-parity) through `nicocli`.
* For FNN VPCs, callers can omit the VPC prefix when creating an instance interface. NICo selects a prefix with available capacity and returns a distinct exhaustion error when capacity must be added.
* Instances can use interfaces from multiple VPCs, and per-interface routing profiles can further restrict anycast advertisements within the VPC-level policy.
* Managed-host state is periodically republished on the DSX exchange so consumers can reconcile state after missing an event.
* `nico-admin-cli` adds a [BIOS factory reset command](../../docs/manuals/nico-admin-cli/commands/redfish/redfish-reset-bios.md) for use before ingestion and supports creating VPCs and network segments.
* Integrated MDS and standalone FMDS now expose `/latest/meta-data/instance-name` from the instance metadata name. The endpoint returns HTTP 404 when no nonempty name is available without changing the existing hostname value.

### Observability and operator experience

* The [metrics and dashboards guide](/infra-controller/documentation/operations-day-2/observability/metrics-and-dashboards) documents an opt-in per-object metrics endpoint that reports machine lifecycle state, state age, SLA status, and manual-intervention signals for fleet-scale troubleshooting.
* A unified instrumentation framework can emit correlated structured logs and bounded-cardinality metrics from the same event. The generated metric catalogue and contract checks cover the new instrumentation, and the [instrumentation guide](/infra-controller/documentation/reference/development/instrumentation) documents how contributors declare and emit events.
* The Admin UI configuration page shows the effective runtime configuration, whether each value is a default or override, and the source of an override.
* Managed hosts can be filtered by an exact active health alert, and large machine and instance lists include an **All** pagination option.
* Control-plane steady-state work has been reduced through batched database queries, connection reuse, concurrent independent requests, and bounded metric growth.

### Credentials and Admin UI security

* NICo can rotate managed BMC and UEFI passwords while a machine is unallocated, and per-model factory-default credentials support mixed BlueField generations at one site.
* NVOS password rotation is a backend-independent, asynchronous workflow with versioned credentials, durable per-switch convergence state, and safe recovery after restarts. Refer to [NVOS password rotation](/infra-controller/documentation/operations-day-2/nvos-password-rotation) for prerequisites and operating procedures.
* The Admin UI uses authentication by default. Helm deployments generate a password in a Kubernetes Secret when basic authentication is selected and no password is supplied.
* Admin UI state-changing requests now include cross-site request forgery protection.

### DPU ToR health and PXE readiness

NICo now waits for a new health report after an HBN configuration change and checks the primary p0 session again immediately before the normal PXE restart. This prevents the premature host restart seen in `v2.1.0-rc.8` while p0 was still recovering. A failed redundant p1 session no longer blocks host state changes.

At the default `min_dpu_functioning_links = 2`, a failed p1 session remains visible but does not prevent allocation or block host state changes. A failed p0 session prevents allocation and normal PXE provisioning. Loss of both sessions prevents allocation and blocks host state changes.

No configuration change is required. An existing value of `1` can remain to suppress the redundant p1 alert, or operators can remove it to restore the default alert visibility. Refer to [DPU ToR uplink health](/infra-controller/documentation/operations-day-2/dpu-management/dpu-configuration#dpu-tor-uplink-health) for the full policy.

### Validation and testing

**machine-a-tron** is a bare-metal simulator that runs end-to-end NICo provisioning flows — Site Explorer, DHCP, PXE, ingestion, and state machines — against mock Redfish BMC endpoints without physical servers or DPUs. It supports standalone hosts and GB300 rack lifecycles and has been validated at 4,500 simulated hosts with two DPUs each (13,500 endpoints) in one unattended run.

It ships as the `nico-machine-a-tron` Helm subchart, enabled with `nico-machine-a-tron.enabled=true`. The `helm-prereqs/setup-machine-a-tron.sh` workflow handles namespace creation, credential seeding, BMC proxy configuration, and verification. Refer to the [machine-a-tron deployment guide](/infra-controller/documentation/reference/development/machine-a-tron-deployment) for build and deployment instructions.

machine-a-tron is intended for simulation-only clusters and must not run alongside real hardware. v2.1 is the first release that includes it.

### Known issues

* The NVLink Manager certificate monitor cannot automatically rotate an NVLink switch certificate that has already expired because it cannot establish the TLS connection needed to inspect the certificate. It logs the connection error without starting rotation. Track the fix in [GitHub issue #4568](https://github.com/dsx-ai-factory/infra-controller/issues/4568).

\
\


Deploy NVIDIA Infra Controller

## July 31, 2026

## NVIDIA Infra Controller v2.0 EOL

NICo v2.0 expands bare-metal lifecycle management with built-in NTP, broader hardware telemetry, multi-architecture support, and stronger security and operational controls.

Before upgrading an existing deployment, review the REST API database migration requirements below.

> **Upgrade note: REST database consolidation**
>
> The NICo REST API database has moved from a standalone PostgreSQL instance to the shared Zalando-managed `nico-pg-cluster`. A new `nico_rest` database and `nico-rest.nico` user are provisioned automatically (gated on `rest.enabled: true`). Database credentials are now synced by External Secrets Operator as the `nico-rest-pg-creds` secret in the `nico-rest` namespace, replacing the former `db-creds` secret.
>
> To upgrade from v0.x, do the following:
>
> 1. Back up the REST database from the old standalone PostgreSQL pod.
> 2. Run `./setup.sh --skip-rest` to provision the prerequisites and External Secrets without starting the REST chart or its migration job.
> 3. Quiesce all writes to the existing REST API.
> 4. Restore the backup into `nico_rest` on `nico-pg-cluster`.
> 5. Rerun `./setup.sh` without `--skip-rest`.
>
>    The REST chart and `nico-rest-db` migration job start only after the restore is complete.

### NTP service

NICo now ships a built-in NTP service. The `nico-ntp` subchart deploys a 3-replica [chrony](https://chrony-project.org/) StatefulSet, each replica exposed on its own MetalLB LoadBalancer VIP so DPUs have a stable, site-local clock source. The Kea DHCP hook advertises these VIPs to DPUs as DHCP option 42 NTP servers.

Enable the service by setting `nico-ntp.externalService.enabled: true`, assigning three VIPs via `nico-ntp.externalService.perPodAnnotations`, and setting `nico-dhcp.config.kea.hookParameters.ntpServer` to the same VIPs (comma-separated). Enterprise NTP servers in `siteConfig.ntp_servers` continue to be used for BMC pre-ingestion time sync and can coexist with `nico-ntp`. Upstream NTP peers default to `time1.google.com` through `time4.google.com`; override via `nico-ntp.ntp.upstreamServers` for air-gapped environments.

### NVSwitch credential rotation

The Vault policy for the `nico-vault-policy` role now includes full access to the `switch_nvos` credential paths, enabling automated NVSwitch NVOS credential rotation. `secret/data/switch_nvos/*` gains create, read, patch, list, update, and delete; `secret/metadata/switch_nvos/*` gains list, read, and delete; `secret/destroy/switch_nvos/*` gains update (KV v2 destroys versions via update, not delete). No operator action is required — the policy is applied automatically by `setup.sh` on install or upgrade.

### Networking & DNS

* End-to-end reverse DNS (PTR) support for both host and overlay instance addresses
* IPv6 dual-stack allocation for FNN segments
* Automatic reverse-DNS zone creation and lifecycle management
* Forward DNS resolution for overlay instance addresses

### Hardware Monitoring & Telemetry

* NVOS gNMI telemetry collector for switch component, interface, and system data
* NVLink domain health records with full API and database support
* Transceiver-exporter sidecar for module EEPROM/DOM data visibility
* Hardware health metrics collection from Redfish Metrics endpoint
* Physical chassis intrusion event detection from BMC logs

### DPU & Host Management

* Zero-DPU support for instance allocation on hosts without DPUs
* DPU-to-NIC mode conversion with automatic power cycling
* Boot interface selection decoupled from DPU management
* Last-seen forge-scout version tracking for machines

### Machine Identity & Security

* Site master encryption key (KEK) rotation for SPIFFE machine identity
* Separate Vault credential location for SuperNIC Lockdown Identity Key Material
* Alternative credentials storage backend using Postgres with envelope encryption
* W3C Trace Context propagation across network boundaries

### Component Management & Power Control

* Power control operations (on/off/reset) extended to switches
* Compute tray management integrated through RMS backend
* Bypass-state-controller flag enabling direct power and firmware commands

### Validation & Testing

* Machine validation test execution tracking with run items and attempts
* Heartbeat-based reliability for validation runs with stale-attempt reconciliation
* RVS artifact pre-caching pipeline with concurrent downloads and SHA-256 verification

### Multi-Architecture Support

* Full end-to-end multi-arch (amd64 + arm64) implementation
* Multi-arch container image builds for core control-plane

### Operational Improvements

* Admin CLI renamed to nico-admin-cli; several commands restructured
* Force-delete racks endpoint for cleanup operations
* Concurrent paged list fetching improving admin CLI performance
* BMC proxy now streams responses instead of buffering
* DNS negative-response caching with per-status TTLs and LRU eviction

### Documentation

* Day 2 Operations guides covering monitoring, firmware updates, and lifecycle cleanup
* Machine Identity (SPIFFE) configuration documentation
* Consolidated Configurability guide covering all four configuration layers
* Authentication/authorization flow documentation with diagrams

\
\


Deploy NVIDIA Infra Controller

## May 15, 2026

## NVIDIA Infra Controller v0.8 EOL

NVIDIA Infra Controller v0.8 introduced a unified documentation site, simplified deployment, and expanded rack-level administration for GB200 systems.

### Compatibility

* NICo Core v0.8.0
* NICo REST API v1.4.2
* NICo REST Site Agent v1.4.2
* BlueField-3 DPU NIC firmware 32.47.2682
* HBN 3.2.2-doca3.2.2

### Deployment and rack-level administration

The `helm-prereqs` workflow uses Helm and Helmfile to install MetalLB, the Zalando PostgreSQL Operator, cert-manager, Vault, External Secrets, NICo Core, and NICo REST. Its `setup.sh`, `preflight.sh`, and `clean.sh` orchestration and validation scripts reduce the work required to install the complete stack.

Rack-level REST APIs support listing, validation, power control, firmware updates, and bring-up for individual racks and batches. Lifecycle management now covers GB200 racks, NVLink switches, and power shelves, with rack-level operations and tray-level control for compute, NVSwitch, and power-shelf trays.

### Networking, BMC, health, and observability

* Managed-host DPUs support BGP session passwords, and instance creation and updates can select explicit IP addresses within a VPC prefix.
* VPC peering VNI and prefix lists are returned in deterministic order, reserved IP addresses are rejected during interface updates, instance status can be filtered by power status, and unknown query parameters return HTTP 400.
* BMCs support static IP assignment.
* Health alerts support configurable severity thresholds, the REST API supports NVUE health checks, and NICo collects NMX-T switch metrics.

### Identity, security, UI, and platform updates

* Credential APIs manage BMC and UEFI credentials, SuperNIC lockdown key management is available, and Vault connections verify TLS certificates.
* The Admin UI includes IPAM views for DHCP, DNS, and networks, plus expected-rack component details. A hardcoded debug UI credential was removed.
* `libredfish` was updated from v0.39.2 to v0.43.10, and the x86 QCOW imager now uses Ubuntu 24.04.

### Reliability and cleanup

Expected Machine OpenAPI definitions now handle BMC default-user fields correctly. Error attribution, RLA validation, inventory synchronization, single and batch instance APIs, and `nvLinkLogicalPartitionId` validation were improved. IPAM and related services require TLS certificates by default, while deprecated IPAM server code and legacy database relationships were removed.

Deploy NVIDIA Infra Controller

## February 12, 2026

## NVIDIA Infra Controller v0.2 EOL

NVIDIA Infra Controller v0.2 made the project available as open-source software and expanded its APIs, orchestration, and hardware lifecycle support.

### APIs and orchestration

* The REST API supports external identity providers for JWT authentication and batch instance creation through `/nico/instance/batch`.
* Instances can be rebooted by `instance_id` as well as `machine_id`.
* State handling is split between a `PeriodicEnqueuer`, which schedules work for managed resources, and a `StateProcessor`, which dequeues and runs state handlers.
* State handlers are rescheduled immediately after a `Transition` outcome or a detected DPU version change, reducing waits for transitions such as `WaitingForNetworkConfig` by up to 30 seconds.

### Provisioning and hardware management

* Pre-ingestion sets the system time zone to UTC when the clock is out of sync so NTP timestamps are interpreted correctly.
* The Scout agent can securely erase NVMe devices asynchronously.
* NVLink interfaces enter Pending while updates are sent, and NVLink Logical Partition inventory metadata updates are more reliable.
* `DpuExtensionService` supports `name` for `orderBy`, and `ExpectedMachine` objects support bulk creation and updates.

### Platform update and bug fix

The Go toolchain was updated to v1.25.4 and `nv-redfish` to v0.1.3. The `nv-redfish` update fixes a critical BMC cache bug that caused repeated cache misses and prevented health-monitor rediscovery.

Deploy NVIDIA Infra Controller

## January 23, 2026

## NVIDIA Infra Controller EA EOL

NVIDIA Infra Controller EA introduced a self-hosted, disconnected deployment model with source and build instructions that do not depend on NGC.

### GB200 and NVLink capabilities

* Provision single- or dual-DPU systems.
* Ingest GB200 compute trays, validate their SKUs, and assign instance types.
* Create allocations and instances, create an NVLink partition, select an instance, and apply its NVLink configuration through the Admin CLI.

### Deployment requirements

* **Software:** Kubernetes, PostgreSQL, Vault, certificate management, and Temporal.
* **Hardware:** Compatible x86 nodes, NIC firmware, BMCs, and switches supporting BGP, EVPN, and RFC 5549 unnumbered IP interfaces.
* **Network:** Preconfigured L2/L3 connectivity, DHCP and PXE services, out-of-band management networks, switch-side ports, IP prefixes, ASNs, and EVPN VNIs.
* **External systems:** DNS resolvers, NTP, an OIDC identity provider such as Azure OIDC or Keycloak, and an OpenTelemetry-compatible observability stack.

Supported switch capabilities include B3220 BF-3 optics compatibility, IPv4 and IPv6 unicast BGP, EVPN BGP, external BGP ASNs, LLDP, RFC 5549 unnumbered routed ports, and DHCP relay with option 82.

Deploy NVIDIA Infra Controller