> This page is for version 1.1.0.
> For other versions, use one of these documentation indexes:
> - 1.0.4 (default): https://docs.nvidia.com/nvcf/1.0.4/llms.txt
> - 1.1.0: https://docs.nvidia.com/nvcf/1.1.0/llms.txt
> - 1.0.3: https://docs.nvidia.com/nvcf/1.0.3/llms.txt
> - 1.0.2: https://docs.nvidia.com/nvcf/1.0.2/llms.txt
> - 1.0.1: https://docs.nvidia.com/nvcf/1.0.1/llms.txt
> - Development: https://docs.nvidia.com/nvcf/dev/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nvcf/llms.txt.

# Release 0.6.1

## Release 0.6.1

NVCF Self-Hosted 0.6.1 is a maintenance release. It updates OpenBao to address
security issues in the runtime and migration images. It also replaces the
archived Bitnami Cassandra runtime with the official Apache Cassandra 5.0.8
image and an in-house Cassandra Helm chart.

### Highlights

| Change                  | Status | Summary                                                                                                                                    |
| ----------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
| OpenBao security update | GA     | OpenBao uses the remediated runtime and migration images. Existing installations must continue through 0.6.2 before rotating server pods.  |
| Cassandra off Bitnami   | GA     | Cassandra runs on the official Apache Cassandra 5.0.8 image, deployed by an in-house Helm chart, replacing the Bitnami image and subchart. |

### Cassandra runtime and chart

The Cassandra runtime image is now built on the official Apache Cassandra 5.0.8
image instead of the archived Bitnami image, and the Bitnami Cassandra Helm
subchart is replaced by an in-house StatefulSet chart. This removes the
CVE-affected Bitnami base and its bundled components while keeping the same
operational surface: PasswordAuthenticator and CassandraAuthorizer, stable-DNS
seed discovery, the Prometheus metrics exporter, keyspace initialization, and
schema migrations.

The chart runs the nodes with `storage_compatibility_mode: NONE` to match the
existing fleet's on-disk and streaming format.

### Upgrade Notes

Fresh installs need no special handling; Cassandra comes up on the official
image with the in-house chart.

Existing clusters that already hold data need a migration, because the runtime
image, the Helm chart shape, and the on-disk data layout all change. A normal
in-place Helm upgrade does not carry an existing Bitnami-based cluster onto the
new stack. Follow the
[0.6.0 to 0.6.1 Upgrade](/nvcf/1.1.0/release-notes/legacy-0-6-0-to-0-6-1-upgrade) procedure, which describes
the supported migration methods (datacenter expansion, in-place volume
adoption, backup and restore) and their trade-offs.

### OpenBao security update

The OpenBao StatefulSet uses `OnDelete`. A Helm upgrade updates its pod
configuration and the injector, but existing server pods keep running their
previous images. A successful Helm upgrade alone does not complete this
security update.

For an existing 0.6.0 installation, apply the full 0.6.1 stack after the
[Cassandra migration](/nvcf/1.1.0/release-notes/legacy-0-6-0-to-0-6-1-upgrade), then continue through the
[0.6.1 to 0.6.2 upgrade](/nvcf/1.1.0/release-notes/0-6-1-to-0-6-2-upgrade). Keep the healthy OpenBao
server pods running at the 0.6.1 checkpoint. Do not restart them there: 0.6.1
does not refresh the stored JWT plugin checksum to match the new binary.

The 0.6.2 procedure refreshes the plugin catalog, verifies the migration, and
replaces stale server pods one at a time while preserving Raft quorum and
persistent volumes. It checks the images actually running in each pod, even
when the StatefulSet template did not change between 0.6.1 and 0.6.2. Fresh
authentication and secret injection checks confirm that the new runtime works.

Follow that procedure as the source of truth for the rotation order and health
checks. Do not delete OpenBao persistent volume claims or reinitialize the
cluster during the upgrade.