Kubeflow Platform v1.10.1 is a patch release focused on component manifest synchronization and CI/test fixes, with two operator-visible changes: Spark Operator is now enabled by default and Istio sidecar injection moved from annotations to labels. No security fixes are included.
breakingSpark Operator now deployed by default
Spark Operator is now enabled by default in the Kubeflow Platform manifests, whereas previously it required explicit opt-in. Clusters upgrading to v1.10.1 will deploy Spark Operator unless it is explicitly disabled in the kustomization.
breakingIstio sidecar injection switched from annotations to labels
Istio sidecar injection is now controlled via labels instead of annotations. Review any custom manifests or overlays that set sidecar injection through annotations, since they may no longer take effect.
Key changes (7)
- Spark Operator is now enabled by default (previously opt-in)
- Istio sidecar injection moved from annotations to labels
- Fixed service account token JWT issuer error
- Component manifest sync: KServe v0.15.0 (web app v0.14.0), model-registry v0.2.17, spark-operator 2.1.1, Pipelines 2.5.0, Training Operator v1.9.2
- Various bug fixes: Knative Serving 404 via example.com patch, cert-manager readiness checks for KServe, Pod Security Standards warnings for cluster-local-gateway/knative-serving
- Profiles integrated with SeaweedFS; PodDisruptionBudget workaround documented
- CI/CD improvements: install_katib updates, removal of KServe DNS test patches, pipelines GHA switched to Istio CNI