microsoft/ltp-platform v1.7

Release v1.7.0

Repository: microsoft/ltp-platform

Tag: v1.7

Published: 2026-10-13T06:37:44Z

Prerelease: no

Release notes: We are pleased to announce the official release of Lucia Training Platform v1.7.0!

Lucia Training Platform v1.7.0 Release Notes

This release focuses on node recovery reliability, runtime modernization, infrastructure upgrades, and security hardening across the platform.

Platform Features & Bug Fixes

• Improved error reporting in cluster-utilization: failures to retrieve Lucia utilization reports or send alerts are now logged
• Updated tools/revokeUserTokens.py to revoke user tokens through the rest-server API instead of deleting Kubernetes Secrets directly, so rest-server's token cache is also cleared; the tool saves and restores the alert-manager application token
• Fixed InfiniBand detection in job-exporter's network monitoring container: it now checks the mounted host directory /hostsys/class/infiniband instead of requiring lspci
• Set imagePullPolicy: Always for job-exporter's GPU, network, and node monitoring containers so they check the registry on startup rather than reuse a stale cached image when a tag is updated

Runtime & Container Updates

• Upgraded the build and runtime container images for rest-server, database-controller, alert-handler, and job-status-change-notification from Node.js 20 to Node.js 24
• Upgraded the Node.js version used to build Grafana's frontend from 20 to 24
• Upgraded the Python runtime images for openpai-runtime, cert-expiration-checker, cluster-utilization, and postgresql-sdk from Python 3.10 to Python 3.12
• Updated the SSH and storage-mount package caches bundled in the openpai-runtime image: removed the Ubuntu 20.04 cache, added an Ubuntu 24.04 cache, and retained the Ubuntu 22.04 cache
• Changed redis-monitoring's base image from redis:7-bullseye to redis:7-bookworm, moving from Debian 11 to Debian 12 while retaining Redis 7

Infrastructure & Networking

• Upgraded Cilium agent and operator from 1.18.9 to 1.20.2 and updated the accompanying Cilium Envoy image from the 1.36.6 to the 1.37.6 release
• Changed Cilium image publishing and the AKS deployment manifest to use version-and-date tags, allowing rebuilt images to receive new tags without replacing earlier release tags
• Updated src/cilium/build/push.sh to skip images that have not been built locally and continue pushing the available images
• Upgraded Prometheus from 2.51.2 to 3.14.0, retaining legacy metric-name validation in its configuration
• Upgraded node-exporter from 1.8.0 to 1.12.1 and updated its filesystem exclusion flag to the name supported by the new version
• Upgraded Alertmanager from 0.29.0 to 0.34.1; Prometheus, node-exporter, and Alertmanager are now built from source so dependency security fixes can be included
• Upgraded the NVIDIA device-plugin image from 0.18.0 to 0.20.0 and updated the Kubernetes deployment manifest to use the same release
• Replaced cluster-local-storage's download of an unpinned AzCopy binary with a source build pinned to AzCopy 10.32.8, including an updated golang.org/x/crypto dependency
• Changed the AKS managed-cluster resource API in the Bicep deployment templates from 2024-03-02-preview to the stable 2024-05-01 version
• Changed cluster configuration deployment to warn and skip node-label updates for layout entries whose nodes no longer exist in Kubernetes

Alert Manager & Node Management

• Added cluster Endpoint filters to Kusto node-status and node-action queries so nodes with the same hostname in different clusters are not mixed together
• Added stage-specific candidate filtering to node-recycler: hardware repair and validation require nodes to be listed in layout.yaml and present in Kubernetes; validation also requires the Kubernetes Ready condition to be True
• Loaded and cached layout.yaml once per node-recycler process; retry node-list requests through rest-server with exponential backoff, and skip the affected repair or validation stage if those requests continue to fail
• Fixed alert-parser's handling of successful validation: validating nodes now transition to available_nodata, meaning validation passed but storage synchronization must finish before the node is uncordoned and made available for jobs
• Fixed alert-parser's handling of failed validation: nodes transition to triaged_unknown and remain cordoned for manual investigation, rather than re-entering automatic classification and hardware repair
• Kept RecoverValidatedNodes success alerts at info severity and changed CordonValidationFailedNodes failure alerts to error; alert-parser now explicitly fetches success alerts for validating nodes and records transitions using the corresponding validation alert's details and timestamp

Security

• Fixed an OIDC login redirect vulnerability in rest-server that could send newly issued cluster bearer tokens to an attacker-controlled URL; login completion is restricted to the configured portal's /index.html, return-page URLs must stay on the portal origin, and error redirects are also validated
• Updated the Go compiler used for frameworkcontroller, frameworkbarrier, hivedscheduler, and watchdog images to 1.25.13, and updated their golang.org/x/text dependency to 0.41.0
• Updated Go compilers and dependencies in device-plugin, Cilium, kube-scheduler, Grafana, reverseproxy, and monitoring image builds, including security fixes in golang.org/x/crypto and gRPC where applicable
• Updated vulnerable JavaScript dependencies across rest-server, database-controller, webportal, alert-handler, and job-status-change-notification, including axios, qs, morgan, DOMPurify, brace-expansion, and ip-address where used
• Updated container base images and applied distribution package updates in affected image builds to address operating system security findings
• Upgraded Pylon's NGINX base image from 1.29.4 to 1.30.4 and set server_tokens off to stop exposing the NGINX version in responses
• Updated job-exporter's nerdctl build to include containerd 2.3.6, addressing a vulnerability in its containerd dependency

CI/CD

• Changed the job container in the Build & Deploy Changed Services workflow from ubuntu:latest to ubuntu:24.04; the self-hosted runner remains unchanged
• Upgraded the GitHub Action that checks out repository code in that workflow from actions/checkout@v4 to actions/checkout@v5
• Added a manual workflow trigger with a deploy...