KServe v0.21.0: CRD Restructuring, KEDA Scaling and Canary Routing Changes

What the release notes contain #

The KServe v0.21.0 release notes are a single list of pull requests, each with a conventional-commit style title, an author and a pull request number. The list covers features, fixes, CI and test work, documentation and dependency updates. The excerpt provided ends partway through an entry (a fix for llmisvc that mentions "disambiguate coll"), so this analysis covers only the entries shown in the source text.

The KServe v0.21.0-rc1 release notes contain the same list of entries and are cut off at the same point. Because the two lists match, every change below is listed in both releases. Each change is attributed here to v0.21.0, and the rc1 notes are cited as the second source. The source metadata gives a published date of 2026-09-25 for v0.21.0 and 2026-09-23 for v0.21.0-rc1.

The table below groups the most operationally relevant entries. Pull request numbers are plain references to the list, and the action column is limited to checks that follow from the entry titles.

CRD management and installation #

The v0.21.0 list includes "feat: restructure CRD management for independent installation" (#5843) by Jooho. The title states the goal of independent installation, but the excerpt does not describe the new installation procedure. Anyone who manages KServe CRDs separately should read the upstream installation documentation for this release rather than relying on this summary.

The same release also includes "fix: update kserve install script for old version/add a new install script" (#6061) and "refactor: kustomize image overrides and add deploy-dev-kind-localmodel" (#6060). These entries touch install scripts and kustomize image handling. The source does not describe the behaviour of either script, so the only supported statement is that both entries appear in the list.

LLMISVC autoscaling with KEDA #

Several entries concern KEDA-based scaling for LLM inference services. The v0.21.0 list includes "feat(llmisvc): add direct KEDA scaling" (#5839) by 0-Zaid-0, and "feat(llmisvc): allow idleReplicaCount=0 for true KEDA scale-to-zero" (#5996) by vivekk16. The second title uses the phrase "true KEDA scale-to-zero", which is the wording of the entry itself. The entries do not state how the behaviour differs from earlier versions, so this article does not make that comparison.

Two further entries address the scope of KEDA objects. "fix(autoscaler): skip KEDA ScaledObject for components without autoScaling" (#6029) by spolti limits ScaledObject creation to components with autoscaling configured. The list also includes "test(llmisvc): extend e2e coverage for standalone KEDA autoscaling" (#6018) and "test(llmisvc): add reverse direct KEDA/WVA actuator case to v1alpha2" (#5995). These test entries show that KEDA and WVA actuator paths were covered by additional end-to-end tests, but the excerpt does not report test results.

For users who run LLMISVC with autoscaling, the practical reading of these entries is that scaling configuration should be checked after the upgrade. The entries do not state default values or migration steps, so operators should confirm those details in the linked release notes and in their own manifests.

LLMISVC migrations for WVA, tokenizer and EndpointPicker #

Three llmisvc entries move configuration to new mechanisms. "feat(llmisvc): replace UDS tokenizer sidecar with vLLM render deployment" (#5712) by vivekk16 replaces a sidecar with a render deployment. "feat(llmisvc): migrate WVA from VA CRD to annotation-based discovery" (#5722) by vivekk16 changes how WVA is discovered. "chore(llmisvc): migrate EndpointPickerConfig apiversion" (#5774) by zdtsw updates the API version used for EndpointPickerConfig.

Each of these entries changes an existing configuration surface. The release notes list the changes, but the excerpt does not include the new field names, annotation keys or API version values. Operators should therefore compare their LLMISVC manifests with the current documentation for this release before applying them.

The release also includes "feat(llmisvc): migrate deprecated flag to metrics-data-source plugin" (#5877), "chore(llmisvc): remove deprecated plugin and rename flag" (#6067) and "feat(llmisvc): migrate remaining --model-server-metrics-* flags for llm-d" (#5930). The titles reference flag migrations. The source does not list the old and new flag names, so this article does not state them.

Canary rollouts on RawDeployment #

Canary-related entries appear in both the functional and test parts of the list. "feat: add canary traffic splitting to RawDeployment HTTPRoutes" (#5912) by maskarb adds traffic splitting to HTTPRoutes for RawDeployment. "fix(httproute): restrict canary weights to predictor rules only" (#5944) by maskarb limits canary weights to predictor rules. Taken together, the two titles describe weight handling for predictor routes. The excerpt does not describe the route structure, so the details must come from the linked notes.

The list also includes "fix(isvc): gate canary traffic on readiness to prevent transient 503s" (#5984) by yuzisun. The title names a specific symptom, transient 503 responses, and the fix that gates canary traffic on readiness. The release notes do not give reproduction steps or timing data, so this article does not quantify the effect.

Several test entries cover canary lifecycle behaviour, including "test(e2e): add canary deployment lifecycle tests" (#5833) and "test(llmisvc): e2e tests for canary deployment" (#5849). These show canary lifecycle coverage in the test suite. They are not evidence of production behaviour.

Security, dependencies and RBAC #

The list contains many dependency entries with CVE identifiers taken from the titles. Examples include "fix(deps): bump cryptography to >=50.0.0 (CVE-2026-69247)" (#5999), "fix: upgrade Pillow to >=12.2.0 (CVE-2026-40192 / GHSA-whj4-6x5x-4v2j)" (#5959), "fix: bump Pillow to >=12.3.0 to patch CVE-2026-54058" (#5998), and "fix(deps): pin urllib3>=2.6.3 to address CVE-2026-21441" (#6023). Each title names the package and, where present, the advisory identifier. The excerpt does not state which KServe images or components include each package, so operators should check their own dependency trees.

Dependency work also includes "fix(deps): bump setuptools to 78.1.1 in python/kserve (CVE-2025-47273)" (#6055) and "fix(qpext): bump opentelemetry-go to v1.43.0 to address CVE-2026-39883" (#6019). Because the titles name different components, a single rebuild may not cover every change. The safest reading of the list is that each affected module should be rebuilt and its resolved versions checked.

On the RBAC side, "fix(rbac): harden controller manager ClusterRoles" (#5785) by mholder6 is the main entry. A related entry, "fix(llmisvc): grant configmap write RBAC for CA bundle sync" (#5965) by cabrinha, adds configmap write permission for CA bundle synchronisation. Administrators who use custom RBAC rules should compare them with the updated roles in this release.

Python packages and storage #

The list includes "feat: add support for Python 3.13" (#5897) by noah4477 and "fix(pmmlserver): bump pyjnius to 1.7.0 for Python 3.13 support" (#5978) by kliukovkin. Together they cover Python 3.13 support in the listed components. Teams that run Python 3.13 should test their workloads against these packages, but the excerpt does not list the full set of supported components.

Storage-related entries include "feat(storage): add oci+fetch:// KServe-side OCI image pull (Step 3, #4083)" (#5739) by kliukovkin and "feat: add ModelScope storage download support (ms:// URI scheme)" (#5330) by xrwang8. The first title refers to a step in a larger effort, indicated by the reference to #4083. The second adds a new URI scheme. The source does not show usage examples, so this article does not provide them.

The list also contains "feat: improve autogluon artifact loading security" (#5803) by ZabinskiMichal and "fix: support both full JWK and raw key formats in JWE decryption" (#6034) by maskarb. Both entries affect how artifacts or keys are handled. The titles are the only information in the source, so the details should be taken from the linked notes.

Upgrade checklist #

1. Open the KServe v0.21.0 release notes and confirm the exact tag you plan to deploy.
2. Read the v0.21.0-rc1 release notes if you tested that candidate, and note that its listed entries match the final list in the excerpts provided.
3. Check how your cluster installs KServe CRDs, and review entry #5843 before changing the installation method.
4. Inventory LLMISVC resources that use WVA annotations, the tokenizer sidecar, EndpointPickerConfig or deprecated metrics flags, and compare them with the current documentation for this release.
5. If you use KEDA with LLMISVC, test scale-up and scale-to-zero in a non-production namespace, including the idleReplicaCount=0 setting from entry #5996.
6. For RawDeployment canaries, verify HTTPRoute weights and the readiness gating described in entries #5912, #5944 and #5984.
7. Review the controller ClusterRoles and any custom RBAC bindings against the hardened roles in entry #5785.
8. Rebuild container images that include the dependencies named in the security entries, and record the resolved versions of cryptography, Pillow, urllib3, setuptools and opentelemetry-go.
9. If you use Python 3.13, run your test suite against the packages affected by entries #5897 and #5978.

Takeaways #