On this page · 7 sections
TL;DR
KServe v0.21.0, released on September 25, restructures CRD management so CRDs can be installed independently, replaces the LLM tokenizer sidecar, adds direct KEDA scaling with true scale-to-zero, and fixes canary routing for RawDeployment. It also fixes a path traversal in AutoGluon model loading and upgrades KEDA to v2.20.2, Go to 1.26 and Envoy AI Gateway to v1.1.0. Teams that tested v0.21.0-rc1 should note that the final release added install manifests rc1 was missing.
Changes That Affect Installation and Upgrades #
| Change | Who is affected | Pull request |
|---|---|---|
| CRD management restructured for independent installation | Everyone installing or upgrading KServe with manifests or scripts | #5843 |
| Install script updated for older versions, plus a new install script | Users of the quick-install scripts | #6061, #6101 |
| Missing install manifests for v0.21.0-rc1 generated | Anyone who tested rc1 | #6273 |
| LLM tokenizer sidecar over UDS replaced by a vLLM render deployment | LLMInferenceService users with tokenization | #5712 |
| Workload Variant Autoscaler moved from the VA CRD to annotation-based discovery | LLMInferenceService users of WVA | #5722 |
TLS version and cipher flags for all controllers; --enable-http2 removed from llmisvc | Operators that pass controller flags | #5791 |
Deprecated llm-d plugin removed and --vllm-port renamed to --model-server-port in pd-sidecar configs | Custom LLM scheduler configurations | #6067 |
Autoscaling: Direct KEDA Scaling and Scale-to-Zero #
LLMInferenceService gains direct KEDA scaling (#5839), and idleReplicaCount=0 is now allowed for true KEDA scale-to-zero (#5996). triggerAuthName works without authModes (#6004), components without autoScaling no longer get a KEDA ScaledObject (#6029), and the bundled KEDA moves to v2.20.2 (#6153). A rolloutStrategy field controls rolling updates for LLMInferenceService (#5916).
Canary Routing Fixes #
RawDeployment HTTPRoutes gain canary traffic splitting (#5912). Three fixes follow: canary traffic is gated on readiness to prevent transient 503 errors (#5984), canary weights are restricted to predictor rules (#5944), and orphaned autoscaler and OpenTelemetry resources are cleaned up when a canary is promoted (#5899).
Security Fixes and Dependency Updates #
v0.21.0 fixes a path traversal in AutoGluon model loading (#5802) and improves AutoGluon artifact loading security (#5803). Controllers can reload rotated TLS certificates (#6106), and the transformer accepts SSL configuration and injects a CA bundle for httpx. The release updates dependencies for these CVEs: CVE-2026-32274 (black), CVE-2026-40192 and GHSA-whj4-6x5x-4v2j, CVE-2026-54058 and CVE-2026-59200 (Pillow), CVE-2026-69247 (cryptography), CVE-2026-46595 (golang.org/x/crypto), CVE-2026-59885 (pyasn1), CVE-2026-21441 (urllib3), CVE-2026-39883 (OpenTelemetry Go) and CVE-2025-47273 (setuptools), and go-jose v4.1.4 for GHSA-78h2-9frx-2jm8.
Other Additions #
- Python 3.13 support (#5897), with pyjnius 1.7.0 for the PMML server.
- resourceClaims for Dynamic Resource Allocation in ServingRuntimes (#5828) and InferenceService tracing configuration (#6108).
- ModelScope downloads with the
ms://scheme (#5330), KServe-side OCI image pulls withoci+fetch://, and Power support for the storage initializer (#5235). - localModelCache support for LoRA adapters (#5690) and an initial kernel cache code donation with signature verification.
Upgrading to v0.21.0 #
- Read #5843 before upgrading, since CRDs now install separately, and use the updated install scripts.
- Replace any v0.21.0-rc1 installation with the final release, which carries the install manifests rc1 lacked.
- For LLMInferenceService, move WVA configuration from the VA CRD to annotations and expect the vLLM render deployment instead of the tokenizer sidecar.
- Rename
--vllm-portto--model-server-portin custom pd-sidecar configurations and drop--enable-http2from llmisvc flags. - Upgrade AutoGluon serving workloads promptly because of the path traversal fix.
The Sentinel’s Call
Teams upgrading to KServe v0.21.0 should plan around the new CRD installation and, for LLMInferenceService, the WVA and tokenizer changes, which need configuration edits. Anyone still on v0.21.0-rc1 should move to the final release for its complete install manifests. AutoGluon users gain a path traversal fix that alone justifies the upgrade.
Our judgement, drawn only from the facts and sources above.
Sources
- Release v0.21.0 · kserve/kserve · GitHub github.com · Sep 25, 2026
- Release v0.21.0-rc1 · kserve/kserve · GitHub github.com · Sep 23, 2026
- kserve/kserve#5791: feat: integrate with cluster TLS security profile github.com · Jul 23, 2026 · Reference
Next reading
Edited and approved by Jarosław Krzemiński. Spotted a mistake? Report a correction or read the corrections policy.
Comments