BullSequana AI 1.2.0

← All release notes

Released: July 21, 2026

Executive summary

This release adds file and GPT sharing, a redesigned Service Desk configuration, admin branding customization, new settings pages for resource profiles and API keys, and significant improvements to the model deployment and setup workflows.

It also delivers a substantial platform overhaul: Python-native manifest generation replaces Terraform/OpenTofu, Argo CD adopts an app-of-apps topology, networking moves to Kubernetes Gateway API, object storage moves to Rook-Ceph, and deployment security and validation are strengthened.

What's new?

• Custom GPT sharing: share any Custom GPT with users or Keycloak groups from the GPT card. Assign Viewer (use only), Editor (use and edit), or Owner (full control) roles. Only the GPT owner or an org admin can open the share panel. See the current Chat & Work: Share an Agent.

• File sharing: share files and folders with users or groups from the Files area. A My Files / Shared toggle switches between owned and shared content. Subfolder URLs are bookmarkable and persist across renames. Shared files with RAG Available status appear in the chat RAG picker. See Chat & Work: Sharing files.

• Resource Profiles settings: new settings page listing all infrastructure resource profiles available for model deployment. Operators can enable or disable individual profiles to control what appears in Easy Setup and Advanced Setup. Requires can_manage_models.

• API Keys settings: new settings page for creating personal API keys for programmatic access. The full key secret is shown only once at creation time and is scoped to the authenticated user. See Chat & Work: API Keys.

• Admin Branding: new settings page (requires can_edit_config) for customizing portal appearance. Includes a color token editor with WCAG 2.1 contrast badges for light and dark mode, a border radius slider, logo upload, CSS/tweakcn JSON import, and a live preview panel with Theme, Chat, Files table, and GPT Cards tabs. Applied themes sync instantly to all open browser tabs. See the current Tenant settings: Theme guide.

• Python-native platform deployment: platform configuration and manifest generation now use Python 3.12, TOML, and Jinja2. The CLI renders Kubernetes resources, resolves environment overrides, seals secrets, generates Argo CD applications, and pushes the output to the GitOps repository.

• Argo CD app-of-apps architecture: applications are organized into ordered common, coreai, and proai parent applications. Automated pruning, self-healing, retries, server-side apply, and component-specific drift handling are enabled.

• Kubernetes Gateway API networking: Envoy Gateway and HTTPRoute resources provide the platform ingress path. JWT authentication, CORS policies, cross-namespace ReferenceGrant resources, and Gateway API routing protect platform services.

• Rook-Ceph storage platform: Rook-Ceph RGW provides S3-compatible object storage. Platform services receive dedicated object-store users and policies. Ceph dashboard SSO, TLS, IAM bootstrapping, orphan cleanup, and dedicated Ceph CSI drivers are included.

• KServe model serving: KServe and its CRDs have been added to the CoreAI application stack, including Ceph RGW integration for model storage.

• Speech-to-text infrastructure: the backend deployment now includes Speaches-based Whisper inference, configurable CPU or GPU execution, separate default models for each mode, and persistent model pre-downloads.

• Kubeflow integration preview: the Kubeflow deployment was rebuilt around Kustomize and Jinja templates with Keycloak SSO, Istio Ambient, profile-level RBAC, Kyverno policies, per-profile artifact buckets, and customized dashboard, notebook, and pipelines images. The component remains under active rework.

Improvements & enhancements

• Service Desk moved to Global Configuration and redesigned: Service Desk is now a subsection of Global Configuration (the standalone sidebar entry has been removed). Operators select a Custom GPT to drive the conversation instead of a raw model name, and choose an optional retrieval folder from the Files library. The enable toggle requires a Custom GPT to be selected first. A custom icon (with crop dialog) and localizable display name and welcome text can be configured per language (English, French, German, Swedish). The end-user chat experience is locked down: no model selector, no file upload, no RAG or web search controls. See the current Tenant settings: Service Desk guide.

• Service Desk chat session continuity: the Service Desk chat now resumes the user's most recent session automatically on open, rather than always starting a new conversation.

• Global Configuration: several new operator controls have been added to the Global Configuration settings page:

  • Reranker controls: select the reranker model and set Reranker Top N (1–50). The toggle requires a model to be selected before it can be enabled.
  • Retrieval K: new setting (1–50, default 3) controls the number of document chunks passed to the model as RAG context.
  • Embedding reindex progress: changing the embedding model or dimension triggers a reindex with live progress tracking (completed, failed, skipped, total). Uploads during reindex are routed to the target collection so search continues without interruption. Operators can cancel a running reindex at any time.
  • Reset to default: restores all system configuration settings to their defaults. A confirmation dialog is shown before applying.

  See the current Tenant settings: General guide.

• Advanced Setup: multi-step form: the Advanced Setup deployment flow has been restructured into a sectioned multi-step form with a stepper component, clearer section grouping (model information, deployment configuration, scaling, timeout, advanced), and a live YAML preview of the resulting model deployment resource.

• Easy Setup: loading and error states: Easy Setup now shows a skeleton loading state while presets load and an inline error state with a Retry button if loading fails, instead of a blank page.

• Model Presets: live backend CRUD: Model Presets settings now reads and writes directly through backend API endpoints instead of portal server actions. Create, edit, and delete operations are immediately reflected without page reloads.

• Model downloader: live download status: the downloader shows a live status indicator. If a download is already in progress when the downloader is opened, the existing status is restored automatically. Download errors from the Model Installer are surfaced in the UI.

• Model repository detail: inline error recovery: if the MLflow model detail page fails to load, an inline error state with a Retry button is shown without a full page reload.

• Homepage: refreshed design: the portal homepage has a new animated design with theme and locale switchers and a version number display. The login flow is handled directly from the homepage without a separate auth page.

• Permission gating: Chat, Files, Custom GPTs, and Settings now show a dedicated "permission denied" view for users lacking can_access_api instead of a broken page. The Models sidebar entry shows a tooltip when can_manage_models is not granted. Settings items requiring elevated permissions are disabled with a tooltip rather than hidden.

• Helm, Kustomize, and plain YAML support: the platform renderer now handles all three component formats with format-specific validation.

• Typed configuration overrides: environment overrides are converted to their corresponding TOML types, including booleans, numbers, lists, and objects.

• Automated secret sealing: rendered Kubernetes Secrets are converted to SealedSecrets offline. The CLI can bootstrap the sealing key and registry pull secret directly into the cluster.

• Keycloak integration: added reusable SSO template generation and CA bundle integration for platform components.

• Backend deployment consolidation: Model Installer functionality and storage configuration have moved into the LLM backend deployment while retaining the existing API routes. Portal-owned database and model-preset bootstrap resources were removed.

• Model installer fixes: S3 file deletion during model removal now works correctly. The MLflow artifact path is correctly included in S3 paths. Model names are sanitized to prevent invalid Kubernetes resource names.

• MLflow improvements: MLflow was upgraded to 3.13.0 with a custom OIDC image and S3 artifact proxy support.

• MLflow deployment reliability: corrected provisioner service-account permissions and moved database setup Jobs to explicit sync-wave ordering.

• MLflow artifact storage: MLflow experiment artifacts are served through the tracking server and stored in the Ceph RGW S3 backend.

• Milvus modernization: replaced the previous integration with the Python-native manifest pipeline and upgraded Milvus to v2.5.16 to address compatibility and security issues.

• Ceph storage and CSI support: added Ceph CSI drivers for RBD and CephFS. The current platform provisions a Ceph RBD block-storage class and Ceph RGW object storage; CephFS-backed workloads require additional filesystem and StorageClass configuration.

• CloudNativePG backups: scheduled database backups now target Ceph RGW and include backup rotation, dedicated credentials, and configurable database resources.

• Observability improvements: Loki retention is enabled for 30 days, and Grafana, Loki, Tempo, Alloy, and OpenTelemetry configurations were refreshed.

• Deployment ordering: sync waves were revised across the platform, unnecessary wait jobs and PreSync hooks were removed, and Argo CD drift handling was expanded.

• Certificate and DNS ordering: corrected sync-wave ordering for ExternalDNS, the self-signed CA chain, certificates, and Sealed Secrets.

• Security refresh: Argo CD, Argo Events, CloudNativePG, Grafana, Milvus, MLflow, OpenBao, OpenFGA, OAuth2 Proxy, Reflector, and Temporal received vulnerability-related upgrades. Argo Events moved from NATS Streaming to JetStream.

• CloudNativePG DatabaseRole CRDs: per-service PostgreSQL role provisioning now uses declarative DatabaseRole custom resources instead of imperative psql Jobs. The CNPG operator reconciles roles directly, reducing boilerplate and removing the need for superuser-credential mounting. Permission-granting Jobs remain, with backoffLimit increased from 3 to 5 for resilience.

• Platform component upgrades: upgraded Grafana to 13.0.1-security-01, OpenBao to 2.5.4, the CloudNativePG operator to 1.30.0 (chart 0.29.0), and the PostgreSQL image to 17.10-system-trixie.

• Kubeflow dependency management: added Metacontroller as a Kubeflow Pipelines dependency, externalized image references, and standardized per-profile bucket naming.

• Container supply chain: additional platform and Kubeflow images are mirrored into the private ACR, with automated image builds and Trivy scanning.

• PR deployment validation: infrastructure pull requests now receive isolated AKS clusters, full GitOps deployment validation, Argo CD health monitoring, automatic diagnostics, and cleanup.

• Helm security scanning: a Python-based scanner renders platform charts, discovers referenced images, runs Trivy, publishes reports, and supports scheduled scanning of release branches.

Platform deployment changes

• Breaking change: Terraform/OpenTofu is no longer the supported platform deployment path. Deployments now use the Python CLI and GitOps workflow.
• Breaking change: External platform routes use Kubernetes Gateway API resources.
• Breaking change: Platform-operated S3-compatible workloads use Rook-Ceph RGW.
• Operational change: Model Installer functionality runs inside the LLM backend while retaining the existing /v1/model-installer API routes.
• Operational change: Generated manifests are organized under common, coreai, and proai app-of-apps directories and should be regenerated with replace mode during migration.

API updates

This section lists all user-facing API surface changes. Breaking changes are marked explicitly.

STT WebSocket endpoint (new)

A new WebSocket endpoint is available for real-time speech-to-text transcription.

WS /v1/stt

Query parameters:

Breaking change: The query parameter was renamed from language to lang. Clients using the old name receive a 1008 Policy Violation close frame with a structured error listing all supported languages.

The endpoint accepts a binary audio stream after an initial JSON handshake and returns transcript frames as JSON messages. The server sends a session_ready frame before audio is accepted. Sending an unsupported language code closes the socket immediately with a structured unsupported_language error frame.

Collection search: structured filters replace raw filter string

Breaking change: The filter field on POST /v1/collections/{name}/search has been replaced by a structured filters array. Raw Milvus filter strings are no longer accepted.

New request shape (partial):

{
  "query": "...",
  "filters": [
    { "field": "metadata_key", "operator": "==", "value": "some_value" },
    { "field": "tag", "operator": "in", "value": ["a", "b"] }
  ]
}

Supported operators: == (scalar string value) and in (list of strings). The == and in operators are mutually exclusive with their value types: mismatched pairs are rejected at the API boundary with a 422 response.

Files API: folder_path replaced by folder_id

Breaking change: All file and folder write endpoints that previously accepted a folder_path string parameter now require folder_id: UUID | null instead. The /v1/files/children and /v1/files/search endpoints also accept a scope parameter.

Affected endpoints: file upload, create folder, move file, move folder, list children, search.

New scope values:

Model download status and logs (new endpoints)

Two new endpoints expose live download progress for model installer jobs. Both require the can_manage_models permission.

GET /v1/model-installer/downloads
GET /v1/model-installer/downloads/{download_id}/logs

GET /v1/model-installer/downloads returns a list of active downloads. Completed and failed downloads are not included.

GET /v1/model-installer/downloads/{download_id}/logs returns buffered log lines for a download. The response is empty once the download reaches a terminal state.

Translations API (new)

A new endpoint exposes tenant-level translation overrides for portal UI strings.

GET  /v1/translations
POST /v1/translations/reset
PATCH /v1/translations/{language}

GET /v1/translations returns all overrides as a nested blob shaped language → namespace → key → value. Requires authentication; no specific permission required.

POST /v1/translations/reset clears all overrides and restores defaults. Requires can_edit_config.

PATCH /v1/translations/{language} merges a partial update for a single language. Requires can_edit_config.

Branding API (new)

New endpoints for admin-controlled portal branding. GET /v1/branding/theme and GET /v1/branding/logo.

GET  /v1/branding/theme
PUT  /v1/branding/theme
POST /v1/branding/theme/preview
POST /v1/branding/theme/reset
GET  /v1/branding/logo
POST /v1/branding/logo

Write endpoints require can_edit_config. Logo upload accepts SVG, PNG, or WebP up to 512 KB.

Group authorization enforcement on all API routers

All API routers now require the can_access_api organization permission. Previously, some endpoints only checked token validity. Users or service accounts in groups without can_access_api receive a 403 Forbidden response on all endpoints.

Service Desk configuration: collection_name replaced by document_ids

Breaking change: The collection_name field in ServiceDeskConfiguration (readable and writable via GET/PATCH /v1/config) has been replaced by document_ids: list[string] | null.

Retrieval configuration: new admin-configurable fields

Two new fields are available in SystemConfiguration via GET/PATCH /v1/config:

Reranker error responses

The reranker now returns structured 400 Bad Request errors (error code rerank_bad_request) instead of a generic 500 when the query or document list is empty or invalid.

Authentication: X-Api-Key header support (new)

All HTTP endpoints now accept API keys via the X-Api-Key request header in addition to the existing Authorization: Bearer header.

X-Api-Key: sk-bsq-v1-<key>

When both X-Api-Key and Authorization: Bearer are present, X-Api-Key takes precedence. This header bypasses gateway-level JWT validation, making it the correct authentication method for API key clients sitting behind a JWT-enforcing gateway. (Superseded in 1.2.1: API keys in the Authorization: Bearer header now pass the gateway too.)

WebSocket connections continue to use the token query parameter. API key format and scoping are unchanged.

Documentation updates