> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Release 21.2.10

> Edge Infrastructure Services API 21.2.10, classic GUI 21.2.3, and new console 1.3.2, published November 2026.

**Published:** November 2026

API: 21.2.10 (upgrade from 20.0.20) | Classic GUI: 21.2.3 | New console: 1.3.2

Release 21.2.10 unifies Node Clusters and Edge Kubernetes Service clusters into one cluster type, lets you add or remove network interfaces on running application instances without redeploying them, and attaches persistent data disks to Docker Compose runtimes. It also makes large Terraform-driven deployments reliable at high parallelism, makes app profile deployments complete reliably, tightens API input validation, and resolves more than 50 issues.

Review [Changed Behavior](#changed-behavior) and [Known Issues](#known-issues) before upgrading automation, scripts, or Terraform configurations. Several API calls that previously succeeded silently now return HTTP 400.

| Feature | Minimum EVE-OS version |
| - | - |
| Network interface changes on running application instances | An EVE-OS release that reports the application instance network interface change capability: EVE-OS 17.3.0 or greater, or a 17.0 LTS patch release that includes the backport. Edge Infrastructure Services rejects the change for an edge node that does not report the capability, and the job fails. |
| Persistent data disks for Docker Compose runtimes | EVE-OS 14.5.0 LTS on nodes with ext4 persistent storage. A 16.0.x LTS release on nodes with ZFS persistent storage. |
| Unified clusters, including enabling Kubernetes access on a running cluster | EVE-OS 17.0.1 LTS or greater on every node in the cluster. |

## New Features

### Unified clusters

New console only. Edge Node Clusters and ZEDEDA Edge Kubernetes Service clusters are now a single cluster type. Every cluster runs application instances (VMs, containers, and Docker Compose workloads) with Longhorn storage and KubeVirt on each node. When you create a cluster, or later on its detail page, you can enable Kubernetes access to add `kubectl`, GitOps, Helm, the Kubernetes dashboard, and a cluster shell. Enabling Kubernetes access on a running cluster is non-destructive: existing application instances and storage stay online. Unified clusters require EVE-OS 17.0.1 LTS or greater on every node in the cluster. You can also import an external Kubernetes cluster for GitOps and Helm delivery without ZEDEDA edge nodes.

The cluster list at **Infrastructure > Fleet > Clusters** shows every cluster type in one view. Each entry shows a **Mode** badge (**Edge Node Cluster**, **K8s Cluster**, or **Imported K8s Cluster**), and all cluster types are managed through the `/api/v1/cluster` endpoints. See [Clusters](https://zededa.mintlify.site/new-ui/infrastructure-services/node-clusters.md#one-cluster-object).

### Change network interfaces on running application instances

New console only. You can now add, remove, or swap network interfaces on a deployed VM or container application instance without deleting and redeploying it. You can also move an interface to a different virtual network and update its access control rules in place. Adding, removing, or swapping an interface triggers one automatic restart of the application; the instance's volumes are preserved. Changing only the access control rules does not restart the instance.

The following conditions apply:

* The project must have **Interface Ordering** enabled. The console does not offer the editor otherwise.
* You can remove only interfaces that the edge app marks as **Optional**. **Required** interfaces cannot be removed.
* The edge node must run an EVE-OS release that reports the application instance network interface change capability: EVE-OS 17.3.0 or greater, or a 17.0 LTS patch release that includes the backport. The console hides the editor for edge nodes that do not report the capability. A change submitted through the API or ZCLI for such an edge node is rejected and the job fails; the change is not held and applied after the edge node upgrades.

See the following:

* [Edit the interface set](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/app-instance-details.md#edit-the-interface-set).
* [Adjust the App Interfaces](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md#adjust-the-app-interfaces).
* [Interface Ordering for Application Instances](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/app-instance-interface-ordering.md).

### Persistent data disks for Docker Compose runtimes

Classic GUI and new console. A Docker Compose runtime edge app can now declare extra data disks after its boot image. A data disk is either a blank persistent disk owned by the instance, or an existing volume instance attached by its volume label. A labeled volume survives deletion of the runtime instance and reattaches to a new instance, so you can move workloads from other runtimes without copying data. Requires EVE-OS 14.5.0 LTS, or a 16.0.x LTS release on nodes with ZFS persistent storage.

See the following:

* [Add a Compose Runtime Image](https://zededa.mintlify.site/new-ui/infrastructure-services/build-and-library/add-a-compose-runtime-image.md).
* [Deploy the Compose Runtime Application](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-compose-runtime.md).
* [Attach an Existing ZFS Pool to the Compose Runtime](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/attach-existing-zfs-pool-to-compose-runtime.md).

## Enhancements

### EVE-OS update history

Each edge node now keeps a history of its EVE-OS image updates. See [Update EVE-OS on Nodes](https://zededa.mintlify.site/new-ui/infrastructure-services/nodes/update-eve-os-on-nodes.md).

### Bulk refresh and purge by project or device list

Bulk application instance refresh and purge no longer require an edge app. You can target a whole project, or narrow the selection with a device list. Instances that are already up to date are reported as not required instead of failing the job.

### Docker Compose runtime deactivation

A Docker Compose runtime can now be deactivated after all of its Compose application instances are stopped. Deleting the runtime still requires removing the Compose application instances first.

### More application instances per edge node

Application instances whose edge app has VNC disabled no longer consume a VNC display slot. This removes the previous limit of 63 application instances per edge node.

### API additions

* The device and application instance status-config list endpoints support sorting by field.
* The Users API stores new console preferences (`cortexSettingsCustom`).
* Virtual networks on Edge Node Clusters are marked as cluster-wide in the edge node's configuration.

### User interface updates

* New console only. The application instance remote console now uses Edge View.
* Application and edge node port fields are validated in the console. A port must be less than 65535.
* The classic GUI login page shows an announcement about the new console.

### Terraform

The `zedcloud_auth_profile` resource now works with OAuth authorization profiles, including create and `terraform import`.

## Changed Behavior

Review the following changes before upgrading automation, scripts, or Terraform configurations. Entries are ordered by likely impact.

| Area | Before 21.2.10 | From 21.2.10 | What to do |
| - | - | - | - |
| API list filters | An unrecognized value for `imageArch`, `imageStatus`, `imageType`, `imageTypes`, `appType`, `originType`, or project type was ignored and the full list was returned. Some valid values were also ignored. | Values are matched case-insensitively. An unrecognized value returns HTTP 400. Valid filters now filter, so results can be shorter. | Check scripts that pass these filters. |
| Volume instances | An invalid access mode could be stored. Changing the access mode on update returned HTTP 200 but did nothing. | Invalid access modes are rejected with HTTP 400. Changing the access mode after create returns HTTP 400. Sending the unchanged value still works. | Set the access mode at create time only. |
| Volume instances | Block storage volumes backed by a content tree could be created with size 0. | Explicitly created block storage volumes need a non-zero `sizeBytes`. Setting it to 0 on update returns HTTP 400. Volumes created implicitly from app manifests are unaffected. | Always pass `sizeBytes` for block storage. |
| Application instance interfaces | A changed interface set was sent to the edge node but applied only after a manual restart. | Adding, removing, or swapping an interface triggers one automatic restart. Rebinding an interface or changing only its access control rules does not restart. | Plan interface changes for a maintenance window where a restart is acceptable. |
| Access control rules (projects with Interface Ordering) | Edge app rules were appended to the instance's rules on create, update, and refresh. | Edge app rules are defaults. A non-empty instance rule list is stored as sent, and refresh no longer rewrites instance rules from the edge app. Projects without Interface Ordering keep the previous behavior. | Push rule changes to existing instances explicitly instead of relying on refresh. |
| Edge apps | Renaming interfaces or toggling direct attach was allowed but broke later refreshes. | These edits are rejected while instances use the edge app. Duplicate interface names in app policies are rejected. | Create a new edge app version for these changes. |
| Bulk refresh and purge | `deviceIdList` was ignored. A selection without an edge app failed. | `deviceIdList` now narrows the selection. An empty selection completes as a no-op. | Check that bulk jobs that pass `deviceIdList` target what you expect. |
| EVE-OS images | Operators and admins could edit EVE-OS images through the general image update API. | Updates to EVE-OS images through that API are rejected. | Use the EVE-OS image workflows instead. |
| ZEDEDA Edge Kubernetes Service secrets and project scope | Git and Helm repository credentials could be read back through the secrets API. Kubernetes app install, GitOps, snapshot, and Git repository APIs did not enforce the project scope of the caller's role. | Credentials are write-only. List responses do not include secret values. Detail responses mask private keys and passwords as `***`. Secrets, app install, GitOps, snapshot, and Git repository creation APIs include or accept only projects the caller's role can access. | Keep credentials in your own secret store. Do not read them back from the API. Check that automation uses a role scoped to the projects it works in. |
| Cluster and user deletion | Deletion ran synchronously. | Deletion runs in the background. The API returns first, and the cluster shows a deleting state until the work finishes. | Poll the status instead of assuming deletion is complete when the call returns. |
| Edge node debug mode | Any edge node update, even a no-op, switched debug mode off. | Debug mode changes only through the debug enable and disable calls. A `debugKnob` value in an update body is ignored. | Use the debug enable and disable calls. |
| VNC | Every application instance received a VNC display number. | Instances whose edge app has VNC disabled receive no display number and report `vncDisplay` 0. | No action required unless tooling relies on that number. |
| App profiles | Moving an edge node between projects left its old profile membership in place. | The node's applications from the old project's profiles are undeployed, and the new project's profiles are deployed. | Expect application changes when moving nodes between projects. |
| Metrics API | `MEMORY_TOTAL` was accepted as a time-series metric type but always failed. | `MEMORY_TOTAL` is no longer a valid metric type. | Remove it from metric queries. |
| OpenAPI specification | `OAUTHProfile.additionalParameters` and `Role.projectTags` were described as strings. | Both are described as string-to-string maps (JSON objects), which is what the API already returned. | Regenerate API clients built from the specification. |
| Remote attestation | Quotes were checked against all reported PCR values. | Only PCR values covered by the TPM signature count, and a quote must answer an outstanding nonce. | No action required for standard EVE-OS nodes. Contact support if a node stops attesting after the upgrade. |
| High-parallelism writes | Bursts of application instance writes could exhaust capacity and fail. | Writes are queued, so very large bursts complete, but individual calls can take longer. | Check client timeouts for large Terraform runs. |
| Remote console | The application instance remote console used the previous console path and an older console engine. | The remote console uses Edge View on an updated console engine. | Edge View must be reachable for the edge node. |
| Docker Compose runtimes | Runtime instances accepted drives in the create request, and every runtime edge app version bump forced a purge. | Drives for runtime instances come only from the edge app, and supplied drives are rejected. While instances exist, data disks can be added or removed only at the end of the edge app's drive list. An edge app bump that changes nothing no longer purges. | Define data disks in the edge app and append new ones at the end. |
| ZEDEDA Edge Kubernetes Service API routes | The `/api/v1/zks/instances` endpoints returned data normally. | All legacy routes still respond but return `Deprecation: true` and `Sunset: 2026-12-01` headers. | Migrate to the `/api/v1/cluster` endpoints before December 1, 2026. See [Edge Kubernetes REST API](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-kubernetes/edge-kubernetes-rest-api.md). |
| Edge Node Cluster size | A cluster required exactly three nodes. | The three-node minimum is removed. Single-node clusters are supported. At most three nodes act as control-plane members; additional nodes join as workers. | Update runbooks or automation that enforces a three-node count. |
| Enabling Kubernetes on an existing cluster | Enabling Kubernetes on a running cluster removed storage and disrupted workloads. | Enabling Kubernetes access is non-destructive. Existing application instances and storage remain online. Requires EVE-OS 17.0.1 LTS or greater on every node in the cluster. | Update edge nodes to EVE-OS 17.0.1 LTS or greater before enabling Kubernetes access on existing clusters. |
| Edge Node Cluster entitlement | Cluster APIs could be called without the Kubernetes entitlement. | Cluster APIs require the Kubernetes entitlement. | Confirm the entitlement before automating cluster operations. |
| Edge Node Cluster operations | Cluster operations did not check the EVE-OS version of each node. | Cluster operations check that each node's EVE-OS supports the requested feature and reject the request otherwise. | Update edge nodes before enabling cluster features on them. |
| Ports | Port numbers greater than 65535 in access control rule port matches and port maps were accepted by the API. | Port numbers greater than 65535 return HTTP 400. | Check scripts and Terraform configurations for invalid port numbers. |
| Volume instances | Create-time fields other than the access mode could be changed on update without effect. | Changing any create-time field on update returns HTTP 400. | Set create-time fields at create time only. |
| Application instance delete (v2) | Deleting an application instance that does not exist returned HTTP 500. | Deleting an application instance that does not exist returns HTTP 404. | Update error handling that treats HTTP 500 as a retryable failure. |
| Queued application instance writes | A queued write was still applied after the client stopped waiting for the response. | A write that is still queued after the client stops waiting is rejected. | Retry the request instead of assuming it was applied. |
| Bulk refresh and purge | An application instance that failed an image, interface, or resource check failed the job. | The instance is skipped and reported as rejected. The job continues with the remaining instances. | Check the job result for rejected instances. |
| App profile asset groups | An asset group could include edge node IDs from another project. | Edge node IDs from another project are rejected. | Keep asset groups within one project. |

## Fixed Issues

### Application instances at scale

* Bulk create, update, and delete of VM application instances at high Terraform parallelism (40 or more) no longer time out with HTTP 504 or leave instances behind, and no longer stall unrelated API calls.

### Application instances

* Deployments to an edge node no longer fail permanently after repeated deploy and undeploy cycles because VNC display slots leaked. Spurious "No free VNC port" errors during create bursts are fixed.
* A removed and re-added network interface no longer shows the previous interface's IP address.
* Editing or removing a default access control rule in the deploy wizard no longer re-adds the original rule, which caused overlapping port maps when deploying a second instance of the same edge app. Duplicate port map entries are removed.
* Updating interface access control rules or the network binding through the API is now applied. Previously, the request returned HTTP 200 without changing anything.
* Creating a snapshot now returns the snapshot's ID and name.
* Changes to custom configuration (cloud-init) variables are applied when the instance is purged.
* A running application no longer gets stuck in a pre-running state when status reports from the edge node arrive out of order.

### Edge apps

* Deleting an edge app while an instance or policy is being created no longer leaves references to the deleted app. Image deletion and app list operations are faster on large enterprises.

### App profiles

* An edge node that leaves a project and rejoins it now gets its profile applications redeployed.
* A profile deployment now creates all of its application instances on an edge node, not only the first nine.
* Deleting a profile deployment removes its application instances, and a failed deletion can be retried.
* Updating a profile deployment no longer leaves behind application instances from removed policies.
* Workflow failures in a profile deployment are reported, and resources for steps that never ran are flagged.
* Deleting an edge node that was selected by a tag-based asset group removes the node's deployment resources.
* Profile updates no longer fail permanently with a `VersionMismatch` error.

### Edge nodes

* Editing an edge node no longer switches off debug mode.
* Generating a single-use EVE-OS installer no longer fails intermittently with HTTP 500.
* An edge node added with only a device certificate and set to **Active** in the same step no longer stays in the **Provisioned** state because its certificate was not registered. The fix prevents new occurrences only. A node that is already stuck needs a one-time repair: with the device powered on, deactivate the node, wait about 30 seconds, and activate it again. The node reaches **Online** within a few minutes. Re-adding a node under the same name as a deleted node also works again.

### Bulk operations

* A bulk purge now delivers pending certificate and secret updates to the application instances.

### Edge Node Clusters

* Replacing a node in an Edge Node Cluster no longer deletes or orphans application instances and volumes, and a replaced node can now be deleted.

### Resource usage

* Fewer online edge nodes are missing from the device resource usage report. See [Known Issues](#known-issues) for the remaining limitation.
* The resource usage report reflects edge node title changes and moves between projects.

### Login

* Users without TOTP can now enroll when **Enforce TOTP** is enabled, instead of being stuck in a loop.
* Newly invited users can set their first password when two-factor authentication is enforced.

### Projects

* Filtering the project list by type no longer returns HTTP 500, and the type filter now applies to project status endpoints. Getting a single project now returns the correct device count.

### Filters

* The `originType` filter on brands, models, images, datastores, and apps is now applied when you pass enum names such as `ORIGIN_LOCAL`.
* Filtering edge nodes by a tag value that contains `&` now works.

### PCR templates

* Searching PCR templates with a space in the name pattern no longer returns HTTP 400, and the list returns a total count.

### Metrics

* The unsupported `MEMORY_TOTAL` time-series metric, which always failed, is removed.

### ZEDEDA Edge Kubernetes Service

* Deleted clusters no longer stay in a deleting state for hours, and stale cluster entries are cleaned up. User deletion on clusters is faster.
* New clusters no longer show the state **None**, and ZEDEDA Edge Kubernetes Service errors return a meaningful message instead of a generic HTTP 500.
* Clusters with many failing Git repositories no longer destabilize cluster management.
* `kubectl`, `k9s`, Lens, and Helm can connect through the cluster proxy with a downloaded kubeconfig.

### Security

* Device authentication and remote attestation checks are hardened.
* Kubernetes Git and Helm repository credentials are no longer returned in API responses or written to logs, and secret listing is limited to projects the user can access.
* The Kubernetes app install, GitOps, snapshot, and Git repository APIs enforce the project scope of the user's role.
* Operators and admins can no longer modify EVE-OS images through the general image update API.
* Connections to Kubernetes management require TLS 1.2 or greater, and third-party dependencies with known CVEs are updated.

### User interface

* New console only. The console no longer freezes on the edge node detail screen.

## Known Issues

* **Network interface changes on running instances require a capable EVE-OS.** The capability shipped in EVE-OS 17.3.0 and was backported to the 17.0 LTS branch on November 4, 2026. Until your edge nodes run a release that includes it, a change submitted through the API or ZCLI is rejected and the job fails, and the console does not offer the editor.
* **The resource usage report can still miss some online edge nodes.** A small number of online nodes might not appear in the device resource usage report.
* **Snapshot API edge cases.** A snapshot can be created on an instance that does not allow snapshots. Deleting or activating a missing snapshot returns HTTP 500 instead of 404.