Add hyp create ray-dashboard-connection command

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## v3.9.0 (2026-06-11)
+
+### Features
+- Support generic `{ide}-remote` connection types for space access (#414)
+- Add v1.1 Space parameters (`queue_name`, `priority` for task governance) and addon version validation warning; bump space template to v1.1.0 (#421)
+- Add v1.2 schema support for custom and jumpstart inference endpoints (#417)
+
+### Inference Operator
+- Update inference helm chart to v2.1.1 with latest CRDs (init container support, custom service accounts, templated manager config) (#416, #418)
+- DPD CRD changes with chart version bump to v3.2; pin operator to amd64 nodes via nodeAffinity; bump inference-operator subchart to v2.2.1 (#427)
+
+### GPU Operator
+- Upgrade GPU Operator v25.3.4 → v26.3.1 to remediate CVEs in base images (#415, #419)
+- Add ap-south-2 (HYD) ECR regional-values for GPU operator (#424)
+
+### Health Monitoring Agent
+- Release Health Monitoring Agent 1.0.1892.0_1.0.424.0 with bug fixes (add 2 min sleep before nvml component checks to prevent missing GPU false positives) (#425)
+
+### Bug Fixes
+- Exclude `kubernetes==36.0.0` which breaks EKS auth and relax `pyyaml` pin (#426)
+- Rename `lr_warmup_ratio` to `lr_warmup_steps_ratio` to match Hub recipe schema (#428)
+
 ## v3.8.0 (2026-04-16)
 
 ### Features

README.md

@@ -852,6 +852,14 @@ hyp create hyp-space \
 | `--lifecycle` | TEXT | No | Lifecycle specifies actions that the management system should take in response to container lifecycle events (JSON string) |
 | `--app-type` | TEXT | No | AppType specifies the application type for this workspace |
 | `--service-account-name` | TEXT | No | ServiceAccountName specifies the name of the ServiceAccount to use for the workspace pod |
+| `--queue-name` | TEXT | No | Queue name for space scheduling (1-63 characters, alphanumeric with hyphens). Required when task governance is enabled on HyperPod EKS clusters. |
+| `--priority` | TEXT | No | Priority class for space scheduling. Sets the `kueue.x-k8s.io/priority-class` label. |
+| `--access-type` | TEXT | No | AccessType specifies who can connect to the workspace ('Public' or 'OwnerOnly') |
+| `--env` | TEXT | No | Environment variables for the workspace container (JSON string, list of {name, value} objects) |
+| `--access-strategy` | TEXT | No | References a WorkspaceAccessStrategy. Format: --access-strategy name=<name>,namespace=<namespace> |
+| `--pod-security-context` | TEXT | No | Pod-level security context. Overrides template defaults when specified (JSON string) |
+| `--container-security-context` | TEXT | No | Container-level security context for the main workspace container. Overrides template defaults (JSON string) |
+| `--init-containers` | TEXT | No | Init containers to run before the workspace container starts (JSON string, max 10) |
 | `--idle-shutdown` | TEXT | No | Idle shutdown configuration. Format: --idle-shutdown enabled=<bool>,idleTimeoutInMinutes=<int>,detection=<JSON string> |
 | `--template-ref` | TEXT | No | TemplateRef references a WorkspaceTemplate to use as base configuration. Format: --template-ref name=<name>,namespace=<namespace> |
 | `--container-config` | TEXT | No | Container configuration. Format: --container-config command=<cmd>,args=<arg1;arg2> |
@@ -1350,7 +1358,7 @@ monitor_config = get_monitoring_config()
 
 ```python
 from sagemaker.hyperpod.space.hyperpod_space import HPSpace
-from hyperpod_space_template.v1_0.model import SpaceConfig
+from hyperpod_space_template.v1_1.model import SpaceConfig
 
 # Create space configuration
 space_config = SpaceConfig(

doc/cli/space/cli_space.md

@@ -51,6 +51,14 @@ hyp create hyp-space [OPTIONS]
 | `--lifecycle` | TEXT | No | Lifecycle specifies actions that the management system should take in response to container lifecycle events (JSON string) |
 | `--app-type` | TEXT | No | AppType specifies the application type for this workspace |
 | `--service-account-name` | TEXT | No | ServiceAccountName specifies the name of the ServiceAccount to use for the workspace pod |
+| `--queue-name` | TEXT | No | Queue name for space scheduling (1-63 characters, alphanumeric with hyphens). Required when task governance is enabled on HyperPod EKS clusters. Sets the `kueue.x-k8s.io/queue-name` label. |
+| `--priority` | TEXT | No | Priority class for space scheduling. Sets the `kueue.x-k8s.io/priority-class` label. |
+| `--access-type` | TEXT | No | AccessType specifies who can connect to the workspace ('Public' or 'OwnerOnly') |
+| `--env` | TEXT | No | Environment variables for the workspace container (JSON string, list of {name, value} objects) |
+| `--access-strategy` | TEXT | No | References a WorkspaceAccessStrategy. Format: name=<name>,namespace=<namespace> |
+| `--pod-security-context` | TEXT | No | Pod-level security context. Overrides template defaults when specified (JSON string) |
+| `--container-security-context` | TEXT | No | Container-level security context for the main workspace container. Overrides template defaults (JSON string) |
+| `--init-containers` | TEXT | No | Init containers to run before the workspace container starts (JSON string, max 10) |
 | `--idle-shutdown` | TEXT | No | Idle shutdown configuration. Format: enabled=<bool>,idleTimeoutInMinutes=<int>,detection=<JSON string> |
 | `--template-ref` | TEXT | No | TemplateRef references a WorkspaceTemplate to use as base configuration. Format: name=<name>,namespace=<namespace> |
 | `--container-config` | TEXT | No | Container configuration. Format: command=<cmd>,args=<arg1;arg2> |
@@ -160,6 +168,14 @@ hyp update hyp-space [OPTIONS]
 | `--lifecycle` | TEXT | No | Lifecycle specifies actions that the management system should take in response to container lifecycle events (JSON string) |
 | `--app-type` | TEXT | No | AppType specifies the application type for this workspace |
 | `--service-account-name` | TEXT | No | ServiceAccountName specifies the name of the ServiceAccount to use for the workspace pod |
+| `--queue-name` | TEXT | No | Queue name for space scheduling (1-63 characters, alphanumeric with hyphens). Required when task governance is enabled on HyperPod EKS clusters. Sets the `kueue.x-k8s.io/queue-name` label. |
+| `--priority` | TEXT | No | Priority class for space scheduling. Sets the `kueue.x-k8s.io/priority-class` label. |
+| `--access-type` | TEXT | No | AccessType specifies who can connect to the workspace ('Public' or 'OwnerOnly') |
+| `--env` | TEXT | No | Environment variables for the workspace container (JSON string, list of {name, value} objects) |
+| `--access-strategy` | TEXT | No | References a WorkspaceAccessStrategy. Format: name=<name>,namespace=<namespace> |
+| `--pod-security-context` | TEXT | No | Pod-level security context. Overrides template defaults when specified (JSON string) |
+| `--container-security-context` | TEXT | No | Container-level security context for the main workspace container. Overrides template defaults (JSON string) |
+| `--init-containers` | TEXT | No | Init containers to run before the workspace container starts (JSON string, max 10) |
 | `--idle-shutdown` | TEXT | No | Idle shutdown configuration. Format: enabled=<bool>,idleTimeoutInMinutes=<int>,detection=<JSON string> |
 | `--template-ref` | TEXT | No | TemplateRef references a WorkspaceTemplate to use as base configuration. Format: name=<name>,namespace=<namespace> |
 | `--container-config` | TEXT | No | Container configuration. Format: command=<cmd>,args=<arg1;arg2> |

doc/getting_started.md

@@ -9,6 +9,7 @@
 Cluster Management <getting_started/cluster_management>
 Training <getting_started/training>
 Inference <getting_started/inference>
+Space <getting_started/space>
 
 ```
 

doc/getting_started/space.md

@@ -41,7 +41,7 @@ hyp create hyp-space \
 ````{tab-item} SDK
 ```python
 from sagemaker.hyperpod.space.hyperpod_space import HPSpace
-from hyperpod_space_template.v1_0.model import SpaceConfig
+from hyperpod_space_template.v1_1.model import SpaceConfig
 
 # Create space configuration
 space_config = SpaceConfig(
@@ -66,16 +66,14 @@ When creating a space, you'll need to specify:
 | **display-name** | TEXT | Yes | Human-readable name for the space |
 | **namespace** | TEXT | No | Kubernetes namespace |
 | **image** | TEXT | No | Docker image for the workspace environment |
-| **cpu** | TEXT | No | CPU resource request |
-| **cpu-limit** | TEXT | No | CPU resource limit |
-| **memory** | TEXT | No | Memory resource request |
-| **memory-limit** | TEXT | No | Memory resource limit |
-| **gpu** | TEXT | No | GPU resource request |
-| **gpu-limit** | TEXT | No | GPU resource limit |
-| **accelerator-partition-type** | TEXT | No | Fractional GPU partition type (e.g., 'mig-3g.20gb') |
-| **accelerator-partition-count** | TEXT | No | Fractional GPU partition count |
-| **volume** | TEXT | No | Volume configuration (can be specified multiple times) |
-| **debug** | FLAG | No | Enable debug mode |
+| **cpu** | TEXT | No | CPU resource request (e.g., '500m') |
+| **memory** | TEXT | No | Memory resource request (e.g., '2Gi') |
+| **gpu** | TEXT | No | GPU resource request (e.g., '1') |
+| **volume** | TEXT | No | Volume configuration. Format: `name=<name>,mountPath=<path>,persistentVolumeClaimName=<pvc_name>` |
+| **queue-name** | TEXT | No | Queue name for space scheduling. Required when task governance is enabled. |
+| **template-ref** | TEXT | No | Reference to a WorkspaceTemplate. Format: `name=<name>,namespace=<namespace>` |
+
+For the full list of parameters, see the [CLI reference](../cli/space/cli_space.md) or run `hyp create hyp-space --help`.
 
 
 ## Managing Spaces

doc/sdk/space/hyperpod_space.rst

@@ -25,6 +25,6 @@ HPSpaceTemplate
 Space Configs
 -------------
 
-.. automodule:: hyperpod_space_template.v1_0.model
+.. automodule:: hyperpod_space_template.v1_1.model
     :members: SpaceConfig
     :show-inheritance:

helm_chart/HyperPodHelmChart/Chart.yaml

@@ -81,7 +81,7 @@ dependencies:
     repository: "file://charts/team-role-and-bindings"
     condition: team-role-and-bindings.enabled
   - name: hyperpod-inference-operator
-    version: "2.1.1"
+    version: "2.3.0"
     repository: "file://charts/inference-operator"
     condition: inferenceOperators.enabled 
   - name: hyperpod-patching

helm_chart/HyperPodHelmChart/charts/gpu-operator/regional-values/values-ap-south-2.yaml

@@ -0,0 +1,13 @@
+gpu-operator:
+  operator:
+    repository: "580982410692.dkr.ecr.ap-south-2.amazonaws.com"
+  toolkit:
+    repository: "580982410692.dkr.ecr.ap-south-2.amazonaws.com/mirror-k8s"
+  devicePlugin:
+    repository: "580982410692.dkr.ecr.ap-south-2.amazonaws.com"
+  gfd:
+    repository: "580982410692.dkr.ecr.ap-south-2.amazonaws.com"
+  migManager:
+    repository: "580982410692.dkr.ecr.ap-south-2.amazonaws.com/mirror-cloud-native"
+  validator:
+    repository: "580982410692.dkr.ecr.ap-south-2.amazonaws.com/mirror-cloud-native"

helm_chart/HyperPodHelmChart/charts/health-monitoring-agent/templates/_helpers.tpl

@@ -55,7 +55,7 @@ Generate the health monitoring agent image URI based on AWS region
 */}}
 {{- define "health-monitoring-agent.imageUri" -}}
 {{- $region := "" -}}
-{{- $imageTag := .Values.imageTag | default "1.0.1481.0_1.0.392.0" -}}
+{{- $imageTag := .Values.imageTag | default "1.0.2297.0_1.0.474.0" -}}
 
 {{/* Debug: Show image tag selection if debug is enabled */}}
 {{- if .Values.debug -}}

helm_chart/HyperPodHelmChart/charts/health-monitoring-agent/templates/health-monitoring-agent.yaml

@@ -78,6 +78,12 @@ spec:
                       - ml.p5.4xlarge
                       - ml.p4d.24xlarge
                       - ml.p4de.24xlarge
+                      - ml.g4dn.xlarge
+                      - ml.g4dn.2xlarge
+                      - ml.g4dn.4xlarge
+                      - ml.g4dn.8xlarge
+                      - ml.g4dn.12xlarge
+                      - ml.g4dn.16xlarge
                       - ml.g5.xlarge
                       - ml.g5.2xlarge
                       - ml.g5.4xlarge
@@ -104,6 +110,12 @@ spec:
                       - ml.g6e.12xlarge
                       - ml.g6e.24xlarge
                       - ml.g6e.48xlarge
+                      - ml.g7.2xlarge
+                      - ml.g7.4xlarge
+                      - ml.g7.8xlarge
+                      - ml.g7.12xlarge
+                      - ml.g7.24xlarge
+                      - ml.g7.48xlarge
                       - ml.g7e.2xlarge
                       - ml.g7e.4xlarge
                       - ml.g7e.8xlarge

helm_chart/HyperPodHelmChart/charts/health-monitoring-agent/values.yaml

@@ -25,7 +25,7 @@ imageTag: ""
 
 # Override the health monitoring agent image URI
 # If specified, this will override the automatic region-based URI selection
-# Example: "905418368575.dkr.ecr.us-west-2.amazonaws.com/hyperpod-health-monitoring-agent:1.0.1481.0_1.0.392.0"
+# Example: "905418368575.dkr.ecr.us-west-2.amazonaws.com/hyperpod-health-monitoring-agent:1.0.2297.0_1.0.474.0"
 hmaimage: ""
 
 # Enable debug output for region selection process

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+name: hyperpod-ray-endpoint-operator
+description: A Helm chart to distribute hyperpod-ray-endpoint-operator
+type: application
+
+version: 0.1.0
+appVersion: "0.1.0"
+
+keywords:
+  - kubernetes
+  - operator
+
+annotations:
+  kubebuilder.io/generated-by: kubebuilder

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/crds/hyperpodrayendpointaccessstrategies.access.sagemaker.amazonaws.com.yaml

@@ -0,0 +1,99 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    "helm.sh/resource-policy": keep
+    controller-gen.kubebuilder.io/version: v0.20.1
+  name: hyperpodrayendpointaccessstrategies.access.sagemaker.amazonaws.com
+spec:
+  group: access.sagemaker.amazonaws.com
+  names:
+    kind: HyperpodRayEndpointAccessStrategy
+    listKind: HyperpodRayEndpointAccessStrategyList
+    plural: hyperpodrayendpointaccessstrategies
+    singular: hyperpodrayendpointaccessstrategy
+  scope: Namespaced
+  versions:
+  - name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: HyperpodRayEndpointAccessStrategy defines how dashboard access
+          is configured for RayClusters.
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: HyperpodRayEndpointAccessStrategySpec defines the desired
+              state of HyperpodRayEndpointAccessStrategy.
+            properties:
+              accessResourceTemplates:
+                description: AccessResourceTemplates defines Kubernetes resources
+                  to create per RayCluster.
+                items:
+                  description: AccessResourceTemplate defines a templated resource
+                    the controller creates per RayCluster.
+                  properties:
+                    apiVersion:
+                      description: APIVersion of the resource.
+                      type: string
+                    kind:
+                      description: Kind of the resource (e.g., IngressRoute).
+                      type: string
+                    namePrefix:
+                      description: NamePrefix is prepended to the RayCluster name
+                        to form the resource name.
+                      type: string
+                    template:
+                      description: Template is a Go template that renders the resource
+                        spec.
+                      type: string
+                  required:
+                  - apiVersion
+                  - kind
+                  - namePrefix
+                  - template
+                  type: object
+                type: array
+              accessType:
+                description: 'AccessType controls ownership checks: "ownerOnly" or
+                  "public".'
+                enum:
+                - ownerOnly
+                - public
+                type: string
+              bearerAuthURLTemplate:
+                description: |-
+                  BearerAuthURLTemplate is a Go template for generating the dashboard URL.
+                  Available variables: .RayCluster.Name, .RayCluster.Namespace, .RayCluster.EncodedNamespace, .Domain
+                type: string
+              displayName:
+                description: DisplayName is a human-readable name for this strategy.
+                type: string
+            required:
+            - accessType
+            - bearerAuthURLTemplate
+            type: object
+          status:
+            description: HyperpodRayEndpointAccessStrategyStatus defines the observed
+              state.
+            type: object
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/templates/NOTES.txt

@@ -0,0 +1,15 @@
+Thank you for installing {{ .Chart.Name }}.
+
+Your release is named {{ .Release.Name }}.
+
+The controller and CRDs have been installed in namespace {{ .Release.Namespace }}.
+
+To verify the installation:
+
+  kubectl get pods -n {{ .Release.Namespace }}
+  kubectl get customresourcedefinitions
+
+To learn more about the release, try:
+
+  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
+  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}

helm_chart/HyperPodHelmChart/charts/hyperpod-ray-endpoint-operator/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Namespace for generated references.
+Always uses the Helm release namespace.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.namespaceName" -}}
+{{- .Release.Namespace }}
+{{- end }}
+
+{{/*
+Resource name with proper truncation for Kubernetes 63-character limit.
+Takes a dict with:
+  - .suffix: Resource name suffix (e.g., "metrics", "webhook")
+  - .context: Template context (root context with .Values, .Release, etc.)
+Dynamically calculates safe truncation to ensure total name length <= 63 chars.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.resourceName" -}}
+{{- $fullname := include "hyperpod-ray-endpoint-operator.fullname" .context }}
+{{- $suffix := .suffix }}
+{{- $maxLen := sub 62 (len $suffix) | int }}
+{{- if gt (len $fullname) $maxLen }}
+{{- printf "%s-%s" (trunc $maxLen $fullname | trimSuffix "-") $suffix | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" $fullname $suffix | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+
+{{/*
+ServiceAccount name to use.
+If serviceAccount.enable is false and serviceAccount.name is set, use that name.
+Otherwise, use the standard resourceName helper with "controller-manager" suffix.
+*/}}
+{{- define "hyperpod-ray-endpoint-operator.serviceAccountName" -}}
+{{- if and (hasKey .Values.serviceAccount "enable") (not .Values.serviceAccount.enable) .Values.serviceAccount.name }}
+{{- .Values.serviceAccount.name }}
+{{- else }}
+{{- include "hyperpod-ray-endpoint-operator.resourceName" (dict "suffix" "controller-manager" "context" .) }}
+{{- end }}
+{{- end }}