spectrocloud
diff --git a/‎_partials/_additional-deployment-options.mdx‎
Lines changed: 10 additions & 7 deletions b/‎_partials/_additional-deployment-options.mdx‎
Lines changed: 10 additions & 7 deletions
diff --git a/‎_partials/_palette-kubernetes-versions.mdx‎
Lines changed: 2 additions & 1 deletion b/‎_partials/_palette-kubernetes-versions.mdx‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎_partials/permissions/_aws-control-plane-policy.mdx‎
Lines changed: 7 additions & 5 deletions b/‎_partials/permissions/_aws-control-plane-policy.mdx‎
Lines changed: 7 additions & 5 deletions
diff --git a/‎_partials/permissions/_aws-controller-policy.mdx‎
Lines changed: 46 additions & 27 deletions b/‎_partials/permissions/_aws-controller-policy.mdx‎
Lines changed: 46 additions & 27 deletions
diff --git a/‎_partials/permissions/_aws-deployment-policy.mdx‎
Lines changed: 13 additions & 3 deletions b/‎_partials/permissions/_aws-deployment-policy.mdx‎
Lines changed: 13 additions & 3 deletions
diff --git a/‎_partials/permissions/_aws-dynamic-permissions.mdx‎
Lines changed: 4 additions & 7 deletions b/‎_partials/permissions/_aws-dynamic-permissions.mdx‎
Lines changed: 4 additions & 7 deletions
@@ -3,11 +3,14 @@ partial_category: self-hosted-and-vertex
 partial_name: additional-deployment-options
 ---
 
-Palette [Virtual Machine Orchestrator](/vm-management/) (VMO) and
-[Virtual Clusters](/clusters/palette-virtual-clusters/) can also be installed for
-airgapped self-hosted instances of Palette and Palette VerteX.
+The following deployment options are also available for airgapped self-hosted Palette and Palette VerteX instances:
 
-| File Name                                            | URL                                                                                                       |
-| ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
-| `airgap-pack-virtual-machine-orchestrator-4.6.2.bin` | https://software-private.spectrocloud.com/airgap/packs/airgap-pack-virtual-machine-orchestrator-4.6.2.bin |
-| `airgap-pack-vcluster-4.6.1.bin`                     | https://software-private.spectrocloud.com/airgap/packs/airgap-pack-vcluster-4.6.1.bin                     |
+- Palette [Virtual Machine Orchestrator](/vm-management/) (VMO)
+- [Virtual Machine Migration Assistant](/vm-management/vm-migration-assistant/) (VM Migration Assistant)
+- [Virtual Clusters](/clusters/palette-virtual-clusters/)
+
+| File Name                                                     | URL                                                                                                       |
+| ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
+| `airgap-pack-virtual-machine-orchestrator-4.6.4.bin`          | https://software-private.spectrocloud.com/airgap/packs/airgap-pack-virtual-machine-orchestrator-4.6.4.bin |
+| `airgap-pack-vm-migration-assistant-4.6.0.bin`                | https://software-private.spectrocloud.com/airgap/packs/airgap-pack-vm-migration-assistant-4.6.0.bin       |
+| `airgap-pack-vcluster-4.6.1.bin`                              | https://software-private.spectrocloud.com/airgap/packs/airgap-pack-vcluster-4.6.1.bin                     |
@@ -7,6 +7,7 @@ For installations using a Kubernetes cluster, we support any non-EOL (End of Lif
 
 | **Palette Version** <!-- kubernetes-max-version-table --> | **Highest Supported Kubernetes Version** |
 | ------------------- | ---------------------- |
+| <!-- k8s-max-4.6.c --> 4.6.32 | 1.31.x |
 | <!-- k8s-max-4.6.b --> 4.6.23 | 1.31.x |
 | <!-- k8s-max-4.6.a --> 4.6.12 | 1.31.x |
 | 4.6.6               | 1.31.x                 |
@@ -27,4 +28,4 @@ For installations using a Kubernetes cluster, we support any non-EOL (End of Lif
 | 4.3.6               | 1.28.x                 |
 | 4.2.13              | 1.28.x                 |
 | 4.2.7               | 1.28.x                 |
-| 4.1.12              | 1.27.x                 |
+| 4.1.12              | 1.27.x                 |
@@ -2,7 +2,7 @@
 partial_category: permissions
 partial_name: aws-control-plane-policy
 ---
-**Last Update**: April 20, 2023
+**Last Update**: May 25, 2025
 
 ```json
 {
@@ -63,11 +63,13 @@ partial_name: aws-control-plane-policy
         "elasticloadbalancing:RegisterTargets",
         "elasticloadbalancing:SetLoadBalancerPoliciesOfListener",
         "iam:CreateServiceLinkedRole",
-        "kms:DescribeKey"
-      ],
-      "Resource": [
-        "*"
+        "kms:DescribeKey",
+        "ec2:AssignIpv6Addresses",
+        "elasticloadbalancing:SetSecurityGroups",
+        "elasticloadbalancing:DeregisterTargets",
+        "sts:AssumeRole"
       ],
+      "Resource": ["*"],
       "Effect": "Allow"
     }
   ]
 
@@ -2,7 +2,7 @@
 partial_category: permissions
 partial_name: aws-controller-policy
 ---
-**Last Update**: April 20, 2023
+**Last Update**: May 25, 2025
 
 ```json
 {
@@ -83,11 +83,44 @@ partial_name: aws-controller-policy
         "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
         "elasticloadbalancing:RemoveTags",
         "iam:CreateOpenIDConnectProvider",
-        "tag:GetResources"
-      ],
-      "Resource": [
-        "*"
-      ],
+        "tag:GetResources",
+        "ec2:DescribeIpamPools",
+        "ec2:AllocateIpamPoolCidr",
+        "ec2:AttachNetworkInterface",
+        "ec2:DetachNetworkInterface",
+        "ec2:AssignIpv6Addresses",
+        "ec2:AssignPrivateIpAddresses",
+        "ec2:UnassignPrivateIpAddresses",
+        "ec2:AssociateVpcCidrBlock",
+        "ec2:CreateCarrierGateway",
+        "ec2:CreateEgressOnlyInternetGateway",
+        "ec2:CreateNetworkInterface",
+        "ec2:CreateVpcEndpoint",
+        "ec2:DisassociateVpcCidrBlock",
+        "ec2:ModifyVpcEndpoint",
+        "ec2:DeleteCarrierGateway",
+        "ec2:DeleteEgressOnlyInternetGateway",
+        "ec2:DeleteVpcEndpoints",
+        "ec2:DescribeCarrierGateways",
+        "ec2:DescribeInstanceTypes",
+        "ec2:DescribeEgressOnlyInternetGateways",
+        "ec2:DescribeVpcEndpoints",
+        "ec2:DescribeDhcpOptions",
+        "ec2:DescribeTags",
+        "ec2:ModifyInstanceMetadataOptions",
+        "elasticloadbalancing:DescribeTargetGroups",
+        "elasticloadbalancing:SetSecurityGroups",
+        "elasticloadbalancing:SetSubnets",
+        "elasticloadbalancing:ModifyTargetGroupAttributes",
+        "elasticloadbalancing:CreateTargetGroup",
+        "elasticloadbalancing:DescribeListeners",
+        "elasticloadbalancing:CreateListener",
+        "elasticloadbalancing:DescribeTargetHealth",
+        "elasticloadbalancing:RegisterTargets",
+        "elasticloadbalancing:DeleteListener",
+        "sts:AssumeRole"
+      ],
+      "Resource": ["*"],
       "Effect": "Allow"
     },
     {
@@ -110,9 +143,7 @@ partial_name: aws-controller-policy
           "iam:AWSServiceName": "autoscaling.amazonaws.com"
         }
       },
-      "Action": [
-        "iam:CreateServiceLinkedRole"
-      ],
+      "Action": ["iam:CreateServiceLinkedRole"],
       "Resource": [
         "arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling"
       ],
@@ -124,9 +155,7 @@ partial_name: aws-controller-policy
           "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
         }
       },
-      "Action": [
-        "iam:CreateServiceLinkedRole"
-      ],
+      "Action": ["iam:CreateServiceLinkedRole"],
       "Resource": [
         "arn:*:iam::*:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
       ],
@@ -138,21 +167,15 @@ partial_name: aws-controller-policy
           "iam:AWSServiceName": "spot.amazonaws.com"
         }
       },
-      "Action": [
-        "iam:CreateServiceLinkedRole"
-      ],
+      "Action": ["iam:CreateServiceLinkedRole"],
       "Resource": [
         "arn:*:iam::*:role/aws-service-role/spot.amazonaws.com/AWSServiceRoleForEC2Spot"
       ],
       "Effect": "Allow"
     },
     {
-      "Action": [
-        "iam:PassRole"
-      ],
-      "Resource": [
-        "arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"
-      ],
+      "Action": ["iam:PassRole"],
+      "Resource": ["arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"],
       "Effect": "Allow"
     },
     {
@@ -161,9 +184,7 @@ partial_name: aws-controller-policy
         "secretsmanager:DeleteSecret",
         "secretsmanager:TagResource"
       ],
-      "Resource": [
-        "arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*"
-      ],
+      "Resource": ["arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*"],
       "Effect": "Allow"
     },
     {
@@ -175,9 +196,7 @@ partial_name: aws-controller-policy
         "s3:PutObjectAcl",
         "s3:PutObject"
       ],
-      "Resource": [
-        "arn:*:s3:::*"
-      ],
+      "Resource": ["arn:*:s3:::*"],
       "Effect": "Allow"
     }
   ]
 
@@ -2,7 +2,7 @@
 partial_category: permissions
 partial_name: aws-deployment-policy
 ---
-**Last Update**: April 20, 2023
+**Last Update**: May 25, 2025
 
 ```json
 {
@@ -44,10 +44,20 @@ partial_name: aws-deployment-policy
         "iam:DeleteGroup",
         "iam:DeleteInstanceProfile",
         "iam:RemoveRoleFromInstanceProfile",
-        "iam:RemoveUserFromGroup"
+        "iam:RemoveUserFromGroup",
+        "ec2:AttachVolume",
+        "ec2:CreateTags",
+        "ec2:CreateVolume",
+        "ec2:DeleteTags",
+        "ec2:DeleteVolume",
+        "ec2:DescribeAvailabilityZones",
+        "ec2:DescribeInstances",
+        "ec2:DescribeVolumes",
+        "ec2:DetachVolume",
+        "ec2:ModifyVolume"   
       ],
       "Resource": "*"
     }
   ]
 }
-```
+```
@@ -2,7 +2,7 @@
 partial_category: permissions
 partial_name: aws-dynamic-permissions
 ---
-**Last Update**: March 12, 2025
+**Last Update**: May 25, 2025
 
 ```json
 {
@@ -65,6 +65,7 @@ partial_name: aws-dynamic-permissions
         "ec2:DescribeVolumesModifications",
         "ec2:DescribeVpcAttribute",
         "ec2:DescribeVpcs",
+        "ec2:DescribeVpcEndpoints",
         "ec2:DetachInternetGateway",
         "ec2:DisassociateAddress",
         "ec2:DisassociateRouteTable",
@@ -138,12 +139,8 @@ partial_name: aws-dynamic-permissions
     },
     {
       "Effect": "Allow",
-      "Action": [
-        "iam:PassRole"
-      ],
-      "Resource": [
-        "arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"
-      ]
+      "Action": ["iam:PassRole"],
+      "Resource": ["arn:*:iam::*:role/*.cluster-api-provider-aws.sigs.k8s.io"]
     }
   ]
 }
Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@`
`2`	`2`	`partial_category: permissions`
`3`	`3`	`partial_name: aws-dynamic-permissions`
`4`	`4`	`---`
`5`		`-Last Update: March 12, 2025`
	`5`	`+Last Update: May 25, 2025`
`6`	`6`
`7`	`7`	```json
`8`	`8`	`{`
`@@ -65,6 +65,7 @@ partial_name: aws-dynamic-permissions`
`65`	`65`	`"ec2:DescribeVolumesModifications",`
`66`	`66`	`"ec2:DescribeVpcAttribute",`
`67`	`67`	`"ec2:DescribeVpcs",`
	`68`	`+ "ec2:DescribeVpcEndpoints",`
`68`	`69`	`"ec2:DetachInternetGateway",`
`69`	`70`	`"ec2:DisassociateAddress",`
`70`	`71`	`"ec2:DisassociateRouteTable",`
`@@ -138,12 +139,8 @@ partial_name: aws-dynamic-permissions`
`138`	`139`	`},`
`139`	`140`	`{`
`140`	`141`	`"Effect": "Allow",`
`141`		`- "Action": [`
`142`		`- "iam:PassRole"`
`143`		`- ],`
`144`		`- "Resource": [`
`145`		`- "arn::iam:::role/*.cluster-api-provider-aws.sigs.k8s.io"`
`146`		`- ]`
	`142`	`+ "Action": ["iam:PassRole"],`
	`143`	`+ "Resource": ["arn::iam:::role/*.cluster-api-provider-aws.sigs.k8s.io"]`
`147`	`144`	`}`
`148`	`145`	`]`
`149`	`146`	`}`