docs: release 2.0

docs/configuration/component-manager-rms.md

@@ -1,4 +1,4 @@
-# Component Manager RMS Backends (Day 1)
+# Component Manager RMS Backends (Day 1) <Badge intent="info">v2.0</Badge> <Badge intent="launch" minimal>New</Badge>
 
 Operator guide for configuring **Rack Manager Service (RMS)** backends in the
 `[component_manager]` section of `nico-api` site config, and the **rack profile**

docs/configuration/dns.md

@@ -1,4 +1,4 @@
-# DNS
+# DNS <Badge intent="info">v2.0</Badge> <Badge intent="launch" minimal>New</Badge>
 
 NICo answers DNS for everything it manages. Records are never authored by hand: they derive from the machine, BMC, and instance inventory in the `nico-api` database, appear when an interface or instance gains an address, and disappear when it loses one. This page covers the names NICo serves, how the site zone and per-segment subdomains are configured, and how reverse (PTR) resolution works. For the deployment side - the `nico-dns` service, the recursive resolver in front of it, and the fixed infrastructure service names - refer to [IP and Network Configuration](../provisioning/ip-and-network-configuration.md#3-dns-configuration).
 

docs/configuration/machine_identity.md

@@ -1,4 +1,4 @@
-# Machine Identity (Day 1)
+# Machine Identity (Day 1) <Badge intent="info">v2.0</Badge> <Badge intent="launch" minimal>New</Badge>
 
 Operator guide for per-organization **machine identity** configuration: JWT-SVID issuance for tenant workloads, optional RFC 8693 token delegation, discovery endpoints, verification, and signing-key rotation.
 
@@ -118,12 +118,12 @@ When token delegation is configured, NICo issues a short-lived **intermediate**
 
 **Endpoint:** `PUT /v2/org/{org}/nico/site/{siteID}/tenant-identity/token-delegation`
 
-> **Recommendation:** Token delegation causes `nico-api` to call the org-configured `tokenEndpoint` over HTTP(S). For external token exchange URLs, configure site-level egress controls in `[machine_identity]` during [Day 0](../getting-started/installation-options/day0-machine-identity.md):
->
-> - `token_endpoint_http_proxy` — route outbound token-exchange HTTP through a controlled egress proxy
-> - `token_endpoint_domain_allowlist` — restrict which hostnames tenants may register on `tokenEndpoint`
->
-> Together these mitigate SSRF-style risk if a tenant admin supplies an endpoint the API should not reach. They are optional at install time but **strongly recommended** for production sites that delegate to external hosts.
+**Recommendation:** Token delegation causes `nico-api` to call the org-configured `tokenEndpoint` over HTTP(S). For external token exchange URLs, configure site-level egress controls in `[machine_identity]` during [Day 0](../getting-started/installation-options/day0-machine-identity.md):
+
+- `token_endpoint_http_proxy` — route outbound token-exchange HTTP through a controlled egress proxy
+- `token_endpoint_domain_allowlist` — restrict which hostnames tenants may register on `tokenEndpoint`
+
+Together these mitigate SSRF-style risk if a tenant admin supplies an endpoint the API should not reach. They are optional at install time but **strongly recommended** for production sites that delegate to external hosts.
 
 Example (adjust fields to match your STS):
 
@@ -142,9 +142,11 @@ curl -sS -X PUT \
   }'
 ```
 
-> **PUT is full replace:** omitting `clientSecretBasic` on an update clears stored credentials. Re-supply secrets on every update that should keep basic auth.
+**PUT is full replace:** omitting `clientSecretBasic` on an update clears stored credentials. Re-supply secrets on every update that should keep basic auth.
 
-> **Note:** `tokenEndpoint` may use `http://` with an IP address (for example a node-local sidecar). NICo allows this for in-instance STS; use allowlists and network policy in production where appropriate.
+<Note>
+`tokenEndpoint` may use `http://` with an IP address (for example a node-local sidecar). NICo allows this for in-instance STS; use allowlists and network policy in production where appropriate.
+</Note>
 
 ```bash
 # Remove delegation (return to direct signing)

docs/configuration/secrets-storage.md

@@ -1,4 +1,4 @@
-# Secrets Storage
+# Secrets Storage <Badge intent="info">v2.0</Badge> <Badge intent="launch" minimal>New</Badge>
 
 NICo keeps the credentials it manages (BMC logins, switch and UFM accounts, factory defaults, and so on) in a credentials store. Vault is the historical and default backend. NICo can also store credentials in Postgres, encrypted per credential with envelope encryption, and can read both backends side by side; that combination is what makes a gradual, reversible migration off Vault possible.
 

docs/hcl.md

@@ -8,59 +8,59 @@ inquiries or technical specifications, please contact the original hardware vend
 
 **Last Updated: 2/20/2026**
 
-| Host Machine                        | BMC/Management Firmware Version     | BIOS/UEFI Version   | Misc. Firmware Version (FPGA, CPLD, LXPM, etc.) |
-|-------------------------------------|-------------------------------------|---------------------|-------------------------------------------------|
-| GB200 NVL - Wiwynn                  | 25.06-2_NV_WW_02                    | 1.3.2GA             | 1.3.2GA                                         |
-| NVSwitch Tray - Wiwynn              | 1.3.2GA                             | 1.3.2GA             | 1.3.2GA                                         |
-| GB200 Compute Tray (1RU)            | 1.3.2GA                             | 1.3.2GA             | 1.3.2GA                                         |
-| NVSwitch Tray DGX                   | 1.3.2GA                             | 1.3.2GA             | 1.3.2GA                                         |
-| DGX H100                            | 25.06.27 (DGXH100_H200_25.06.4 pkg) | 1.06.07 (DGXH100_H200_25.06.4 pkg) |                                  |
-| Lenovo ThinkSystem SR670 V2         | 6.10                                | 3.30                | 3.31.01                                         |
-| Lenovo ThinkSystem SR675 V3         | 14.10                               | 8.30                | 4.20.03                                         |
-| Lenovo ThinkSystem SR675 V3 OVX*    | 14.10                               | 8.30                | 4.20.03                                         |
-| Lenovo ThinkSystem SR650            | 10.40                               | 4.30                | 2.13                                            |
-| Lenovo ThinkSystem SR650 V3         | 6.92                                | 3.70                | 4.21.01                                         |
-| Lenovo ThinkSystem SR650 V2         | 5.70                                | 3.60                | 3.31.01                                         |
-| Lenovo ThinkSystem SR650 V2 OVX*    | 5.70                                | 3.60                | 3.31.01                                         |
-| Lenovo ThinkSystem SR655 V3         | 5.80                                | 5.70                | 4.20.03                                         |
-| Lenovo ThinkSystem SR655 V3 OVX*    | 5.80                                | 5.70                | 4.20.03                                         |
-| Lenovo ThinkSystem SR665 V3 OVX*    | 5.80                                | 5.70                | 4.20.03                                         |
-| Lenovo SR650 V4                     | 1.90                                | 1.30                | 5.03.00                                         |
-| Lenovo HS350X V3                    | 1.20                                | 2.17.0              |                                                 |
-| Dell PowerEdge XE9680               | iDRAC 7.20.60.50                    | 2.7.4               | 1.6.0                                           |
-| Dell PowerEdge R750                 | iDRAC 7.20.60.50                    | 1.18.1              | 1.1.1                                           |
-| SYS-221H-TNR                        | 1.03.18                             | 2.7                 | SAA Ver = 1.3.0-p7                              |
-| Dell PowerEdge R760                 | iDRAC 7.20.60.50                    | 2.7.5               | 1.2.6                                           |
-| ARS-121L-DNR                        | 01.08.02 / 01.03.16 (LCC)           | 2.2a / 2.0 (LCC)    | SAA Ver = 1.2.0-p6 / SUM = 2.14.0-p6 (LCC)      |
-| SYS-221H-TN24R                      | X1.05.10                            | 2.7                 | SAA Ver = 1.3.0-p5                              |
-| ARS-221GL-NR                        | 1.03.16                             | 2.0                 |                                                 |
-| HPE ProLiant DL385 Gen10 Plus v2    | 3.15                                | 3.80_09-05-2025     |                                                 |
-| DL380 Gen12                         | 1.20.00                             | 1.62_02-06-2026     |                                                 |
-| SSG-121E-NES24R                     | 01.04.19                            | 2.7                 | SAA Ver = 1.3.0-p1                              |
-| SYS-121H-TNR                        | X1.05.10                            | 2.7                 | SAA Ver = 1.3.0-p5                              |
-| SYS-821GE-TNHR                      | 1.03.18                             | 2.7                 | SAA Ver = 1.3.0-p7                              |
-| Dell R760xd2                        | iDRAC 7.20.80.50                    | 2.9.4               | 1.1.2                                           |
-| Dell R670                           | iDRAC 1.20.80.51                    | 1.7.5               |                                                 |
-| Dell R770                           | iDRAC 1.20.80.51                    | 1.7.5               |                                                 |
-| SYS-421GE-TNRT                      | 1.03.19                             | 2.6                 | SAA Ver = 1.2.0-p8                              |
-| Dell PowerEdge R640                 | iDRAC 7.00.00.182                   | 2.24.0              | 1.0.6                                           |
+| Host Machine | BMC/Management Firmware Version | BIOS/UEFI Version | Misc. Firmware Version (FPGA, CPLD, LXPM, etc.) |
+| ------------ | ------------------------------- | ----------------- | ----------------------------------------------- |
+| GB200 NVL - Wiwynn | 25.06-2_NV_WW_02 | 1.3.2GA | 1.3.2GA |
+| NVSwitch Tray - Wiwynn | 1.3.2GA | 1.3.2GA | 1.3.2GA |
+| GB200 Compute Tray (1RU) | 1.3.2GA | 1.3.2GA | 1.3.2GA |
+| NVSwitch Tray DGX | 1.3.2GA | 1.3.2GA | 1.3.2GA |
+| DGX H100 | 25.06.27 (DGXH100_H200_25.06.4 pkg) | 1.06.07 (DGXH100_H200_25.06.4 pkg) |  |
+| Lenovo ThinkSystem SR670 V2 | 6.10 | 3.30 | 3.31.01 |
+| Lenovo ThinkSystem SR675 V3 | 14.10 | 8.30 | 4.20.03 |
+| Lenovo ThinkSystem SR675 V3 OVX* | 14.10 | 8.30 | 4.20.03 |
+| Lenovo ThinkSystem SR650 | 10.40 | 4.30 | 2.13 |
+| Lenovo ThinkSystem SR650 V3 | 6.92 | 3.70 | 4.21.01 |
+| Lenovo ThinkSystem SR650 V2 | 5.70 | 3.60 | 3.31.01 |
+| Lenovo ThinkSystem SR650 V2 OVX* | 5.70 | 3.60 | 3.31.01 |
+| Lenovo ThinkSystem SR655 V3 | 5.80 | 5.70 | 4.20.03 |
+| Lenovo ThinkSystem SR655 V3 OVX* | 5.80 | 5.70 | 4.20.03 |
+| Lenovo ThinkSystem SR665 V3 OVX* | 5.80 | 5.70 | 4.20.03 |
+| Lenovo SR650 V4 | 1.90 | 1.30 | 5.03.00 |
+| Lenovo HS350X V3 | 1.20 | 2.17.0 |  |
+| Dell PowerEdge XE9680 | iDRAC 7.20.60.50 | 2.7.4 | 1.6.0 |
+| Dell PowerEdge R750 | iDRAC 7.20.60.50 | 1.18.1 | 1.1.1 |
+| SYS-221H-TNR | 1.03.18 | 2.7 | SAA Ver = 1.3.0-p7 |
+| Dell PowerEdge R760 | iDRAC 7.20.60.50 | 2.7.5 | 1.2.6 |
+| ARS-121L-DNR | 01.08.02 / 01.03.16 (LCC) | 2.2a / 2.0 (LCC) | SAA Ver = 1.2.0-p6 / SUM = 2.14.0-p6 (LCC) |
+| SYS-221H-TN24R | X1.05.10 | 2.7 | SAA Ver = 1.3.0-p5 |
+| ARS-221GL-NR | 1.03.16 | 2.0 |  |
+| HPE ProLiant DL385 Gen10 Plus v2 | 3.15 | 3.80_09-05-2025 |  |
+| DL380 Gen12 | 1.20.00 | 1.62_02-06-2026 |  |
+| SSG-121E-NES24R | 01.04.19 | 2.7 | SAA Ver = 1.3.0-p1 |
+| SYS-121H-TNR | X1.05.10 | 2.7 | SAA Ver = 1.3.0-p5 |
+| SYS-821GE-TNHR | 1.03.18 | 2.7 | SAA Ver = 1.3.0-p7 |
+| Dell R760xd2 | iDRAC 7.20.80.50 | 2.9.4 | 1.1.2 |
+| Dell R670 | iDRAC 1.20.80.51 | 1.7.5 |  |
+| Dell R770 | iDRAC 1.20.80.51 | 1.7.5 |  |
+| SYS-421GE-TNRT | 1.03.19 | 2.6 | SAA Ver = 1.2.0-p8 |
+| Dell PowerEdge R640 | iDRAC 7.00.00.182 | 2.24.0 | 1.0.6 |
 
 \* OVX may not show up as an option; check the Server Serial Number to confirm.
 
-### Hosts -- Under Development
+### Hosts -- Under Development <Badge intent="info">Upcoming</Badge>
 
 This list outlines platforms that are under development and have not undergone full unit testing.
 
-| Host Machine                        | BMC/Management Firmware Version     | BIOS/UEFI Version   | Provisioning Manager Version               |
-|-------------------------------------|-------------------------------------|---------------------|--------------------------------------------|
-| Lenovo GB300 Compute Tray           | 3.0.0                               | 1.0.0GA             | 1.0.0GA                                    |
+| Host Machine | BMC/Management Firmware Version | BIOS/UEFI Version | Provisioning Manager Version |
+| ------------ | ------------------------------- | ----------------- | ---------------------------- |
+| Lenovo GB300 Compute Tray | 3.0.0 | 1.0.0GA | 1.0.0GA |
 
 ## DPUs
 
-| DPU          | Firmware / Software Version                       |
-|--------------|---------------------------------------------------|
-| BlueField 2  | DOCA 3.2.0                                        |
-| BlueField 3  | DOCA 3.2.0                                        |
+| DPU | Firmware / Software Version |
+| --- | --------------------------- |
+| BlueField 2 | DOCA 3.2.0 |
+| BlueField 3 | DOCA 3.2.0 |
 
 ## GPUs
 
@@ -71,4 +71,3 @@ Unlike host platforms, GPU compatibility is not validated on a per-platform basi
 | GPU Family | Support |
 | ---------- | ------- |
 | Current NVIDIA Data Center GPUs | Supported |
-

docs/manuals/vpc/flat_vpcs_zero_dpu.md

@@ -1,4 +1,4 @@
-# Flat VPCs and Zero-DPU Hosts
+# Flat VPCs and Zero-DPU Hosts <Badge intent="info">v2.0</Badge> <Badge intent="launch" minimal>New</Badge>
 
 `Flat` is a VPC virtualization type for tenant instances that run on hosts
 **without a NICo-managed DPU** — either hosts with no DPU hardware at all, or
@@ -371,7 +371,7 @@ Rules enforced at allocation:
 
 Read instance status through the REST API or `nicocli`:
 
-```
+```text
 GET /v2/org/{org}/nico/instance/{id}
 nicocli instance get <instance-id>
 ```

docs/operations/firmware-updates.md

@@ -1,4 +1,4 @@
-# Firmware Updates
+# Firmware Updates <Badge intent="launch" minimal>New</Badge>
 
 This guide first gives a high-level view of firmware updates in NICo and helps
 you choose the workflow that applies to your hardware. The linked workflow

docs/operations/monitoring-health.md

@@ -1,4 +1,4 @@
-# Monitoring and Health
+# Monitoring and Health <Badge intent="launch" minimal>New</Badge>
 
 This page covers monitoring and health workflows for NICo sites after
 deployment: hardware health, DPU health, aggregate host health, health

docs/operations/nvos-password-rotation.md

@@ -1,4 +1,4 @@
-# NVOS Password Rotation
+# NVOS Password Rotation <Badge intent="info">v2.0</Badge> <Badge intent="launch" minimal>New</Badge>
 
 Use this workflow to rotate the NVOS admin password across managed NVLink switches, monitor site-wide convergence, and recover switches that do not reach the published target.
 

docs/operations/tenant-lifecycle-cleanup.md

@@ -1,4 +1,4 @@
-# Tenant Lifecycle Cleanup
+# Tenant Lifecycle Cleanup <Badge intent="launch" minimal>New</Badge>
 
 Use this workflow to release an instance, track NICo cleanup progress, and
 verify that the host is ready for reuse.

docs/provisioning/boot-interfaces-and-dpu-modes.md

@@ -1,4 +1,4 @@
-# Boot Interfaces and DPU Policies
+# Boot Interfaces and DPU Policies <Badge intent="info">v2.0</Badge> <Badge intent="launch" minimal>New</Badge>
 
 This guide explains how NICo decides **which interface a host boots from**, how a host's **DPUs are managed**, and how operators configure both through the Expected Machines table. It is the deep companion to [Ingesting Hosts](ingesting-hosts.md): that page covers the end-to-end ingest flow and the basic `expected_machines.json`; this page covers the per-host and per-NIC knobs (`dpu_policy`, `host_nics`), **what the defaults do when you set nothing**, and how a boot device is chosen and applied behind the scenes.
 

docs/provisioning/machine-validation.md

@@ -1,4 +1,4 @@
-# Machine Validation
+# Machine Validation <Badge intent="info">v2.0</Badge>
 
 Machine Validation is NVIDIA Infra Controller's in-band validation framework for
 checking a machine before it is made available to tenants. NICo uses Scout to run

fern/changelog/2026-01-23.mdx

@@ -2,7 +2,7 @@
 tags: ["EOL", "deployment", "gb200", "nvlink"]
 ---
 
-## NVIDIA Infra Controller EA <Badge intent="error">End of Life</Badge>
+## NVIDIA Infra Controller EA <Badge intent="error">EOL</Badge>
 
 NVIDIA Infra Controller EA introduced a self-hosted, disconnected deployment model with source and build instructions that do not depend on NGC.
 

fern/changelog/2026-02-12.mdx

@@ -1,8 +1,8 @@
 ---
-tags: ["EOL", "rest-api", "provisioning", "nvlink"]
+tags: ["EOL", "nvlink", "provisioning", "rest-api"]
 ---
 
-## NVIDIA Infra Controller v0.2 <Badge intent="error">End of Life</Badge>
+## NVIDIA Infra Controller v0.2 <Badge intent="error">EOL</Badge>
 
 NVIDIA Infra Controller v0.2 made the project available as open-source software and expanded its APIs, orchestration, and hardware lifecycle support.
 

fern/changelog/2026-05-15.mdx

@@ -1,8 +1,8 @@
 ---
-tags: ["current", "deployment", "rack-level-administration", "gb200"]
+tags: ["maintenance", "deployment", "gb200", "rack-level-administration"]
 ---
 
-## NVIDIA Infra Controller v0.8 <Badge intent="launch">Current</Badge>
+## NVIDIA Infra Controller v0.8 <Badge intent="warning">Maintenance</Badge>
 
 NVIDIA Infra Controller v0.8 introduced a unified documentation site, simplified deployment, and expanded rack-level administration for GB200 systems.
 

fern/changelog/2026-07-31.mdx

@@ -1,8 +1,12 @@
 ---
-tags: ["next", "deployment", "ntp", "security", "database"]
+tags: ["current", "database", "deployment", "dpu", "machine-identity", "multi-arch", "networking", "ntp", "rest-api", "security", "telemetry", "validation", "zero-dpu"]
 ---
 
-## NVIDIA Infra Controller v2.0 <Badge intent="launch">Next</Badge>
+## NVIDIA Infra Controller v2.0 <Badge intent="launch">Current</Badge>
+
+NICo v2.0 expands bare-metal lifecycle management with built-in NTP, broader hardware telemetry, multi-architecture support, and stronger security and operational controls.
+
+Before upgrading an existing deployment, review the REST API database migration requirements below.
 
 <Warning title="Upgrade note: REST database consolidation">
 The NICo REST API database has moved from a standalone PostgreSQL instance to the shared Zalando-managed `nico-pg-cluster`. A new `nico_rest` database and `nico-rest.nico` user are provisioned automatically (gated on `rest.enabled: true`). Database credentials are now synced by External Secrets Operator as the `nico-rest-pg-creds` secret in the `nico-rest` namespace, replacing the former `db-creds` secret.

fern/docs.yml

@@ -44,5 +44,11 @@ redirects:
     destination: "/infra-controller/documentation/getting-started/quick-start-guide"
   - source: "/infra-controller/documentation/introduction"
     destination: "/infra-controller/documentation/overview/what-is-nico"
+  - source: "/infra-controller/documentation/operations-day-2/firmware-updates"
+    destination: "/infra-controller/documentation/operations-day-2/firmware-updates/overview"
+  - source: "/infra-controller/documentation/operations-day-2/observability/core-metrics"
+    destination: "/infra-controller/documentation/operations-day-2/observability/core-metrics-list"
+  - source: "/infra-controller/documentation/provisioning-day-0/boot-interfaces-and-dpu-modes"
+    destination: "/infra-controller/documentation/provisioning-day-0/boot-interfaces-and-dpu-policies"
   - source: "/infra-controller/documentation/reference/release-notes"
     destination: "/infra-controller/documentation/release-notes"

fern/fern.config.json

@@ -1,4 +1,4 @@
 {
   "organization": "nvidia",
-  "version": "5.80.4"
+  "version": "5.89.1"
 }