HAMi AI Platform Chart 0.21.1

Release date: 2026-10-16 (UTC)

Version status: Known issue

This release changes how gateway hostname configuration is passed, but the default backend image remains v0.15.0 and does not include the corresponding runtime changes. The gateway issue is fixed in Chart 0.21.2. Before choosing an upgrade target, review its status and known issues; the impact is described below.

Component	Comparison baseline	This release
Chart	0.21.0	0.21.1
appVersion	0.15.0	0.15.0
API Server	v0.15.0	v0.15.0
Controller Manager	v0.15.0	v0.15.0
Database migration component (when SQLite auth storage is enabled)	v0.15.0	v0.15.0
UI	v0.12.1	v0.12.1

HAMi Enterprise compatibility

The table lists minimum companion versions for specific interfaces and usage conditions. A monitoring metric requirement for one vendor is not a minimum version for the entire platform.

Feature or scenario	Minimum HAMi Enterprise version	Companion requirements and conclusions
NVIDIA HAMi-core device allocation, scheduling capacity, allocated resources, and workload usage monitoring for a single regular container (excluding init containers)	v2.9.0-rc0	Use the companion Enterprise scheduler, NVIDIA device plugin, and vGPU Monitor, and ensure Prometheus scrapes the scheduler and device-plugin monitoring endpoints. This applies to a single regular container; use the separately stated conditions for other container modes.
Historical trend for the NVIDIA GPU memory oversell factor	v2.10.0-r0	The scheduler must expose hami_gpu_memory_oversell_factor, which the platform rules convert into a trend metric. This is the minimum for displaying the factor, not the first version with GPU memory oversell runtime support.
Container-core percentage for an allocated AMD workload	v2.10.0-r0	Applies when the AMD device is registered and allocated by HAMi. The scheduler converts physical CU count to the hami_vgpu_core_allocated_ratio percentage using the device's total core count. Physical-device utilization still comes from the vendor monitoring component.
Resource pools for regular NVIDIA/Ascend workloads: device ownership, namespace binding, CPU/memory and device quotas, explicit or binpack/spread pool selection	v2.9.0-rc0	Requires CRD Chart 0.4.2 and Resource Pool Manager application v0.0.1; the default installation uses RPM Chart 0.0.5. RPM Chart 0.0.4 requires an explicit correction to the Manager image. Use extender mode, Kubernetes >=1.30.0-0, and registered devices. This minimum combination is confirmed for amd64 artifacts.
GPU mutex/NUMA or comma-combination strategies within an NVIDIA resource pool	v2.10.0-r0	Use the CRD and RPM components above. These are GPU-allocation strategies within a pool, distinct from RPM's binpack/spread pool-selection strategies.
HCU resource pools	v2.10.0-r3	Requires CRD Chart 0.4.2, RPM application v0.0.2 (default RPM Chart 0.0.6), and HCU device plugin v3.0.0 in hami registration mode; use extender mode and Kubernetes >=1.30.0-0. This minimum combination is confirmed for amd64 artifacts.

The rc suffix in HAMi Enterprise versions does not indicate a test or prerelease build. The old v2.9.0-rc0 image is no longer available. For new deployments, choose an available version that meets the interface requirements above; image availability does not change the confirmed minimum interface version.

Chart changes

• gateway.hostnames is now injected as a comma-separated list into the API Server and Controller Manager GATEWAY_HOSTNAMES environment variables. The Controller Manager no longer receives the former GATEWAY_ENDPOINT. The parameter still defaults to []; hostname configuration for UI and API routes is unchanged.
• The default backend and UI images are unchanged. Therefore, this release does not deliver the hostname propagation and listener-selection fixes for control-plane workload, vLLM Demo, and CloudShell routes.

Known issue

Issue	Impact	Workaround	Fixed in
Gateway configuration does not match the default backend image	When gateway.hostnames is non-empty and the default v0.15.0 backend is used, the old backend does not read GATEWAY_HOSTNAMES. The control-plane access address falls back to the address in Gateway status and may be empty if no status address exists. Generated workload routes still do not inherit the site domain, so accessing Jupyter and other workload paths through that domain may show the platform page and return 403.	Chart 0.21.2 includes the gateway fix and its default backend. Review that release's known issue before adopting it, and check whether custom values still pin an old backend image. Changing only appVersion or upgrading Enterprise does not fix this issue.	Chart 0.21.2, default backend v0.15.1

Upgrade guidance

• When upgrading from Chart 0.21.0, if gateway.hostnames is non-empty, do not use Chart 0.21.1's default image combination to obtain the domain-routing fix. The fix is in Chart 0.21.2; review its status and known issues before upgrading. An empty hostname list does not trigger the old environment-variable replacement difference, but this release still does not update the backend with the fix.
• For the fixed release, check apiserver.image.tag, controllerManager.image.tag, and auth.image.tag so existing overrides do not keep them at v0.15.0. The fixed release defaults all three to v0.15.1; the UI remains v0.12.1. For a private image registry, global.imageRegistry overrides each component's image.registry; use the images for the corresponding release.
• The Chart diff from 0.21.0 to 0.21.1 does not change CRDs, RBAC, auth-storage configuration, or the database migration image. This gateway configuration change does not require switching auth storage or adding a data migration. With SQLite, the existing migration init container continues to run under the same conditions.
• Resource pools are optional companion components; the version requirements above are not new general upgrade requirements for this gateway change. To enable them for the first time or complete their prerequisites, install the relevant CRDs first, prepare a compatible Enterprise scheduler and device plugin, and then deploy RPM. RPM's hami.existingConfigMap must point to the ConfigMap actually used by the scheduler and containing device-config.yaml; the runtime pool-selection configuration must be readable and writable. Update RPM after device configuration changes so it receives the updated configuration.
• For the earliest RPM combination, prefer the default RPM Chart listed in the table. If using RPM Chart 0.0.4, set image.repository to ghcr.io/dynamia-ai/resource-pool-manager and image.tag to v0.0.1. Ascend pool selection in RPM Chart 0.0.5 uses hami.ascendEnabled=true; Chart 0.0.6 uses devices.ascend.enabled=true. With RPM Chart 0.0.6, HCU uses devices.hygon.enabled=true, and the HCU plugin uses RESOURCE_REGISTER_STRATEGY=hami. These minimum combinations do not apply to DRA mode.

See the Chart and appVersion mapping or the software center.

Values reference

The following parameter descriptions are taken from the README bundled with the Chart 0.21.1 release package and are preserved as published. Use this version's values.yaml as the source of default configuration.

Expand values table

Key	Type	Default	Description
apiserver.affinity	object	{}	apiserver affinity settings
apiserver.clusterAPIBurst	int	100	Burst to use while talking with cluster kube-apiserver
apiserver.clusterAPIQPS	int	50	QPS to use while talking with cluster kube-apiserver
apiserver.image.pullPolicy	string	"IfNotPresent"	kantaloupe image pull policy
apiserver.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
apiserver.image.registry	string	"ghcr.io"	kantaloupe image registry
apiserver.image.repository	string	"dynamia-ai/kantaloupe-apiserver"	kantaloupe image repository
apiserver.image.tag	string	"v0.15.0"	kantaloupe image tag (immutable tags are recommended)
apiserver.labels	object	{}	apiserver labels
apiserver.leaderElection.enabled	bool	true	Enable apiserver leader election for auth singleton bootstrap when auth.storeBackend=crd
apiserver.leaderElection.leaseDuration	string	"15s"	Lease duration for apiserver leader election
apiserver.leaderElection.renewDeadline	string	"10s"	Renew deadline for apiserver leader election
apiserver.leaderElection.resourceNamespace	string	""	Namespace of the Lease object; empty means use the release namespace
apiserver.leaderElection.retryPeriod	string	"2s"	Retry period for apiserver leader election
apiserver.livenessProbe.enabled	bool	false	Enable livenessProbe on apiserver containers
apiserver.logLevel	int	4	apiserver glog verbosity level (0=minimal, 4=info, 5=debug)
apiserver.meteringGRPCAddress	string	""	Optional upstream metering gRPC service address. Leave empty to disable metering APIs
apiserver.nodeSelector	object	{}	apiserver node labels for pod assignment
apiserver.podAnnotations	object	{}	apiserver pod annotations
apiserver.podLabels	object	{}	apiserver pod labels
apiserver.prometheusAddr	string	""	Prometheus server address for apiserver metrics querying
apiserver.readinessProbe.enabled	bool	false	Enable readinessProbe on ui containers
apiserver.replicaCount	int	1	apiserver target replica count
apiserver.resources	object	{}	apiserver resource requests and limits
apiserver.service.nodePort	int	31800
apiserver.service.port	int	8000
apiserver.service.type	string	"ClusterIP"
apiserver.tolerations	object	{}	apiserver tolerations for pod assignment
auth.apiserverServiceAccountName	string	""	ServiceAccount name of the kantaloupe-apiserver, used by the auth assignment admission webhook to validate the requester identity. Defaults to the release fullname.
auth.bootstrapAdminEmail	string	"[email protected]"	Bootstrap PlatformAdmin email address
auth.bootstrapAdminFullName	string	"Platform Administrator"	Bootstrap PlatformAdmin full name (display name)
auth.bootstrapAdminPassword	string	"admin12345"	Bootstrap admin password (plain text, dev only)
auth.bootstrapAdminUsername	string	"bootstrap-platform-admin"	Bootstrap PlatformAdmin username
auth.crdAuditWindowSize	int	1000	Max number of audit CRDs retained by the apiserver write path
auth.dbPath	string	"/data/kantaloupe/auth.db"	SQLite database path for auth data when auth.storeBackend=sqlite
auth.dryRun	bool	false	Allow requests without enforcing auth; inject bootstrap admin when no valid token is provided
auth.enabled	bool	true	Enable kantaloupe auth (JWT login, RBAC, audit)
auth.existingAuthSecret	string	""	Name of an existing K8s Secret with keys "jwt-secret" and "bootstrap-admin-password" (use instead of plain-text values for production)
auth.image.pullPolicy	string	"IfNotPresent"	db-migrate image pull policy for sqlite backend
auth.image.registry	string	"ghcr.io"	db-migrate image registry for sqlite backend
auth.image.repository	string	"dynamia-ai/kantaloupe-db-migrate"	db-migrate image repository for sqlite backend
auth.image.tag	string	"v0.15.0"	db-migrate image tag for sqlite backend
auth.jwtSecret	string	"your-own-jwt-secret"	JWT signing secret (plain text, dev only)
auth.persistence.enabled	bool	false	Enable persistence using PVC for sqlite backend (PV is dynamically provisioned via cluster default StorageClass)
auth.persistence.existingClaim	string	""	Name of an existing PVC to use for sqlite backend (if set, a new PVC will not be created)
auth.persistence.size	string	"1Gi"	PVC storage size for sqlite backend
auth.persistence.storageClass	string	""	PVC storage class for sqlite backend (empty = use cluster default StorageClass for dynamic PV provisioning)
auth.storeBackend	string	"crd"	Auth store backend. Supported values: crd, sqlite
cloudtty.enabled	bool	true
controlPlaneName	string	"control-plane"
controllerManager.affinity	object	{}	controllerManager affinity settings
controllerManager.enablePromoteKantaloupeflowController	bool	false	Automatically create KantaloupeFlow CRs for existing GPU deployments in member clusters.
controllerManager.image.pullPolicy	string	"IfNotPresent"	kantaloupe image pull policy
controllerManager.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
controllerManager.image.registry	string	"ghcr.io"	kantaloupe image registry
controllerManager.image.repository	string	"dynamia-ai/kantaloupe-controller-manager"	kantaloupe image repository
controllerManager.image.tag	string	"v0.15.0"	kantaloupe image tag (immutable tags are recommended)
controllerManager.labels	object	{}	controllerManager labels
controllerManager.livenessProbe.enabled	bool	false	Enable livenessProbe on controllerManager containers
controllerManager.metricsPort	int	31001
controllerManager.nodeSelector	object	{}	controllerManager node labels for pod assignment
controllerManager.podAnnotations	object	{}	controllerManager pod annotations
controllerManager.podLabels	object	{}	controllerManager pod labels
controllerManager.prometheusAddr	string	""	The Prometheus-compatible query endpoint for controller-manager. If empty, uses the default value from Go code.
controllerManager.readinessProbe.enabled	bool	false	Enable readinessProbe on controllerManager containers
controllerManager.replicaCount	int	1	controllerManager target replica count
controllerManager.resources	object	{}	controllerManager resource requests and limits
controllerManager.tolerations	object	{}	controllerManager tolerations for pod assignment
controllerManager.webhook.certDir	string	"/var/run/kantaloupe/webhook-certs"
controllerManager.webhook.certName	string	"tls.crt"
controllerManager.webhook.enabled	bool	true
controllerManager.webhook.keyName	string	"tls.key"
controllerManager.webhook.port	int	9443
controllerManager.webhook.servicePort	int	443
fullnameOverride	string	"kantaloupe"	String to fully override the fullname template
gateway.apiserverCors	object	{"allowCredentials":false,"allowHeaders":["authorization","content-type","accept","origin"],"allowMethods":["GET","POST","PUT","PATCH","DELETE","OPTIONS"],"allowOrigins":[],"enabled":false,"exposeHeaders":[],"maxAge":null}	Optional CORS policy attached only to the apiserver HTTPRoute (/apis)
gateway.apiserverCors.allowCredentials	bool	false	Whether credentialed cross-origin requests are allowed
gateway.apiserverCors.allowHeaders	list	["authorization","content-type","accept","origin"]	Allowed request headers returned on CORS preflight responses
gateway.apiserverCors.allowMethods	list	["GET","POST","PUT","PATCH","DELETE","OPTIONS"]	Allowed methods returned on CORS preflight responses
gateway.apiserverCors.allowOrigins	list	[]	Allowed browser origins for apiserver CORS; required when enabled
gateway.apiserverCors.enabled	bool	false	Enable Envoy Gateway SecurityPolicy-based CORS on the apiserver route
gateway.apiserverCors.exposeHeaders	list	[]	Response headers exposed to browser JavaScript
gateway.apiserverCors.maxAge	string	nil	Optional browser preflight cache max age in seconds
gateway.apiserverHostnames	list	[]	Dedicated external hostnames for direct apiserver access, separate from gateway.hostnames (the UI/site domain). When non-empty, a dedicated HTTPRoute routes these hosts to the apiserver; they must be covered by the HTTPS listener's TLS certificate.
gateway.className	string	"kantaloupe"	GatewayClass name
gateway.enabled	bool	true	Enable Gateway API resources
gateway.envoy	object	{"proxy":{"image":{"pullSecrets":[],"registry":"","repository":"","tag":""}},"service":{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}}	Envoy Gateway implementation details
gateway.envoy.proxy.image.pullSecrets	list	[]	Image pull secrets for Envoy proxy pods
gateway.envoy.proxy.image.registry	string	""	Envoy proxy image registry
gateway.envoy.proxy.image.repository	string	""	Envoy proxy image repository. When set without a tag, renders the EnvoyProxy imageRepository field.
gateway.envoy.proxy.image.tag	string	""	Envoy proxy image tag. When set, renders a complete EnvoyProxy image reference.
gateway.envoy.service	object	{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}	Envoy service configuration
gateway.envoy.service.ports.http	object	{"nodePort":30080}	HTTP port configuration
gateway.envoy.service.ports.http.nodePort	int	30080	HTTP NodePort
gateway.envoy.service.ports.https	object	{"nodePort":30443}	HTTPS port configuration
gateway.envoy.service.ports.https.nodePort	int	30443	HTTPS NodePort
gateway.envoy.service.type	string	"NodePort"	Envoy service type (LoadBalancer or NodePort)
gateway.hostnames	list	[]	List of site hostnames (DNS names or wildcard names such as *.example.com, without scheme, port, or path). Applied to UI/API routes and passed to controller-manager and apiserver as GATEWAY_HOSTNAMES for control-plane workload, vLLM demo, and CloudShell HTTPRoutes. Member-cluster workload routes do not inherit the control-plane site hostnames. An empty list leaves site routes unrestricted by hostname. The first entry also supplies the control-plane cluster gateway address for generated access URLs; use a concrete hostname first. HTTPS certificates must cover these names.
gateway.ipAddress	string	""	Gateway IP address
gateway.listeners	list	[{"name":"http","port":80,"protocol":"HTTP"}]	Gateway listeners configuration
global.imagePullSecrets	list	[]	Global Docker image pull secrets
global.imageRegistry	string	""	Global Docker image registry
hamiNamespace	string	"hami-system"
hook.image.pullPolicy	string	"IfNotPresent"	CRD hook image pull policy
hook.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
hook.image.registry	string	"ghcr.io"	CRD hook image registry
hook.image.repository	string	"cloudtty/cloudshell"	CRD hook image repository
hook.image.tag	string	"v0.8.9"	CRD hook image tag (immutable tags are recommended)
installCRDs	bool	true	define flag whether to install CRD resources
monitoring.enabled	bool	true
monitoring.hamiServiceMonitor.enabled	bool	true
monitoring.serviceMonitorLabels	object	{}	Labels added to ServiceMonitor and PrometheusRule resources for discovery by Prometheus-compatible operators. When empty, defaults to release: prometheus; providing any labels replaces that fallback. The built-in app, role, and control-plane labels cannot be overridden.
monitoring.vendorServiceMonitor.enableAMDServiceMonitor	bool	false	Enable AMD GPU Operator exporter discovery and AMD recording rules in the control plane. Required for monitoring AMD devices in local or member clusters.
monitoring.vendorServiceMonitor.enableAlibabaPPUServicemonitor	bool	false	Enable Alibaba PPU exporter discovery and Alibaba PPU recording rules in the control plane. Required for monitoring Alibaba PPU devices in local or member clusters.
monitoring.vendorServiceMonitor.enableAscendServicemonitor	bool	false	Enable Ascend exporter discovery and Ascend recording rules in the control plane. Required for monitoring Ascend devices in local or member clusters.
monitoring.vendorServiceMonitor.enableEnflameServicemonitor	bool	false	Enable Enflame GCU exporter discovery and Enflame recording rules in the control plane. Required for monitoring Enflame devices in local or member clusters.
monitoring.vendorServiceMonitor.enableHygonServicemonitor	bool	false	Enable HCU exporter discovery and Hygon device recording rules in the control plane. Required for monitoring Hygon devices in local or member clusters. Discovers hcu-exporter in the monitoring namespace.
monitoring.vendorServiceMonitor.enableIluvatarServicemonitor	bool	false	Enable Iluvatar ix-exporter and vgpu-manager discovery and Iluvatar recording rules in the control plane. Required for monitoring Iluvatar devices in local or member clusters.
monitoring.vendorServiceMonitor.enableMetaxServicemonitor	bool	false	Enable MetaX exporter discovery and MetaX recording rules in the control plane. Required for monitoring MetaX devices in local or member clusters.
monitoring.vendorServiceMonitor.enableNvidiaServicemonitor	bool	true	Enable NVIDIA exporter discovery and NVIDIA recording rules in the control plane. Required for monitoring NVIDIA devices in local or member clusters.
monitoring.vendorServiceMonitor.enabled	bool	true	Create vendor ServiceMonitor templates and recording rules for enabled vendors.
mpu.enabled	bool	false
mpu.image.pullPolicy	string	"IfNotPresent"	MPU image pull policy
mpu.image.pullSecrets	list	[]
mpu.image.registry	string	"ghcr.io"
mpu.image.repository	string	"dynamia-ai/mpu"
mpu.image.tag	string	"dev-ubuntu24.04"
nameOverride	string	""	String to partially override the fullname template (will maintain the release name)
ui.affinity	object	{}	ui affinity settings
ui.apiBackendURL	string	""	Optional backend address for UI API requests. Leave empty to use same-origin requests
ui.forceChinese	bool	false	Force UI to display Chinese language
ui.image.pullPolicy	string	"IfNotPresent"	kantaloupe image pull policy
ui.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
ui.image.registry	string	"ghcr.io"	kantaloupe image registry
ui.image.repository	string	"dynamia-ai/kantaloupe-ui"	kantaloupe image repository
ui.image.tag	string	"v0.12.1"	kantaloupe image tag (immutable tags are recommended)
ui.labels	object	{}	ui labels
ui.livenessProbe.enabled	bool	false	Enable livenessProbe on ui containers
ui.nodeSelector	object	{}	ui node labels for pod assignment
ui.podAnnotations	object	{}	ui pod annotations
ui.podLabels	object	{}	ui pod labels
ui.readinessProbe.enabled	bool	false	Enable readinessProbe on ui containers
ui.replicaCount	int	1	ui target replica count
ui.resources	object	{}	ui resource requests and limits
ui.service.nodePort	int	31300
ui.service.port	int	80
ui.service.type	string	"ClusterIP"
ui.tolerations	object	{}	ui tolerations for pod assignment