Skip to main content

HAMi AI Platform Chart 0.21.2

Release date: 2026-10-16 (UTC)

Version status: Known issue

This release upgrades the backend to v0.15.1 so that the site-domain configuration introduced in Chart 0.21.1 takes effect with the default backend image. The default UI v0.12.1 does not match the GPU resource format expected by the new workload-template API. This affects creating, copying, and editing GPU workloads in the UI. The issue is fixed in the default UI v0.13.0 shipped with Chart 0.21.3. Environments that depend on these operations should avoid this release's default component combination and review the fix release's scope and status before upgrading.

ComponentComparison baselineThis release
Chart0.21.10.21.2
appVersion0.15.00.15.1
API Serverv0.15.0v0.15.1
Controller Managerv0.15.0v0.15.1
Database migration imagev0.15.0v0.15.1
UIv0.12.1v0.12.1

The database migration container runs only when authentication is enabled and auth.storeBackend=sqlite.

HAMi Enterprise compatibility​

The following are the minimum companion versions for the interfaces and protocols relevant to this release. Resource pools are optional; their prerequisites do not automatically apply to the platform's basic operation. These findings do not replace validation in the target hardware environment.

Feature or scenarioMinimum HAMi Enterprise versionCompanion requirements and upgrade notes
Read four-field annotations for allocated devices, including empty slots across multiple containers; NVIDIA, AMD, Ascend, Iluvatar, AWS Neuron, Enflame vGPU, and Alibaba PPUv2.9.0-rc0Applies only to reading allocation records. This release fixes platform parsing; no Enterprise upgrade is required if the existing version already supports the matching protocol. This does not mean this version covers all scheduling, isolation, or monitoring capabilities for these vendors.
Resource-pool management, namespace authorization, quotas, explicit pool selection, and automatic binpack/spread selection for regular NVIDIA/Ascend workloadsv2.9.0-rc0Minimum standalone CRD Chart: 0.4.2; minimum RPM application: v0.0.1; minimum RPM Chart with the correct default component: 0.0.5. RPM Chart 0.0.4 meets the requirement only when explicitly configured to use the correct RPM image. These RPM artifact combinations are confirmed for amd64.
An initialization container that does not request a GPU before an NVIDIA workload containerv2.9.0-rc1Set scheduler.useDownward=true. Earlier versions do not handle container indexes for this template. When resource pools are enabled, also meet the standalone component requirements in the previous row.
An NVIDIA initialization container that requests a GPU, including workloads where only the initialization container requests onev2.10.0-r0Set scheduler.useDownward=true; the complete initialization-container annotations and plugin must be compatible. When resource pools are enabled, also meet the RPM/CRD requirements above.
GPU mutex, NUMA, or combined strategies within an NVIDIA resource poolv2.10.0-r0Use the RPM/CRD components above. These are GPU strategies within a pool, distinct from RPM's binpack/spread selection between pools.
HCU resource-pool management and scheduling interfacesv2.10.0-r3Minimum CRD Chart: 0.4.2; minimum RPM application: v0.0.2; minimum RPM Chart with the default RPM image: 0.0.6. HCU device plugin must be v3.0.0 or later with RESOURCE_REGISTER_STRATEGY=hami. Plugin artifacts are confirmed for amd64. The older DCU naming protocol is not a substitute for the HCU protocol.

The rc suffix in HAMi Enterprise versions does not indicate a test or prerelease build. The old v2.9.0-rc0 and v2.9.0-rc1 images are no longer pullable. For new deployments, choose an available version that meets the interface requirements above. A minimum version is not a guarantee against regressions in every later version.

Resource pools require Kubernetes 1.30 or later and HAMi extender mode; they do not apply to DRA. The Ascend resource-pool scenario in the table is limited to regular workload containers. Ascend or NVIDIA initialization-container device requests in non-Downward mode are not among the confirmed combinations; the current production device-locking path does not cover this condition.

Software changes​

  • Workload-domain routing fix. Control-plane Flow workload routes (including Jupyter and VS Code), the vLLM Demo, and CloudShell now read gateway.hostnames, preventing workload paths from matching the platform UI's domain route and returning a 403 page. The vLLM Demo no longer hard-codes dashboard.hami.run. Workload routes in member clusters do not inherit the control-plane domain.
  • Primary listener selection fix. When a site domain is configured, Flow and CloudShell routes bind to the Gateway's first HTTPS listener, or the first HTTP listener if no HTTPS listener exists. This prevents a more-specific workload path from bypassing the HTTP-to-HTTPS redirect. An error is returned if the Gateway cannot be read or no suitable listener is found.
  • Expanded Flow templates. The API's spec.template is now a native Kubernetes PodTemplateSpec and can retain fields such as init containers, affinity, and security context. Resource requests and limits use Kubernetes-native resource-name-to-quantity maps. Older clients must update their request structure. See “Known issue” for the corresponding limitation in the default UI.
  • Validation before saving workloads. When creating or updating a Deployment-type Flow, the platform performs a dry-run of the final Deployment against the target cluster before saving the Flow. Invalid templates, resource conflicts, and admission errors are returned earlier. Requests using generic ephemeral volumes require storage.manage permission. When the plugin is enabled, the first workload container cannot define a custom readinessProbe, livenessProbe, or lifecycle; the name init-container is reserved for platform use.
  • Device-allocation parsing fix. Empty containers and empty device slots in HAMi multi-container allocation annotations are now handled correctly, preventing delimiters from being included in device UUIDs and affecting allocation-record reads.

Chart changes​

There are no new Chart configuration options, templates, or dependencies compared with 0.21.1. This release updates Chart metadata and the default backend and migration image versions. The UI image is unchanged.

Known issue​

IssueImpactWorkaroundFixed in
The default UI submits GPU resources in a format that does not match the backend template APIIn UI v0.12.1 workload forms, enabling a GPU places the accelerator resource under the resources.limits.resources object. API Server v0.15.1 parses native Kubernetes resource quantities, so create, copy, and edit requests are rejected.No verified workaround is available within this release's UI. Upgrade to the default component combination in Chart 0.21.3 and ensure the UI image is not pinned to an older version. Review that release's status and validation scope before upgrading.Chart 0.21.3, default UI v0.13.0

This issue was confirmed using source corresponding to the published images and a local reproduction of request parsing. Browser or cluster end-to-end validation has not been completed. The impact is limited to submitting GPU workload forms; CPU-only requests using this resource format and the operation of existing Pods are outside the scope of this issue.

Upgrade guidance​

  • Check the companion versions for the scenarios above. If adopting only this release's annotation-parsing fix and the existing companion versions already meet the protocol requirements, no Enterprise upgrade is needed. For new initialization-container templates or advanced resource-pool strategies, first meet the corresponding major-version prerequisites.
  • When enabling resource pools, install the CRD Chart first, then prepare the Enterprise version and device plugins listed above, and finally install RPM and update the platform. Set hami.existingConfigMap in RPM to the existing scheduler device configuration in the same namespace; the RPM webhook and controller must be enabled. For Ascend, set hami.ascendEnabled=true in RPM Chart 0.0.4/0.0.5; from 0.0.6 onward use devices.ascend.enabled=true. For HCU, set devices.hygon.enabled=true in 0.0.6. Global pool-selection settings also require its runtime ConfigMap. Update RPM when device configuration changes. If retaining RPM Chart 0.0.4, explicitly set image.repository=ghcr.io/dynamia-ai/resource-pool-manager and image.tag=v0.0.1; for the default combination use RPM Chart 0.0.5 or later, and for HCU use 0.0.6 or later.
  • Before upgrading from Chart 0.21.1, assess the UI issue above. Custom API clients must also update spec.template: for example, move limits.resources["nvidia.com/gpu"] to limits["nvidia.com/gpu"]; use the same flattened resource map for requests. Clients that use gRPC directly must regenerate their clients from the updated API definition and adjust template construction.
  • If you override image tags, check apiserver.image.tag, controllerManager.image.tag, and auth.image.tag; each should target v0.15.1. The default ui.image.tag remains v0.12.1; pinning an older backend image skips this release's fixes. Image addresses are composed from each component's registry, repository, and tag; global.imageRegistry overrides the registry.
  • For domain-based access, set gateway.hostnames to a list of DNS names without schemes, ports, or paths. Use a specific hostname as the first item, and ensure the HTTPS certificate covers the configured names. The default empty list does not restrict hostnames. The API Server and Controller Manager read this configuration after they are updated. The Flow controller updates existing routes during reconciliation. Existing CloudShell and vLLM Demo routes are not rewritten automatically by this upgrade; recreate the relevant sessions or demos for the change to take effect.
  • For deployments that manage backend process environment variables directly, replace GATEWAY_ENDPOINT with GATEWAY_HOSTNAMES, using commas to separate multiple hostnames. The first hostname is used as the control-plane cluster access address. Continue to use GATEWAY_BASE_URL for workload path prefixes.
  • Creating and updating Flows through the API now requires a Deployment dry-run against the target cluster. Check the target cluster connection, permissions, and admission services. Authorization failures, throttling, or admission timeouts prevent saving and should not be treated as invalid templates. Requests using generic ephemeral volumes or custom plugin templates must meet the permission and field restrictions above.
  • This release adds no database migration scripts or CRD schema changes. SQLite deployments still run the migration container before the API Server starts. Keep the existing data-persistence configuration and back up data before upgrading. A Helm rollback does not restore database data.

See the Chart and appVersion mapping or the software center.

Values reference​

The following parameter descriptions are taken from the README bundled with the Chart 0.21.2 release package and are preserved as published. Use this version's values.yaml as the source of default configuration.

Expand values table
KeyTypeDefaultDescription
apiserver.affinityobject{}apiserver affinity settings
apiserver.clusterAPIBurstint100Burst to use while talking with cluster kube-apiserver
apiserver.clusterAPIQPSint50QPS to use while talking with cluster kube-apiserver
apiserver.image.pullPolicystring"IfNotPresent"kantaloupe image pull policy
apiserver.image.pullSecretslist[]Specify docker-registry secret names as an array
apiserver.image.registrystring"ghcr.io"kantaloupe image registry
apiserver.image.repositorystring"dynamia-ai/kantaloupe-apiserver"kantaloupe image repository
apiserver.image.tagstring"v0.15.1"kantaloupe image tag (immutable tags are recommended)
apiserver.labelsobject{}apiserver labels
apiserver.leaderElection.enabledbooltrueEnable apiserver leader election for auth singleton bootstrap when auth.storeBackend=crd
apiserver.leaderElection.leaseDurationstring"15s"Lease duration for apiserver leader election
apiserver.leaderElection.renewDeadlinestring"10s"Renew deadline for apiserver leader election
apiserver.leaderElection.resourceNamespacestring""Namespace of the Lease object; empty means use the release namespace
apiserver.leaderElection.retryPeriodstring"2s"Retry period for apiserver leader election
apiserver.livenessProbe.enabledboolfalseEnable livenessProbe on apiserver containers
apiserver.logLevelint4apiserver glog verbosity level (0=minimal, 4=info, 5=debug)
apiserver.meteringGRPCAddressstring""Optional upstream metering gRPC service address. Leave empty to disable metering APIs
apiserver.nodeSelectorobject{}apiserver node labels for pod assignment
apiserver.podAnnotationsobject{}apiserver pod annotations
apiserver.podLabelsobject{}apiserver pod labels
apiserver.prometheusAddrstring""Prometheus server address for apiserver metrics querying
apiserver.readinessProbe.enabledboolfalseEnable readinessProbe on ui containers
apiserver.replicaCountint1apiserver target replica count
apiserver.resourcesobject{}apiserver resource requests and limits
apiserver.service.nodePortint31800
apiserver.service.portint8000
apiserver.service.typestring"ClusterIP"
apiserver.tolerationsobject{}apiserver tolerations for pod assignment
auth.apiserverServiceAccountNamestring""ServiceAccount name of the kantaloupe-apiserver, used by the auth assignment admission webhook to validate the requester identity. Defaults to the release fullname.
auth.bootstrapAdminEmailstring"[email protected]"Bootstrap PlatformAdmin email address
auth.bootstrapAdminFullNamestring"Platform Administrator"Bootstrap PlatformAdmin full name (display name)
auth.bootstrapAdminPasswordstring"admin12345"Bootstrap admin password (plain text, dev only)
auth.bootstrapAdminUsernamestring"bootstrap-platform-admin"Bootstrap PlatformAdmin username
auth.crdAuditWindowSizeint1000Max number of audit CRDs retained by the apiserver write path
auth.dbPathstring"/data/kantaloupe/auth.db"SQLite database path for auth data when auth.storeBackend=sqlite
auth.dryRunboolfalseAllow requests without enforcing auth; inject bootstrap admin when no valid token is provided
auth.enabledbooltrueEnable kantaloupe auth (JWT login, RBAC, audit)
auth.existingAuthSecretstring""Name of an existing K8s Secret with keys "jwt-secret" and "bootstrap-admin-password" (use instead of plain-text values for production)
auth.image.pullPolicystring"IfNotPresent"db-migrate image pull policy for sqlite backend
auth.image.registrystring"ghcr.io"db-migrate image registry for sqlite backend
auth.image.repositorystring"dynamia-ai/kantaloupe-db-migrate"db-migrate image repository for sqlite backend
auth.image.tagstring"v0.15.1"db-migrate image tag for sqlite backend
auth.jwtSecretstring"your-own-jwt-secret"JWT signing secret (plain text, dev only)
auth.persistence.enabledboolfalseEnable persistence using PVC for sqlite backend (PV is dynamically provisioned via cluster default StorageClass)
auth.persistence.existingClaimstring""Name of an existing PVC to use for sqlite backend (if set, a new PVC will not be created)
auth.persistence.sizestring"1Gi"PVC storage size for sqlite backend
auth.persistence.storageClassstring""PVC storage class for sqlite backend (empty = use cluster default StorageClass for dynamic PV provisioning)
auth.storeBackendstring"crd"Auth store backend. Supported values: crd, sqlite
cloudtty.enabledbooltrue
controlPlaneNamestring"control-plane"
controllerManager.affinityobject{}controllerManager affinity settings
controllerManager.enablePromoteKantaloupeflowControllerboolfalseAutomatically create KantaloupeFlow CRs for existing GPU deployments in member clusters.
controllerManager.image.pullPolicystring"IfNotPresent"kantaloupe image pull policy
controllerManager.image.pullSecretslist[]Specify docker-registry secret names as an array
controllerManager.image.registrystring"ghcr.io"kantaloupe image registry
controllerManager.image.repositorystring"dynamia-ai/kantaloupe-controller-manager"kantaloupe image repository
controllerManager.image.tagstring"v0.15.1"kantaloupe image tag (immutable tags are recommended)
controllerManager.labelsobject{}controllerManager labels
controllerManager.livenessProbe.enabledboolfalseEnable livenessProbe on controllerManager containers
controllerManager.metricsPortint31001
controllerManager.nodeSelectorobject{}controllerManager node labels for pod assignment
controllerManager.podAnnotationsobject{}controllerManager pod annotations
controllerManager.podLabelsobject{}controllerManager pod labels
controllerManager.prometheusAddrstring""The Prometheus-compatible query endpoint for controller-manager. If empty, uses the default value from Go code.
controllerManager.readinessProbe.enabledboolfalseEnable readinessProbe on controllerManager containers
controllerManager.replicaCountint1controllerManager target replica count
controllerManager.resourcesobject{}controllerManager resource requests and limits
controllerManager.tolerationsobject{}controllerManager tolerations for pod assignment
controllerManager.webhook.certDirstring"/var/run/kantaloupe/webhook-certs"
controllerManager.webhook.certNamestring"tls.crt"
controllerManager.webhook.enabledbooltrue
controllerManager.webhook.keyNamestring"tls.key"
controllerManager.webhook.portint9443
controllerManager.webhook.servicePortint443
fullnameOverridestring"kantaloupe"String to fully override the fullname template
gateway.apiserverCorsobject{"allowCredentials":false,"allowHeaders":["authorization","content-type","accept","origin"],"allowMethods":["GET","POST","PUT","PATCH","DELETE","OPTIONS"],"allowOrigins":[],"enabled":false,"exposeHeaders":[],"maxAge":null}Optional CORS policy attached only to the apiserver HTTPRoute (/apis)
gateway.apiserverCors.allowCredentialsboolfalseWhether credentialed cross-origin requests are allowed
gateway.apiserverCors.allowHeaderslist["authorization","content-type","accept","origin"]Allowed request headers returned on CORS preflight responses
gateway.apiserverCors.allowMethodslist["GET","POST","PUT","PATCH","DELETE","OPTIONS"]Allowed methods returned on CORS preflight responses
gateway.apiserverCors.allowOriginslist[]Allowed browser origins for apiserver CORS; required when enabled
gateway.apiserverCors.enabledboolfalseEnable Envoy Gateway SecurityPolicy-based CORS on the apiserver route
gateway.apiserverCors.exposeHeaderslist[]Response headers exposed to browser JavaScript
gateway.apiserverCors.maxAgestringnilOptional browser preflight cache max age in seconds
gateway.apiserverHostnameslist[]Dedicated external hostnames for direct apiserver access, separate from gateway.hostnames (the UI/site domain). When non-empty, a dedicated HTTPRoute routes these hosts to the apiserver; they must be covered by the HTTPS listener's TLS certificate.
gateway.classNamestring"kantaloupe"GatewayClass name
gateway.enabledbooltrueEnable Gateway API resources
gateway.envoyobject{"proxy":{"image":{"pullSecrets":[],"registry":"","repository":"","tag":""}},"service":{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}}Envoy Gateway implementation details
gateway.envoy.proxy.image.pullSecretslist[]Image pull secrets for Envoy proxy pods
gateway.envoy.proxy.image.registrystring""Envoy proxy image registry
gateway.envoy.proxy.image.repositorystring""Envoy proxy image repository. When set without a tag, renders the EnvoyProxy imageRepository field.
gateway.envoy.proxy.image.tagstring""Envoy proxy image tag. When set, renders a complete EnvoyProxy image reference.
gateway.envoy.serviceobject{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}Envoy service configuration
gateway.envoy.service.ports.httpobject{"nodePort":30080}HTTP port configuration
gateway.envoy.service.ports.http.nodePortint30080HTTP NodePort
gateway.envoy.service.ports.httpsobject{"nodePort":30443}HTTPS port configuration
gateway.envoy.service.ports.https.nodePortint30443HTTPS NodePort
gateway.envoy.service.typestring"NodePort"Envoy service type (LoadBalancer or NodePort)
gateway.hostnameslist[]List of site hostnames (DNS names or wildcard names such as *.example.com, without scheme, port, or path). Applied to UI/API routes and passed to controller-manager and apiserver as GATEWAY_HOSTNAMES for control-plane workload, vLLM demo, and CloudShell HTTPRoutes. Member-cluster workload routes do not inherit the control-plane site hostnames. An empty list leaves site routes unrestricted by hostname. The first entry also supplies the control-plane cluster gateway address for generated access URLs; use a concrete hostname first. HTTPS certificates must cover these names.
gateway.ipAddressstring""Gateway IP address
gateway.listenerslist[{"name":"http","port":80,"protocol":"HTTP"}]Gateway listeners configuration
global.imagePullSecretslist[]Global Docker image pull secrets
global.imageRegistrystring""Global Docker image registry
hamiNamespacestring"hami-system"
hook.image.pullPolicystring"IfNotPresent"CRD hook image pull policy
hook.image.pullSecretslist[]Specify docker-registry secret names as an array
hook.image.registrystring"ghcr.io"CRD hook image registry
hook.image.repositorystring"cloudtty/cloudshell"CRD hook image repository
hook.image.tagstring"v0.8.9"CRD hook image tag (immutable tags are recommended)
installCRDsbooltruedefine flag whether to install CRD resources
monitoring.enabledbooltrue
monitoring.hamiServiceMonitor.enabledbooltrue
monitoring.serviceMonitorLabelsobject{}Labels added to ServiceMonitor and PrometheusRule resources for discovery by Prometheus-compatible operators. When empty, defaults to release: prometheus; providing any labels replaces that fallback. The built-in app, role, and control-plane labels cannot be overridden.
monitoring.vendorServiceMonitor.enableAMDServiceMonitorboolfalseEnable AMD GPU Operator exporter discovery and AMD recording rules in the control plane. Required for monitoring AMD devices in local or member clusters.
monitoring.vendorServiceMonitor.enableAlibabaPPUServicemonitorboolfalseEnable Alibaba PPU exporter discovery and Alibaba PPU recording rules in the control plane. Required for monitoring Alibaba PPU devices in local or member clusters.
monitoring.vendorServiceMonitor.enableAscendServicemonitorboolfalseEnable Ascend exporter discovery and Ascend recording rules in the control plane. Required for monitoring Ascend devices in local or member clusters.
monitoring.vendorServiceMonitor.enableEnflameServicemonitorboolfalseEnable Enflame GCU exporter discovery and Enflame recording rules in the control plane. Required for monitoring Enflame devices in local or member clusters.
monitoring.vendorServiceMonitor.enableHygonServicemonitorboolfalseEnable HCU exporter discovery and Hygon device recording rules in the control plane. Required for monitoring Hygon devices in local or member clusters. Discovers hcu-exporter in the monitoring namespace.
monitoring.vendorServiceMonitor.enableIluvatarServicemonitorboolfalseEnable Iluvatar ix-exporter and vgpu-manager discovery and Iluvatar recording rules in the control plane. Required for monitoring Iluvatar devices in local or member clusters.
monitoring.vendorServiceMonitor.enableMetaxServicemonitorboolfalseEnable MetaX exporter discovery and MetaX recording rules in the control plane. Required for monitoring MetaX devices in local or member clusters.
monitoring.vendorServiceMonitor.enableNvidiaServicemonitorbooltrueEnable NVIDIA exporter discovery and NVIDIA recording rules in the control plane. Required for monitoring NVIDIA devices in local or member clusters.
monitoring.vendorServiceMonitor.enabledbooltrueCreate vendor ServiceMonitor templates and recording rules for enabled vendors.
mpu.enabledboolfalse
mpu.image.pullPolicystring"IfNotPresent"MPU image pull policy
mpu.image.pullSecretslist[]
mpu.image.registrystring"ghcr.io"
mpu.image.repositorystring"dynamia-ai/mpu"
mpu.image.tagstring"dev-ubuntu24.04"
nameOverridestring""String to partially override the fullname template (will maintain the release name)
ui.affinityobject{}ui affinity settings
ui.apiBackendURLstring""Optional backend address for UI API requests. Leave empty to use same-origin requests
ui.forceChineseboolfalseForce UI to display Chinese language
ui.image.pullPolicystring"IfNotPresent"kantaloupe image pull policy
ui.image.pullSecretslist[]Specify docker-registry secret names as an array
ui.image.registrystring"ghcr.io"kantaloupe image registry
ui.image.repositorystring"dynamia-ai/kantaloupe-ui"kantaloupe image repository
ui.image.tagstring"v0.12.1"kantaloupe image tag (immutable tags are recommended)
ui.labelsobject{}ui labels
ui.livenessProbe.enabledboolfalseEnable livenessProbe on ui containers
ui.nodeSelectorobject{}ui node labels for pod assignment
ui.podAnnotationsobject{}ui pod annotations
ui.podLabelsobject{}ui pod labels
ui.readinessProbe.enabledboolfalseEnable readinessProbe on ui containers
ui.replicaCountint1ui target replica count
ui.resourcesobject{}ui resource requests and limits
ui.service.nodePortint31300
ui.service.portint80
ui.service.typestring"ClusterIP"
ui.tolerationsobject{}ui tolerations for pod assignment