HAMi AI Platform Chart 0.21.3

Release date: 2026-10-26 (UTC)

Version status: Generally available

This release upgrades the default UI to v0.13.0. It is confirmed to fix the GPU workload form/backend resource-format mismatch in Chart 0.21.2. Actual UI conversion results for create, copy, edit, and CPU-only cases passed validation against backend template parsing boundaries; the old nested format is rejected as a negative case. The default component combination has been validated and marked generally available by maintainers.

Component	Comparison baseline	This release
Chart	0.21.2	0.21.3
appVersion	0.15.1	0.15.1
API Server	v0.15.1	v0.15.1
Controller Manager	v0.15.1	v0.15.1
Database migration image	v0.15.1	v0.15.1
UI	v0.12.1	v0.13.0

The database migration container runs only when authentication is enabled and auth.storeBackend=sqlite.

HAMi Enterprise compatibility

The backend, scheduling interfaces, and resource-pool components in this release retain the requirements of Chart 0.21.2. The table lists the minimum companion versions for relevant interfaces and protocols. This UI fix adds no uniform Enterprise upgrade requirement. Resource pools are optional; their prerequisites do not automatically apply to basic platform operation. These findings do not replace validation in the target hardware environment.

Feature or scenario	Minimum HAMi Enterprise version	Companion requirements and upgrade notes
Read four-field annotations for allocated devices, including empty slots across multiple containers; NVIDIA, AMD, Ascend, Iluvatar, AWS Neuron, Enflame vGPU, and Alibaba PPU	v2.9.0-rc0	Applies only to reading allocation records. The platform backend remains v0.15.1, so this UI update does not require an Enterprise upgrade if the existing version supports the matching protocol. This does not mean this version covers all scheduling, isolation, or monitoring capabilities for these vendors.
Percentage-based GPU memory requests for regular NVIDIA HAMi-core workloads	v2.9.0-rc0	The UI writes the percentage to nvidia.com/gpumem-percentage. The scheduler and NVIDIA device plugin must use the same resource name and compatible HAMi-core. This adds a form entry point for existing scheduling capability; a custom resource-name prefix must match the platform device configuration.
Resource-pool management, namespace authorization, quotas, explicit pool selection, and automatic binpack/spread selection for regular NVIDIA/Ascend workloads	v2.9.0-rc0	Minimum standalone CRD Chart: 0.4.2; minimum RPM application: v0.0.1; minimum RPM Chart with the correct default component: 0.0.5. RPM Chart 0.0.4 meets the requirement only when explicitly configured with the correct RPM image. These RPM artifact combinations are confirmed for amd64.
An initialization container that does not request a GPU before an NVIDIA workload container	v2.9.0-rc1	Set scheduler.useDownward=true. Earlier versions do not handle container indexes for this template. When resource pools are enabled, also meet the standalone component requirements in the previous row.
An NVIDIA initialization container that requests a GPU, including workloads where only the initialization container requests one	v2.10.0-r0	Set scheduler.useDownward=true; the complete initialization-container annotations and plugin must be compatible. When resource pools are enabled, also meet the RPM/CRD requirements above.
GPU mutex, NUMA, or combined strategies within an NVIDIA resource pool	v2.10.0-r0	Use the RPM/CRD components above. These are GPU strategies within a pool, distinct from RPM's binpack/spread selection between pools.
HCU resource-pool management and scheduling interfaces	v2.10.0-r3	Minimum CRD Chart: 0.4.2; minimum RPM application: v0.0.2; minimum RPM Chart with the default RPM image: 0.0.6. HCU device plugin must be v3.0.0 or later with RESOURCE_REGISTER_STRATEGY=hami. Plugin artifacts are confirmed for amd64. The older DCU naming protocol is not a substitute for the HCU protocol.

The rc suffix in HAMi Enterprise versions does not indicate a test or prerelease build. The old v2.9.0-rc0 and v2.9.0-rc1 images are no longer pullable. For new deployments, choose an available version that meets the interface requirements above. A minimum version is not a guarantee against regressions in every later version.

Resource pools require Kubernetes 1.30 or later and HAMi extender mode; they do not apply to DRA. The Ascend resource-pool scenario in the table is limited to regular workload containers. Ascend or NVIDIA initialization-container device requests in non-Downward mode are not among the confirmed combinations; the current production device-locking path does not cover this condition.

Software changes

• Fix GPU workload-form resource format. When creating, copying, or editing GPU workloads, extended resources are written directly to the container's resources.limits and resources.requests, matching the native Kubernetes template interface in API Server v0.15.1. Resource readback for edit forms, workload lists, and details is updated for the same format.
• Expand workload forms. Forms support replica count, image pull policy, workload and Pod labels, ConfigMap/Secret environment-variable references, TCP/UDP container ports, HTTP readiness and liveness probes, tolerations, node affinity, Pod anti-affinity, DNS options, and Pod/container security contexts. Enter ConfigMap/Secret references by name; they must already exist in the workload namespace. Container-level settings apply to the first workload container.
• Adjust edit-save behavior. Editing starts from the existing Pod template and then overwrites fields managed by the form; copying rebuilds the template from form fields. When access plugins such as Jupyter or VS Code are enabled, custom readiness and liveness probes are disabled to avoid backend constraint conflicts. HTTP probe initial delay may be 0.
• Add NVIDIA vGPU memory-percentage input. Memory limits can be specified as a percentage or absolute capacity. Percentage input is restricted to integers from 1 to 100, and existing percentage requests can be populated when editing. This option applies only to NVIDIA vGPU, not vPPU or other card types.
• Update Jupyter access links. Opening Jupyter from the workload list now adds a per-access routecheck parameter to avoid stale gateway-path caching in browsers that reuse a previous route. The access token is preserved and encoded correctly.

Chart changes

Compared with 0.21.2, this release only updates the Chart version, default UI image, and generated documentation. appVersion, backend and migration images, configuration options, templates, dependencies, and CRDs are unchanged.

Upgrade guidance

• When upgrading from Chart 0.21.2, confirm ui.image.tag is updated to v0.13.0; custom values pinned to v0.12.1 continue to use the affected UI. Keep apiserver.image.tag, controllerManager.image.tag, and auth.image.tag at v0.15.1; do not roll back the backend when upgrading the UI. For a private registry, provide the new UI image and note that global.imageRegistry overrides component registries.
• After the UI update, reload the platform page before creating, copying, or editing workloads. The new workload-list entry point generates Jupyter's cache parameter; existing bookmarks do not change automatically. Reopen the entry point from the platform when needed.
• Before using the advanced forms, check the target namespace's Secrets and ConfigMaps, probe ports, and scheduling conditions. When first editing a complex template created through the API or YAML in the UI, keep its original configuration and review the form-managed fields: volumes, environment variables, affinity, and security contexts are regenerated from form state. Do not assume arbitrary native fields round-trip unchanged; copying is also not guaranteed to retain fields outside the form.
• For the UI resource-format fix alone, no additional HAMi Enterprise, RPM, or CRD upgrade is needed. New use of percentage-based GPU memory or resource pools must still meet the corresponding conditions in the table. Resource-pool installation order and vendor switches follow the Chart 0.21.2 upgrade guidance.
• This release adds no database migration or storage-configuration changes. For SQLite auth storage, retain the existing persistence and backup arrangements. The backend interface remains v0.15.1; custom clients should continue using the native PodTemplateSpec and flattened resource maps.

See the Chart and appVersion mapping or the software center.

Values reference

The following parameter descriptions are taken from the README bundled with the Chart 0.21.3 release package and are preserved as published. Use this version's values.yaml as the source of default configuration.

Expand values table

Key	Type	Default	Description
apiserver.affinity	object	{}	apiserver affinity settings
apiserver.clusterAPIBurst	int	100	Burst to use while talking with cluster kube-apiserver
apiserver.clusterAPIQPS	int	50	QPS to use while talking with cluster kube-apiserver
apiserver.image.pullPolicy	string	"IfNotPresent"	kantaloupe image pull policy
apiserver.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
apiserver.image.registry	string	"ghcr.io"	kantaloupe image registry
apiserver.image.repository	string	"dynamia-ai/kantaloupe-apiserver"	kantaloupe image repository
apiserver.image.tag	string	"v0.15.1"	kantaloupe image tag (immutable tags are recommended)
apiserver.labels	object	{}	apiserver labels
apiserver.leaderElection.enabled	bool	true	Enable apiserver leader election for auth singleton bootstrap when auth.storeBackend=crd
apiserver.leaderElection.leaseDuration	string	"15s"	Lease duration for apiserver leader election
apiserver.leaderElection.renewDeadline	string	"10s"	Renew deadline for apiserver leader election
apiserver.leaderElection.resourceNamespace	string	""	Namespace of the Lease object; empty means use the release namespace
apiserver.leaderElection.retryPeriod	string	"2s"	Retry period for apiserver leader election
apiserver.livenessProbe.enabled	bool	false	Enable livenessProbe on apiserver containers
apiserver.logLevel	int	4	apiserver glog verbosity level (0=minimal, 4=info, 5=debug)
apiserver.meteringGRPCAddress	string	""	Optional upstream metering gRPC service address. Leave empty to disable metering APIs
apiserver.nodeSelector	object	{}	apiserver node labels for pod assignment
apiserver.podAnnotations	object	{}	apiserver pod annotations
apiserver.podLabels	object	{}	apiserver pod labels
apiserver.prometheusAddr	string	""	Prometheus server address for apiserver metrics querying
apiserver.readinessProbe.enabled	bool	false	Enable readinessProbe on ui containers
apiserver.replicaCount	int	1	apiserver target replica count
apiserver.resources	object	{}	apiserver resource requests and limits
apiserver.service.nodePort	int	31800
apiserver.service.port	int	8000
apiserver.service.type	string	"ClusterIP"
apiserver.tolerations	object	{}	apiserver tolerations for pod assignment
auth.apiserverServiceAccountName	string	""	ServiceAccount name of the kantaloupe-apiserver, used by the auth assignment admission webhook to validate the requester identity. Defaults to the release fullname.
auth.bootstrapAdminEmail	string	"[email protected]"	Bootstrap PlatformAdmin email address
auth.bootstrapAdminFullName	string	"Platform Administrator"	Bootstrap PlatformAdmin full name (display name)
auth.bootstrapAdminPassword	string	"admin12345"	Bootstrap admin password (plain text, dev only)
auth.bootstrapAdminUsername	string	"bootstrap-platform-admin"	Bootstrap PlatformAdmin username
auth.crdAuditWindowSize	int	1000	Max number of audit CRDs retained by the apiserver write path
auth.dbPath	string	"/data/kantaloupe/auth.db"	SQLite database path for auth data when auth.storeBackend=sqlite
auth.dryRun	bool	false	Allow requests without enforcing auth; inject bootstrap admin when no valid token is provided
auth.enabled	bool	true	Enable kantaloupe auth (JWT login, RBAC, audit)
auth.existingAuthSecret	string	""	Name of an existing K8s Secret with keys "jwt-secret" and "bootstrap-admin-password" (use instead of plain-text values for production)
auth.image.pullPolicy	string	"IfNotPresent"	db-migrate image pull policy for sqlite backend
auth.image.registry	string	"ghcr.io"	db-migrate image registry for sqlite backend
auth.image.repository	string	"dynamia-ai/kantaloupe-db-migrate"	db-migrate image repository for sqlite backend
auth.image.tag	string	"v0.15.1"	db-migrate image tag for sqlite backend
auth.jwtSecret	string	"your-own-jwt-secret"	JWT signing secret (plain text, dev only)
auth.persistence.enabled	bool	false	Enable persistence using PVC for sqlite backend (PV is dynamically provisioned via cluster default StorageClass)
auth.persistence.existingClaim	string	""	Name of an existing PVC to use for sqlite backend (if set, a new PVC will not be created)
auth.persistence.size	string	"1Gi"	PVC storage size for sqlite backend
auth.persistence.storageClass	string	""	PVC storage class for sqlite backend (empty = use cluster default StorageClass for dynamic PV provisioning)
auth.storeBackend	string	"crd"	Auth store backend. Supported values: crd, sqlite
cloudtty.enabled	bool	true
controlPlaneName	string	"control-plane"
controllerManager.affinity	object	{}	controllerManager affinity settings
controllerManager.enablePromoteKantaloupeflowController	bool	false	Automatically create KantaloupeFlow CRs for existing GPU deployments in member clusters.
controllerManager.image.pullPolicy	string	"IfNotPresent"	kantaloupe image pull policy
controllerManager.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
controllerManager.image.registry	string	"ghcr.io"	kantaloupe image registry
controllerManager.image.repository	string	"dynamia-ai/kantaloupe-controller-manager"	kantaloupe image repository
controllerManager.image.tag	string	"v0.15.1"	kantaloupe image tag (immutable tags are recommended)
controllerManager.labels	object	{}	controllerManager labels
controllerManager.livenessProbe.enabled	bool	false	Enable livenessProbe on controllerManager containers
controllerManager.metricsPort	int	31001
controllerManager.nodeSelector	object	{}	controllerManager node labels for pod assignment
controllerManager.podAnnotations	object	{}	controllerManager pod annotations
controllerManager.podLabels	object	{}	controllerManager pod labels
controllerManager.prometheusAddr	string	""	The Prometheus-compatible query endpoint for controller-manager. If empty, uses the default value from Go code.
controllerManager.readinessProbe.enabled	bool	false	Enable readinessProbe on controllerManager containers
controllerManager.replicaCount	int	1	controllerManager target replica count
controllerManager.resources	object	{}	controllerManager resource requests and limits
controllerManager.tolerations	object	{}	controllerManager tolerations for pod assignment
controllerManager.webhook.certDir	string	"/var/run/kantaloupe/webhook-certs"
controllerManager.webhook.certName	string	"tls.crt"
controllerManager.webhook.enabled	bool	true
controllerManager.webhook.keyName	string	"tls.key"
controllerManager.webhook.port	int	9443
controllerManager.webhook.servicePort	int	443
fullnameOverride	string	"kantaloupe"	String to fully override the fullname template
gateway.apiserverCors	object	{"allowCredentials":false,"allowHeaders":["authorization","content-type","accept","origin"],"allowMethods":["GET","POST","PUT","PATCH","DELETE","OPTIONS"],"allowOrigins":[],"enabled":false,"exposeHeaders":[],"maxAge":null}	Optional CORS policy attached only to the apiserver HTTPRoute (/apis)
gateway.apiserverCors.allowCredentials	bool	false	Whether credentialed cross-origin requests are allowed
gateway.apiserverCors.allowHeaders	list	["authorization","content-type","accept","origin"]	Allowed request headers returned on CORS preflight responses
gateway.apiserverCors.allowMethods	list	["GET","POST","PUT","PATCH","DELETE","OPTIONS"]	Allowed methods returned on CORS preflight responses
gateway.apiserverCors.allowOrigins	list	[]	Allowed browser origins for apiserver CORS; required when enabled
gateway.apiserverCors.enabled	bool	false	Enable Envoy Gateway SecurityPolicy-based CORS on the apiserver route
gateway.apiserverCors.exposeHeaders	list	[]	Response headers exposed to browser JavaScript
gateway.apiserverCors.maxAge	string	nil	Optional browser preflight cache max age in seconds
gateway.apiserverHostnames	list	[]	Dedicated external hostnames for direct apiserver access, separate from gateway.hostnames (the UI/site domain). When non-empty, a dedicated HTTPRoute routes these hosts to the apiserver; they must be covered by the HTTPS listener's TLS certificate.
gateway.className	string	"kantaloupe"	GatewayClass name
gateway.enabled	bool	true	Enable Gateway API resources
gateway.envoy	object	{"proxy":{"image":{"pullSecrets":[],"registry":"","repository":"","tag":""}},"service":{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}}	Envoy Gateway implementation details
gateway.envoy.proxy.image.pullSecrets	list	[]	Image pull secrets for Envoy proxy pods
gateway.envoy.proxy.image.registry	string	""	Envoy proxy image registry
gateway.envoy.proxy.image.repository	string	""	Envoy proxy image repository. When set without a tag, renders the EnvoyProxy imageRepository field.
gateway.envoy.proxy.image.tag	string	""	Envoy proxy image tag. When set, renders a complete EnvoyProxy image reference.
gateway.envoy.service	object	{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}	Envoy service configuration
gateway.envoy.service.ports.http	object	{"nodePort":30080}	HTTP port configuration
gateway.envoy.service.ports.http.nodePort	int	30080	HTTP NodePort
gateway.envoy.service.ports.https	object	{"nodePort":30443}	HTTPS port configuration
gateway.envoy.service.ports.https.nodePort	int	30443	HTTPS NodePort
gateway.envoy.service.type	string	"NodePort"	Envoy service type (LoadBalancer or NodePort)
gateway.hostnames	list	[]	List of site hostnames (DNS names or wildcard names such as *.example.com, without scheme, port, or path). Applied to UI/API routes and passed to controller-manager and apiserver as GATEWAY_HOSTNAMES for control-plane workload, vLLM demo, and CloudShell HTTPRoutes. Member-cluster workload routes do not inherit the control-plane site hostnames. An empty list leaves site routes unrestricted by hostname. The first entry also supplies the control-plane cluster gateway address for generated access URLs; use a concrete hostname first. HTTPS certificates must cover these names.
gateway.ipAddress	string	""	Gateway IP address
gateway.listeners	list	[{"name":"http","port":80,"protocol":"HTTP"}]	Gateway listeners configuration
global.imagePullSecrets	list	[]	Global Docker image pull secrets
global.imageRegistry	string	""	Global Docker image registry
hamiNamespace	string	"hami-system"
hook.image.pullPolicy	string	"IfNotPresent"	CRD hook image pull policy
hook.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
hook.image.registry	string	"ghcr.io"	CRD hook image registry
hook.image.repository	string	"cloudtty/cloudshell"	CRD hook image repository
hook.image.tag	string	"v0.8.9"	CRD hook image tag (immutable tags are recommended)
installCRDs	bool	true	define flag whether to install CRD resources
monitoring.enabled	bool	true
monitoring.hamiServiceMonitor.enabled	bool	true
monitoring.serviceMonitorLabels	object	{}	Labels added to ServiceMonitor and PrometheusRule resources for discovery by Prometheus-compatible operators. When empty, defaults to release: prometheus; providing any labels replaces that fallback. The built-in app, role, and control-plane labels cannot be overridden.
monitoring.vendorServiceMonitor.enableAMDServiceMonitor	bool	false	Enable AMD GPU Operator exporter discovery and AMD recording rules in the control plane. Required for monitoring AMD devices in local or member clusters.
monitoring.vendorServiceMonitor.enableAlibabaPPUServicemonitor	bool	false	Enable Alibaba PPU exporter discovery and Alibaba PPU recording rules in the control plane. Required for monitoring Alibaba PPU devices in local or member clusters.
monitoring.vendorServiceMonitor.enableAscendServicemonitor	bool	false	Enable Ascend exporter discovery and Ascend recording rules in the control plane. Required for monitoring Ascend devices in local or member clusters.
monitoring.vendorServiceMonitor.enableEnflameServicemonitor	bool	false	Enable Enflame GCU exporter discovery and Enflame recording rules in the control plane. Required for monitoring Enflame devices in local or member clusters.
monitoring.vendorServiceMonitor.enableHygonServicemonitor	bool	false	Enable HCU exporter discovery and Hygon device recording rules in the control plane. Required for monitoring Hygon devices in local or member clusters. Discovers hcu-exporter in the monitoring namespace.
monitoring.vendorServiceMonitor.enableIluvatarServicemonitor	bool	false	Enable Iluvatar ix-exporter and vgpu-manager discovery and Iluvatar recording rules in the control plane. Required for monitoring Iluvatar devices in local or member clusters.
monitoring.vendorServiceMonitor.enableMetaxServicemonitor	bool	false	Enable MetaX exporter discovery and MetaX recording rules in the control plane. Required for monitoring MetaX devices in local or member clusters.
monitoring.vendorServiceMonitor.enableNvidiaServicemonitor	bool	true	Enable NVIDIA exporter discovery and NVIDIA recording rules in the control plane. Required for monitoring NVIDIA devices in local or member clusters.
monitoring.vendorServiceMonitor.enabled	bool	true	Create vendor ServiceMonitor templates and recording rules for enabled vendors.
mpu.enabled	bool	false
mpu.image.pullPolicy	string	"IfNotPresent"	MPU image pull policy
mpu.image.pullSecrets	list	[]
mpu.image.registry	string	"ghcr.io"
mpu.image.repository	string	"dynamia-ai/mpu"
mpu.image.tag	string	"dev-ubuntu24.04"
nameOverride	string	""	String to partially override the fullname template (will maintain the release name)
ui.affinity	object	{}	ui affinity settings
ui.apiBackendURL	string	""	Optional backend address for UI API requests. Leave empty to use same-origin requests
ui.forceChinese	bool	false	Force UI to display Chinese language
ui.image.pullPolicy	string	"IfNotPresent"	kantaloupe image pull policy
ui.image.pullSecrets	list	[]	Specify docker-registry secret names as an array
ui.image.registry	string	"ghcr.io"	kantaloupe image registry
ui.image.repository	string	"dynamia-ai/kantaloupe-ui"	kantaloupe image repository
ui.image.tag	string	"v0.13.0"	kantaloupe image tag (immutable tags are recommended)
ui.labels	object	{}	ui labels
ui.livenessProbe.enabled	bool	false	Enable livenessProbe on ui containers
ui.nodeSelector	object	{}	ui node labels for pod assignment
ui.podAnnotations	object	{}	ui pod annotations
ui.podLabels	object	{}	ui pod labels
ui.readinessProbe.enabled	bool	false	Enable readinessProbe on ui containers
ui.replicaCount	int	1	ui target replica count
ui.resources	object	{}	ui resource requests and limits
ui.service.nodePort	int	31300
ui.service.port	int	80
ui.service.type	string	"ClusterIP"
ui.tolerations	object	{}	ui tolerations for pod assignment