Dynamia ppu-vgpu-device-plugin Chart 0.0.2

Release date: 2026-09-16

Version	Previous	This release
Chart	0.0.1	0.0.2
appVersion	1.0.2	1.0.4

The default application version increases from 1.0.2 to 1.0.4, including the changes from intermediate application version 1.0.3. Plugin and monitor both use ghcr.io/dynamia-ai/ppu-device-plugin:v1.0.4. PPU-HAMi-core delivered with the image adds runtime authorization checks. During upgrade, prepare node authorization, update both plugin and monitor, and recreate existing workload Pods so they receive new per-container authorization files and mounts.

HAMi Enterprise compatibility

Existing PPU workloads running successfully does not mean the plugin can be upgraded by itself. This release requires a valid PPU authorization on the node when devices are allocated. If the existing Enterprise meets the conditions below, recognizes the original authorization, and publishes a valid hami.io/alibaba-license, it does not need to be upgraded. Otherwise, upgrade the compatible scheduler and complete authorization delivery first, then upgrade the plugin. Merely keeping the old authorization file on the host does not satisfy the new allocation flow.

Feature or use case	Minimum usable HAMi Enterprise version	Compatibility requirements and upgrade conclusion
PPU scheduling, memory/compute partitioning, and the new authorization delivery and renewal with legacy UUID- or model-based licenses	v2.9.0-rc2	The scheduler must validate the original license and publish node PPU authorization. Deployments on v2.9.0-rc0, v2.9.0-rc1, or another compatible version without this delivery interface must upgrade first. Deployments already meeting the interface and authorization requirements can retain their existing Enterprise version.
Instance authorization using the deviceInstances format	v2.10.0-r0	If the original authorization uses this format, it must be processed by a scheduler that can parse it. The plugin consumes the node authorization produced by the scheduler; not every deployment is required to adopt this authorization format.

Device-path and startup-argument fixes do not add Enterprise compatibility requirements. The version floors above are based on checks of released artifacts and interface implementations; they do not mean physical PPU hardware was tested with every compatible version.

Changes

Chart changes

Fixes unintended extra double quotes around numeric values in --device-split-count and --device-memory-scaling. For example, the rendered argument changes from --device-split-count="2" in the previous release to --device-split-count=2, preventing numeric argument parsing failures. The default split count remains 2; memory and compute scaling remain 1.0. Resource names, monitoring ports, and deployment-node selection are unchanged.

Application changes

• Generate runtime authorization per container. On each allocation, the plugin reads hami.io/alibaba-license from the node, validates the physical PPU UUID and expiration for the allocation, then generates an authorization file for that container. Allocation returns an error if the assigned device has no valid authorization or if preparing the directory/file fails. The file also contains records for other authorized cards in the plugin's physical-device pool to account for devices the driver may enumerate.
• The monitor renews authorization files. During refresh, the monitor reads the latest node authorization and extends expiration for matching UUIDs in existing container files, updating reminder information in place while preserving the mounted file's inode. Renewal does not add or remove UUIDs and does not create files for old containers that lack them. If the node annotation is missing or invalid, existing files are retained.
• The runtime library validates device authorization. The bundled PPU-HAMi-core validates the complete UUID and expiration while initializing device information. Initialization terminates if authorization is absent, expired, or unreadable. It checks devices visible to HGML; if the driver still exposes an unauthorized card, initialization may fail even if that card was not requested by the workload.
• Fixes multi-container allocation and retry after failure. Allocation requests are matched by container position in the Pod and positions for containers that do not request PPU are retained. The pending-allocation annotation is consumed only after authorization-file and mount preparation succeed, preventing a failed preparation from prematurely losing the request.
• Fixes physical device-path mapping. Maps the one-based minor number returned by HGML to the zero-based device file /dev/alixpu_ppu{minor-1}, replacing the old index-modulo mapping that could incorrectly map higher-numbered devices to one of the first eight paths. The common devices /dev/alixpu and /dev/alixpu_ctl must still exist; duplicate paths are deduplicated. This fix does not imply verification for arbitrary card counts or driver combinations.

Upgrade guidance

Verify scheduler compatibility and authorization first

Place the original license, unchanged, in a Secret in the namespace containing the Enterprise scheduler. Use data key license and label hami.io/license=true. The cluster ESN bound to the license must match the UID of the kube-system namespace. If a matching Secret already exists, update that object; do not copy the original license contents directly to the host runtime-authorization path.

Before upgrading the plugin, check that the scheduler has published a valid hami.io/alibaba-license to each target PPU node. UUIDs must match the physical devices and expiration must cover the workload runtime. The original-license Secret, node-authorization annotation, and runtime file in the container are distinct stages of the flow; the scheduler and plugin perform the conversion.

Update plugin, monitor, and existing workloads

• Upgrade plugin and monitor together to application 1.0.4. If Chart image.tag is empty, the default version is used. If pinned to v1.0.2, v1.0.3, or a custom image, update image.repository and image.tag as appropriate and confirm the image contains the compatible runtime library. Updating only Chart metadata does not override an explicitly selected old image.
• Keep monitor.enabled: true for the monitor to update authorization files of existing containers automatically. With monitoring disabled, new containers still read current authorization during plugin allocation, but existing files are not renewed through the monitor.
• As part of maintenance, recreate existing PPU workload Pods so new containers run device allocation again and receive their per-container authorization files, mounts, and this release's runtime library. Restarting only the plugin, monitor, or business process inside an old container cannot add the authorization mount missing from the old Pod. Save workload state before recreating Pods.
• The default path mapping is below. If mounts have been changed locally, verify mappings in the plugin, monitor, and workload containers; changing only one component's HOOK_PATH is insufficient.

Location or component	Default path and purpose
Container authorization on host	/usr/local/vgpu/containers/<Pod UID>_<container name>/license; directory identifies the Pod UID and container name
Primary authorization path in workload container	/usr/local/vgpu/license; mounted from the container directory above
Alternate authorization path in workload container	/tmp/license; read-only mount of the same authorization file
Monitor scan directory	/usr/local/vgpu/containers; monitor HOOK_PATH is /usr/local/vgpu
Plugin path prefix	HOOK_PATH=/usr/local; under it the plugin uses vgpu/containers

This release does not require deleting all of host /usr/local/vgpu or /tmp/vgpulock. Before cleaning old container state, stop the corresponding Pod and processes using those files, verify the directory's Pod UID and container name, then follow the local maintenance procedure. Do not remove shared directories still used by workloads.

Renewal and validation

To renew authorization, update the original-license Secret, confirm the scheduler updates node authorization, then confirm the monitor updates container files. The runtime library caches parsed authorization in each process: new processes read the renewed authorization after the file is updated; existing processes must restart to use it. Changes to UUID scope must be handled through a new allocation; the renewal flow only extends expiration.

The plugin writes authorization times in UTC, while this release's runtime library interprets them in the workload process's local time zone. Use UTC in workload containers, for example by setting TZ=UTC, to avoid expiration-time interpretation differences.

After upgrading, check plugin and monitor rollouts, node capacity registration, device allocation for new workloads, container authorization files, actually visible PPU UUIDs, and memory/compute limits. Investigate missing hami.io/alibaba-license, expired authorization, device-path mismatches, and driver-exposed unauthorized devices. Source and Chart-render validation do not replace validation with actual workloads in the target environment.

See the Chart and appVersion mapping or the software center.

Values reference

The following parameter descriptions are taken from the README bundled with the Chart 0.0.2 release package and are preserved as published. Use this version's values.yaml as the source of default configuration.

Expand values table

Key	Type	Default	Description
commonAnnotations	object	{}
commonLabels	object	{}
config.create	bool	true
config.data.alibaba.defaultCores	int	0
config.data.alibaba.defaultGPUNum	int	1
config.data.alibaba.defaultMemory	int	0
config.data.alibaba.deviceCoreScaling	float	1
config.data.alibaba.deviceMemoryScaling	float	1
config.data.alibaba.deviceSplitCount	int	2
config.data.alibaba.gpuCorePolicy	string	"default"
config.data.alibaba.memoryFactor	int	1
config.data.alibaba.overwriteEnv	bool	false
config.data.alibaba.resourceCoreName	string	"alibaba.com/gpu-core"
config.data.alibaba.resourceCountName	string	"alibaba.com/ppu"
config.data.alibaba.resourceMemoryName	string	"alibaba.com/ppu-memory"
config.data.alibaba.resourceMemoryPercentageName	string	"alibaba.com/ppu-memory-percentage"
config.data.alibaba.runtimeClassName	string	""
config.existingConfigMapName	string	""
fullnameOverride	string	""
image.pullPolicy	string	"IfNotPresent"
image.pullSecrets	list	[]
image.repository	string	"ghcr.io/dynamia-ai/ppu-device-plugin"
image.tag	string	""
monitor.enabled	bool	true
monitor.resources	object	{}
monitor.service.enabled	bool	true
monitor.service.nodePort	int	31992
monitor.service.port	int	31992
monitor.service.type	string	"NodePort"
nameOverride	string	""
namespaceOverride	string	"hami-system"
nodeSelector.alibabappu	string	"on"
plugin.enabled	bool	true
plugin.resources.limits.cpu	string	"500m"
plugin.resources.limits.memory	string	"512Mi"
plugin.resources.requests.cpu	string	"100m"
plugin.resources.requests.memory	string	"128Mi"
priorityClassName	string	"system-node-critical"
tolerations[0].key	string	"CriticalAddonsOnly"
tolerations[0].operator	string	"Exists"
tolerations[1].effect	string	"NoSchedule"
tolerations[1].operator	string	"Exists"