# Default values for kantaloupe. # This is a YAML-formatted file. # Declare variables to be passed into your templates. ## @section Global configuration # global.imageRegistry -- Global Docker image registry # global.imagePullSecrets -- Global Docker image pull secrets # nameOverride -- String to partially override the fullname template (will maintain the release name) # fullnameOverride -- String to fully override the fullname template nameOverride: "" fullnameOverride: "kantaloupe" global: # global.imageRegistry -- Global Docker image registry imageRegistry: "" ## E.g. ## imagePullSecrets: ## - myRegistryKeySecretName # global.imagePullSecrets -- Global Docker image pull secrets imagePullSecrets: [] ## @section Pre-Hook configuration # installCRDs -- define flag whether to install CRD resources installCRDs: true ## @section CRD hook image configuration # hook.image.registry -- CRD hook image registry # hook.image.repository -- CRD hook image repository # hook.image.tag -- CRD hook image tag (immutable tags are recommended) # hook.image.pullPolicy -- CRD hook image pull policy # hook.image.pullSecrets -- Specify docker-registry secret names as an array hook: image: registry: ghcr.io repository: cloudtty/cloudshell tag: "v0.8.9" pullPolicy: IfNotPresent pullSecrets: [] controlPlaneName: "control-plane" ## @section Gateway configuration # gateway.enabled -- Enable Gateway API resources # gateway.className -- GatewayClass name # gateway.apiserverCors -- Optional CORS policy attached only to the apiserver HTTPRoute (`/apis`) # gateway.apiserverCors.enabled -- Enable Envoy Gateway SecurityPolicy-based CORS on the apiserver route # gateway.apiserverCors.allowOrigins -- Allowed browser origins for apiserver CORS; required when enabled # gateway.apiserverCors.allowMethods -- Allowed methods returned on CORS preflight responses # gateway.apiserverCors.allowHeaders -- Allowed request headers returned on CORS preflight responses # gateway.apiserverCors.exposeHeaders -- Response headers exposed to browser JavaScript # gateway.apiserverCors.allowCredentials -- Whether credentialed cross-origin requests are allowed # gateway.apiserverCors.maxAge -- Optional browser preflight cache max age in seconds # gateway.ipAddress -- Gateway IP address # gateway.hostnames -- External hostnames for the Gateway # gateway.apiserverHostnames -- Dedicated external hostnames for direct apiserver access, separate from gateway.hostnames (the UI/site domain). When non-empty, a dedicated HTTPRoute routes these hosts to the apiserver; they must be covered by the HTTPS listener's TLS certificate. # gateway.listeners -- Gateway listeners configuration # gateway.envoy -- Envoy Gateway implementation details # gateway.envoy.service -- Envoy service configuration # gateway.envoy.service.type -- Envoy service type (LoadBalancer or NodePort) # gateway.envoy.service.ports.http -- HTTP port configuration # gateway.envoy.service.ports.http.nodePort -- HTTP NodePort # gateway.envoy.service.ports.https -- HTTPS port configuration # gateway.envoy.service.ports.https.nodePort -- HTTPS NodePort gateway: enabled: true className: kantaloupe apiserverCors: enabled: false allowOrigins: [] # @schema item:string allowMethods: - GET - POST - PUT - PATCH - DELETE - OPTIONS allowHeaders: - authorization - content-type - accept - origin exposeHeaders: [] # @schema item:string allowCredentials: false maxAge: null # @schema type:[string, null] ipAddress: "" hostnames: [] apiserverHostnames: [] listeners: - name: http port: 80 protocol: HTTP # @schema enum:["HTTP","HTTPS"] envoy: service: # @schema enum:["LoadBalancer", "NodePort"] type: NodePort ports: http: nodePort: 30080 https: nodePort: 30443 proxy: # gateway.envoy.proxy.image.registry -- Envoy proxy image registry # gateway.envoy.proxy.image.repository -- Envoy proxy image repository. When set without a tag, renders the EnvoyProxy `imageRepository` field. # gateway.envoy.proxy.image.tag -- Envoy proxy image tag. When set, renders a complete EnvoyProxy `image` reference. # gateway.envoy.proxy.image.pullSecrets -- Image pull secrets for Envoy proxy pods image: registry: "" repository: "" tag: "" pullSecrets: [] hamiNamespace: "hami-system" # controller manager config controllerManager: metricsPort: 31001 ## @section controllerManager configuration # controllerManager.labels -- controllerManager labels labels: {} # controllerManager.replicaCount -- controllerManager target replica count replicaCount: 1 # controllerManager.podAnnotations -- controllerManager pod annotations podAnnotations: {} # controllerManager.podLabels -- controllerManager pod labels podLabels: {} # controllerManager.image.registry -- kantaloupe image registry # controllerManager.image.repository -- kantaloupe image repository # controllerManager.image.tag -- kantaloupe image tag (immutable tags are recommended) # controllerManager.image.pullPolicy -- kantaloupe image pull policy # controllerManager.image.pullSecrets -- Specify docker-registry secret names as an array image: registry: ghcr.io repository: dynamia-ai/kantaloupe-controller-manager tag: "v0.15.0" ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## Example: ## pullSecrets: ## - myRegistryKeySecretName ## pullSecrets: [] # controllerManager.resources -- controllerManager resource requests and limits resources: {} # If you do want to specify resources, uncomment the following # lines, adjust them as necessary, and remove the curly braces after 'resources:'. # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # controllerManager.nodeSelector -- controllerManager node labels for pod assignment nodeSelector: {} # controllerManager.affinity -- controllerManager affinity settings affinity: {} # controllerManager.tolerations -- controllerManager tolerations for pod assignment tolerations: {} # controllerManager.livenessProbe.enabled -- Enable livenessProbe on controllerManager containers livenessProbe: enabled: false # controllerManager.readinessProbe.enabled -- Enable readinessProbe on controllerManager containers readinessProbe: enabled: false # controllerManager.prometheusAddr -- The Prometheus-compatible query endpoint for controller-manager. If empty, uses the default value from Go code. prometheusAddr: "" # controllerManager.enablePromoteKantaloupeflowController -- Automatically create KantaloupeFlow CRs for existing GPU deployments in member clusters. enablePromoteKantaloupeflowController: false webhook: enabled: true port: 9443 servicePort: 443 certDir: /var/run/kantaloupe/webhook-certs certName: tls.crt keyName: tls.key ## @section auth configuration # auth.enabled -- Enable kantaloupe auth (JWT login, RBAC, audit) # auth.storeBackend -- Auth store backend. Supported values: `crd`, `sqlite` # auth.crdAuditWindowSize -- Max number of audit CRDs retained by the apiserver write path # auth.dbPath -- SQLite database path for auth data when `auth.storeBackend=sqlite` # auth.jwtSecret -- JWT signing secret (plain text, dev only) # auth.bootstrapAdminUsername -- Bootstrap PlatformAdmin username # auth.bootstrapAdminPassword -- Bootstrap admin password (plain text, dev only) # auth.bootstrapAdminFullName -- Bootstrap PlatformAdmin full name (display name) # auth.bootstrapAdminEmail -- Bootstrap PlatformAdmin email address # auth.existingAuthSecret -- Name of an existing K8s Secret with keys "jwt-secret" and "bootstrap-admin-password" (use instead of plain-text values for production) # auth.dryRun -- Allow requests without enforcing auth; inject bootstrap admin when no valid token is provided auth: enabled: true storeBackend: crd crdAuditWindowSize: 1000 dryRun: false dbPath: /data/kantaloupe/auth.db jwtSecret: "your-own-jwt-secret" bootstrapAdminUsername: "bootstrap-platform-admin" bootstrapAdminPassword: "admin12345" bootstrapAdminFullName: "Platform Administrator" bootstrapAdminEmail: "admin@email.com" existingAuthSecret: "" # auth.apiserverServiceAccountName -- ServiceAccount name of the kantaloupe-apiserver, used by the auth assignment admission webhook to validate the requester identity. Defaults to the release fullname. apiserverServiceAccountName: "" # auth.image.registry -- db-migrate image registry for sqlite backend # auth.image.repository -- db-migrate image repository for sqlite backend # auth.image.tag -- db-migrate image tag for sqlite backend # auth.image.pullPolicy -- db-migrate image pull policy for sqlite backend image: registry: ghcr.io repository: dynamia-ai/kantaloupe-db-migrate tag: v0.15.0 pullPolicy: IfNotPresent # auth.persistence.enabled -- Enable persistence using PVC for sqlite backend (PV is dynamically provisioned via cluster default StorageClass) ## WARNING: If set to false, all auth data (user accounts, tokens) will be lost when the pod restarts. ## Set to true for production sqlite installs or switch to the `crd` backend for etcd-backed persistence. # auth.persistence.size -- PVC storage size for sqlite backend # auth.persistence.storageClass -- PVC storage class for sqlite backend (empty = use cluster default StorageClass for dynamic PV provisioning) # auth.persistence.existingClaim -- Name of an existing PVC to use for sqlite backend (if set, a new PVC will not be created) persistence: enabled: false size: 1Gi storageClass: "" existingClaim: "" # apiserver config apiserver: ## @section apiserver configuration # apiserver.labels -- apiserver labels labels: {} # apiserver.replicaCount -- apiserver target replica count replicaCount: 1 # apiserver.podAnnotations -- apiserver pod annotations podAnnotations: {} # apiserver.podLabels -- apiserver pod labels podLabels: {} # apiserver.image.registry -- kantaloupe image registry # apiserver.image.repository -- kantaloupe image repository # apiserver.image.tag -- kantaloupe image tag (immutable tags are recommended) # apiserver.image.pullPolicy -- kantaloupe image pull policy # apiserver.image.pullSecrets -- Specify docker-registry secret names as an array image: registry: ghcr.io repository: dynamia-ai/kantaloupe-apiserver tag: "v0.15.0" ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## Example: ## pullSecrets: ## - myRegistryKeySecretName ## pullSecrets: [] # apiserver.resources -- apiserver resource requests and limits resources: {} # If you do want to specify resources, uncomment the following # lines, adjust them as necessary, and remove the curly braces after 'resources:'. # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # apiserver.nodeSelector -- apiserver node labels for pod assignment nodeSelector: {} # apiserver.affinity -- apiserver affinity settings affinity: {} # apiserver.tolerations -- apiserver tolerations for pod assignment tolerations: {} # apiserver.livenessProbe.enabled -- Enable livenessProbe on apiserver containers livenessProbe: enabled: false # apiserver.readinessProbe.enabled -- Enable readinessProbe on ui containers readinessProbe: enabled: false # apiserver.clusterAPIQPS -- QPS to use while talking with cluster kube-apiserver clusterAPIQPS: 50 # apiserver.clusterAPIBurst -- Burst to use while talking with cluster kube-apiserver clusterAPIBurst: 100 # apiserver.logLevel -- apiserver glog verbosity level (0=minimal, 4=info, 5=debug) logLevel: 4 # apiserver.prometheusAddr -- Prometheus server address for apiserver metrics querying prometheusAddr: "" # apiserver.meteringGRPCAddress -- Optional upstream metering gRPC service address. Leave empty to disable metering APIs meteringGRPCAddress: "" # apiserver.leaderElection.enabled -- Enable apiserver leader election for auth singleton bootstrap when auth.storeBackend=crd # apiserver.leaderElection.leaseDuration -- Lease duration for apiserver leader election # apiserver.leaderElection.renewDeadline -- Renew deadline for apiserver leader election # apiserver.leaderElection.retryPeriod -- Retry period for apiserver leader election # apiserver.leaderElection.resourceNamespace -- Namespace of the Lease object; empty means use the release namespace leaderElection: enabled: true leaseDuration: 15s renewDeadline: 10s retryPeriod: 2s resourceNamespace: "" ## service config service: type: ClusterIP nodePort: 31800 port: 8000 # ui config ui: ## @section ui configuration # ui.labels -- ui labels labels: {} # ui.replicaCount -- ui target replica count replicaCount: 1 # ui.podAnnotations -- ui pod annotations podAnnotations: {} # ui.podLabels -- ui pod labels podLabels: {} # ui.image.registry -- kantaloupe image registry # ui.image.repository -- kantaloupe image repository # ui.image.tag -- kantaloupe image tag (immutable tags are recommended) # ui.image.pullPolicy -- kantaloupe image pull policy # ui.image.pullSecrets -- Specify docker-registry secret names as an array image: registry: ghcr.io repository: dynamia-ai/kantaloupe-ui tag: "v0.12.1" ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images ## pullPolicy: IfNotPresent ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## Example: ## pullSecrets: ## - myRegistryKeySecretName ## pullSecrets: [] # ui.resources -- ui resource requests and limits resources: {} # If you do want to specify resources, uncomment the following # lines, adjust them as necessary, and remove the curly braces after 'resources:'. # limits: # cpu: 100m # memory: 128Mi # requests: # cpu: 100m # memory: 128Mi # ui.nodeSelector -- ui node labels for pod assignment nodeSelector: {} # ui.affinity -- ui affinity settings affinity: {} # ui.tolerations -- ui tolerations for pod assignment tolerations: {} # ui.livenessProbe.enabled -- Enable livenessProbe on ui containers livenessProbe: enabled: false # ui.readinessProbe.enabled -- Enable readinessProbe on ui containers readinessProbe: enabled: false # ui.forceChinese -- Force UI to display Chinese language forceChinese: false # ui.apiBackendURL -- Optional backend address for UI API requests. Leave empty to use same-origin requests apiBackendURL: "" ## service config service: type: ClusterIP nodePort: 31300 port: 80 ## universe metrics monitoring: enabled: true # monitoring.serviceMonitorLabels -- Labels added to ServiceMonitor and PrometheusRule resources for discovery by Prometheus-compatible operators. When empty, defaults to `release: prometheus`; providing any labels replaces that fallback. The built-in `app`, `role`, and `control-plane` labels cannot be overridden. serviceMonitorLabels: {} # @schema additionalProperties: {"type":"string"} hamiServiceMonitor: enabled: true vendorServiceMonitor: # monitoring.vendorServiceMonitor.enabled -- Create vendor ServiceMonitor templates and recording rules for enabled vendors. enabled: true # monitoring.vendorServiceMonitor.enableNvidiaServicemonitor -- Enable NVIDIA exporter discovery and NVIDIA recording rules in the control plane. Required for monitoring NVIDIA devices in local or member clusters. enableNvidiaServicemonitor: true # monitoring.vendorServiceMonitor.enableMetaxServicemonitor -- Enable MetaX exporter discovery and MetaX recording rules in the control plane. Required for monitoring MetaX devices in local or member clusters. enableMetaxServicemonitor: false # monitoring.vendorServiceMonitor.enableAscendServicemonitor -- Enable Ascend exporter discovery and Ascend recording rules in the control plane. Required for monitoring Ascend devices in local or member clusters. enableAscendServicemonitor: false # monitoring.vendorServiceMonitor.enableEnflameServicemonitor -- Enable Enflame GCU exporter discovery and Enflame recording rules in the control plane. Required for monitoring Enflame devices in local or member clusters. enableEnflameServicemonitor: false # monitoring.vendorServiceMonitor.enableAlibabaPPUServicemonitor -- Enable Alibaba PPU exporter discovery and Alibaba PPU recording rules in the control plane. Required for monitoring Alibaba PPU devices in local or member clusters. enableAlibabaPPUServicemonitor: false # monitoring.vendorServiceMonitor.enableAMDServiceMonitor -- Enable AMD GPU Operator exporter discovery and AMD recording rules in the control plane. Required for monitoring AMD devices in local or member clusters. enableAMDServiceMonitor: false # monitoring.vendorServiceMonitor.enableIluvatarServicemonitor -- Enable Iluvatar ix-exporter and vgpu-manager discovery and Iluvatar recording rules in the control plane. Required for monitoring Iluvatar devices in local or member clusters. enableIluvatarServicemonitor: false # monitoring.vendorServiceMonitor.enableHygonServicemonitor -- Enable HCU exporter discovery and Hygon device recording rules in the control plane. Required for monitoring Hygon devices in local or member clusters. Discovers hcu-exporter in the monitoring namespace. enableHygonServicemonitor: false cloudtty: enabled: true mpu: enabled: false # mpu.image.pullPolicy -- MPU image pull policy image: registry: ghcr.io repository: dynamia-ai/mpu # ubuntu-24.04 or ubuntu-22.04 or ubuntu-20.04 for different versions of kernel # ubuntu-24.04 for kernel version 6.8.0-6.17.0, ubuntu-22.04 for kernel version 5.15.0-6.8.0, ubuntu-20.04 for kernel version 5.4.0-5.15.0 tag: "dev-ubuntu24.04" pullPolicy: IfNotPresent pullSecrets: []