HAMi AI Platform Chart 0.21.1
发布时间：2026-10-16（UTC）
版本状态：有已知问题
本版调整了网关主机名配置的传递方式，但默认后端镜像仍为 v0.15.0，未包含对应的运行时修改。该网关问题的修复已随 Chart 0.21.2 交付。选择升级目标前，应同时查阅目标版本的版本状态与已知问题；具体影响见下文。
| 版本 | 比较基线 | 本版 |
|---|---|---|
| Chart | 0.21.0 | 0.21.1 |
| appVersion | 0.15.0 | 0.15.0 |
| API Server | v0.15.0 | v0.15.0 |
| Controller Manager | v0.15.0 | v0.15.0 |
| 数据库迁移组件（启用 SQLite 认证存储时） | v0.15.0 | v0.15.0 |
| UI | v0.12.1 | v0.12.1 |
HAMi Enterprise 兼容性
下表按具体接口与使用条件列出配套门槛，不将某一厂商的监控指标门槛作为整个平台的统一最低版本。
| 功能或使用场景 | 最低可用 HAMi Enterprise 版本 | 本版配套要求与升级结论 |
|---|---|---|
| NVIDIA HAMi-core 单个常规容器的设备分配、调度容量、已分配资源与工作负载运行使用量监控（不含 init container） | v2.9.0-rc0 | 使用配套的 Enterprise 调度器、NVIDIA 设备插件和 vGPU Monitor，并保持 Prometheus 对调度器与设备插件监控端点的采集。此处范围为单个常规容器；其他容器模式按其单独条件选择配套版本。 |
| NVIDIA 显存超卖倍数历史趋势 | v2.10.0-r0 | 调度器需提供 hami_gpu_memory_oversell_factor，平台规则将其转换为趋势指标。此门槛只约束倍数指标的展示，不是显存超卖运行能力的首次版本。 |
| AMD 已分配工作负载的容器核心百分比 | v2.10.0-r0 | 适用于 AMD 设备已注册并由 HAMi 分配的场景；调度器将物理 CU 数按设备总核心数转换成 hami_vgpu_core_allocated_ratio 百分比。AMD 物理设备使用量仍由相应厂商监控组件提供。 |
| NVIDIA／Ascend 常规业务容器资源池：设备归属、命名空间绑定、CPU／内存与设备配额、显式或 binpack／spread 选池 | v2.9.0-rc0 | 需要 CRD Chart 0.4.2、Resource Pool Manager 应用 v0.0.1；默认安装使用 RPM Chart 0.0.5。RPM Chart 0.0.4 须显式纠正 Manager 镜像。使用 extender 模式、Kubernetes >=1.30.0-0 及已注册的相应设备；此最低组合对应 amd64 制品。 |
| NVIDIA 资源池内 GPU mutex／numa 或逗号组合策略 | v2.10.0-r0 | 使用上述 CRD 与 RPM 配套。这里是池内 GPU 分配策略，区别于 RPM 的 binpack／spread 选池策略。 |
| HCU 资源池 | v2.10.0-r3 | 需要 CRD Chart 0.4.2、RPM 应用 v0.0.2（默认 RPM Chart 0.0.6），以及 HCU 设备插件 v3.0.0 的 hami 注册模式；使用 extender 模式和 Kubernetes >=1.30.0-0。此最低组合对应 amd64 制品。 |
HAMi Enterprise 的 rc 后缀不代表测试版或预发布版。v2.9.0-rc0 的旧镜像当前不可取得，新部署需选择满足上述接口条件且制品可取得的版本；镜像可获取性不改变已确认的最低接口版本。
Chart 变更
gateway.hostnames现在以逗号分隔的完整列表注入 API Server 和 Controller Manager 的GATEWAY_HOSTNAMES环境变量；Controller Manager 不再接收原来的GATEWAY_ENDPOINT。该参数默认仍为[]，UI 与 API 路由的主机名设置方式未变。- 默认后端与 UI 镜像均未更新。因此，本版尚未交付控制面工作负载、vLLM 演示及 CloudShell 路由的主机名传播和监听器选择修复。
已知问题
| 问题 | 影响范围 | 规避方法 | 修复版本 |
|---|---|---|---|
| 网关配置与默认后端镜像不匹配 | gateway.hostnames 非空且使用默认 v0.15.0 后端时，旧后端不读取 GATEWAY_HOSTNAMES。控制面集群访问地址会回退到 Gateway 状态中的地址；状态地址不存在时可能为空。生成的工作负载路由仍未继承站点域名，按站点域名访问 Jupyter 等工作负载路径时仍可能进入平台页面并显示 403。 | Chart 0.21.2 及其默认后端包含该网关问题的修复，采用前应查阅该版已知问题，并检查自定义 values 是否仍固定旧后端镜像。仅修改 appVersion 或升级 Enterprise 无法解决。 | Chart 0.21.2，默认后端 v0.15.1 |
升级说明
- 从 Chart
0.21.0升级时，若配置了非空gateway.hostnames，不要使用 Chart0.21.1的默认镜像组合承接域名路由修复，该网关问题的修复版本为 Chart 0.21.2，升级前应查阅其版本状态与已知问题。域名为空的部署不会触发上述旧环境变量被替换的配置差异，但本版也未更新后端修复。 - 采用修复版时，检查
apiserver.image.tag、controllerManager.image.tag和auth.image.tag，避免既有覆盖值继续固定在v0.15.0。修复版默认值均为v0.15.1；UI 仍为v0.12.1。使用私有镜像仓库时，global.imageRegistry会覆盖组件的image.registry，需要同步对应版本的镜像。 - 本次
0.21.0→0.21.1的 Chart 差异未改变 CRD、RBAC、认证存储配置或数据库迁移镜像。无需因这次网关配置调整切换认证存储或新增数据迁移；使用 SQLite 时，既有迁移 init container 仍按原条件执行。 - 资源池为可选配套；上述版本门槛不是本次网关调整新增的统一升级要求。首次启用或需要补齐配套时，先安装对应 CRD，再准备满足该用法的 Enterprise 调度器和设备插件，最后部署 RPM；RPM 的
hami.existingConfigMap必须指向调度器实际使用且包含device-config.yaml的 ConfigMap，运行时选池配置须可读写。设备配置改变后更新 RPM，使其同步配置。 - 使用最早 RPM 配套时，优先按表中默认 RPM Chart 组合部署；若使用 RPM Chart
0.0.4，需将image.repository设为ghcr.io/dynamia-ai/resource-pool-manager、image.tag设为v0.0.1。RPM Chart0.0.5的 Ascend 选池需设置hami.ascendEnabled=true；RPM Chart0.0.6改用devices.ascend.enabled=true。HCU 使用 RPM Chart0.0.6时需设置devices.hygon.enabled=true，HCU 插件设置RESOURCE_REGISTER_STRATEGY=hami。上述最低组合不适用于 DRA 模式。
查看Chart 与 appVersion 对应关系或软件中心。
Values 说明
以下参数说明取自 Chart 0.21.1 发布包随附的 README，保留原文。默认配置以该版本的 values.yaml 为准。
展开参数表
| Key | Type | Default | Description |
|---|---|---|---|
| apiserver.affinity | object | {} | apiserver affinity settings |
| apiserver.clusterAPIBurst | int | 100 | Burst to use while talking with cluster kube-apiserver |
| apiserver.clusterAPIQPS | int | 50 | QPS to use while talking with cluster kube-apiserver |
| apiserver.image.pullPolicy | string | "IfNotPresent" | kantaloupe image pull policy |
| apiserver.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| apiserver.image.registry | string | "ghcr.io" | kantaloupe image registry |
| apiserver.image.repository | string | "dynamia-ai/kantaloupe-apiserver" | kantaloupe image repository |
| apiserver.image.tag | string | "v0.15.0" | kantaloupe image tag (immutable tags are recommended) |
| apiserver.labels | object | {} | apiserver labels |
| apiserver.leaderElection.enabled | bool | true | Enable apiserver leader election for auth singleton bootstrap when auth.storeBackend=crd |
| apiserver.leaderElection.leaseDuration | string | "15s" | Lease duration for apiserver leader election |
| apiserver.leaderElection.renewDeadline | string | "10s" | Renew deadline for apiserver leader election |
| apiserver.leaderElection.resourceNamespace | string | "" | Namespace of the Lease object; empty means use the release namespace |
| apiserver.leaderElection.retryPeriod | string | "2s" | Retry period for apiserver leader election |
| apiserver.livenessProbe.enabled | bool | false | Enable livenessProbe on apiserver containers |
| apiserver.logLevel | int | 4 | apiserver glog verbosity level (0=minimal, 4=info, 5=debug) |
| apiserver.meteringGRPCAddress | string | "" | Optional upstream metering gRPC service address. Leave empty to disable metering APIs |
| apiserver.nodeSelector | object | {} | apiserver node labels for pod assignment |
| apiserver.podAnnotations | object | {} | apiserver pod annotations |
| apiserver.podLabels | object | {} | apiserver pod labels |
| apiserver.prometheusAddr | string | "" | Prometheus server address for apiserver metrics querying |
| apiserver.readinessProbe.enabled | bool | false | Enable readinessProbe on ui containers |
| apiserver.replicaCount | int | 1 | apiserver target replica count |
| apiserver.resources | object | {} | apiserver resource requests and limits |
| apiserver.service.nodePort | int | 31800 | |
| apiserver.service.port | int | 8000 | |
| apiserver.service.type | string | "ClusterIP" | |
| apiserver.tolerations | object | {} | apiserver tolerations for pod assignment |
| auth.apiserverServiceAccountName | string | "" | ServiceAccount name of the kantaloupe-apiserver, used by the auth assignment admission webhook to validate the requester identity. Defaults to the release fullname. |
| auth.bootstrapAdminEmail | string | "[email protected]" | Bootstrap PlatformAdmin email address |
| auth.bootstrapAdminFullName | string | "Platform Administrator" | Bootstrap PlatformAdmin full name (display name) |
| auth.bootstrapAdminPassword | string | "admin12345" | Bootstrap admin password (plain text, dev only) |
| auth.bootstrapAdminUsername | string | "bootstrap-platform-admin" | Bootstrap PlatformAdmin username |
| auth.crdAuditWindowSize | int | 1000 | Max number of audit CRDs retained by the apiserver write path |
| auth.dbPath | string | "/data/kantaloupe/auth.db" | SQLite database path for auth data when auth.storeBackend=sqlite |
| auth.dryRun | bool | false | Allow requests without enforcing auth; inject bootstrap admin when no valid token is provided |
| auth.enabled | bool | true | Enable kantaloupe auth (JWT login, RBAC, audit) |
| auth.existingAuthSecret | string | "" | Name of an existing K8s Secret with keys "jwt-secret" and "bootstrap-admin-password" (use instead of plain-text values for production) |
| auth.image.pullPolicy | string | "IfNotPresent" | db-migrate image pull policy for sqlite backend |
| auth.image.registry | string | "ghcr.io" | db-migrate image registry for sqlite backend |
| auth.image.repository | string | "dynamia-ai/kantaloupe-db-migrate" | db-migrate image repository for sqlite backend |
| auth.image.tag | string | "v0.15.0" | db-migrate image tag for sqlite backend |
| auth.jwtSecret | string | "your-own-jwt-secret" | JWT signing secret (plain text, dev only) |
| auth.persistence.enabled | bool | false | Enable persistence using PVC for sqlite backend (PV is dynamically provisioned via cluster default StorageClass) |
| auth.persistence.existingClaim | string | "" | Name of an existing PVC to use for sqlite backend (if set, a new PVC will not be created) |
| auth.persistence.size | string | "1Gi" | PVC storage size for sqlite backend |
| auth.persistence.storageClass | string | "" | PVC storage class for sqlite backend (empty = use cluster default StorageClass for dynamic PV provisioning) |
| auth.storeBackend | string | "crd" | Auth store backend. Supported values: crd, sqlite |
| cloudtty.enabled | bool | true | |
| controlPlaneName | string | "control-plane" | |
| controllerManager.affinity | object | {} | controllerManager affinity settings |
| controllerManager.enablePromoteKantaloupeflowController | bool | false | Automatically create KantaloupeFlow CRs for existing GPU deployments in member clusters. |
| controllerManager.image.pullPolicy | string | "IfNotPresent" | kantaloupe image pull policy |
| controllerManager.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| controllerManager.image.registry | string | "ghcr.io" | kantaloupe image registry |
| controllerManager.image.repository | string | "dynamia-ai/kantaloupe-controller-manager" | kantaloupe image repository |
| controllerManager.image.tag | string | "v0.15.0" | kantaloupe image tag (immutable tags are recommended) |
| controllerManager.labels | object | {} | controllerManager labels |
| controllerManager.livenessProbe.enabled | bool | false | Enable livenessProbe on controllerManager containers |
| controllerManager.metricsPort | int | 31001 | |
| controllerManager.nodeSelector | object | {} | controllerManager node labels for pod assignment |
| controllerManager.podAnnotations | object | {} | controllerManager pod annotations |
| controllerManager.podLabels | object | {} | controllerManager pod labels |
| controllerManager.prometheusAddr | string | "" | The Prometheus-compatible query endpoint for controller-manager. If empty, uses the default value from Go code. |
| controllerManager.readinessProbe.enabled | bool | false | Enable readinessProbe on controllerManager containers |
| controllerManager.replicaCount | int | 1 | controllerManager target replica count |
| controllerManager.resources | object | {} | controllerManager resource requests and limits |
| controllerManager.tolerations | object | {} | controllerManager tolerations for pod assignment |
| controllerManager.webhook.certDir | string | "/var/run/kantaloupe/webhook-certs" | |
| controllerManager.webhook.certName | string | "tls.crt" | |
| controllerManager.webhook.enabled | bool | true | |
| controllerManager.webhook.keyName | string | "tls.key" | |
| controllerManager.webhook.port | int | 9443 | |
| controllerManager.webhook.servicePort | int | 443 | |
| fullnameOverride | string | "kantaloupe" | String to fully override the fullname template |
| gateway.apiserverCors | object | {"allowCredentials":false,"allowHeaders":["authorization","content-type","accept","origin"],"allowMethods":["GET","POST","PUT","PATCH","DELETE","OPTIONS"],"allowOrigins":[],"enabled":false,"exposeHeaders":[],"maxAge":null} | Optional CORS policy attached only to the apiserver HTTPRoute (/apis) |
| gateway.apiserverCors.allowCredentials | bool | false | Whether credentialed cross-origin requests are allowed |
| gateway.apiserverCors.allowHeaders | list | ["authorization","content-type","accept","origin"] | Allowed request headers returned on CORS preflight responses |
| gateway.apiserverCors.allowMethods | list | ["GET","POST","PUT","PATCH","DELETE","OPTIONS"] | Allowed methods returned on CORS preflight responses |
| gateway.apiserverCors.allowOrigins | list | [] | Allowed browser origins for apiserver CORS; required when enabled |
| gateway.apiserverCors.enabled | bool | false | Enable Envoy Gateway SecurityPolicy-based CORS on the apiserver route |
| gateway.apiserverCors.exposeHeaders | list | [] | Response headers exposed to browser JavaScript |
| gateway.apiserverCors.maxAge | string | nil | Optional browser preflight cache max age in seconds |
| gateway.apiserverHostnames | list | [] | Dedicated external hostnames for direct apiserver access, separate from gateway.hostnames (the UI/site domain). When non-empty, a dedicated HTTPRoute routes these hosts to the apiserver; they must be covered by the HTTPS listener's TLS certificate. |
| gateway.className | string | "kantaloupe" | GatewayClass name |
| gateway.enabled | bool | true | Enable Gateway API resources |
| gateway.envoy | object | {"proxy":{"image":{"pullSecrets":[],"registry":"","repository":"","tag":""}},"service":{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}} | Envoy Gateway implementation details |
| gateway.envoy.proxy.image.pullSecrets | list | [] | Image pull secrets for Envoy proxy pods |
| gateway.envoy.proxy.image.registry | string | "" | Envoy proxy image registry |
| gateway.envoy.proxy.image.repository | string | "" | Envoy proxy image repository. When set without a tag, renders the EnvoyProxy imageRepository field. |
| gateway.envoy.proxy.image.tag | string | "" | Envoy proxy image tag. When set, renders a complete EnvoyProxy image reference. |
| gateway.envoy.service | object | {"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"} | Envoy service configuration |
| gateway.envoy.service.ports.http | object | {"nodePort":30080} | HTTP port configuration |
| gateway.envoy.service.ports.http.nodePort | int | 30080 | HTTP NodePort |
| gateway.envoy.service.ports.https | object | {"nodePort":30443} | HTTPS port configuration |
| gateway.envoy.service.ports.https.nodePort | int | 30443 | HTTPS NodePort |
| gateway.envoy.service.type | string | "NodePort" | Envoy service type (LoadBalancer or NodePort) |
| gateway.hostnames | list | [] | List of site hostnames (DNS names or wildcard names such as *.example.com, without scheme, port, or path). Applied to UI/API routes and passed to controller-manager and apiserver as GATEWAY_HOSTNAMES for control-plane workload, vLLM demo, and CloudShell HTTPRoutes. Member-cluster workload routes do not inherit the control-plane site hostnames. An empty list leaves site routes unrestricted by hostname. The first entry also supplies the control-plane cluster gateway address for generated access URLs; use a concrete hostname first. HTTPS certificates must cover these names. |
| gateway.ipAddress | string | "" | Gateway IP address |
| gateway.listeners | list | [{"name":"http","port":80,"protocol":"HTTP"}] | Gateway listeners configuration |
| global.imagePullSecrets | list | [] | Global Docker image pull secrets |
| global.imageRegistry | string | "" | Global Docker image registry |
| hamiNamespace | string | "hami-system" | |
| hook.image.pullPolicy | string | "IfNotPresent" | CRD hook image pull policy |
| hook.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| hook.image.registry | string | "ghcr.io" | CRD hook image registry |
| hook.image.repository | string | "cloudtty/cloudshell" | CRD hook image repository |
| hook.image.tag | string | "v0.8.9" | CRD hook image tag (immutable tags are recommended) |
| installCRDs | bool | true | define flag whether to install CRD resources |
| monitoring.enabled | bool | true | |
| monitoring.hamiServiceMonitor.enabled | bool | true | |
| monitoring.serviceMonitorLabels | object | {} | Labels added to ServiceMonitor and PrometheusRule resources for discovery by Prometheus-compatible operators. When empty, defaults to release: prometheus; providing any labels replaces that fallback. The built-in app, role, and control-plane labels cannot be overridden. |
| monitoring.vendorServiceMonitor.enableAMDServiceMonitor | bool | false | Enable AMD GPU Operator exporter discovery and AMD recording rules in the control plane. Required for monitoring AMD devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableAlibabaPPUServicemonitor | bool | false | Enable Alibaba PPU exporter discovery and Alibaba PPU recording rules in the control plane. Required for monitoring Alibaba PPU devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableAscendServicemonitor | bool | false | Enable Ascend exporter discovery and Ascend recording rules in the control plane. Required for monitoring Ascend devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableEnflameServicemonitor | bool | false | Enable Enflame GCU exporter discovery and Enflame recording rules in the control plane. Required for monitoring Enflame devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableHygonServicemonitor | bool | false | Enable HCU exporter discovery and Hygon device recording rules in the control plane. Required for monitoring Hygon devices in local or member clusters. Discovers hcu-exporter in the monitoring namespace. |
| monitoring.vendorServiceMonitor.enableIluvatarServicemonitor | bool | false | Enable Iluvatar ix-exporter and vgpu-manager discovery and Iluvatar recording rules in the control plane. Required for monitoring Iluvatar devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableMetaxServicemonitor | bool | false | Enable MetaX exporter discovery and MetaX recording rules in the control plane. Required for monitoring MetaX devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableNvidiaServicemonitor | bool | true | Enable NVIDIA exporter discovery and NVIDIA recording rules in the control plane. Required for monitoring NVIDIA devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enabled | bool | true | Create vendor ServiceMonitor templates and recording rules for enabled vendors. |
| mpu.enabled | bool | false | |
| mpu.image.pullPolicy | string | "IfNotPresent" | MPU image pull policy |
| mpu.image.pullSecrets | list | [] | |
| mpu.image.registry | string | "ghcr.io" | |
| mpu.image.repository | string | "dynamia-ai/mpu" | |
| mpu.image.tag | string | "dev-ubuntu24.04" | |
| nameOverride | string | "" | String to partially override the fullname template (will maintain the release name) |
| ui.affinity | object | {} | ui affinity settings |
| ui.apiBackendURL | string | "" | Optional backend address for UI API requests. Leave empty to use same-origin requests |
| ui.forceChinese | bool | false | Force UI to display Chinese language |
| ui.image.pullPolicy | string | "IfNotPresent" | kantaloupe image pull policy |
| ui.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| ui.image.registry | string | "ghcr.io" | kantaloupe image registry |
| ui.image.repository | string | "dynamia-ai/kantaloupe-ui" | kantaloupe image repository |
| ui.image.tag | string | "v0.12.1" | kantaloupe image tag (immutable tags are recommended) |
| ui.labels | object | {} | ui labels |
| ui.livenessProbe.enabled | bool | false | Enable livenessProbe on ui containers |
| ui.nodeSelector | object | {} | ui node labels for pod assignment |
| ui.podAnnotations | object | {} | ui pod annotations |
| ui.podLabels | object | {} | ui pod labels |
| ui.readinessProbe.enabled | bool | false | Enable readinessProbe on ui containers |
| ui.replicaCount | int | 1 | ui target replica count |
| ui.resources | object | {} | ui resource requests and limits |
| ui.service.nodePort | int | 31300 | |
| ui.service.port | int | 80 | |
| ui.service.type | string | "ClusterIP" | |
| ui.tolerations | object | {} | ui tolerations for pod assignment |