HAMi AI Platform Chart 0.21.3
发布时间：2026-10-26（UTC）
版本状态：正式可用
本版将默认 UI 升级至 v0.13.0，已确认修复 Chart 0.21.2 中 GPU 工作负载表单与后端资源格式不匹配的问题。创建、复制、编辑及 CPU-only 场景的实际 UI 转换结果已通过后端模板解析边界验证，旧嵌套格式作为反例会被拒绝。本版默认组件组合已验证可用，经维护者确认标记为正式可用。
| 版本 | 比较基线 | 本版 |
|---|---|---|
| Chart | 0.21.2 | 0.21.3 |
| appVersion | 0.15.1 | 0.15.1 |
| API Server | v0.15.1 | v0.15.1 |
| Controller Manager | v0.15.1 | v0.15.1 |
| 数据库迁移镜像 | v0.15.1 | v0.15.1 |
| UI | v0.12.1 | v0.13.0 |
数据库迁移容器仅在启用认证且 auth.storeBackend=sqlite 时运行。
HAMi Enterprise 兼容性
本版后端、调度接口和资源池组件要求延续 Chart 0.21.2。以下列出相关接口与协议的最低配套版本；本次 UI 修复不新增 Enterprise 的统一升级要求。资源池为可选功能，其门槛不自动成为平台基础运行门槛；这些结论不替代具体硬件环境验收。
| 功能或使用场景 | 最低可用 HAMi Enterprise 版本 | 本版配套要求与升级结论 |
|---|---|---|
| 读取已分配设备的四字段注解，含多容器空槽；NVIDIA、AMD、Ascend、Iluvatar、AWS Neuron、Enflame vGPU、Alibaba PPU | v2.9.0-rc0 | 仅约束分配记录读取。平台后端沿用 v0.15.1，无需为本次 UI 更新升级已有匹配协议的 Enterprise；不代表这些厂商的全部调度、隔离或监控能力均由此版本覆盖。 |
| NVIDIA HAMi-core 常规业务容器按百分比申请显存 | v2.9.0-rc0 | UI 将百分比写入 nvidia.com/gpumem-percentage，需要调度器和 NVIDIA 设备插件使用一致的资源名与 HAMi-core 配套。这是既有调度能力的新增表单入口；自定义资源名前缀须与平台设备配置一致。 |
| NVIDIA／Ascend 常规业务容器资源池管理、命名空间授权、配额、显式选池及 binpack/spread 自动选池 | v2.9.0-rc0 | 独立 CRD Chart 最低 0.4.2、RPM 应用最低 v0.0.1；默认组件正确的 RPM Chart 最低 0.0.5。RPM Chart 0.0.4 只有显式改用正确的 RPM 镜像才满足条件。上述 RPM 制品组合按 amd64 确认。 |
| NVIDIA 业务容器前有不申请 GPU 的初始化容器 | v2.9.0-rc1 | 使用 scheduler.useDownward=true。更早版本的容器索引处理不满足此模板；启用资源池时另满足上一行独立组件要求。 |
| NVIDIA 初始化容器申请 GPU，包括仅初始化容器申请 GPU | v2.10.0-r0 | 使用 scheduler.useDownward=true，需要完整的初始化容器注解与插件配套。启用资源池时另满足上述 RPM／CRD 要求。 |
| NVIDIA 资源池内使用 GPU mutex、numa 或组合策略 | v2.10.0-r0 | 配套上述 RPM／CRD。这些是池内 GPU 策略，与 RPM 的池间 binpack/spread 自动选池不同。 |
| HCU 资源池管理与调度接口 | v2.10.0-r3 | CRD Chart 最低 0.4.2、RPM 应用最低 v0.0.2、默认 RPM Chart 最低 0.0.6；HCU device plugin 最低 v3.0.0，启用 RESOURCE_REGISTER_STRATEGY=hami。插件制品按 amd64 确认。旧 DCU 命名协议不能替代 HCU 协议。 |
HAMi Enterprise 的 rc 后缀不代表测试版或预发布版。v2.9.0-rc0 和 v2.9.0-rc1 的旧镜像当前不可拉取，新部署需选择满足上述接口条件且制品可取得的版本。最低版本不构成对所有后续版本无回归的保证。
资源池要求 Kubernetes 1.30 或更高版本及 HAMi extender 模式，不适用于 DRA。表中的 Ascend 资源池用法限定常规业务容器；Ascend 或 NVIDIA 非 Downward 模式的仅初始化容器设备请求不在已确认组合内，当前正式发布中的设备加锁路径仍未覆盖该条件。
软件变更
- 修复 GPU 工作负载表单资源格式。 创建、复制和编辑 GPU 工作负载时，将扩展资源直接写入容器的
resources.limits和resources.requests，与 API Serverv0.15.1的原生 Kubernetes 模板接口一致。编辑回填、工作负载列表和详情中的资源读取同步适配该格式。 - 扩展工作负载表单。 支持副本数、镜像拉取策略、工作负载标签与 Pod 标签，以及 ConfigMap／Secret 环境变量引用、TCP／UDP 容器端口、HTTP 就绪与存活探针、容忍、节点亲和性、Pod 反亲和性、DNS 选项和 Pod／容器安全上下文。ConfigMap／Secret 引用按名称填写，需预先存在于工作负载命名空间；容器级配置作用于第一个业务容器。
- 调整编辑保存行为。 编辑时以已有 Pod 模板为底稿，再覆盖表单管理的字段；复制时按表单重建模板。启用 Jupyter 或 VS Code 等访问插件时，表单禁用自定义就绪与存活探针，避免与后端约束冲突；HTTP 探针的初始延迟允许为
0。 - 新增 NVIDIA vGPU 显存百分比输入。 显存限制可选择百分比或绝对容量；百分比输入限定整数
1–100，编辑时可回填已有百分比请求。该选项仅适用于 NVIDIA vGPU，不扩展到 vPPU 或其他卡类型。 - 更新 Jupyter 访问链接。 从工作负载列表打开 Jupyter 时，链接增加随访问生成的
routecheck参数，以避开浏览器复用旧网关路径缓存；保留并正确编码访问 token。
Chart 变更
相对 0.21.2，仅更新 Chart 版本、默认 UI 镜像和生成文档。appVersion、后端与迁移镜像、配置项、模板、依赖和 CRD 均未变化。
升级说明
- 从 Chart 0.21.2 升级时，确认
ui.image.tag更新为v0.13.0；固定在v0.12.1的自定义 values 会继续使用有问题的 UI。apiserver.image.tag、controllerManager.image.tag和auth.image.tag保持v0.15.1，不要因 UI 升级回退后端。使用私有仓库时同步新 UI 镜像，并注意global.imageRegistry会覆盖组件 registry。 - UI 更新后重新加载平台页面，再进行工作负载创建、复制或编辑。Jupyter 的缓存参数由新版工作负载列表入口生成，已有书签不会自动变化；需要时从平台重新打开入口。
- 采用高级表单前核对目标命名空间中的 Secret／ConfigMap、探针端口和调度条件。首次通过 UI 编辑由 API 或 YAML 创建的复杂模板时，先保留原始配置并核对表单管理的字段：卷、环境变量、亲和性和安全上下文等会按表单重新生成，不能据此认为任意原生字段都能原样往返；复制也不保证保留表单外字段。
- 仅修复 UI 资源格式时，无需额外升级 HAMi Enterprise、RPM 或 CRD；新增使用显存百分比或资源池功能时，仍须满足上表中的对应条件。资源池安装顺序和厂商开关沿用 0.21.2 的升级说明。
- 本版没有新增数据库迁移或存储配置变化；采用 SQLite 认证存储时仍保留现有持久化与备份安排。后端接口沿用 v0.15.1，自定义客户端继续使用原生
PodTemplateSpec和扁平资源映射。
查看Chart 与 appVersion 对应关系或软件中心。
Values 说明
以下参数说明取自 Chart 0.21.3 发布包随附的 README，保留原文。默认配置以该版本的 values.yaml 为准。
展开参数表
| Key | Type | Default | Description |
|---|---|---|---|
| apiserver.affinity | object | {} | apiserver affinity settings |
| apiserver.clusterAPIBurst | int | 100 | Burst to use while talking with cluster kube-apiserver |
| apiserver.clusterAPIQPS | int | 50 | QPS to use while talking with cluster kube-apiserver |
| apiserver.image.pullPolicy | string | "IfNotPresent" | kantaloupe image pull policy |
| apiserver.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| apiserver.image.registry | string | "ghcr.io" | kantaloupe image registry |
| apiserver.image.repository | string | "dynamia-ai/kantaloupe-apiserver" | kantaloupe image repository |
| apiserver.image.tag | string | "v0.15.1" | kantaloupe image tag (immutable tags are recommended) |
| apiserver.labels | object | {} | apiserver labels |
| apiserver.leaderElection.enabled | bool | true | Enable apiserver leader election for auth singleton bootstrap when auth.storeBackend=crd |
| apiserver.leaderElection.leaseDuration | string | "15s" | Lease duration for apiserver leader election |
| apiserver.leaderElection.renewDeadline | string | "10s" | Renew deadline for apiserver leader election |
| apiserver.leaderElection.resourceNamespace | string | "" | Namespace of the Lease object; empty means use the release namespace |
| apiserver.leaderElection.retryPeriod | string | "2s" | Retry period for apiserver leader election |
| apiserver.livenessProbe.enabled | bool | false | Enable livenessProbe on apiserver containers |
| apiserver.logLevel | int | 4 | apiserver glog verbosity level (0=minimal, 4=info, 5=debug) |
| apiserver.meteringGRPCAddress | string | "" | Optional upstream metering gRPC service address. Leave empty to disable metering APIs |
| apiserver.nodeSelector | object | {} | apiserver node labels for pod assignment |
| apiserver.podAnnotations | object | {} | apiserver pod annotations |
| apiserver.podLabels | object | {} | apiserver pod labels |
| apiserver.prometheusAddr | string | "" | Prometheus server address for apiserver metrics querying |
| apiserver.readinessProbe.enabled | bool | false | Enable readinessProbe on ui containers |
| apiserver.replicaCount | int | 1 | apiserver target replica count |
| apiserver.resources | object | {} | apiserver resource requests and limits |
| apiserver.service.nodePort | int | 31800 | |
| apiserver.service.port | int | 8000 | |
| apiserver.service.type | string | "ClusterIP" | |
| apiserver.tolerations | object | {} | apiserver tolerations for pod assignment |
| auth.apiserverServiceAccountName | string | "" | ServiceAccount name of the kantaloupe-apiserver, used by the auth assignment admission webhook to validate the requester identity. Defaults to the release fullname. |
| auth.bootstrapAdminEmail | string | "[email protected]" | Bootstrap PlatformAdmin email address |
| auth.bootstrapAdminFullName | string | "Platform Administrator" | Bootstrap PlatformAdmin full name (display name) |
| auth.bootstrapAdminPassword | string | "admin12345" | Bootstrap admin password (plain text, dev only) |
| auth.bootstrapAdminUsername | string | "bootstrap-platform-admin" | Bootstrap PlatformAdmin username |
| auth.crdAuditWindowSize | int | 1000 | Max number of audit CRDs retained by the apiserver write path |
| auth.dbPath | string | "/data/kantaloupe/auth.db" | SQLite database path for auth data when auth.storeBackend=sqlite |
| auth.dryRun | bool | false | Allow requests without enforcing auth; inject bootstrap admin when no valid token is provided |
| auth.enabled | bool | true | Enable kantaloupe auth (JWT login, RBAC, audit) |
| auth.existingAuthSecret | string | "" | Name of an existing K8s Secret with keys "jwt-secret" and "bootstrap-admin-password" (use instead of plain-text values for production) |
| auth.image.pullPolicy | string | "IfNotPresent" | db-migrate image pull policy for sqlite backend |
| auth.image.registry | string | "ghcr.io" | db-migrate image registry for sqlite backend |
| auth.image.repository | string | "dynamia-ai/kantaloupe-db-migrate" | db-migrate image repository for sqlite backend |
| auth.image.tag | string | "v0.15.1" | db-migrate image tag for sqlite backend |
| auth.jwtSecret | string | "your-own-jwt-secret" | JWT signing secret (plain text, dev only) |
| auth.persistence.enabled | bool | false | Enable persistence using PVC for sqlite backend (PV is dynamically provisioned via cluster default StorageClass) |
| auth.persistence.existingClaim | string | "" | Name of an existing PVC to use for sqlite backend (if set, a new PVC will not be created) |
| auth.persistence.size | string | "1Gi" | PVC storage size for sqlite backend |
| auth.persistence.storageClass | string | "" | PVC storage class for sqlite backend (empty = use cluster default StorageClass for dynamic PV provisioning) |
| auth.storeBackend | string | "crd" | Auth store backend. Supported values: crd, sqlite |
| cloudtty.enabled | bool | true | |
| controlPlaneName | string | "control-plane" | |
| controllerManager.affinity | object | {} | controllerManager affinity settings |
| controllerManager.enablePromoteKantaloupeflowController | bool | false | Automatically create KantaloupeFlow CRs for existing GPU deployments in member clusters. |
| controllerManager.image.pullPolicy | string | "IfNotPresent" | kantaloupe image pull policy |
| controllerManager.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| controllerManager.image.registry | string | "ghcr.io" | kantaloupe image registry |
| controllerManager.image.repository | string | "dynamia-ai/kantaloupe-controller-manager" | kantaloupe image repository |
| controllerManager.image.tag | string | "v0.15.1" | kantaloupe image tag (immutable tags are recommended) |
| controllerManager.labels | object | {} | controllerManager labels |
| controllerManager.livenessProbe.enabled | bool | false | Enable livenessProbe on controllerManager containers |
| controllerManager.metricsPort | int | 31001 | |
| controllerManager.nodeSelector | object | {} | controllerManager node labels for pod assignment |
| controllerManager.podAnnotations | object | {} | controllerManager pod annotations |
| controllerManager.podLabels | object | {} | controllerManager pod labels |
| controllerManager.prometheusAddr | string | "" | The Prometheus-compatible query endpoint for controller-manager. If empty, uses the default value from Go code. |
| controllerManager.readinessProbe.enabled | bool | false | Enable readinessProbe on controllerManager containers |
| controllerManager.replicaCount | int | 1 | controllerManager target replica count |
| controllerManager.resources | object | {} | controllerManager resource requests and limits |
| controllerManager.tolerations | object | {} | controllerManager tolerations for pod assignment |
| controllerManager.webhook.certDir | string | "/var/run/kantaloupe/webhook-certs" | |
| controllerManager.webhook.certName | string | "tls.crt" | |
| controllerManager.webhook.enabled | bool | true | |
| controllerManager.webhook.keyName | string | "tls.key" | |
| controllerManager.webhook.port | int | 9443 | |
| controllerManager.webhook.servicePort | int | 443 | |
| fullnameOverride | string | "kantaloupe" | String to fully override the fullname template |
| gateway.apiserverCors | object | {"allowCredentials":false,"allowHeaders":["authorization","content-type","accept","origin"],"allowMethods":["GET","POST","PUT","PATCH","DELETE","OPTIONS"],"allowOrigins":[],"enabled":false,"exposeHeaders":[],"maxAge":null} | Optional CORS policy attached only to the apiserver HTTPRoute (/apis) |
| gateway.apiserverCors.allowCredentials | bool | false | Whether credentialed cross-origin requests are allowed |
| gateway.apiserverCors.allowHeaders | list | ["authorization","content-type","accept","origin"] | Allowed request headers returned on CORS preflight responses |
| gateway.apiserverCors.allowMethods | list | ["GET","POST","PUT","PATCH","DELETE","OPTIONS"] | Allowed methods returned on CORS preflight responses |
| gateway.apiserverCors.allowOrigins | list | [] | Allowed browser origins for apiserver CORS; required when enabled |
| gateway.apiserverCors.enabled | bool | false | Enable Envoy Gateway SecurityPolicy-based CORS on the apiserver route |
| gateway.apiserverCors.exposeHeaders | list | [] | Response headers exposed to browser JavaScript |
| gateway.apiserverCors.maxAge | string | nil | Optional browser preflight cache max age in seconds |
| gateway.apiserverHostnames | list | [] | Dedicated external hostnames for direct apiserver access, separate from gateway.hostnames (the UI/site domain). When non-empty, a dedicated HTTPRoute routes these hosts to the apiserver; they must be covered by the HTTPS listener's TLS certificate. |
| gateway.className | string | "kantaloupe" | GatewayClass name |
| gateway.enabled | bool | true | Enable Gateway API resources |
| gateway.envoy | object | {"proxy":{"image":{"pullSecrets":[],"registry":"","repository":"","tag":""}},"service":{"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"}} | Envoy Gateway implementation details |
| gateway.envoy.proxy.image.pullSecrets | list | [] | Image pull secrets for Envoy proxy pods |
| gateway.envoy.proxy.image.registry | string | "" | Envoy proxy image registry |
| gateway.envoy.proxy.image.repository | string | "" | Envoy proxy image repository. When set without a tag, renders the EnvoyProxy imageRepository field. |
| gateway.envoy.proxy.image.tag | string | "" | Envoy proxy image tag. When set, renders a complete EnvoyProxy image reference. |
| gateway.envoy.service | object | {"ports":{"http":{"nodePort":30080},"https":{"nodePort":30443}},"type":"NodePort"} | Envoy service configuration |
| gateway.envoy.service.ports.http | object | {"nodePort":30080} | HTTP port configuration |
| gateway.envoy.service.ports.http.nodePort | int | 30080 | HTTP NodePort |
| gateway.envoy.service.ports.https | object | {"nodePort":30443} | HTTPS port configuration |
| gateway.envoy.service.ports.https.nodePort | int | 30443 | HTTPS NodePort |
| gateway.envoy.service.type | string | "NodePort" | Envoy service type (LoadBalancer or NodePort) |
| gateway.hostnames | list | [] | List of site hostnames (DNS names or wildcard names such as *.example.com, without scheme, port, or path). Applied to UI/API routes and passed to controller-manager and apiserver as GATEWAY_HOSTNAMES for control-plane workload, vLLM demo, and CloudShell HTTPRoutes. Member-cluster workload routes do not inherit the control-plane site hostnames. An empty list leaves site routes unrestricted by hostname. The first entry also supplies the control-plane cluster gateway address for generated access URLs; use a concrete hostname first. HTTPS certificates must cover these names. |
| gateway.ipAddress | string | "" | Gateway IP address |
| gateway.listeners | list | [{"name":"http","port":80,"protocol":"HTTP"}] | Gateway listeners configuration |
| global.imagePullSecrets | list | [] | Global Docker image pull secrets |
| global.imageRegistry | string | "" | Global Docker image registry |
| hamiNamespace | string | "hami-system" | |
| hook.image.pullPolicy | string | "IfNotPresent" | CRD hook image pull policy |
| hook.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| hook.image.registry | string | "ghcr.io" | CRD hook image registry |
| hook.image.repository | string | "cloudtty/cloudshell" | CRD hook image repository |
| hook.image.tag | string | "v0.8.9" | CRD hook image tag (immutable tags are recommended) |
| installCRDs | bool | true | define flag whether to install CRD resources |
| monitoring.enabled | bool | true | |
| monitoring.hamiServiceMonitor.enabled | bool | true | |
| monitoring.serviceMonitorLabels | object | {} | Labels added to ServiceMonitor and PrometheusRule resources for discovery by Prometheus-compatible operators. When empty, defaults to release: prometheus; providing any labels replaces that fallback. The built-in app, role, and control-plane labels cannot be overridden. |
| monitoring.vendorServiceMonitor.enableAMDServiceMonitor | bool | false | Enable AMD GPU Operator exporter discovery and AMD recording rules in the control plane. Required for monitoring AMD devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableAlibabaPPUServicemonitor | bool | false | Enable Alibaba PPU exporter discovery and Alibaba PPU recording rules in the control plane. Required for monitoring Alibaba PPU devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableAscendServicemonitor | bool | false | Enable Ascend exporter discovery and Ascend recording rules in the control plane. Required for monitoring Ascend devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableEnflameServicemonitor | bool | false | Enable Enflame GCU exporter discovery and Enflame recording rules in the control plane. Required for monitoring Enflame devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableHygonServicemonitor | bool | false | Enable HCU exporter discovery and Hygon device recording rules in the control plane. Required for monitoring Hygon devices in local or member clusters. Discovers hcu-exporter in the monitoring namespace. |
| monitoring.vendorServiceMonitor.enableIluvatarServicemonitor | bool | false | Enable Iluvatar ix-exporter and vgpu-manager discovery and Iluvatar recording rules in the control plane. Required for monitoring Iluvatar devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableMetaxServicemonitor | bool | false | Enable MetaX exporter discovery and MetaX recording rules in the control plane. Required for monitoring MetaX devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enableNvidiaServicemonitor | bool | true | Enable NVIDIA exporter discovery and NVIDIA recording rules in the control plane. Required for monitoring NVIDIA devices in local or member clusters. |
| monitoring.vendorServiceMonitor.enabled | bool | true | Create vendor ServiceMonitor templates and recording rules for enabled vendors. |
| mpu.enabled | bool | false | |
| mpu.image.pullPolicy | string | "IfNotPresent" | MPU image pull policy |
| mpu.image.pullSecrets | list | [] | |
| mpu.image.registry | string | "ghcr.io" | |
| mpu.image.repository | string | "dynamia-ai/mpu" | |
| mpu.image.tag | string | "dev-ubuntu24.04" | |
| nameOverride | string | "" | String to partially override the fullname template (will maintain the release name) |
| ui.affinity | object | {} | ui affinity settings |
| ui.apiBackendURL | string | "" | Optional backend address for UI API requests. Leave empty to use same-origin requests |
| ui.forceChinese | bool | false | Force UI to display Chinese language |
| ui.image.pullPolicy | string | "IfNotPresent" | kantaloupe image pull policy |
| ui.image.pullSecrets | list | [] | Specify docker-registry secret names as an array |
| ui.image.registry | string | "ghcr.io" | kantaloupe image registry |
| ui.image.repository | string | "dynamia-ai/kantaloupe-ui" | kantaloupe image repository |
| ui.image.tag | string | "v0.13.0" | kantaloupe image tag (immutable tags are recommended) |
| ui.labels | object | {} | ui labels |
| ui.livenessProbe.enabled | bool | false | Enable livenessProbe on ui containers |
| ui.nodeSelector | object | {} | ui node labels for pod assignment |
| ui.podAnnotations | object | {} | ui pod annotations |
| ui.podLabels | object | {} | ui pod labels |
| ui.readinessProbe.enabled | bool | false | Enable readinessProbe on ui containers |
| ui.replicaCount | int | 1 | ui target replica count |
| ui.resources | object | {} | ui resource requests and limits |
| ui.service.nodePort | int | 31300 | |
| ui.service.port | int | 80 | |
| ui.service.type | string | "ClusterIP" | |
| ui.tolerations | object | {} | ui tolerations for pod assignment |