v1.12.7-20260729 Release
Pre-release
Pre-release
feat(mesh) — Linkerd mesh for Shared in-cluster traffic (#3785)
* fix(app-gateway): support multi-arch ARM for linkerd-pki-guardian (#3678)
* chore(deploy): pin linkerd-pki-guardian multi-arch 0.1.2 digest
* fix(app-gateway): cross-compile pki-guardian for multi-arch ARM
* chore(merge): merge main into release-prepare-1.12.8 (#3709)
* docs: enhance sitemap handling by adding noindex for specific routes and redirect sources (#3679)
- Implemented normalization for routes to improve sitemap comparisons.
- Added logic to exclude URLs that redirect from the sitemap to optimize crawl budget.
- Introduced a pattern to noindex low-value reference pages in both English and Chinese locales.
* revert(app-gateway): drop Linkerd foundation from main onto release-prepare-1.12.8 (#3677)
* Revert "feat(app-gateway): install Linkerd foundation without traffic cutover (#3632)"
This reverts commit 23b583b43e75ddc07dff42ebdb99102c60a20f5a.
* Revert " feat(app-service): inject gpu.intel.com/i915 for intel compute mode (#3648)"
This reverts commit f05ffccfabe54ba593b0f176a4d019385d42000a.
* fix: stop fanning out shared apps per user in allUsersApps
* fix: checkappname test
* fix: appupgrade add cluster capacity check
installing to installFailed
app settings market-source
remove patched gpu limits if an app removed gpu required
* fix: cleanup return
* fix: make webhook listen before mgr controller
* fix: sync opertion block reconcile
* fix: sharedentranceid
* fix: shared entrance id for v2
* feat: inject gpu.intel.com/i915 for intel compute mode
* chore(appservice): update image version to 0.6.2
* fix: limit intel type to i915
---------
Co-authored-by: hys <hysyeah@gmail.com>
* docs: batch on-page SEO cleanup (#3680)
* update on-page content based on SEO audits
* fix on-page multiple h1 titles
* add missing translation
* remove or noindex orphan pages
* fix duplicate title tags
* update redirects based on comments
* remove studio files
* fix(download-server): update ytdlp url (#3673)
ytdlp move to ytdlpv3 ns
* docs: Modify parameters for recommended vLLM model (#3681)
edits for parameters accuracy
* docs: offline merchant app related content (#3676)
offline merchant app related content
* fix(appservice): third-level, third-party conflict check (#3682)
* fix: third-level, third-party conflict check
* chore(appservice): update image version to 0.6.7
* chore(user-service): bump image to v0.1.3 (#3684)
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: fix meta title and description length (#3683)
fix meta title and description titles
* market: fix treat cancel with no active install task as success (#3685)
Co-authored-by: admin <>
* docs: enhance Open Graph and Twitter meta tags for improved SEO (#3689)
Added comprehensive Open Graph and Twitter meta tags to enhance social sharing and SEO. Included localized site names, descriptions, and a default image for better representation across platforms. Introduced a new Open Graph image asset for consistent branding.
* helm-charts: register download provider service and RBAC, bump system-frontend & user-service images (#3690)
feat(helm-charts): add download provider service and role bindings
- Introduced new ClusterRole and ClusterRoleBinding for download provider service.
- Added Service definition for download with ClusterIP configuration.
- Updated olares-app.yaml to use the latest images for system-frontend and user-service.
* fix(cli): make generation of etcd certs idempotent by config check (#3687)
* market: optimize startup caching, tighten upload auth (#3694)
market: optimize startup caching, tighten upload auth, and filter AppleDouble metadata
* feat(cli): migrate node identity on hostname change during change-ip (#3693)
* feat(cli): migrate node identity on hostname change during change-ip
A machine hostname change makes the kubelet register a brand-new
Kubernetes node under the new name and abandon the old one. Recovering
is complex: the workloads must be rebuilt on the new node, and a lot of
per-node state (node metadata, node-local storage, GPU allocations)
still points at the old node and has to be migrated first.
change-ip now handles this. It detects a hostname change by matching the
machine's machine-id and system UUID against the registered nodes (after
lowercasing the hostname), and then:
- restores the node labels/annotations Olares owns (GPU labels, worker
role, GPU share-mode) onto the newly registered node;
- migrates the app-service GPU allocation store and share-mode keys,
rewriting the old node name in node-scoped device ids while leaving
stable GPU UUIDs untouched;
- removes node-local PersistentVolumes bound to the old node and deletes
the stale node object;
- waits for the old node to drain and its workloads to come back ready
on the new node.
When the hostname is unchanged, change-ip behaves exactly as before.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli): address bugbot review on hostname-change migration
- Readiness: after a hostname change, check pod readiness cluster-wide
instead of scoping to the new node. A new-node-scoped check skips
unscheduled Pending replacements (empty NodeName), so it could pass
before the migrated workloads actually reschedule and become ready.
- GPU allocations: only rewrite rows whose nodeName is the old node.
The deviceId rewrite is a "<oldNode>-" prefix match, so rewriting
every row could corrupt a different node's non-HAMI device id when its
name shares that prefix. Scope the rewrite (nodeName and deviceId) to
the migrated node's rows only, and cover it with a regression test.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: remove Ornith-1.0-35B (llama.cpp) (#3695)
officially offline model
* docs: update Activate Olares using Olares CLI for Olares v1.12.6 (#3651)
* update steps to cover 1.12.6 procedure
* align zh, update images
* test fix
* adjustments for new release
* update version check cmd
* docs: Adjust table row display (#3691)
* fix row display
* test
* test new table line fix
* remove manual br
* refactor(app-service): make the app state machine testable via dependency seams (#3699)
* fix: third-level, third-party conflict check
* chore(appservice): update image version to 0.6.7
* refactor(app-service): make the app state machine testable via dependency seams
Introduce a `Deps` dependency-injection container in pkg/appstate so every
external boundary of the ApplicationManager state machine can be faked. This
unblocks unit/integration testing of the install/upgrade/cancel lifecycle
without a live cluster, and formalizes the cancel message/reason vocabulary.
State machine / DI:
- Add pkg/appstate/deps.go with a `Deps` struct and seams for helm
(HelmOpsFactory), kubeconfig, kubeblocks middleware ops, image manager,
image-ref resolution, expose-port assignment, install validation, IsAdmin,
and the Pending->Downloading concurrency gate (DownloadingCounter).
Production wires the real implementations via NewDeps/DefaultDeps; tests
inject fakes.
- Centralize dependency injection in statefulAppFactory.New (depsSetter /
setDeps in types.go) instead of each constructor populating its own struct.
- Thread Deps through the controller: add ApplicationManagerController.Deps,
pass it in load.go, and wire DefaultDeps in cmd/app-service/main.go.
Cancel semantics:
- Give reconcile-timeout cancels and handler-driven (?type=) user cancels a
consistent (Message, Reason) tuple. Add cancelStatus() in
handler_installer_cancel.go and the corresponding *CanceledBy* /
*CancelBy* constants in pkg/constants, and preserve the reason forward
into the subsequent Stopping state.
- Emit a stable Reason on ApplyingEnv and related handler-published events.
State transitions:
- Formalize the declared state transitions, allowed op transitions, cancel
lineages, and per-state operation timeouts in state_transition.go.
Tests:
- Add a golden, lineage-driven state-flow test (controllers/
state_flow_lineages_test.go) rendering the full pushed-message payload to
state_flow_pushed_messages.html and comparing byte-for-byte.
- Add controllers/appmgr_controller_integration_test.go and a broad set of
appstate unit tests (download, install, initializing, uninstall,
suspend/resume, force-delete, factory concurrency, update-status), plus
shared test utilities and seam helpers.
- Promote go-difflib to a direct dependency for readable golden diffs.
* fix(cli): support installation on Ubuntu 26 (#3696)
* feat(cli): add doctor thirdleveldomain conflict check (#3697)
Add `olares-cli doctor thirdleveldomain` to audit per-user
customDomain.third_level_domain values via kubeconfig, flagging
duplicate prefixes within a user zone and reserved names
(auth/desktop/wizard). `--force-dedupe` keeps one duplicate per zone,
clears the rest, and clears reserved names by writing the Application
CRs (shared apps via per-user overlay, per-user apps via Spec.Settings).
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: fix get-started snippet links and restyle GPU passthrough tutorial (#3700)
* docs: fix get-started snippet links and restyle GPU passthrough tutorial
- Add 6 get-started snippet files to srcExclude
- Update manage-team activation links to join-olares
- Rewrite EN/ZH GPU passthrough tutorial for style guide compliance
- Reuse install-and-activate/log-in snippets via @include
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix duplicate titles
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(docs): add organization schema to VitePress config (#3703)
Incorporated structured data for the Olares organization into the VitePress configuration. This includes details such as the organization's name, URL, logo, and social media links, enhancing SEO and providing better context for search engines.
* docs: rewrite "Connect AI apps" guide to align with v1.12.6+ architecture (#3688)
* initial draft
* second batch input
* update description and examples
* add ZH version for both legacy and new topics
* refine description
* opt image sizes
* add more info on entrances
* add version tag
* update prepackaged model apps amount
* rewrite
* rewrite topic
* Add ZH version
* align objectives
* remove Legacy topics
* rename new topics to reuse existing file names
* fix nav
* fix link
* opt subtitles
* edits for consistency
* address comment
* market: fix cloning/version handling and restore app metadata fields (#3704)
* fix(download-server): add download_status to inspect, improve file accuracy (#3705)
download server
---------
Co-authored-by: yyh <24493052+yongheng2016@users.noreply.github.com>
Co-authored-by: hys <hysyeah@gmail.com>
Co-authored-by: Yajing <110797546+fnalways@users.noreply.github.com>
Co-authored-by: simon <89775922+kaki-admin@users.noreply.github.com>
Co-authored-by: Power-One-2025 <zhengchunhong@bytetrade.io>
Co-authored-by: wiy <guojianmin@bytetrade.io>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: aby913 <aby913@163.com>
Co-authored-by: berg <2433219116@qq.com>
Co-authored-by: dkeven <82354774+dkeven@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Revert "chore(merge): merge main into release-prepare-1.12.8" (#3716)
Revert "chore(merge): merge main into release-prepare-1.12.8 (#3709)"
This reverts commit e811820c6591be5332ee44c81fa2ec7da5fcf6ec.
* feat(app-gateway): install Linkerd foundation (#3718)
* docs: enhance sitemap handling by adding noindex for specific routes and redirect sources (#3679)
- Implemented normalization for routes to improve sitemap comparisons.
- Added logic to exclude URLs that redirect from the sitemap to optimize crawl budget.
- Introduced a pattern to noindex low-value reference pages in both English and Chinese locales.
* revert(app-gateway): drop Linkerd foundation from main onto release-prepare-1.12.8 (#3677)
* Revert "feat(app-gateway): install Linkerd foundation without traffic cutover (#3632)"
This reverts commit 23b583b43e75ddc07dff42ebdb99102c60a20f5a.
* Revert " feat(app-service): inject gpu.intel.com/i915 for intel compute mode (#3648)"
This reverts commit f05ffccfabe54ba593b0f176a4d019385d42000a.
* fix: stop fanning out shared apps per user in allUsersApps
* fix: checkappname test
* fix: appupgrade add cluster capacity check
installing to installFailed
app settings market-source
remove patched gpu limits if an app removed gpu required
* fix: cleanup return
* fix: make webhook listen before mgr controller
* fix: sync opertion block reconcile
* fix: sharedentranceid
* fix: shared entrance id for v2
* feat: inject gpu.intel.com/i915 for intel compute mode
* chore(appservice): update image version to 0.6.2
* fix: limit intel type to i915
---------
Co-authored-by: hys <hysyeah@gmail.com>
* docs: batch on-page SEO cleanup (#3680)
* update on-page content based on SEO audits
* fix on-page multiple h1 titles
* add missing translation
* remove or noindex orphan pages
* fix duplicate title tags
* update redirects based on comments
* remove studio files
* fix(download-server): update ytdlp url (#3673)
ytdlp move to ytdlpv3 ns
* docs: Modify parameters for recommended vLLM model (#3681)
edits for parameters accuracy
* docs: offline merchant app related content (#3676)
offline merchant app related content
* fix(appservice): third-level, third-party conflict check (#3682)
* fix: third-level, third-party conflict check
* chore(appservice): update image version to 0.6.7
* chore(user-service): bump image to v0.1.3 (#3684)
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: fix meta title and description length (#3683)
fix meta title and description titles
* market: fix treat cancel with no active install task as success (#3685)
Co-authored-by: admin <>
* docs: enhance Open Graph and Twitter meta tags for improved SEO (#3689)
Added comprehensive Open Graph and Twitter meta tags to enhance social sharing and SEO. Included localized site names, descriptions, and a default image for better representation across platforms. Introduced a new Open Graph image asset for consistent branding.
* helm-charts: register download provider service and RBAC, bump system-frontend & user-service images (#3690)
feat(helm-charts): add download provider service and role bindings
- Introduced new ClusterRole and ClusterRoleBinding for download provider service.
- Added Service definition for download with ClusterIP configuration.
- Updated olares-app.yaml to use the latest images for system-frontend and user-service.
* fix(cli): make generation of etcd certs idempotent by config check (#3687)
* market: optimize startup caching, tighten upload auth (#3694)
market: optimize startup caching, tighten upload auth, and filter AppleDouble metadata
* feat(cli): migrate node identity on hostname change during change-ip (#3693)
* feat(cli): migrate node identity on hostname change during change-ip
A machine hostname change makes the kubelet register a brand-new
Kubernetes node under the new name and abandon the old one. Recovering
is complex: the workloads must be rebuilt on the new node, and a lot of
per-node state (node metadata, node-local storage, GPU allocations)
still points at the old node and has to be migrated first.
change-ip now handles this. It detects a hostname change by matching the
machine's machine-id and system UUID against the registered nodes (after
lowercasing the hostname), and then:
- restores the node labels/annotations Olares owns (GPU labels, worker
role, GPU share-mode) onto the newly registered node;
- migrates the app-service GPU allocation store and share-mode keys,
rewriting the old node name in node-scoped device ids while leaving
stable GPU UUIDs untouched;
- removes node-local PersistentVolumes bound to the old node and deletes
the stale node object;
- waits for the old node to drain and its workloads to come back ready
on the new node.
When the hostname is unchanged, change-ip behaves exactly as before.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli): address bugbot review on hostname-change migration
- Readiness: after a hostname change, check pod readiness cluster-wide
instead of scoping to the new node. A new-node-scoped check skips
unscheduled Pending replacements (empty NodeName), so it could pass
before the migrated workloads actually reschedule and become ready.
- GPU allocations: only rewrite rows whose nodeName is the old node.
The deviceId rewrite is a "<oldNode>-" prefix match, so rewriting
every row could corrupt a different node's non-HAMI device id when its
name shares that prefix. Scope the rewrite (nodeName and deviceId) to
the migrated node's rows only, and cover it with a regression test.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: remove Ornith-1.0-35B (llama.cpp) (#3695)
officially offline model
* docs: update Activate Olares using Olares CLI for Olares v1.12.6 (#3651)
* update steps to cover 1.12.6 procedure
* align zh, update images
* test fix
* adjustments for new release
* update version check cmd
* docs: Adjust table row display (#3691)
* fix row display
* test
* test new table line fix
* remove manual br
* refactor(app-service): make the app state machine testable via dependency seams (#3699)
* fix: third-level, third-party conflict check
* chore(appservice): update image version to 0.6.7
* refactor(app-service): make the app state machine testable via dependency seams
Introduce a `Deps` dependency-injection container in pkg/appstate so every
external boundary of the ApplicationManager state machine can be faked. This
unblocks unit/integration testing of the install/upgrade/cancel lifecycle
without a live cluster, and formalizes the cancel message/reason vocabulary.
State machine / DI:
- Add pkg/appstate/deps.go with a `Deps` struct and seams for helm
(HelmOpsFactory), kubeconfig, kubeblocks middleware ops, image manager,
image-ref resolution, expose-port assignment, install validation, IsAdmin,
and the Pending->Downloading concurrency gate (DownloadingCounter).
Production wires the real implementations via NewDeps/DefaultDeps; tests
inject fakes.
- Centralize dependency injection in statefulAppFactory.New (depsSetter /
setDeps in types.go) instead of each constructor populating its own struct.
- Thread Deps through the controller: add ApplicationManagerController.Deps,
pass it in load.go, and wire DefaultDeps in cmd/app-service/main.go.
Cancel semantics:
- Give reconcile-timeout cancels and handler-driven (?type=) user cancels a
consistent (Message, Reason) tuple. Add cancelStatus() in
handler_installer_cancel.go and the corresponding *CanceledBy* /
*CancelBy* constants in pkg/constants, and preserve the reason forward
into the subsequent Stopping state.
- Emit a stable Reason on ApplyingEnv and related handler-published events.
State transitions:
- Formalize the declared state transitions, allowed op transitions, cancel
lineages, and per-state operation timeouts in state_transition.go.
Tests:
- Add a golden, lineage-driven state-flow test (controllers/
state_flow_lineages_test.go) rendering the full pushed-message payload to
state_flow_pushed_messages.html and comparing byte-for-byte.
- Add controllers/appmgr_controller_integration_test.go and a broad set of
appstate unit tests (download, install, initializing, uninstall,
suspend/resume, force-delete, factory concurrency, update-status), plus
shared test utilities and seam helpers.
- Promote go-difflib to a direct dependency for readable golden diffs.
* fix(cli): support installation on Ubuntu 26 (#3696)
* feat(cli): add doctor thirdleveldomain conflict check (#3697)
Add `olares-cli doctor thirdleveldomain` to audit per-user
customDomain.third_level_domain values via kubeconfig, flagging
duplicate prefixes within a user zone and reserved names
(auth/desktop/wizard). `--force-dedupe` keeps one duplicate per zone,
clears the rest, and clears reserved names by writing the Application
CRs (shared apps via per-user overlay, per-user apps via Spec.Settings).
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: fix get-started snippet links and restyle GPU passthrough tutorial (#3700)
* docs: fix get-started snippet links and restyle GPU passthrough tutorial
- Add 6 get-started snippet files to srcExclude
- Update manage-team activation links to join-olares
- Rewrite EN/ZH GPU passthrough tutorial for style guide compliance
- Reuse install-and-activate/log-in snippets via @include
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix duplicate titles
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(docs): add organization schema to VitePress config (#3703)
Incorporated structured data for the Olares organization into the VitePress configuration. This includes details such as the organization's name, URL, logo, and social media links, enhancing SEO and providing better context for search engines.
* docs: rewrite "Connect AI apps" guide to align with v1.12.6+ architecture (#3688)
* initial draft
* second batch input
* update description and examples
* add ZH version for both legacy and new topics
* refine description
* opt image sizes
* add more info on entrances
* add version tag
* update prepackaged model apps amount
* rewrite
* rewrite topic
* Add ZH version
* align objectives
* remove Legacy topics
* rename new topics to reuse existing file names
* fix nav
* fix link
* opt subtitles
* edits for consistency
* address comment
* market: fix cloning/version handling and restore app metadata fields (#3704)
* fix(download-server): add download_status to inspect, improve file accuracy (#3705)
download server
* perf(daemon): trim per-tick intranet reload and steamheadless lookup (#3518)
* perf(daemon): trim per-tick intranet reload and steamheadless lookup
Two reductions in the 5s status loop:
- postWatch looked up the steamheadless deployment by listing every
deployment in the cluster and deserializing it each tick; use a
metadata.name field selector so the apiserver returns just that one.
- The intranet ApplicationWatcher re-ran DNS SetHosts/StartAll and the DSR
reconfigure on every tick. Hash the computed ServerOptions and skip the
Reload when it is identical to the last applied config; reset the cached
signature when the server is stopped or recreated.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): cache entrance URLs and drop per-tick IAM client
GetApplicationUrlAll ran every status tick, building a fresh IAM REST/TLS
client and issuing per-app GetUserZone/GenEntranceURL API calls. Read the
owner zone from the listed users' annotations instead of an IAM client,
and skip the whole recompute via an apps+users resourceVersion signature
cache, returning the cached URLs when nothing changed.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): run first intranet Reload after Start to configure DSR
Start only brings up the DNS/proxy/DSR goroutines; the DSR backend, VIP
and reconfigure are applied by Reload. Setting lastAppliedSig right after
Start made the next tick treat the server as fully configured and skip the
first Reload, leaving intranet DSR misconfigured on Linux.
Leave lastAppliedSig empty after Start so the next tick performs that
first Reload, then records the signature for subsequent no-op skips.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): do not cache partial application URL results
GetApplicationUrlAll stored the signature and URL slice even when some apps
failed GenEntranceURL/BatchGenSharedAppEntranceURL and were skipped, so
later ticks with unchanged resourceVersions returned the incomplete list
and never retried the failing apps. Skip memoizing when any app errored and
return the best-effort result, letting the next tick recompute.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: clear host ip if no internal ip found
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: eball <liuy102@hotmail.com>
* perf(daemon): add shared informers and back pod reads with cache (#3520)
* perf(daemon): add shared informers and back pod reads with cache
olaresd had no informers and did a full cluster-wide Pods("").List +
deserialize on every 5s tick, at least twice (IsTerminusRunning and the
intranet DNS-pod lookup). Introduce a lazily-started shared informer factory
(pkg/utils/informers.go) with a pod lister, and route both pod reads through
utils.ListPods, which serves from the synced cache and falls back to a live
List while the cache warms up so cluster health is never misjudged. The
factory lifecycle is bound to the daemon's main context.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): make shared informers self-healing and observable
Rebuild the informer factory when the cached kube client is replaced
(e.g. after a kubeconfig change), stop the stale factory via a per-factory
context, log live-List fallbacks at debug verbosity, and document that
cache reads are eventually consistent.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): start shared informers once instead of per-client-identity
GetKubeClient builds a fresh clientset on every call, so comparing the
returned client against a cached pointer treated every informer read as a
kubeconfig change and canceled/recreated the factory on each ListPods call.
The pod cache never stayed synced and the daemon kept paying for repeated
watches plus cluster-wide live Lists.
Start the factory once for the process lifetime (it stops only when the
lifecycle context is canceled at shutdown). A kubeconfig change is handled
by an olaresd restart, so client-identity self-healing is unnecessary.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): back node, application and user reads with informers (#3521)
* perf(daemon): add shared informers and back pod reads with cache
olaresd had no informers and did a full cluster-wide Pods("").List +
deserialize on every 5s tick, at least twice (IsTerminusRunning and the
intranet DNS-pod lookup). Introduce a lazily-started shared informer factory
(pkg/utils/informers.go) with a pod lister, and route both pod reads through
utils.ListPods, which serves from the synced cache and falls back to a live
List while the cache warms up so cluster health is never misjudged. The
factory lifecycle is bound to the daemon's main context.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): make shared informers self-healing and observable
Rebuild the informer factory when the cached kube client is replaced
(e.g. after a kubeconfig change), stop the stale factory via a per-factory
context, log live-List fallbacks at debug verbosity, and document that
cache reads are eventually consistent.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): start shared informers once instead of per-client-identity
GetKubeClient builds a fresh clientset on every call, so comparing the
returned client against a cached pointer treated every informer read as a
kubeconfig change and canceled/recreated the factory on each ListPods call.
The pod cache never stayed synced and the daemon kept paying for repeated
watches plus cluster-wide live Lists.
Start the factory once for the process lifetime (it stops only when the
lifecycle context is canceled at shutdown). A kubeconfig change is handled
by an olaresd restart, so client-identity self-healing is unnecessary.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): back node, application and user reads with informers
Extend the shared informer layer with node (core), application (typed
beclab/api factory) and user (dynamic informer) caches, and route the
remaining per-tick cluster-wide Lists through them:
- GetThisNodeName / GetNodesPressure -> ListNodes
- ListUsers / IsTerminusInitialized -> listUsersRaw
- GetApplicationUrlAll -> ListApplications
Each accessor falls back to a live List until its cache has synced. Cached
applications are DeepCopied before GenEntranceURL mutates them, since the
informer serves shared read-only objects.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(daemon): clarify informer-backed reads are read-only
Note on ListUsers/IsTerminusInitialized/IsTerminusRunning that the client
argument is retained only for signature compatibility and that objects
returned from the cache are shared read-only references.
Co-authored-by: Cursor <cursoragent@cursor.com>
* refactor: remove dynamic client usage from user listing functions
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: eball <liuy102@hotmail.com>
* docs: consolidate Olares One software docs into manual, add SEO metadata, and version ISO links (#3711)
* delete software-feature duplicates from one
* batch update olares iso download link with version number
* docs: fix duplicate meta title tags and description (#3715)
fix duplicate meta title tags and description
* feat(app-gateway): add Linkerd foundation
* chore(gen): add app-gateway go.sum for linkerdpki deps
---------
Co-authored-by: yyh <24493052+yongheng2016@users.noreply.github.com>
Co-authored-by: hys <hysyeah@gmail.com>
Co-authored-by: Yajing <110797546+fnalways@users.noreply.github.com>
Co-authored-by: simon <89775922+kaki-admin@users.noreply.github.com>
Co-authored-by: Power-One-2025 <zhengchunhong@bytetrade.io>
Co-authored-by: wiy <guojianmin@bytetrade.io>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: aby913 <aby913@163.com>
Co-authored-by: berg <2433219116@qq.com>
Co-authored-by: dkeven <82354774+dkeven@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Peng Peng <billpengpeng@gmail.com>
Co-authored-by: eball <liuy102@hotmail.com>
* feat(app-service,app-gateway): Linkerd mesh auth for Shared in-cluster HTTP/HTTPS; skip envoy on Shared path (#3746)
* docs: enhance sitemap handling by adding noindex for specific routes and redirect sources (#3679)
- Implemented normalization for routes to improve sitemap comparisons.
- Added logic to exclude URLs that redirect from the sitemap to optimize crawl budget.
- Introduced a pattern to noindex low-value reference pages in both English and Chinese locales.
* revert(app-gateway): drop Linkerd foundation from main onto release-prepare-1.12.8 (#3677)
* Revert "feat(app-gateway): install Linkerd foundation without traffic cutover (#3632)"
This reverts commit 23b583b43e75ddc07dff42ebdb99102c60a20f5a.
* Revert " feat(app-service): inject gpu.intel.com/i915 for intel compute mode (#3648)"
This reverts commit f05ffccfabe54ba593b0f176a4d019385d42000a.
* fix: stop fanning out shared apps per user in allUsersApps
* fix: checkappname test
* fix: appupgrade add cluster capacity check
installing to installFailed
app settings market-source
remove patched gpu limits if an app removed gpu required
* fix: cleanup return
* fix: make webhook listen before mgr controller
* fix: sync opertion block reconcile
* fix: sharedentranceid
* fix: shared entrance id for v2
* feat: inject gpu.intel.com/i915 for intel compute mode
* chore(appservice): update image version to 0.6.2
* fix: limit intel type to i915
---------
Co-authored-by: hys <hysyeah@gmail.com>
* docs: batch on-page SEO cleanup (#3680)
* update on-page content based on SEO audits
* fix on-page multiple h1 titles
* add missing translation
* remove or noindex orphan pages
* fix duplicate title tags
* update redirects based on comments
* remove studio files
* fix(download-server): update ytdlp url (#3673)
ytdlp move to ytdlpv3 ns
* docs: Modify parameters for recommended vLLM model (#3681)
edits for parameters accuracy
* docs: offline merchant app related content (#3676)
offline merchant app related content
* fix(appservice): third-level, third-party conflict check (#3682)
* fix: third-level, third-party conflict check
* chore(appservice): update image version to 0.6.7
* chore(user-service): bump image to v0.1.3 (#3684)
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: fix meta title and description length (#3683)
fix meta title and description titles
* market: fix treat cancel with no active install task as success (#3685)
Co-authored-by: admin <>
* docs: enhance Open Graph and Twitter meta tags for improved SEO (#3689)
Added comprehensive Open Graph and Twitter meta tags to enhance social sharing and SEO. Included localized site names, descriptions, and a default image for better representation across platforms. Introduced a new Open Graph image asset for consistent branding.
* helm-charts: register download provider service and RBAC, bump system-frontend & user-service images (#3690)
feat(helm-charts): add download provider service and role bindings
- Introduced new ClusterRole and ClusterRoleBinding for download provider service.
- Added Service definition for download with ClusterIP configuration.
- Updated olares-app.yaml to use the latest images for system-frontend and user-service.
* fix(cli): make generation of etcd certs idempotent by config check (#3687)
* market: optimize startup caching, tighten upload auth (#3694)
market: optimize startup caching, tighten upload auth, and filter AppleDouble metadata
* feat(cli): migrate node identity on hostname change during change-ip (#3693)
* feat(cli): migrate node identity on hostname change during change-ip
A machine hostname change makes the kubelet register a brand-new
Kubernetes node under the new name and abandon the old one. Recovering
is complex: the workloads must be rebuilt on the new node, and a lot of
per-node state (node metadata, node-local storage, GPU allocations)
still points at the old node and has to be migrated first.
change-ip now handles this. It detects a hostname change by matching the
machine's machine-id and system UUID against the registered nodes (after
lowercasing the hostname), and then:
- restores the node labels/annotations Olares owns (GPU labels, worker
role, GPU share-mode) onto the newly registered node;
- migrates the app-service GPU allocation store and share-mode keys,
rewriting the old node name in node-scoped device ids while leaving
stable GPU UUIDs untouched;
- removes node-local PersistentVolumes bound to the old node and deletes
the stale node object;
- waits for the old node to drain and its workloads to come back ready
on the new node.
When the hostname is unchanged, change-ip behaves exactly as before.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli): address bugbot review on hostname-change migration
- Readiness: after a hostname change, check pod readiness cluster-wide
instead of scoping to the new node. A new-node-scoped check skips
unscheduled Pending replacements (empty NodeName), so it could pass
before the migrated workloads actually reschedule and become ready.
- GPU allocations: only rewrite rows whose nodeName is the old node.
The deviceId rewrite is a "<oldNode>-" prefix match, so rewriting
every row could corrupt a different node's non-HAMI device id when its
name shares that prefix. Scope the rewrite (nodeName and deviceId) to
the migrated node's rows only, and cover it with a regression test.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: remove Ornith-1.0-35B (llama.cpp) (#3695)
officially offline model
* docs: update Activate Olares using Olares CLI for Olares v1.12.6 (#3651)
* update steps to cover 1.12.6 procedure
* align zh, update images
* test fix
* adjustments for new release
* update version check cmd
* docs: Adjust table row display (#3691)
* fix row display
* test
* test new table line fix
* remove manual br
* refactor(app-service): make the app state machine testable via dependency seams (#3699)
* fix: third-level, third-party conflict check
* chore(appservice): update image version to 0.6.7
* refactor(app-service): make the app state machine testable via dependency seams
Introduce a `Deps` dependency-injection container in pkg/appstate so every
external boundary of the ApplicationManager state machine can be faked. This
unblocks unit/integration testing of the install/upgrade/cancel lifecycle
without a live cluster, and formalizes the cancel message/reason vocabulary.
State machine / DI:
- Add pkg/appstate/deps.go with a `Deps` struct and seams for helm
(HelmOpsFactory), kubeconfig, kubeblocks middleware ops, image manager,
image-ref resolution, expose-port assignment, install validation, IsAdmin,
and the Pending->Downloading concurrency gate (DownloadingCounter).
Production wires the real implementations via NewDeps/DefaultDeps; tests
inject fakes.
- Centralize dependency injection in statefulAppFactory.New (depsSetter /
setDeps in types.go) instead of each constructor populating its own struct.
- Thread Deps through the controller: add ApplicationManagerController.Deps,
pass it in load.go, and wire DefaultDeps in cmd/app-service/main.go.
Cancel semantics:
- Give reconcile-timeout cancels and handler-driven (?type=) user cancels a
consistent (Message, Reason) tuple. Add cancelStatus() in
handler_installer_cancel.go and the corresponding *CanceledBy* /
*CancelBy* constants in pkg/constants, and preserve the reason forward
into the subsequent Stopping state.
- Emit a stable Reason on ApplyingEnv and related handler-published events.
State transitions:
- Formalize the declared state transitions, allowed op transitions, cancel
lineages, and per-state operation timeouts in state_transition.go.
Tests:
- Add a golden, lineage-driven state-flow test (controllers/
state_flow_lineages_test.go) rendering the full pushed-message payload to
state_flow_pushed_messages.html and comparing byte-for-byte.
- Add controllers/appmgr_controller_integration_test.go and a broad set of
appstate unit tests (download, install, initializing, uninstall,
suspend/resume, force-delete, factory concurrency, update-status), plus
shared test utilities and seam helpers.
- Promote go-difflib to a direct dependency for readable golden diffs.
* fix(cli): support installation on Ubuntu 26 (#3696)
* feat(cli): add doctor thirdleveldomain conflict check (#3697)
Add `olares-cli doctor thirdleveldomain` to audit per-user
customDomain.third_level_domain values via kubeconfig, flagging
duplicate prefixes within a user zone and reserved names
(auth/desktop/wizard). `--force-dedupe` keeps one duplicate per zone,
clears the rest, and clears reserved names by writing the Application
CRs (shared apps via per-user overlay, per-user apps via Spec.Settings).
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs: fix get-started snippet links and restyle GPU passthrough tutorial (#3700)
* docs: fix get-started snippet links and restyle GPU passthrough tutorial
- Add 6 get-started snippet files to srcExclude
- Update manage-team activation links to join-olares
- Rewrite EN/ZH GPU passthrough tutorial for style guide compliance
- Reuse install-and-activate/log-in snippets via @include
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix duplicate titles
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(docs): add organization schema to VitePress config (#3703)
Incorporated structured data for the Olares organization into the VitePress configuration. This includes details such as the organization's name, URL, logo, and social media links, enhancing SEO and providing better context for search engines.
* docs: rewrite "Connect AI apps" guide to align with v1.12.6+ architecture (#3688)
* initial draft
* second batch input
* update description and examples
* add ZH version for both legacy and new topics
* refine description
* opt image sizes
* add more info on entrances
* add version tag
* update prepackaged model apps amount
* rewrite
* rewrite topic
* Add ZH version
* align objectives
* remove Legacy topics
* rename new topics to reuse existing file names
* fix nav
* fix link
* opt subtitles
* edits for consistency
* address comment
* market: fix cloning/version handling and restore app metadata fields (#3704)
* fix(download-server): add download_status to inspect, improve file accuracy (#3705)
download server
* perf(daemon): trim per-tick intranet reload and steamheadless lookup (#3518)
* perf(daemon): trim per-tick intranet reload and steamheadless lookup
Two reductions in the 5s status loop:
- postWatch looked up the steamheadless deployment by listing every
deployment in the cluster and deserializing it each tick; use a
metadata.name field selector so the apiserver returns just that one.
- The intranet ApplicationWatcher re-ran DNS SetHosts/StartAll and the DSR
reconfigure on every tick. Hash the computed ServerOptions and skip the
Reload when it is identical to the last applied config; reset the cached
signature when the server is stopped or recreated.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): cache entrance URLs and drop per-tick IAM client
GetApplicationUrlAll ran every status tick, building a fresh IAM REST/TLS
client and issuing per-app GetUserZone/GenEntranceURL API calls. Read the
owner zone from the listed users' annotations instead of an IAM client,
and skip the whole recompute via an apps+users resourceVersion signature
cache, returning the cached URLs when nothing changed.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): run first intranet Reload after Start to configure DSR
Start only brings up the DNS/proxy/DSR goroutines; the DSR backend, VIP
and reconfigure are applied by Reload. Setting lastAppliedSig right after
Start made the next tick treat the server as fully configured and skip the
first Reload, leaving intranet DSR misconfigured on Linux.
Leave lastAppliedSig empty after Start so the next tick performs that
first Reload, then records the signature for subsequent no-op skips.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): do not cache partial application URL results
GetApplicationUrlAll stored the signature and URL slice even when some apps
failed GenEntranceURL/BatchGenSharedAppEntranceURL and were skipped, so
later ticks with unchanged resourceVersions returned the incomplete list
and never retried the failing apps. Skip memoizing when any app errored and
return the best-effort result, letting the next tick recompute.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: clear host ip if no internal ip found
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: eball <liuy102@hotmail.com>
* perf(daemon): add shared informers and back pod reads with cache (#3520)
* perf(daemon): add shared informers and back pod reads with cache
olaresd had no informers and did a full cluster-wide Pods("").List +
deserialize on every 5s tick, at least twice (IsTerminusRunning and the
intranet DNS-pod lookup). Introduce a lazily-started shared informer factory
(pkg/utils/informers.go) with a pod lister, and route both pod reads through
utils.ListPods, which serves from the synced cache and falls back to a live
List while the cache warms up so cluster health is never misjudged. The
factory lifecycle is bound to the daemon's main context.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): make shared informers self-healing and observable
Rebuild the informer factory when the cached kube client is replaced
(e.g. after a kubeconfig change), stop the stale factory via a per-factory
context, log live-List fallbacks at debug verbosity, and document that
cache reads are eventually consistent.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): start shared informers once instead of per-client-identity
GetKubeClient builds a fresh clientset on every call, so comparing the
returned client against a cached pointer treated every informer read as a
kubeconfig change and canceled/recreated the factory on each ListPods call.
The pod cache never stayed synced and the daemon kept paying for repeated
watches plus cluster-wide live Lists.
Start the factory once for the process lifetime (it stops only when the
lifecycle context is canceled at shutdown). A kubeconfig change is handled
by an olaresd restart, so client-identity self-healing is unnecessary.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): back node, application and user reads with informers (#3521)
* perf(daemon): add shared informers and back pod reads with cache
olaresd had no informers and did a full cluster-wide Pods("").List +
deserialize on every 5s tick, at least twice (IsTerminusRunning and the
intranet DNS-pod lookup). Introduce a lazily-started shared informer factory
(pkg/utils/informers.go) with a pod lister, and route both pod reads through
utils.ListPods, which serves from the synced cache and falls back to a live
List while the cache warms up so cluster health is never misjudged. The
factory lifecycle is bound to the daemon's main context.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): make shared informers self-healing and observable
Rebuild the informer factory when the cached kube client is replaced
(e.g. after a kubeconfig change), stop the stale factory via a per-factory
context, log live-List fallbacks at debug verbosity, and document that
cache reads are eventually consistent.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(daemon): start shared informers once instead of per-client-identity
GetKubeClient builds a fresh clientset on every call, so comparing the
returned client against a cached pointer treated every informer read as a
kubeconfig change and canceled/recreated the factory on each ListPods call.
The pod cache never stayed synced and the daemon kept paying for repeated
watches plus cluster-wide live Lists.
Start the factory once for the process lifetime (it stops only when the
lifecycle context is canceled at shutdown). A kubeconfig change is handled
by an olaresd restart, so client-identity self-healing is unnecessary.
Co-authored-by: Cursor <cursoragent@cursor.com>
* perf(daemon): back node, application and user reads with informers
Extend the shared informer layer with node (core), application (typed
beclab/api factory) and user (dynamic informer) caches, and route the
remaining per-tick cluster-wide Lists through them:
- GetThisNodeName / GetNodesPressure -> ListNodes
- ListUsers / IsTerminusInitialized -> listUsersRaw
- GetApplicationUrlAll -> ListApplications
Each accessor falls back to a live List until its cache has synced. Cached
applications are DeepCopied before GenEntranceURL mutates them, since the
informer serves shared read-only objects.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(daemon): clarify informer-backed reads are read-only
Note on ListUsers/IsTerminusInitialized/IsTerminusRunning that the client
argument is retained only for signature compatibility and that objects
returned from the cache are shared read-only references.
Co-authored-by: Cursor <cursoragent@cursor.com>
* refactor: remove dynamic client usage from user listing functions
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: eball <liuy102@hotmail.com>
* docs: consolidate Olares One software docs into manual, add SEO metadata, and version ISO links (#3711)
* delete software-feature duplicates from one
* batch update olares iso download link with version number
* docs: fix duplicate meta title tags and description (#3715)
fix duplicate meta title tags and description
* feat: upgrade search3 to v0.3.5 (#3710)
Co-authored-by: ubuntu <you@example.com>
* feat: files streaming recursive directory usage API (#3713)
* cli, framework/download-server: add olares knowledge download command suite (#3692)
* feat(download): implement download task management commands
Added a new `download` command subtree to manage download-server tasks, including creating, listing, pausing, resuming, canceling, and removing tasks. Introduced commands for inspecting URLs and setting user preferences for yt-dlp quality. This feature requires Olares version 1.12.7 or higher.
* fix(cli): nest download task centre under knowledge download
Avoid colliding with the installer top-level `download` command by
exposing the download-server task centre as `olares-cli knowledge download`.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(cli): surface quality/URL/HuggingFace rules in knowledge download help
Make the help output self-explanatory so users stop hitting avoidable
400s and shell-parsing errors:
- list the accepted --quality values (shared via a ytdlpQualityValues
constant so create/prefs stay in sync)
- warn that URLs with ?, & or = must be single-quoted for the shell
- document the default destination (drive/Home/Downloads/) and the
accepted --path formats, plus HuggingFace-specific path/name behaviour
- mirror these rules in the download-lifecycle skill reference
* feat(download): add file management commands and torrent inspection features
Introduced new commands for managing downloaded files, including:
- `file exists`: Pre-checks if a URL download would collide at the destination.
- `file check`: Verifies if a downloaded file exists on the PVC.
- `file remove`: Deletes a specified file from the PVC.
Additionally, added torrent inspection capabilities with commands for:
- `torrent inspect`: Inspects a local .torrent file and retrieves metadata.
- `torrent stats`: Displays live BitTorrent statistics for a task.
- `torrent peers`: Lists connected BitTorrent peers.
- `torrent files`: Allows selection of files from a multi-file torrent.
Updated the CLI help documentation to reflect these changes and ensure clarity for users.
* downloadRecordToFilesUrl
* refactor(settings): streamline download-server settings management
Updated the CLI to focus on a single global setting, `aria2_max_concurrent`, for the download-server. The `set` command now requires only this parameter, and the request structure has been simplified to send a single key/value pair. Adjusted related tests and documentation to reflect these changes, ensuring clarity and consistency in usage.
* refactor(cookies): hide cookies command due to production limitations
Updated the `cookies` command to be hidden in the CLI, as the production integration provider only supports the `retrieve` endpoint, while `list`, `set`, `delete`, and `health` return 404. Documentation has been adjusted to clarify the command's functionality and its limitations in a production environment.
* feat(sync): enhance sync command with composite cursor support
Updated the sync command to utilize a composite cursor based on (updated_at, id) for incremental pulls. Introduced the --since and --since-id flags for more precise control over task retrieval, allowing users to fetch tasks updated after a specific timestamp or with a specific ID. Adjusted the response structure to reflect the new cursor mechanism and added comprehensive documentation to clarify usage.
Additionally, refactored related functions and tests to ensure consistency and reliability in the sync process.
* feat(download): add normalization and validation for --select-files flag
Introduced a new function, normalizeSelectFiles, to validate and normalize the --select-files input into a CSV format for the extra.selected_files parameter. This enhancement ensures that invalid tokens (0, negatives, non-integers) are rejected locally, improving user experience by preventing unnecessary server errors. Additionally, updated related documentation to clarify the behavior of the --select-files flag and its integration with the download command.
* fix(download): add JSON tags to CookieListResult fields
Updated the CookieListResult struct in types.go to include JSON tags for the List and Total fields, ensuring proper serialization and deserialization when interacting with the API.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* olares: bump system-frontend image to v1.11.12 (#3719)
Bump the olares-app-init (system-frontend) image from v1.11.9 to
v1.11.12, shipping the file-manager changes from beclab/TermiPass#1300
and beclab/TermiPass#1299.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: fix highlight and sort order (#3720)
* feat: upgrade search3 to v0.3.5
* fix: fix highlight and order problem
* feat: search3 upgrade to v0.3.7
---------
Co-authored-by: ubuntu <you@example.com>
* fix(download-server): detect aria2 completions past the 200-row stopped window (#3721)
download
* feat(daemon): atomic overlay gateway enable for stable node switching (#3724)
* feat(daemon): atomic overlay bridge switch with NM checkpoint
* fix(daemon): raise overlay bridge ready timeout to 90s
* fix(daemon): harden overlay bridge checkpoint destroy on commit failure
* fix(daemon): drop sh -c and symmetrize overlay gateway disable handler
* test(daemon): cover bridge MAC argv, destroy fail, and activate steps
* fix(daemon): log overlay bridge and gateway enable/disable errors
* fix(daemon): return error when NM list fails on bridge reset
* notifications: bump notifications-api image to v1.12.43 (#3723)
Bump the notifications-api image from v1.12.42 to v1.12.43, shipping the
i18n copy polish and additional localizations from beclab/notifications#22.
Co-authored-by: Cursor <cursoragent@cursor.com>
* olares: bump system-frontend to v1.11.13 and user-service to v0.1.5 (#3726)
Bump the olares-app-init (system-frontend) image from v1.11.12 to
v1.11.13 and the user-service image from v0.1.4 to v0.1.5.
Co-authored-by: qq815776412 <815776412@qq.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(comfyui): add extra_model_paths.yaml guidance and v3 directory structure (#3707)
* docs(comfyui): add extra_model_paths.yaml and v3 directory structure
- Update Access file locations table to v3 paths (/Data and /Common)
- Fix model directory structure: checkpoints/ instead of main/
- Fix extra_model_paths.yaml: base_path only, no custom_nodes_path
- Add troubleshooting: workflow cannot find models in /Common
- Update all External/olares/ai references to new paths
- Add tip for 1.12.5 users with legacy External/ paths
- Update both EN and ZH docs
* docs(comfyui): expand troubleshooting for models not recognized in /Common
- Add two-cause distinction (subdirectory not registered vs node path mismatch)
- Add subdirectory mapping examples (detection, ultralytics_bbox)
- Reference ImpactPack/UltralyticsDetectorProvider case study
- Show confirmation via startup log entry
- Update both EN and ZH docs
* docs(comfyui): add screenshots for models not recognized troubleshooting
Add 8 screenshots from Feishu source doc:
- Model detected vs missing comparison
- extra_model_paths.yaml file view
- Adding detection subdirectory mapping
- Startup log confirming detection path added
- Model recognized after restart
- ultralytics_bbox custom node path mapping
- face_yolov8m.pt finally recognized
EN and ZH common-issues docs updated with same screenshots.
* fix img path in cn and refine wording
* fix description
* refactored extra_model_paths related sections
---------
Co-authored-by: Haro <haro@olares.com>
Co-authored-by: Meow33 <supermonkey03@163.com>
* chore(app-service): add mesh-in/mesh-out agent Hub publish workflows (#3731)
* docs: align Olares overview pages with the latest positioning (#3730)
update Olares intro
* docs: update Jellyfin plugin installation steps (#3714)
update steps for plugin installation
* docs: update readme (#3708)
* update readme with the latest positioning
* refine wording and structure
* add video and refine wording
* fix video
* refine wording and add zh&jp versions
* fix(daemon): disarm leftover NM checkpoint after overlay-bridge rollback failure (#3727)
fix(daemon): disarm leftover NM checkpoint after rollback failure
* fix(daemon): require auth on registry mirrors and harden chpasswd (#3728)
Co-authored-by: Cursor <cursoragent@cursor.com>
* olares: bump system-frontend to v1.11.14 (#3733)
olares: bump system-frontend to v1.11.14 (#3732)
Update the olares-app-init image from v1.11.13 to v1.11.14.
* update hardware acceleration and file path
* fix(GPU): avoid NVML error in container caused by systemd reload (#3735)
* cli/market: gate resume cancel on Olares 1.12.7 and fix resume watch on stopped (#3740)
feat(cli): gate resume cancel on Olares 1.12.7 and fix resume watch on stopped
Align market cancel with the Termipass 1.12.7 resume-cancel UX by fail-closed
version gating when cancelling a resuming app. Fix watchResume hanging when a
resume is cancelled and settles at stopped via a baseline-gated terminal state.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(appservice): preserve app settings and align scheduling and upgrades (#3742)
* chore(appservice): update image version to 0.6.8
* fix(app-service): pick helm values reuse mode per Upgrade/Scale/ApplyEnv (#3717)
Upgrade uses ResetThenReuseValues so chart default changes (image/template) are absorbed; Scale and ApplyEnv keep ReuseValues to avoid unintended chart updates.
* refactor(appservice): parse new format of containerd mirror config
* refactor(app-service): store entrance/settings edits as read-time overlays
Base Spec.Entrances now follows chart truth (the deployment annotation)
directly instead of being merged in updateApplication; user edits live in
Spec.Settings (non-shared) or Spec.UserSettings (shared) and are layered at
read time via EffectiveEntrances/EffectiveSettings, so they survive redeploys.
- Drop mergeEntrances / mergePolicySettings and their tests; updateApplication
assigns entrances from chart truth and only refreshes the chart-derived base
policy for shared apps. For non-shared apps Spec.Settings["policy"] is the
user-owned slot, so it is no longer overwritten on redeploy (fixes user
policy being reverted after every deployment).
- Add overridePatch helper to centralize writing overrides into the correct
slot (Spec.UserSettings[caller] for shared, Spec.Settings for non-shared) and
use it across the authLevel / policy / customDomain handlers.
- Validate entrance names against EffectiveEntrances so proxylistener-managed
"dev-<port>" entrances (which live only in the addedEntrances overlay) are
accepted; fixes authLevel edits on newly added dev entrances not applying.
- Reject custom third_party_domain / third_level_domain on dev-type entrances,
which are reached directly by pod IP and cannot own a custom domain.
- apps / allUsersApps list responses now return EffectiveEntrances.
- Add EntranceTypeDev constant.
- Fix Intel GPU resource mapping: i915 becomes IntelIGPU and IntelGPU is now
gpu.intel.com/xe; map IntelType / IntelGPUType accordingly in the webhook.
- Bump beclab/api dependency.
* fix(appservice): avoid mark pods created before rebooting as pending timeout
* fix(appservice): unify mem reserve of timeslice both in install and resume
* chore(appservice): update image version to 0.6.9
---------
Co-authored-by: hys <hysyeah@gmail.com>
* market: add llm-gateway adaptor API surface, add lldap, market provider (#3743)
* market: add llm-gateway adaptor API surface, add lldap, market provider
* fix: modify secret key
* fix(daemon): rebuild informers when kubeconfig or hosts change (#3744)
Invalidate shared informers together with cached k8s clients so olaresd
does not keep serving a stale cache after IP or cert rotation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* olares: bump system-frontend to v1.11.15 and user-service to v0.1.6 (#3745)
Bump the bundled system application images to their latest releases:
- beclab/system-frontend (TermiPass): v1.11.14 -> v1.11.15
- beclab/user-service: v0.1.5 -> v0.1.6
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(oac): validate service port manifests
Reject malformed or ambiguous ports before install so invalid protocols, missing routing fields, and duplicate names cannot reach expose-port allocation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli): align version gates, chart scaffolding, and skills (#3750)
* fix(cli): use profile refresh for version gates
Point unsupported command trees to the real cached-version recovery flow and cover the knowledge download gate at Olares 1.12.7.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(skills): align routing and command guidance
Keep the skill suite consistent with current CLI behavior, Market's embedded DCR, and the supported profile-version recovery path.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(chart): emit v3 manifests from compose
Make fresh scaffolds match the supported Olares 1.12.6 baseline and lock generator, lint, and skill guidance to one canonical manifest shape.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(cli): align chart lint security check help
Reflect that OAC enables the non-beclab securityContext check by default so the CLI no longer advertises a misleading opt-in behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(skills): clarify chart runtime identity and diagnosis
Document root-init PUID/PGID images according to the actual webhook and OPA behavior, and require parallel pod diagnosis to avoid passive install waits.
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(skills): clarify LLM serving routes
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(skills): clarify LLM memory modes
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(skills): align LLM version floor
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(market): correct clone help contracts
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(skills): clarify runtime and embedding constraints
Co-authored-by: Cursor <cursoragent@cursor.com>
* chore: ignore local planning artifacts
Co-authored-by: Cursor <cursoragent@cursor.com>
* docs(skills): normalize upload source flag
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* Update docs/use-cases/jellyfin.md
Co-authored-by: Meow33 <panpanswork@gmail.com>
* Update docs/use-cases/jellyfin.md
Co-authored-by: Meow33 <panpanswork@gmail.com>
* Update docs/use-cases/jellyfin.md
Co-authored-by: Meow33 <panpanswork@gmail.com>
* Apply suggestions from code review
Co-authored-by: Meow33 <panpanswork@gmail.com>
* Update docs/use-cases/jellyfin.md
* Apply suggestions from code review
Co-authored-by: Meow33 <panpanswork@gmail.com>
* Apply suggestions from code review
Co-authored-by: Meow33 <panpanswork@gmail.com>
* fix(cli): clear iptable rules completely (#3747)
* files: Common support SMB share (#3749)
* fix(image-service): parse new version of containerd mirror config (#3751)
* chore(appservice): update module and ci dependencies
* fix(image-service): parse new version of containerd mirror config
* feat(l4): add support for dev entrance (#3754)
* feat: add support for dev entrance
* fix(translator): order node-scoped file routes before master catch-all
Emit all fileserver node-scoped routes before the master node's generic
catch-all prefixes. Previously the master's /api/resources/external/ was
placed ahead of worker nodes' /api/resources/external/<node>/ routes, so
Envoy's first-match-wins swallowed the request and misrouted it to the
master node. Split route generation into two passes so more specific
node routes always take precedence. Add a regression test.
* update l4 image tag to v0.3.38
* feat(cli): distinguish Intel iGPU/dGPU and install discrete GPU drivers (#3755)
Detect Intel integrated vs discrete GPUs from PCI topology and drive
per-kind node labeling, kernel checks, and discrete-GPU driver install.
- connector: rework Intel detection to enumerate display-class PCI
devices (IntelGPU{ID,Discrete}) via sysfs, classifying integrated vs
discrete by whether the device hangs off the root complex; expose
HasIntelIGPU/HasIntelDGPU on top of it.
- connector: add IntelGPUMinKernel, a lookup of the minimum supported
kernel per PCI id built from Intel's i915/xe driver support tables
(Initial vs Full support rule, Out-of-tree handling), with tests, and
a KernelVersion type comparing via Masterminds/semver.
- connector: add ParseKernelVersion, GetOsKernel(), IsIntelDGPU() and the
CpuInfo.IsIntelDGPU system-info flag.
- intelgpu: label the node by device kind (intel for iGPU, intel-gpu for
dGPU) regardless of kernel/Out-of-tree; warn and skip driver packages
when a device is unknown, Out-of-tree, or below its minimum kernel.
- intelgpu: install the discrete-GPU stack (intel-omix from the Intel GPU
repository, noble only) when a qualifying dGPU is present; clean up any
leftover kobuk-team/intel-graphics PPA and use --allow-downgrades with a
purge-and-retry fallback to resolve conflicting compute l…