From 753fd6f019364ad96cdf1756d9fa90d3a608b81d Mon Sep 17 00:00:00 2001 From: imneov Date: Thu, 22 Oct 2026 03:40:24 -0700 Subject: [PATCH] fix(helm): bundle swiss 0.7.0 for catalog schema v2 and writable catalogs The chart pinned the swiss subchart at 0.6.3, which predates catalog schema v2 and the site profile's schemaVersion/writable fields. The 0.2.x Model Serving pages offer both, so with a bundled swiss the Model Library could not list a v2 catalog or save a writable one. 0.7.0 also vendors catalog-server, so a site whose own catalog is a read-only static index can add a writable catalog and use the Model Library to add models. The chart README documents enabling it and naming it in the site profile. Fixes #90 --- CHANGELOG.md | 6 +++++ docs/console-design.md | 2 ++ helm/console/Chart.lock | 6 ++--- helm/console/Chart.yaml | 2 +- helm/console/README.md | 45 ++++++++++++++++++++++++++++++++++-- helm/console/README.zh-CN.md | 44 +++++++++++++++++++++++++++++++++-- helm/console/values.yaml | 7 ++++++ 7 files changed, 104 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c9c19fe..514677c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ chart's `appVersion`; the image and chart are released together under it. ## [Unreleased] +### Added +- The chart can install a writable catalog — the swiss chart's catalog-server, swiss 0.7.0+; named in the site profile, it lets the Model Library add models even when the site's own catalog is a read-only static index (#90). + +### Changed +- The swiss subchart is 0.7.0 (was 0.6.3). 0.6.3 predates catalog schema v2 and the site profile's `schemaVersion`/`writable`, so with a bundled swiss the Model Library could not read a v2 catalog or save one (#90). + ### Fixed - Overlay panels keep their edge. The site-wide "no focus ring" rule zeroed the `ring-1` that draws the border of menus, popovers, selects, comboboxes and dialogs, so an open white panel on the white page showed only a faint shadow — the top-bar avatar menu read as a line of text floating under the header. - The top-bar avatar menu names the signed-in user — avatar, name, role and, when console has one to read, the email — instead of a single `name · role` line. With `server.auth.disabled` the user button itself turns amber and the avatar carries a dot, so the state shows without opening anything and the bar gains no element; the menu carries 登录已关闭，当前为管理员身份 (*Sign-in off — acting as the administrator*) in place of change-password and sign-out, which that mode cannot honour. diff --git a/docs/console-design.md b/docs/console-design.md index 6188caf..f4fdad0 100644 --- a/docs/console-design.md +++ b/docs/console-design.md @@ -496,6 +496,8 @@ Console adds nothing to the path. | New model | **New model** in the library toolbar, with fields for its name and first variant id that write into both files: `metadata.yaml` and a first variant copied from one the catalog has, in one commit (catalog-server's `POST models`); the page then opens the new model | | Freshness | swissd drops its cached index on a write, so the page refetches and shows the commit | +Console owns no catalog storage and publishes no index of its own. A writable catalog is a catalog-server the site profile names; an install whose own catalog is a static index gets one from the swiss chart, which vendors catalog-server since 0.7.0 (`swiss.catalogServer`; the chart README covers enabling it, its token, and the profile entry). A console-hosted catalog was rejected: it would duplicate catalog-server's repository and write API, and its publication would be deprecated schema v1, which the LLMSvc backend cannot deploy. + ## Playground The Playground is chat against the inference gateway, for the question a diff --git a/helm/console/Chart.lock b/helm/console/Chart.lock index a82ce2e..f2151cc 100644 --- a/helm/console/Chart.lock +++ b/helm/console/Chart.lock @@ -1,6 +1,6 @@ dependencies: - name: swiss repository: oci://ghcr.io/modelsphere/charts - version: 0.6.3 -digest: sha256:d7d5f29c782c8b3106d2717e989ef799e48cb5a874fdef689cf392ca531db3e7 -generated: "2026-10-08T13:00:31.898408+08:00" + version: 0.7.0 +digest: sha256:6d03b121a65a1a38f0422d09b50679a7d671b1b32a14885309da7b8531180c1c +generated: "2026-10-22T03:37:03.797449782-07:00" diff --git a/helm/console/Chart.yaml b/helm/console/Chart.yaml index 27dab37..ba3ad1f 100644 --- a/helm/console/Chart.yaml +++ b/helm/console/Chart.yaml @@ -12,6 +12,6 @@ keywords: [console, llm, inference, portal] # render this chart until it has run, even with swiss.enabled off. dependencies: - name: swiss - version: 0.6.3 # always use a stable version + version: 0.7.0 # always use a stable version repository: oci://ghcr.io/modelsphere/charts condition: swiss.enabled diff --git a/helm/console/README.md b/helm/console/README.md index 7bbea9a..9bb3c48 100644 --- a/helm/console/README.md +++ b/helm/console/README.md @@ -56,7 +56,7 @@ Builds from `main` need the full version. **Do not use `--devel` to get the "lat | Helm runs with cluster-admin rights | all | the chart creates IAM CRDs and a ClusterRole/ClusterRoleBinding (the platform-admin role has `*`, and Kubernetes only lets a user who already holds those rights create it); with Swiss it also creates Roles in other namespaces | `kubectl auth can-i '*' '*' --all-namespaces` prints `yes` | | linux/amd64 nodes | all | the image is amd64 only | `kubectl get nodes -L kubernetes.io/arch` | | nodes can reach `ghcr.io` | all | the Console image is on GHCR | — | -| Swiss chart 0.6.0 or later with `auth.proxyKey` on, or Swiss running with `auth.disabled=true` | existing Swiss | Console calls Swiss on behalf of the signed-in user with the proxyKey | see [Find Swiss and the gateway](#1-find-swiss-and-the-gateway) | +| Swiss chart 0.7.0 or later with `auth.proxyKey` on, or Swiss running with `auth.disabled=true` | existing Swiss | Console calls Swiss on behalf of the signed-in user with the proxyKey; 0.7.0 is also the first chart with catalog schema v2 and the site profile's `schemaVersion`/`writable` | see [Find Swiss and the gateway](#1-find-swiss-and-the-gateway) | | a Swiss site profile exists and `cluster.profile.key` is `profile.yaml` (the default) | existing Swiss | Console reads the gateway entrypoint from the profile, and only from the `profile.yaml` key; Swiss creates the profile the first time settings are saved in its UI | same as above | ## Connecting to an existing Swiss @@ -92,7 +92,7 @@ kubectl -n modelsphere create secret generic swiss-proxy-key --from-file=proxyKe rm proxyKey ``` -If the second command prints nothing, this Swiss has no proxyKey: upgrade the Swiss chart to 0.6.0 or later, or run it with `auth.disabled=true`. +If the second command prints nothing, this Swiss has no proxyKey: upgrade the Swiss chart to 0.7.0 or later, or run it with `auth.disabled=true`. ### 3. Write the values @@ -131,6 +131,47 @@ helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \ --wait --timeout 10m ``` +## Adding models from the Model Library + +Read-only catalogs are enough to deploy. **New model**, **Edit model**, **Add variant** and **Catalog settings** need a **writable** catalog: a catalog-server serving schema v2. A static `index.json` catalog stays read-only. + +| Your install | Where the writable catalog comes from | +|---|---| +| Swiss bundled (`swiss.enabled=true`) | the swiss chart's `catalogServer` (0.7.0+), enabled below | +| Existing Swiss (`externalSwiss`) | upgrade Swiss to chart 0.7.0, enable its `catalogServer`, or point swissd at any catalog-server it can reach | + +```bash +# The write token: catalog-server reads it from a Secret, and you enter the same +# value in the site profile below. Keep it out of values files. +TOKEN=$(openssl rand -hex 24) +printf -- '- name: console\n email: console@example.com\n token: %s\n' "$TOKEN" > tokens.yaml +kubectl -n modelsphere create secret generic console-catalog-tokens --from-file=tokens.yaml +rm tokens.yaml +printf 'Write token: %s\n' "$TOKEN" + +helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \ + --namespace modelsphere \ + --set swiss.enabled=true --set 'swiss.rbac.namespaces={models}' \ + --set swiss.catalogServer.enabled=true \ + --set swiss.catalogServer.tokens.existingSecret=console-catalog-tokens +``` + +That runs catalog-server in the release's namespace and serves the catalog at `http://-catalog-server..svc`. Its repository is a PVC, kept across `helm upgrade` and `helm uninstall`; storage, tokens and an optional ingress are the swiss chart's values (`helm show values oci://ghcr.io/modelsphere/charts/swiss --version 0.7.0`). + +Then, in Console: + +1. **Model Serving → Site Profile**: add a catalog with `schemaVersion: v2`, **Writable** ticked, and the write token printed above. For the release above: + + ```yaml + catalogs: + - name: local + url: http://console-catalog-server.modelsphere.svc + schemaVersion: v2 + writable: true + ``` + +2. **Model Library**: **Set up this catalog** while the catalog is empty, then **New model**. Each change is one commit to the catalog's git repository; see [Deploying models](https://github.com/modelsphere/console/blob/main/web/src/modules/docs/content/en-US/deploy.md#edit-a-catalogs-variants) for editing models and variants. + ## Check and sign in ```bash diff --git a/helm/console/README.zh-CN.md b/helm/console/README.zh-CN.md index 71671c1..860a57d 100644 --- a/helm/console/README.zh-CN.md +++ b/helm/console/README.zh-CN.md @@ -56,7 +56,7 @@ kubectl -n modelsphere port-forward svc/console-console 8080:8080 | Helm 使用 cluster-admin 级权限 | 全部 | Chart 创建 IAM CRD、ClusterRole/ClusterRoleBinding（platform-admin 角色含 `*` 权限，Kubernetes 只允许已持有这些权限的用户创建），接入 Swiss 时还要在其他 namespace 创建 Role | `kubectl auth can-i '*' '*' --all-namespaces` 输出 `yes` | | linux/amd64 节点 | 全部 | 镜像只有 amd64 | `kubectl get nodes -L kubernetes.io/arch` | | 节点能访问 `ghcr.io` | 全部 | Console 镜像在 GHCR | — | -| Swiss Chart 0.6.0 及以上且开启 `auth.proxyKey`，或 Swiss 以 `auth.disabled=true` 运行 | 接入 Swiss | Console 用 proxyKey 代表登录用户访问 Swiss | 见[找到 Swiss 和网关](#1-找到-swiss-和网关) | +| Swiss Chart 0.7.0 及以上且开启 `auth.proxyKey`，或 Swiss 以 `auth.disabled=true` 运行 | 接入 Swiss | Console 用 proxyKey 代表登录用户访问 Swiss；目录 schema v2 和 site profile 的 `schemaVersion`/`writable` 也从 0.7.0 开始支持 | 见[找到 Swiss 和网关](#1-找到-swiss-和网关) | | Swiss site profile 已存在，且 `cluster.profile.key` 为 `profile.yaml`（默认值） | 接入 Swiss | Console 从 profile 读取网关入口，且只读 `profile.yaml` 这个 key；profile 在 Swiss 网页首次保存设置时才创建 | 同上 | ## 接入已有 Swiss @@ -92,7 +92,7 @@ kubectl -n modelsphere create secret generic swiss-proxy-key --from-file=proxyKe rm proxyKey ``` -第二条没有输出时，说明这个 Swiss 没有 proxyKey：升级 Swiss Chart 到 0.6.0 及以上，或让它以 `auth.disabled=true` 运行。 +第二条没有输出时，说明这个 Swiss 没有 proxyKey：升级 Swiss Chart 到 0.7.0 及以上，或让它以 `auth.disabled=true` 运行。 ### 3. 写 values @@ -131,6 +131,46 @@ helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \ --wait --timeout 10m ``` +## 新增模型（可写目录） + +只读目录足以部署。**新增模型**、**编辑模型**、**新增变体**和**目录设置**则需要**可写**目录，即提供 schema v2 的 catalog-server；静态 `index.json` 目录保持只读。 + +| 你的安装 | 可写目录从哪来 | +|---|---| +| 自带 Swiss（`swiss.enabled=true`） | 打开 swiss chart 的 `catalogServer`（0.7.0+），见下 | +| 接入已有 Swiss（`externalSwiss`） | 把 Swiss 升到 Chart 0.7.0 并打开它的 `catalogServer`，或让 swissd 指向任意可达的 catalog-server | + +```bash +# 写 token：catalog-server 从 Secret 读取，同一个值稍后填进 site profile。不要写进 values 文件。 +TOKEN=$(openssl rand -hex 24) +printf -- '- name: console\n email: console@example.com\n token: %s\n' "$TOKEN" > tokens.yaml +kubectl -n modelsphere create secret generic console-catalog-tokens --from-file=tokens.yaml +rm tokens.yaml +printf 'Write token: %s\n' "$TOKEN" + +helm upgrade --install console oci://ghcr.io/modelsphere/charts/console \ + --namespace modelsphere \ + --set swiss.enabled=true --set 'swiss.rbac.namespaces={models}' \ + --set swiss.catalogServer.enabled=true \ + --set swiss.catalogServer.tokens.existingSecret=console-catalog-tokens +``` + +这会在 release 所在 namespace 运行 catalog-server，目录地址为 `http://-catalog-server..svc`。目录仓库放在 PVC 上，`helm upgrade` 和 `helm uninstall` 都会保留；存储、token、可选 ingress 都是 swiss chart 的 values（`helm show values oci://ghcr.io/modelsphere/charts/swiss --version 0.7.0`）。 + +然后在 Console 里： + +1. **模型服务 → Site Profile**：新增目录，`schemaVersion: v2`、勾选 **Writable**、填入上面的写 token。对应上面的 release： + + ```yaml + catalogs: + - name: local + url: http://console-catalog-server.modelsphere.svc + schemaVersion: v2 + writable: true + ``` + +2. **模型库**：目录为空时点 **Set up this catalog**，之后点 **New model**。每次改动都是目录 git 仓库的一次提交；模型和变体的编辑见[部署模型](https://github.com/modelsphere/console/blob/main/web/src/modules/docs/content/zh-CN/deploy.md#编辑目录中的变体)。 + ## 检查和登录 ```bash diff --git a/helm/console/values.yaml b/helm/console/values.yaml index df397f1..1dc46d1 100644 --- a/helm/console/values.yaml +++ b/helm/console/values.yaml @@ -89,6 +89,13 @@ backends: [] # differently is here. The chart refuses to render without rbac.namespaces, the # namespaces holding model releases: # --set swiss.enabled=true --set 'swiss.rbac.namespaces={models}' +# +# A writable catalog, so the model library can add and edit models (swiss +# 0.7.0+): the swiss chart vendors catalog-server; enable it and give it a write +# token, then name it in the site profile. See "Adding models from the Model +# Library" in the chart README. +# --set swiss.catalogServer.enabled=true \ +# --set swiss.catalogServer.tokens.existingSecret=console-catalog-tokens swiss: enabled: false auth: