fix(gpu): handle scheduler inconsistency and device stuck in unhealthy

* fix: failed release upgrade

* fix: helm upgrade do not use atomic param and allow upgrade failed release

* fix: app upgrade set tailscale acl (#2357)

* fix: increase wait timeout for namespace delete

* fix: update app-service image tag to 0.4.73

apps/.olares/config/user/helm-charts/system-apps/templates/olares-app.yaml

@@ -317,7 +317,7 @@ spec:
             chown -R 1000:1000 /uploadstemp && \
             chown -R 1000:1000 /appdata 
         - name: olares-app-init
-          image: beclab/system-frontend:v1.6.36
+          image: beclab/system-frontend:v1.6.38
           imagePullPolicy: IfNotPresent
           command:
             - /bin/sh

daemon/go.mod

@@ -18,7 +18,7 @@ require (
 	bytetrade.io/web3os/bfl v0.0.0-00010101000000-000000000000
 	github.com/Masterminds/semver/v3 v3.4.0
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
-	github.com/beclab/Olares/cli v0.0.0-20251219153848-63d422037cf9
+	github.com/beclab/Olares/cli v0.0.0-20251230161135-5264df60cc33
 	github.com/beclab/Olares/framework/app-service v0.0.0-20251225061130-909b7656fd70
 	github.com/containerd/containerd v1.7.29
 	github.com/distribution/distribution/v3 v3.0.0

daemon/go.sum

@@ -24,8 +24,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
 github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
-github.com/beclab/Olares/cli v0.0.0-20251219153848-63d422037cf9 h1:YNHfPra2FqsKJ5mAxSWNVIK6VyWygRyZiNwfPqiFxlg=
-github.com/beclab/Olares/cli v0.0.0-20251219153848-63d422037cf9/go.mod h1:cYPcuju2yRSp9BQjIN/CC495dDOOvVoL42r/gvFlutk=
+github.com/beclab/Olares/cli v0.0.0-20251230161135-5264df60cc33 h1:WYuUPOT/p26aCDJGJEDai1v7YM6QHiaFDusBVynnbBY=
+github.com/beclab/Olares/cli v0.0.0-20251230161135-5264df60cc33/go.mod h1:ixhzBK5XIovsRB5djk44TChsOK4wum2q4y/hZxJKlNw=
 github.com/beclab/Olares/framework/app-service v0.0.0-20251225061130-909b7656fd70 h1:U3z6m0hokD1gzl788BrUdxCbDyAjdOBBXA8ilYgn6VQ=
 github.com/beclab/Olares/framework/app-service v0.0.0-20251225061130-909b7656fd70/go.mod h1:D9wl7y3obLqXMqfubMROMgdxWAwInnKNrFC//d0nyIA=
 github.com/beclab/bfl v0.3.36 h1:PgeSPGc+XoONiwFsKq9xX8rqcL4kVM1G/ut0lYYj/js=

daemon/internel/apiserver/handlers/handler_did.go

@@ -2,8 +2,10 @@ package handlers
 
 import (
 	"net/http"
+	"net/url"
 
 	"github.com/beclab/Olares/cli/pkg/web5/jws"
+	"github.com/beclab/Olares/daemon/pkg/commands"
 	"github.com/gofiber/fiber/v2"
 	"k8s.io/klog/v2"
 )
@@ -14,8 +16,14 @@ func (h *Handlers) ResolveOlaresName(c *fiber.Ctx) error {
 		klog.Error("olaresName parameter is missing")
 		return h.ErrJSON(c, fiber.StatusBadRequest, "olaresName parameter is required")
 	}
+
 	klog.Infof("Received olaresName: %s", olaresName)
-	result, err := jws.ResolveOlaresName(olaresName)
+
+	didServiceURL, err := getDidGateURL()
+	if err != nil {
+		return h.ErrJSON(c, fiber.StatusInternalServerError, "Failed to get DID gate URL")
+	}
+	result, err := jws.ResolveOlaresName(didServiceURL, olaresName)
 	if err != nil {
 		klog.Errorf("Failed to resolve DID for %s: %v", olaresName, err)
 		return h.ErrJSON(c, fiber.StatusInternalServerError, "Failed to resolve DID")
@@ -46,7 +54,11 @@ func (h *Handlers) CheckJWS(c *fiber.Ctx) error {
 		body.Duration = int64(3 * 60 * 1000) // 3 minutes in milliseconds
 	}
 
-	result, err := jws.CheckJWS(body.JWS, body.Duration)
+	didServiceURL, err := getDidGateURL()
+	if err != nil {
+		return h.ErrJSON(c, fiber.StatusInternalServerError, "Failed to get DID gate URL")
+	}
+	result, err := jws.CheckJWS(didServiceURL, body.JWS, body.Duration)
 	if err != nil {
 		klog.Errorf("Failed to check JWS: %v", err)
 		return h.ErrJSON(c, fiber.StatusBadRequest, "Invalid JWS")
@@ -54,3 +66,12 @@ func (h *Handlers) CheckJWS(c *fiber.Ctx) error {
 
 	return h.OkJSON(c, "success", result)
 }
+
+func getDidGateURL() (string, error) {
+	didServiceURL, err := url.JoinPath(commands.OLARES_REMOTE_SERVICE, "/did/1.0/name/")
+	if err != nil {
+		klog.Errorf("failed to parse DID gate service URL: %v, Olares remote service: %s", err, commands.OLARES_REMOTE_SERVICE)
+		return "", err
+	}
+	return didServiceURL, nil
+}

daemon/pkg/utils/drivers_linux.go

@@ -199,7 +199,7 @@ func MountedHddPath(ctx context.Context) ([]string, error) {
 
 func FilterBySerial(serial string) func(dev storageDevice) bool {
 	return func(dev storageDevice) bool {
-		return dev.IDSerial == serial || dev.IDSerialShort == serial
+		return strings.HasSuffix(serial, dev.IDSerial) || strings.HasSuffix(serial, dev.IDSerialShort)
 	}
 }
 

daemon/pkg/utils/jws.go

@@ -18,15 +18,14 @@ func ValidateJWS(token string) (bool, string, error) {
 		klog.Errorf("failed to parse DID gate service URL: %v, Olares remote service: %s", err, commands.OLARES_REMOTE_SERVICE)
 		return false, "", err
 	}
-	jws.DIDGateURL = didServiceURL
 
 	// Validate the JWS token with a 20-minute expiration time
-	checkJWS, err := jws.CheckJWS(token, 20*60*1000)
+	checkJWS, err := jws.CheckJWS(didServiceURL, token, 20*60*1000)
 	if err != nil {
 		if strings.HasPrefix(err.Error(), "timestamp") {
 			err = fmt.Errorf("%v, server time: %s", err, time.Now().UTC().Format(time.RFC3339))
 		}
-		klog.Errorf("failed to check JWS: %v, on %s", err, jws.DIDGateURL)
+		klog.Errorf("failed to check JWS: %v, on %s", err, didServiceURL)
 		return false, "", err
 	}
 

docs/developer/develop/tutorial/develop.md

@@ -92,13 +92,13 @@ This example demonstrates creating a basic web page manually.
    ```
 5. Create a file named `index.js` in `/root/` with the following content:
    ```js
-    // Ensure the port matches what you defined
-    const express = require('express');
-    const app = express();
-    app.use(express.static('public/'));
-    app.listen(8080), function() {
-        console.log('Server is running on port 8080');
-    };
+   // Ensure the port matches what you defined
+   const express = require('express');
+   const app = express();
+   app.use(express.static('public/'));
+   app.listen(8080, function() {
+       console.log('Server is running on port 8080');
+   });
    ```
 6. Create a `public` directory in `/root/` and add an `index.html` file:
    ```html
@@ -204,15 +204,15 @@ Once deployed, go to **Services** > **Ports**. You can see your new port listed
    const express = require('express');
    const app = express();
    app.use(express.static('public/'));
-   app.listen(8080), function() {
-   console.log('Server is running on port 8080');
-   };
+   app.listen(8080, function() {
+       console.log('Server is running on port 8080');
+   });
    // Add the following
    const app_new = express();
    app_new.use(express.static('new/'));
-   app_new.listen(8081), function() {
-   console.log('Server is running on port 8081');
-   };
+   app_new.listen(8081, function() {
+       console.log('Server is running on port 8081');
+   });
    ```
 2. Create a `new` directory in `/root/` and add an `index.html` file:
    ```html

docs/zh/developer/develop/tutorial/develop.md

@@ -93,12 +93,12 @@ Olares Studio 允许你启动预配置的开发容器来编写和调试代码（
 5. 在 `/root/` 中创建文件 `index.js`，内容如下：
    ```js
     // 确保端口与定义的一致
-    const express = require('express');
-    const app = express();
-    app.use(express.static('public/'));
-    app.listen(8080), function() {
-        console.log('Server is running on port 8080');
-    };
+   const express = require('express');
+   const app = express();
+   app.use(express.static('public/'));
+   app.listen(8080, function() {
+       console.log('Server is running on port 8080');
+   });
    ```
 6. 在 `/root/` 中创建 `public` 目录并添加 `index.html` 文件：
    ```html
@@ -204,15 +204,15 @@ Olares Studio 允许你启动预配置的开发容器来编写和调试代码（
    const express = require('express');
    const app = express();
    app.use(express.static('public/'));
-   app.listen(8080), function() {
-   console.log('Server is running on port 8080');
-   };
+   app.listen(8080, function() {
+       console.log('Server is running on port 8080');
+   });
    // 添加以下内容
    const app_new = express();
    app_new.use(express.static('new/'));
-   app_new.listen(8081), function() {
-   console.log('Server is running on port 8081');
-   };
+   app_new.listen(8081, function() {
+       console.log('Server is running on port 8081');
+   });
    ```
 2. 在 `/root/` 中创建 `new` 目录并添加 `index.html` 文件：
    ```html

framework/app-service/.olares/config/cluster/deploy/appservice_deploy.yaml

@@ -170,7 +170,7 @@ spec:
       priorityClassName: "system-cluster-critical"
       containers:
       - name: app-service
-        image: beclab/app-service:0.4.72
+        image: beclab/app-service:0.4.73
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsUser: 0

framework/app-service/controllers/load.go

@@ -146,7 +146,7 @@ func LoadStatefulApp(ctx context.Context, appmgr *ApplicationManagerController,
 		case appv1alpha1.ApplyingEnvCanceling:
 			return appstate.NewApplyingEnvCancelingApp(appmgr, &am)
 		case appv1alpha1.Uninstalling:
-			return appstate.NewUninstallingApp(appmgr, &am, 15*time.Minute)
+			return appstate.NewUninstallingApp(appmgr, &am, 30*time.Minute)
 		case appv1alpha1.StopFailed:
 			return appstate.NewSuspendFailedApp(appmgr, &am)
 		case appv1alpha1.UninstallFailed:

framework/app-service/pkg/appstate/types.go

@@ -20,6 +20,7 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+	utilwait "k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/rest"
 	"k8s.io/klog/v2"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -138,6 +139,13 @@ func (p *baseStatefulApp) forceDeleteApp(ctx context.Context) error {
 			return err
 		}
 	}
+
+	// Wait for namespace to be fully deleted before updating status
+	if err = p.waitForNamespaceDeleted(ctx); err != nil {
+		klog.Errorf("wait for namespace %s deleted failed %v", p.manager.Spec.AppNamespace, err)
+		return err
+	}
+
 	err = p.updateStatus(ctx, p.manager, appsv1.Uninstalled, nil, appsv1.Uninstalled.String(), "")
 	if err != nil {
 		klog.Errorf("update app manager %s to state %s failed", p.manager.Name, appsv1.Uninstalled)
@@ -146,6 +154,32 @@ func (p *baseStatefulApp) forceDeleteApp(ctx context.Context) error {
 	return nil
 }
 
+// waitForNamespaceDeleted waits for the namespace to be completely deleted
+func (p *baseStatefulApp) waitForNamespaceDeleted(ctx context.Context) error {
+	namespace := p.manager.Spec.AppNamespace
+	if apputils.IsProtectedNamespace(namespace) {
+		return nil
+	}
+
+	klog.Infof("waiting for namespace %s to be fully deleted", namespace)
+	err := utilwait.PollImmediate(time.Second, 30*time.Minute, func() (done bool, err error) {
+		var ns corev1.Namespace
+		err = p.client.Get(ctx, types.NamespacedName{Name: namespace}, &ns)
+		if err != nil && !apierrors.IsNotFound(err) {
+			klog.Errorf("failed to get namespace %s: %v", namespace, err)
+			return false, err
+		}
+		if apierrors.IsNotFound(err) {
+			klog.Infof("namespace %s has been fully deleted", namespace)
+			return true, nil
+		}
+		klog.Infof("namespace %s still exists, waiting...", namespace)
+		return false, nil
+	})
+
+	return err
+}
+
 type OperationApp interface {
 	StatefulApp
 	IsTimeout() bool

framework/app-service/pkg/appstate/uninstalling_app.go

@@ -100,7 +100,7 @@ func (p *UninstallingApp) waitForDeleteNamespace(ctx context.Context) error {
 	if apputils.IsProtectedNamespace(p.manager.Spec.AppNamespace) {
 		return nil
 	}
-	err := utilwait.PollImmediate(time.Second, 15*time.Minute, func() (done bool, err error) {
+	err := utilwait.PollImmediate(time.Second, 30*time.Minute, func() (done bool, err error) {
 		klog.Infof("waiting for namespace %s to be deleted", p.manager.Spec.AppNamespace)
 		nsName := p.manager.Spec.AppNamespace
 		var ns corev1.Namespace

framework/app-service/pkg/appstate/upgrading_app.go

@@ -176,6 +176,7 @@ func (p *UpgradingApp) exec(ctx context.Context) error {
 			return err
 		}
 		appConfig.Ports = cfg.Ports
+		appConfig.TailScale = cfg.TailScale
 
 	} else {
 		_, err = apputils.GetIndexAndDownloadChart(ctx, &apputils.ConfigOptions{

framework/authelia/.olares/config/user/helm-charts/auth/templates/auth_deploy.yaml

@@ -29,7 +29,7 @@ spec:
         name: check-auth
       containers:
       - name: auth-front
-        image: beclab/login:v1.6.30
+        image: beclab/login:v1.6.38
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 80

infrastructure/gpu/.olares/config/gpu/hami/values.yaml

@@ -4,7 +4,7 @@ nameOverride: ""
 fullnameOverride: ""
 namespaceOverride: ""
 imagePullSecrets: []
-version: "v2.6.6"
+version: "v2.6.7"
 
 # Nvidia GPU Parameters
 resourceName: "nvidia.com/gpu"

platform/hami/.olares/Olares.yaml

@@ -3,7 +3,7 @@ target: prebuilt
 output:
   containers:
     - 
-      name: beclab/hami:v2.6.6
+      name: beclab/hami:v2.6.7
     - 
       name: beclab/hami-webui-fe-oss:v1.0.8
     - 

platform/kubeblocks/.olares/Olares.yaml

@@ -7,4 +7,4 @@ output:
     -
       name: beclab/apecloud-kubeblocks:1.0.1
     -
-      name: beclab/kubeblock-addon-charts:v1.0.1-ext
+      name: beclab/kubeblock-addon-charts:v1.0.1-ext2

platform/kubeblocks/.olares/config/cluster/deploy/kubeblocks-addon.yaml

@@ -11,7 +11,7 @@ spec:
     or cluster of machines.
   helm:
     chartLocationURL: file:///minio-1.0.1.tgz
-    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext
+    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext2
     chartsPathInImage: /charts
     installValues: {}
     valuesMapping:
@@ -44,7 +44,7 @@ spec:
     and scaling.
   helm:
     chartLocationURL: file:///mongodb-1.0.1.tgz
-    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext
+    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext2
   installable:
     autoInstall: true
   type: Helm
@@ -68,7 +68,7 @@ spec:
     speed and relevance on production-scale workloads.
   helm:
     chartLocationURL: file:///elasticsearch-1.0.1.tgz
-    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext
+    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext2
   installable:
     autoInstall: true
   type: Helm
@@ -90,7 +90,7 @@ spec:
   description: RabbitMQ is a reliable and mature messaging and streaming broker.
   helm:
     chartLocationURL: file:///rabbitmq-1.0.1.tgz
-    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext
+    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext2
   installable:
     autoInstall: true
   type: Helm
@@ -113,7 +113,7 @@ spec:
     system that is widely used for web and application servers
   helm:
     chartLocationURL: file:///mariadb-1.0.1.tgz
-    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext
+    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext2
   installable:
     autoInstall: true
   type: Helm
@@ -136,7 +136,7 @@ spec:
     system (RDBMS)
   helm:
     chartLocationURL: file:///mysql-1.0.1.tgz
-    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext
+    chartsImage: beclab/kubeblock-addon-charts:v1.0.1-ext2
   installable:
     autoInstall: true
   type: Helm