Chart tag dify-3.13.2 · appVersion 1.17.1 · verified 03 Nov 2026
25 static workloads in either all-option reference render; dynamic resources, external dependencies and the shared alternative are listed separately. This is not a live PolyU inventory.
| Service / resource | Helm workload / resource | Service name and port → targetPort | Type / scope | Purpose | 中文讲解 |
|---|---|---|---|---|---|
| Ingress / OpenShift Route | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Ingress / Route both | Cluster traffic entry | 集群入口，转发到Caddy；OpenShift Route的实际配置由校方集群决定。 |
| Caddy Gateway | polyu-ee-dify-gateway dify | polyu-ee-dify-gateway-svc 80 → 3080 · 443 → 3443 | Deployment both | Enterprise entry routing | 入口代理：按域名、路径和应用部署路由至平台或Runner，执行配置的访问和审计钩子。 |
| Web Studio | polyu-ee-dify-web dify | polyu-ee-dify-web-svc 3000 → 3000 | Deployment both | Application builder | Studio及应用Web界面。 |
| Enterprise Console | polyu-ee-dify-enterprise-frontend dify | polyu-ee-dify-enterprise-frontend-svc 3000 → 3000 | Deployment both | Organization administration | 企业管理前端：组织、成员、空间、许可证、环境和部署管理。 |
| Core API | polyu-ee-dify-api dify | polyu-ee-dify-api-svc 5001 → 5001 | Deployment both | Apps, knowledge, Workflow | 常规应用、知识、Workflow接口；普通执行在Core路径中运行，不需要先部署App Runner。 |
| API WebSocket | polyu-ee-dify-api-websocket dify | polyu-ee-dify-api-websocket-svc 5001 → 5001 | Deployment · optional both | Live collaboration | 可选协作服务，collaboration开启时部署。 |
| Enterprise / AppDeploy | polyu-ee-dify-enterprise dify | polyu-ee-dify-enterprise-svc 8082 → 8082 · 9000 → 9000 | Deployment both | Management + deploy control | 企业管理与AppDeploy同在enterprise服务内。AppDeploy通过Kubernetes API创建Runner资源，不是另一个独立appdeploy微服务。 |
| RBAC service | polyu-ee-dify-enterprise-rbac dify | polyu-ee-dify-enterprise-rbac-svc 8086 → 8086 | Deployment both | Authorization decisions | 企业授权服务，与Kubernetes的Role和ServiceAccount是不同权限层。 |
| Audit service | polyu-ee-dify-enterprise-audit dify | polyu-ee-dify-enterprise-audit-svc 8083 → 8083 | Deployment both | Audit processing | 消费、存储和查询审计事件；不等同运行遥测。 |
| OTel Collector | polyu-ee-dify-enterprise-collector dify | polyu-ee-dify-enterprise-collector-svc 4317 → 4317 · 4318 → 4318 · 8889 → 8889 | Deployment both | Configured telemetry | 接收配置的OTLP信号，执行处理与导出。不是所有服务自动启用全链路追踪的保证。 |
| Celery Worker | polyu-ee-dify-worker dify | No Service | Deployment both | Background tasks | 常规Celery任务，包括配置的运行、索引等队列。 |
| Worker Beat | polyu-ee-dify-worker-beat dify | No Service | Deployment both | Periodic scheduling | 周期调度，向任务队列发送定时工作。 |
| Trigger Worker | polyu-ee-dify-trigger-worker dify | No Service | Deployment both | Trigger queues | 默认启用的附加worker，处理触发与调度队列。 |
| Dataset Worker | polyu-ee-dify-dataset-worker dify | No Service | Deployment · optional both | Dataset / pipeline queues | 可选拆分知识库与数据流水线任务。 |
| Workflow Worker | polyu-ee-dify-workflow-worker dify | No Service | Deployment · optional both | Workflow execution queues | 可选拆分Workflow和workflow_based_app_execution队列。 |
| General Worker | polyu-ee-dify-general-worker dify | No Service | Deployment · optional both | Mail / cleanup / telemetry | 可选拆分邮件、清理、遥测等队列。 |
| Unstructured | polyu-ee-dify-unstructured dify | polyu-ee-dify-unstructured-svc 8000 → 8000 | Deployment · optional both | Document parsing | 可选文档解析服务。 |
| Plugin Daemon | polyu-ee-dify-plugin-daemon dify | polyu-ee-dify-plugin-daemon-svc 5002 → 5002 polyu-ee-dify-plugin-daemon-debug-svc 5003 → 5003 | Deployment both | Plugin invocation | 模型及工具插件调用入口；调试端口按需限制。 |
| Plugin Manager | polyu-ee-dify-plugin-manager dify | polyu-ee-dify-plugin-manager-svc 8084 → 8084 · 9084 → 9084 | Deployment both | Lifecycle and policy | 企业插件生命周期与策略管理。 |
| Plugin Connector | polyu-ee-dify-plugin-connector dify | polyu-ee-dify-plugin-connector-svc 80 → 5004 | Deployment both | Build and provision | 承接构建和插件实例部署适配，连接镜像仓库及Kubernetes控制资源。 |
| DifyPlugin Controller | polyu-ee-dify-crd-controller dify | No Service | Deployment both | Reconcile DifyPlugin CR | 协调DifyPlugin自定义资源，生成插件运行Deployment和Service等。 |
| Plugin build Job | Generated by plugin system Dynamic resource | Created by the plugin lifecycle/controller; generated instance names are not fixed Helm service names. | Job both | Build and push image | 按构建器设置创建Job，构建并推送镜像；不是每个调用都创建。 |
| Plugin runtime | Generated by plugin system Dynamic resource | Created by the plugin lifecycle/controller; generated instance names are not fixed Helm service names. | Dynamic Deployment both | Gateway + plugin containers | 动态插件运行实例，包含插件网关与插件容器；实例数量由安装和运行策略决定。 |
| App Runner | Generated by AppDeploy Dynamic resource | AppDeploy generates the resource name. Deployment, Service, ConfigMap and Secret use the generated spec.Name; there is no fixed Helm Deployment or Service name. | Dynamic Deployment both | Deployed app execution | AppDeploy创建的应用执行实例。Go承接服务与控制，Python worker执行Graphon。与Agent会话沙箱分开。 |
| Runner Deployment | Generated by AppDeploy Dynamic resource | AppDeploy generates the resource name. Deployment, Service, ConfigMap and Secret use the generated spec.Name; there is no fixed Helm Deployment or Service name. | Deployment both | One replica in checked source | 已检查实现生成1副本Deployment，workerPoolSize是Pod内并发；不能解释为HPA副本数。 |
| Runner Service | Generated by AppDeploy Dynamic resource | AppDeploy generates the resource name. Deployment, Service, ConfigMap and Secret use the generated spec.Name; there is no fixed Helm Deployment or Service name. | Service both | Application traffic endpoint | Caddy将已部署应用的请求转至Runner Service。 |
| Runner ConfigMap | Generated by AppDeploy Dynamic resource | AppDeploy generates the resource name. Deployment, Service, ConfigMap and Secret use the generated spec.Name; there is no fixed Helm Deployment or Service name. | ConfigMap both | Runner configuration | 保存非敏感运行配置，由AppDeploy协调。 |
| Runner Secret | Generated by AppDeploy Dynamic resource | AppDeploy generates the resource name. Deployment, Service, ConfigMap and Secret use the generated spec.Name; there is no fixed Helm Deployment or Service name. | Secret both | Join and runtime credentials | 保存join token及运行依赖凭据，图中不包含实际值。 |
| Agent Backend | polyu-ee-dify-agent-backend dify | polyu-ee-dify-agent-backend-svc 5050 → 5050 | Deployment both | Model and tool loop | New Agent模型、工具与事件循环常驻此服务；命令和文件操作才发送到runtime。 |
| Sandbox Gateway | polyu-ee-dify-sandbox-gateway dify | polyu-ee-dify-sandbox-gateway-svc 8090 → 8090 · 9090 → 9090 | Deployment dedicated | Claim + shell proxy | 专属模式：创建Claim、等待绑定并代理shellctl访问；执行活动及回收管理。 |
| Agent egress proxy | polyu-ee-dify-agent-sandbox-ssrf-proxy dify | polyu-ee-dify-agent-sandbox-ssrf-proxy-svc 3128 → 3128 | Deployment both | Agent runtime Squid | Agent runtime专用代理。最终出口隔离还需核对NetworkPolicy和运行时，不能仅靠环境变量保证。 |
| Shared Agent runtime | polyu-ee-dify-agent-runtime dify | polyu-ee-dify-agent-runtime-svc 5004 → 5004 | Deployment shared | All sessions share runtime | sandboxGateway关闭时部署固定共享runtime；不按每会话申请独立Pod。 |
| Session sandbox Pod | Generated per session Dynamic resource | Created by the Agent sandbox lifecycle; the per-session resource name is generated, not a fixed Helm service name. | Dynamic Pod dedicated | Commands and files | 专属会话运行环境，动态分配，镜像是Agent runtime；与Backend常驻模型循环分开。 |
| Agent Sandbox Controller | Outside the Dify Chart Separate installation | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Controller dedicated | Controller + extensions | 单独安装agent-sandbox控制器与扩展；本参考采用已核验v0.5.2 CRD族，不盲目追随上游最新版。 |
| SandboxClaim | Generated per session Dynamic resource | Created by the Agent sandbox lifecycle; the per-session resource name is generated, not a fixed Helm service name. | Custom resource dedicated | Request and binding | 会话申请并绑定一个Sandbox。 |
| SandboxTemplate | dify-sandbox dify | Configured name in the dedicated-mode reference Chart render; not a fixed HTTP service. | Custom resource dedicated | Runtime Pod specification | 镜像、CPU/内存、网络、卷等Pod模板。 |
| SandboxWarmPool | dify-sandbox-warmpool dify | Configured name in the dedicated-mode reference Chart render; not a fixed HTTP service. | Custom resource dedicated | Pre-created idle sandboxes | 维持空闲预热资源；会话可从池中获得实例。 |
| Sandbox | Generated per session Dynamic resource | Created by the Agent sandbox lifecycle; the per-session resource name is generated, not a fixed Helm service name. | Custom resource dedicated | Managed runtime resource | 由控制器协调的Sandbox资源，承载运行Pod。 |
| Code Sandbox | polyu-ee-dify-sandbox dify | polyu-ee-dify-sandbox-svc 8194 → 8194 | Deployment both | Workflow Code nodes | Workflow Code节点执行服务；不等于New Agent shellctl会话Pod。 |
| SSRF proxy | polyu-ee-dify-ssrf-proxy dify | polyu-ee-dify-ssrf-proxy-svc 3128 → 3128 | Deployment both | Configured HTTP egress | 常规HTTP／Code执行的Squid出口路径，实际是否经过代理取决于调用及网络配置。 |
| Relational database | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Database both | Core / Enterprise / audit / plugins | 四类逻辑数据库可以在同一数据库服务上；不要求四台独立数据库服务器。 |
| Redis | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Data service both | Cache, queues, Agent events | 缓存、Celery broker、事件／审计队列和Agent运行状态，逻辑DB不等于硬隔离。 |
| Vector database | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Data service both | Choose one supported backend | 按目标版本选择一种向量后端，不是同时部署所有后端。 |
| Object storage / PVC | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Storage both | Files and persistent artifacts | 持久文件、插件包、可选Home Snapshot按各组件配置，沙箱卷另行规划。 |
| Image registry | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Infrastructure both | Platform and plugin images | 提供平台、Runner与插件镜像拉取及构建推送。 |
| Model endpoints | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | External service both | Approved model providers | 常规模型插件经插件运行体系调用；Runner也可按镜像配置使用Slim执行器，不能一律画成同一插件路径。 |
| Campus IdP | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | External system both | SSO federation | 校园SSO为集成目标，尚未接通校方IdP。 |
| LMS + trusted backend | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | External system both | Course identity and access | LMS经可信后端做课程授权，再调用Dify；不把Dify API Key放到浏览器。 |
| Research / tool APIs | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | External system both | Approved external sources | 研究库与外部工具经获准接口接入；图中出现不代表已接通校方私有资料。 |
| Kubernetes API | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Cluster service both | Resource reconciliation | 供AppDeploy、插件控制器与Agent控制器协调资源。 |
| ServiceAccount + RBAC | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Policy both | Workload permissions | 限制控制器及平台服务的Kubernetes权限，独立于企业用户RBAC。 |
| NetworkPolicy / CNI | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Policy both | Runtime network rules | 以最终Pod和CNI验证允许／拒绝路径，代理配置不等于不可绕过网络边界。 |
| PVC + StorageClass | External / configured infrastructure External / configured infrastructure | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Storage both | Persistent volumes | 数据文件、插件与可选会话持久化按具体卷定义规划。 |
| AI Foundations | Logical workspace Logical workspace | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Logical boundary both | Apps, knowledge, members | 课程工作空间是逻辑分区。 |
| Workflow Lab | Logical workspace Logical workspace | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Logical boundary both | Apps, knowledge, members | 课程工作空间共享平台微服务。 |
| Research Lab | Logical workspace Logical workspace | This diagram item does not represent a single fixed Deployment or Service created by this Dify Chart. | Logical boundary both | Apps, knowledge, members | 不会自动创建独立Namespace、数据库或算力。 |
Sources: Official release · Pinned Chart. Runtime implementation cross-check: f815a071; binary equivalence to the 3.13.2 images was not verified.