Ai tier ga

.github/workflows/cluster-setup-tests.yml

@@ -0,0 +1,24 @@
+name: Cluster Setup Tests
+on:
+  workflow_call:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+
+      - name: Ensure yq is available
+        run: |
+          if ! command -v yq &> /dev/null; then
+            sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+            sudo chmod +x /usr/local/bin/yq
+          fi
+          yq --version
+
+      - name: Run cluster_setup unit tests
+        run: bash tools/cluster_setup/test_k0s_cluster_with_stack.sh
+
+      - name: Run Splunk-optional installer dry-run tests
+        run: bash tools/cluster_setup/test_installer_dry_run.sh

.github/workflows/main.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     branches:
       - main
+      - ai-tier-ga
   push:
     branches:
       - main
@@ -23,6 +24,10 @@ jobs:
     uses: ./.github/workflows/main-unit-tests.yml
     needs: check-formatting
 
+  cluster-setup-tests:
+    uses: ./.github/workflows/cluster-setup-tests.yml
+    needs: check-formatting
+
   build-image:
     uses: ./.github/workflows/main-build-image.yml
     secrets: inherit

.gitignore

@@ -40,8 +40,8 @@ helm-chart/**/charts/
 !helm-chart/**/charts/.gitkeep
 
 # Cluster-setup script byproducts (*.original): pristine-snapshot backups
-# written by tools/cluster_setup/k0s_cluster_with_stack.sh on first run and
-# reused as a reset point on subsequent runs (see configure_images()
-# → "Restoring from clean originals"). Needed locally for idempotent
-# re-installs; never committed.
+# written by tools/cluster_setup/eks_cluster_with_stack.sh on first run and
+# reused as a reset point on subsequent runs. Needed locally for idempotent
+# re-installs; never committed. (k0s_cluster_with_stack.sh no longer uses
+# this snapshot/restore pattern, but the EKS script still does.)
 tools/cluster_setup/*.original

Dockerfile

@@ -39,7 +39,8 @@ WORKDIR /
 COPY --from=builder /workspace/manager .
 COPY config/configs/instance.yaml instance.yaml
 COPY config/configs/applications.yaml applications.yaml
-COPY config/configs/features/ features/
+COPY config/configs/model-scale.yaml model-scale.yaml
+COPY config/configs/worker-scale.yaml worker-scale.yaml
 COPY LICENSE LICENSE-2.0.txt
 COPY --from=builder /certs/tls.crt /certs/tls.crt
 COPY --from=builder /certs/tls.key /certs/tls.key
@@ -51,4 +52,6 @@ COPY --from=builder /certs/tls.key /certs/tls.key
 USER 1001:0
 ENV INSTANCE_FILE=/instance.yaml
 ENV APPLICATION_FILE=/applications.yaml
+ENV MODEL_SCALE_FILE=/model-scale.yaml
+ENV WORKER_SCALE_FILE=/worker-scale.yaml
 ENTRYPOINT ["/manager"]

Dockerfile.debug

@@ -47,14 +47,17 @@ COPY --from=builder /workspace/manager .
 # Copy config files
 COPY config/configs/instance.yaml instance.yaml
 COPY config/configs/applications.yaml applications.yaml
-COPY config/configs/features/ features/
+COPY config/configs/model-scale.yaml model-scale.yaml
+COPY config/configs/worker-scale.yaml worker-scale.yaml
 COPY --from=builder /certs/tls.crt /certs/tls.crt
 COPY --from=builder /certs/tls.key /certs/tls.key
 
 USER 65532:65532
 
 ENV INSTANCE_FILE=/instance.yaml
 ENV APPLICATION_FILE=/applications.yaml
+ENV MODEL_SCALE_FILE=/model-scale.yaml
+ENV WORKER_SCALE_FILE=/worker-scale.yaml
 
 # Start with delve for debugging
 ENTRYPOINT ["/dlv", "--listen=:2345", "--headless=true", "--api-version=2", "--accept-multiclient", "exec", "/manager", "--"]

api/v1/aiplatform_types.go

@@ -65,6 +65,16 @@ type AIPlatformSpec struct {
 	// +kubebuilder:validation:MaxItems=10
 	Features []FeatureSpec `json:"features,omitempty"`
 
+	// ScaleFactor is a platform-wide capacity multiplier. It uniformly scales
+	// BOTH the model (Serve) replicas AND the GPU worker-pool pod counts, so a
+	// single knob grows capacity without needing to know which models exist or
+	// how many GPUs each uses. The cluster must have proportionally more GPUs
+	// available before raising it. Defaults to 1 (single-capacity deployment).
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:default=1
+	ScaleFactor *int32 `json:"scaleFactor,omitempty"`
+
 	// WorkerGroupConfig defines the Ray worker group configuration
 	// +kubebuilder:validation:Optional
 	WorkerGroupConfig *WorkerGroupConfig `json:"workerGroupConfig,omitempty"`
@@ -177,17 +187,13 @@ type VectorDBStorageSpec struct {
 
 // FeatureSpec defines the features to enable in the AIPlatform
 type FeatureSpec struct {
-	// Name of the feature, e.g. "saia" or "seca"
-	// +kubebuilder:validation:Enum=saia;seca
+	// Name of the feature, e.g. "saia", "seca" or "slim"
+	// +kubebuilder:validation:Enum=saia;seca;slim
 	Name string `json:"name,omitempty"`
 	// ServiceAccountName is the name of the service account to use for the feature
 	ServiceAccountName string `json:"serviceAccountName,omitempty"`
 	// Version of the feature, e.g. "1.0.0"
 	Version string `json:"version,omitempty"`
-	// ScaleFactor is the desired fixed number of replicas for the feature.
-	// +kubebuilder:validation:Minimum=1
-	// +optional
-	ScaleFactor *int32 `json:"scaleFactor,omitempty"`
 }
 
 // WeaviateSpec defines the configuration for the Weaviate vector database
@@ -295,11 +301,18 @@ type SplunkConfigurationSpec struct {
 	// +kubebuilder:validation:Optional
 	SecretRef corev1.SecretReference `json:"secretRef,omitempty"`
 
-	// Endpoint is the Splunk HEC endpoint URL or service name (mutually exclusive with SplunkCustomResourceRef)
-	// Either Endpoint or SplunkCustomResourceRef must be provided
+	// Endpoint is the Splunk management/JWKS URL used as the JWT issuer for
+	// SAIA/Slim token validation (mutually exclusive with SplunkCustomResourceRef).
+	// Either Endpoint or SplunkCustomResourceRef must be provided.
 	// +kubebuilder:validation:Optional
 	Endpoint string `json:"endpoint,omitempty"`
 
+	// HECEndpoint is the Splunk HTTP Event Collector base URL used only by the
+	// OTel sidecar to export telemetry. It falls back to Endpoint when unset for
+	// backward compatibility with configurations that predate this field.
+	// +kubebuilder:validation:Optional
+	HECEndpoint string `json:"hecEndpoint,omitempty"`
+
 	// Token is the Splunk HEC token (consider using SecretRef instead)
 	// +kubebuilder:validation:Optional
 	Token string `json:"token,omitempty"`
@@ -311,6 +324,14 @@ type SplunkConfigurationSpec struct {
 	// VaultFilePath is the path where Vault Agent injects the Splunk HEC token
 	// +kubebuilder:validation:Optional
 	VaultFilePath string `json:"vaultFilePath,omitempty"`
+
+	// TrustedIssuers is a list of Splunk JWT issuer URLs (management port,
+	// e.g. https://<splunk-host>:8089) that SAIA will trust for token validation.
+	// When the in-cluster Splunk Standalone is deployed (SplunkCustomResourceRef is set),
+	// its issuer is included automatically and TrustedIssuers are appended.
+	// In external or disabled modes, SPLUNK_ISSUERS is populated solely from this list.
+	// +optional
+	TrustedIssuers []string `json:"trustedIssuers,omitempty"`
 }
 
 // ReplicasSpec sets min/max worker replicas