Ai tier ga - #143
Open
kupratyu-splunk wants to merge 171 commits into
Open
Conversation
feat(AIP-3938): AI tier openshift support
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
feat(AIP-4163): Ai pod script enhancements
feat(AIP-4161): Openshift air gap install script
Bring ai-tier-ga in sync with main
… script issues (#126) * feat(openshift): route GPU/CPU workers via ai-tier-node label * resolve codex comments
chore: Merge ai-pod-feature-branch to ai-tier-ga
Creates EC2 infrastructure consumed by k0s_cluster_with_stack.sh: - VPC + public subnet + IGW in a single AZ - Security group with self-referencing rule (private-IP k0s comms) - RHEL 9 instances: controller(s), CPU workers, GPU workers, installer - Installer gets an EIP; k0s nodes stay on private IPs only - Separate EBS volumes for /var/lib/k0s (GPU) and /data/minio (installer) - Auto-creates or reuses AWS key pair, downloads .pem locally - Optional MinIO install via install_minio_ec2.sh after provisioning - Generates my-k0s-config.yaml on the installer with private IPs pre-filled - Commands: provision / output / status / destroy / validate / dry-run - Test config (t3.medium, ~$1-2) for Level 2 validation - Design + test plan in K0S_AWS_PROVISION.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…mount fix
Rewrites CloudFormation-based provisioner to direct AWS CLI calls,
bypassing SCP p-m68tib3s which blocks ec2:RunInstances via CloudFormation.
Key changes:
- IMDSv2 required (HttpTokens=required) on all instances — required by SCP
- EBS encryption on all volumes — required by SCP
- Existing VPC only (vpc-09b191e89c83d588e) — no new VPC creation
- Separate subnets: k0s nodes in private subnet, installer in public subnet with EIP
- SSH ProxyCommand instead of -J flag (fixes key forwarding on macOS)
- mount_disk_via_ssh: mount EBS data disks via SSH after attach, not UserData
(UserData runs before EBS volumes are attached by the provisioner)
- destroy --yes / -y flag for non-interactive teardown
- Fix _INSTANCE grep pattern to include INSTALLER_INSTANCE (was missing)
- Fix ${var,,} bash 3.2 incompatibility with tr [:upper:] [:lower:]
Validated end-to-end: provision → status → output → destroy all pass.
All 4 instances, EBS volumes, EIP, SG, key pair created and destroyed cleanly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…on steps, failure history Updates the provisioner doc to reflect the rewrite from CloudFormation to direct AWS CLI calls. Adds: - SCP compliance table (IMDSv2, EBS encryption, existing VPC requirement) - Corrected architecture diagram (public vs private subnet split) - Full k0s integration guide (Option A from installer, Option B from laptop + ProxyJump) - Development history: 9 documented failures with root causes and fixes (SCP block, VPC, set -e false negative, private subnet EIP, SSH -J key, EBS mount timing, INSTALLER_INSTANCE grep, destroy TTY, bash 3.2 compat) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…s-west-2 VPC When network.vpcId is empty (or omitted in non-us-west-2 regions), the provisioner now creates the full network stack automatically: VPC → IGW → public subnet + route (0.0.0.0/0 → IGW) → NAT GW EIP → NAT GW → private subnet + route (0.0.0.0/0 → NAT GW) All six resources are tagged and tracked in the state file so destroy tears them down cleanly in reverse order (private RT → private subnet → NAT GW → NAT EIP → public RT → public subnet → IGW → VPC). For us-west-2, the default vpcId remains vpc-09b191e89c83d588e (SCP in splunkcloud-ai-dev blocks new-VPC creation; leaving the default avoids breaking existing deployments). Any other region defaults to auto-create. Config additions: network.vpcCidr (default 10.0.0.0/16) network.publicSubnetCidr (default 10.0.1.0/24) network.privateSubnetCidr (default 10.0.2.0/24) Docs updated with Network Modes table, mandatory-fields list, and full config reference with inline comments for each network field. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… to not create AWS resources - Add WARNING comments to ensure_network and destroy_network (untested code path) - Emit runtime warn() when auto-create mode activates - dry-run: skip pick_subnet in auto-create mode (no VPC exists yet) - dry-run: remove ensure_key_pair call (was creating real key pairs in AWS) Dry-run now creates zero AWS resources in both existing-VPC and auto-create modes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…writing
Old behaviour: cat > my-k0s-config.yaml (full overwrite with hardcoded defaults)
New behaviour:
1. If my-k0s-config.yaml exists on installer → back it up as
my-k0s-config.bak-<timestamp>.yaml, then yq-patch in-place.
2. If it doesn't exist → copy k0s-cluster-config.yaml (already
uploaded by setup_installer) as the base, then yq-patch.
Only infrastructure fields are written:
cluster.{name,region,sshKeyPath,sshUser}
nodes.existingIPs.{controllers,workers}
storage.objectStore.{type,bucket,endpoint,auth.*} (when minio.enabled)
All other fields (images, operators, aiPlatform, metallb, ecr, etc.)
are preserved from the user's own file.
IPs are serialised via jq to a proper JSON array before yq injection,
avoiding quoting issues with multi-node configs.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Condense the splunk: block's comments to match other sections' style (detail moved to K0S_README.md), document the previously-unmentioned trustedIssuers and imagePullSecrets.custom fields, and fix the cpuWorkers/gpuWorkers comments which incorrectly claimed they're unused with existingIPs (they drive CPU-first worker ordering). Co-Authored-By: Claude <noreply@anthropic.com>
…th issuer splunk.enabled wires Splunk as the SAIA/Slim JWT auth issuer; HEC export is only an optional secondary piece. Calling the whole feature "telemetry" in install-plan output, preflight, and logs understates what it actually does. Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Ai tier config update
Reducing disk space
AIP-4800: SAIA personalization ingestion fails for large payloads and leaves accepted uploads unprocessed
fix: config changes for testing
…o run mirror registry
…egistry # Conflicts: # docs/deployment/k0s-quick-reference.md
fix: airgap - allowing model_staging as true, hostname fix & script t…
Adding sock proxy documentation
fix: Increase saia failure threshold
…k reference Clarify that L40S and H100 GPU worker specs are alternatives, not additive; add the repo clone step to Config Setup to match K0S_README's Quick Start; and drop the redundant macOS brew install snippet. Co-Authored-By: Claude <noreply@anthropic.com>
docs: clarify GPU hardware options and update clone steps in k0s quic…
Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
k0s-cluster-config.yaml's operator image default moved to v2.4, but the test mirror registry helper still mirrored v2.3, so an air-gapped install requested an unmirrored image and hit ImagePullBackOff. Co-Authored-By: Claude <noreply@anthropic.com>
chore: bump splunk-ai-operator image to v2.4 in k0s cluster config
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Related Issues
Type of Change
Changes Made
Testing Performed
make test)make lint)Test Environment
Test Steps
Documentation
Checklist
Breaking Changes
Impact:
Migration Path:
Screenshots/Recordings
Additional Notes
Reviewer Notes
Please pay special attention to:
Commit Message Convention: This PR follows Conventional Commits