CLI Configuration File (AICRConfig)

1
kind: AICRConfig               # required, exactly this value
2
apiVersion: aicr.run/v1alpha2  # required, exactly this value
3
metadata:
4
  name: gke-h100-training      # optional, identifying only
5
spec:
6
  snapshot: {}                 # each section optional —
7
  recipe: {}                   # at least ONE must be present
8
  bundle: {}
9
  validate: {}
10
  verify: {}

1
kind: AICRConfig
2
apiVersion: aicr.run/v1alpha2
3
metadata:
4
  name: eks-h100-training
5
spec:
6
  snapshot:
7
    output:
8
      path: snapshot.yaml            # same shape as -o
9
      format: yaml                   # yaml | json | table
10
      template: ""                   # optional Go template path
11
    agent:                           # in-cluster snapshot Job pod
12
      namespace: aicr-validation
13
      image: ""                      # default: ghcr.io/nvidia/aicr:latest
14
      imagePullSecrets: []
15
      jobName: aicr
16
      serviceAccountName: aicr
17
      nodeSelector:
18
        nodeGroup: gpu-worker
19
      tolerations:
20
        - dedicated=gpu-workload:NoSchedule
21
      requireGpu: false
22
      runtimeClassName: ""           # mutually exclusive with requireGpu
23
      os: ""                         # ubuntu | rhel | cos | amazonlinux | ol | talos
24
      requests: ""                   # "cpu=500m,memory=1Gi"
25
      limits: ""
26
    execution:
27
      timeout: 5m
28
      noCleanup: false
29
      privileged: true               # false for PSS-restricted namespaces
30
      maxNodesPerEntry: 0            # 0 = unlimited topology entries
31
32
  recipe:
33
    criteria:                        # mutually exclusive with input.snapshot
34
      service: eks
35
      accelerator: h100
36
      intent: training
37
      os: ubuntu
38
      platform: kubeflow
39
      nodes: 2
40
    profile: ""                      # optional name=value; empty uses the declared default
41
    # configuration:                 # typed desired-state inputs (not matched on)
42
    #   slurm:                       # only valid when the resolved recipe platform is slurm
43
    #     accounting:
44
    #       mode: disabled           # disabled | customer-managed | aicr-provided
45
    # input:
46
    #   snapshot: snapshot.yaml      # derive criteria from a snapshot instead
47
    output:
48
      path: recipe.yaml
49
      format: yaml                   # yaml | json | table
50
    data: ""                         # optional data-overlay dir/archive
51
    criteriaStrict: false            # reject criteria outside the embedded catalog
52
53
  bundle:
54
    input:
55
      recipe: recipe.yaml            # must match recipe.output.path when both set
56
    output:
57
      target: ./bundles              # local dir or oci:// URI
58
      imageRefs: ""                  # external digest file; OCI output only
59
    deployment:
60
      deployer: helmfile             # helm | helmfile | argocd | argocd-helm | flux | ...
61
      repo: ""
62
      set: []                        # value overrides, "key:path=value"
63
      dynamic: []
64
      vendorCharts: false
65
      appName: ""                    # argocd parent Application name override
66
    scheduling:
67
      systemNodeSelector: {}
68
      systemNodeTolerations: []
69
      acceleratedNodeSelector:
70
        nodeGroup: gpu-worker
71
      acceleratedNodeTolerations:
72
        - nvidia.com/gpu=present:NoSchedule
73
      workloadGate: ""
74
      workloadSelector: {}
75
      nodes: 2
76
      storageClass: ""
77
      sharedStorageClass: ""          # RWX class for opt-in shared filesystems
78
    attestation:
79
      enabled: false
80
      certificateIdentityRegexp: ""
81
      oidcDeviceFlow: false
82
      fulcioURL: ""                  # private Sigstore overrides; empty = public good
83
      rekorURL: ""
84
      signingKey: ""                 # KMS key ref (awskms:// | gcpkms:// | ...); empty = keyless OIDC
85
    registry:                        # OCI transport for oci:// push
86
      insecureTLS: false
87
      plainHTTP: false
88
89
  validate:
90
    input:
91
      recipe: recipe.yaml
92
      snapshot: snapshot.yaml
93
    agent:                           # same nil-vs-empty semantics as snapshot.agent
94
      namespace: aicr-validation
95
      image: ""
96
      imagePullSecrets: []
97
      jobName: aicr
98
      serviceAccountName: aicr
99
      nodeSelector:
100
        nodeGroup: gpu-worker
101
      tolerations:
102
        - nvidia.com/gpu=present:NoSchedule
103
      requireGpu: false
104
    execution:
105
      phases: [deployment, conformance, performance]
106
      failOnError: true              # tri-state; absent = CLI default (true)
107
      failFast: false
108
      noCluster: false
109
      noCleanup: false
110
      timeout: 40m
111
    evidence:
112
      cncf:                          # CNCF AI Conformance markdown
113
        dir: ./evidence
114
        cncfSubmission: false        # requires dir
115
        features: []                 # empty = all features
116
      attestation:                   # recipe-evidence bundle (ADR-007)
117
        out: evidence-result.json    # setting this enables the path
118
        bom: ""
119
        push: ""                     # OCI ref to push the signed bundle
120
        plainHTTP: false
121
        insecureTLS: false
122
  verify:                            # consumer side: policy for `aicr verify`
123
    policy:                          # assertions checked after verification
124
      minTrustLevel: verified        # unknown | unverified | attested | verified | max
125
      requireCreator: ci@myorg.example.com
126
      cliVersionConstraint: ">= 0.16.0"
127
    trust:                           # material verification runs against
128
      certificateIdentityRegexp: ""  # when set, must BEGIN with https://github.com/NVIDIA/aicr/
129
      key: ""                        # KMS URI or local PEM public-key path
130
      trustRoot: ""                  # private Sigstore trusted_root.json