API Reference

API Reference

API Reference

Packages

pais.vmware.com/v1alpha1

Package v1alpha1 contains API Schema definitions for the pais v1alpha1 API group

Resource Types

APIRuntimeConfig

APIRuntimeConfig defines configuration/tuning parameters for all Private AI Services API

Appears In:
Field Description Default Validation

deployment RuntimeDeploymentConfig

deployment specifies the desired configuration for the Private AI Services API. Modify only if
instructed by Broadcom support to increase concurrent requests.

Auth

Auth describes the authentication backend for Private AI Service

Appears In:
Field Description Default Validation

oidc OIDCProvider

oidc defines the OpenID Connect connection details that the Private AI Services UI will use to authenticate users.

Deprecated: Use providers instead. This field is retained for backward compatibility and will be removed in a future release.

providers AuthProvider array

providers defines a list of authentication providers for the Private AI Services API and UI.
Each entry configures an authentication backend (e.g. OIDC, OIDC Custom).

AuthProvider

AuthProvider describes an authentication provider for Private AI Services.

Appears In:
Field Description Default Validation

name string

name is the stable, required identifier for this provider. It must be unique
within the same PAISConfiguration.
Must be 2-8 lowercase alphanumeric characters or hyphens, starting and ending
with a letter or digit (e.g. "corp", "lab", "my-idp").

MaxLength: 8
MinLength: 2
Pattern: ^[a-z][a-z0-9-]*[a-z0-9]$

displayName string

displayName is an optional human-friendly label for this provider, surfaced in
the UI as the provider display name. When omitted, the system derives a label
from the provider’s issuer-URL hostname at render time. If two providers share
the same derived label, the name is appended for disambiguation:
"<hostname> (<name>)". This field is informational and need not be unique.

MaxLength: 253

oidc OIDCProvider

oidc configures a standard OpenID Connect authentication provider.

oidcCustom OIDCCustomProvider

oidcCustom configures a customizable OpenID Connect authentication provider
with CEL-based validation rules and response header injection.

vcfa VCFAProvider

vcfa configures an authentication provider backed by VMware Cloud Foundation Automation (VCFA).

staticCredentials StaticCredentialsProvider

staticCredentials configures a built-in authentication provider backed by a static user
database stored in a Kubernetes Secret. Designed for demo, lab, and proof-of-concept
deployments where an external OIDC IdP is not available or practical.

AutomaticUpgradeStrategy

AutomaticUpgradeStrategy means the Supervisor Service will manage upgrades

Appears In:

BackendAuth

BackendAuth configures authentication when connecting to a backend

Appears In:
Field Description Default Validation

apiTokenRef LocalObjectReference

apiTokenRef may be used to provide a bearer token when making HTTPS requests to the backend.
It must name a Secret in this namespace with type "pais.vmware.com/api-token-credentials"
that contains a key "api_token".

BackendTLS

BackendTLS configures TLS when connecting to a backend

Appears In:
Field Description Default Validation

verification TLSVerification

verification determines how to validate the HTTPS connection to the backend.

Add certificate authorities to the PAISConfiguration.spec.clientTls.caBundleRefs in this namespace
so that they are trusted.

  • strict does one-way TLS with full strict validation (default)

  • caOnly does one-way TLS and validates the server certificate chain, but allows a mismatch in server name

  • none does one-way TLS but does not validate the server certificate chain at all.
    It is insecure and should not be used in production.

  • mutual should only be used for local models managed by this instance of Private AI Services.
    It does a full mutual-TLS handshake using system-managed certificates.

Enum: [strict caOnly none mutual]

CABundleReference

CABundleReference references either a ConfigMap or a Secret in the PAISConfiguration’s namespace whose data["ca.crt"] is a PEM-encoded certificate bundle to trust.

Appears In:
Field Description Default Validation

kind string

kind of the resource in this namespace containing the CA bundle to trust

ConfigMap

Enum: [ConfigMap Secret]

name string

name of the ConfigMap or Secret in this namespace containing the CA bundle to trust

MinLength: 1

ChildStatus

ChildStatus is the schema for child resources of PAISConfiguration

Appears In:
Field Description Default Validation

apiGroup string

APIGroup is the group for the resource being referenced.
If APIGroup is not specified, the specified Kind must be in the core API group.
For any other third-party types, APIGroup is required.

kind string

Kind is the type of resource being referenced

name string

Name is the name of resource being referenced

observedGeneration integer

observedGeneration describes the generation of this child observed by the PAISConfiguration controller

ClientCredentialsGrant

ClientCredentialsGrant enables the client_credentials grant for staticCredentials providers. It is intentionally empty - its presence is the enablement marker. Additional configuration fields may be added here in the future.

Appears In:

ClientTLS

ClientTLS configures TLS/SSL clients used by Private AI Services to connect to remote services

Appears In:
Field Description Default Validation

caBundleRefs CABundleReference array

caBundleRefs specifies what certificates Private AI Services will trust when connecting to remote servers over TLS.

Each element references either a ConfigMap or a Secret in the current namespace,
with a key ca.crt that contains a PEM-encoded certificate bundle. If kind is unset
it defaults to ConfigMap, preserving backwards compatibility.

Note: Name must be unique in the list, even if kind is different.
This constraint may be relaxed in a future version.

In addition to being provided to PAIS pods, these CA bundles are included in VKS cluster
nodes' osConfiguration, allowing them to be used to pull container images from private registries.

Note that if this list is changed, or if the contents of the referenced ConfigMaps
or Secrets are modified, the PAISConfiguration will be reconciled and all data-plane
pods will be rolled to pick up the updated CA bundles. Changes also propagate to VKS
cluster nodes' osConfiguration.

Be aware that changes to this list with an existing cluster will result in a rollout
of the cluster, which may affect availability of single-replica ModelEndpoints.

DBPasswordRef

DBPasswordRef describes the database connection secret reference to connect to the database

Appears In:
Field Description Default Validation

name string

name of a Secret in this namespace

MinLength: 1

fieldPath string

fieldPath is the name of the key within the Secret containing the password.

In addition to this key for the password, there should also be
an additional key called "ca.crt" which contains the Certificate Authority
to trust when verifying the TLS connection to the database.

MinLength: 1

Database

Database describes the connection details for Private AI Services to connect to a Postgres database See https://gitlab-vmw.devops.broadcom.net/moneta/dsm-tsql-provisioner/-/blob/4c2d19b30bbd5da3857aa2cad93270cf336874b2/dsm-apis/api/databases/v1alpha1/database_common.go#L381

Appears In:
Field Description Default Validation

host string

host is the network hostname of a PostgreSQL server to use

MinLength: 1

port integer

port is the TCP port to connect to on the database server
If unset, the default Postgres port (5432) will be used

5432

username string

username to use when connecting to the database server

MinLength: 1

passwordRef DBPasswordRef

passwordRef is a reference to a Secret in this namespace containing the password for this database user

dbname string

dbname is the name of the logical database to use within the server

MinLength: 1

sslMode DatabaseSslMode

sslMode configures how to validate the connection with the database server

Enum: [VerifyFull VerifyCA Require Allow]

DatabaseSslMode

Underlying type: string

DatabaseSslMode describes how the Private AI Services instance validates the SSL connection to the database.

Validation:

  • Enum: [VerifyFull VerifyCA Require Allow]

Appears In:

Driver

Driver selects the GPU driver. Set exactly one of the subfields.

Validation:

  • MaxProperties: 1

  • MinProperties: 1

Appears In:
Field Description Default Validation

version string

version selects a GPU driver version that ships in the PAIS GPU-operator
bundle (e.g. "580.105.8").

Pattern: ^[0-9]+\.[0-9]+\.[0-9]+$

image string

image is the full OCI reference of a custom GPU driver image
(custom Artifactory or NVIDIA-bound URL), tag-pinned.
Digest-pinned references are not supported because NVIDIADriver.spec.version
must be a tag, not a sha256 digest.

MinLength: 1

EnvVar

EnvVar represents an environment variable present in a Container. NOTE: We do not use corev1.EnvVar, as we cannot implement all sources of data that it supports in EnvVarSource (since we’d have to mount these values into the VKS cluster) NOTE: Immutability for both properties is already provided by the struct referencing this type. Adding the XValidation rules here as well exceeds complexity allowed by the k8s API

Appears In:
Field Description Default Validation

name string

name is the key for an environment variable override to be passed to the inference engine

MaxLength: 128
MinLength: 1

value string

value is the value for an environment variable override to be passed to the inference engine

GPUDriverType

Underlying type: string

GPUDriverType defines types of GPU drivers

Validation:

  • Enum: [NVAIE OSS]

Appears In:

IndexingMCPServerRuntimeConfig

IndexingMCPServerRuntimeConfig defines configuration/tuning parameters for Private AI Services Indexing MCP server

Appears In:
Field Description Default Validation

deployment RuntimeDeploymentConfig

deployment specifies the desired configuration for the Private AI Services Indexing MCP server.
Modify only if instructed by Broadcom support to increase concurrent requests.

IndexingWorkersRuntimeConfig

IndexingWorkersRuntimeConfig defines configuration/tuning parameters for all Private AI Services indexing workers

Appears In:
Field Description Default Validation

deployment RuntimeDeploymentConfig

deployment specifies the desired configuration for the Private AI Services workers performing
indexing tasks. It allows scaling the throughput of indexing tasks by assigning more resources
to the workers in terms of resources per worker or number of workers total.
Modify only if instructed by Broadcom support to increase indexing throughput.

workerThreads integer

workerThreads specifies the desired number of threads for each Private AI Services worker performing
indexing tasks. It allows scaling the throughput of indexing tasks by running more concurrent
tasks in each indexing worker without increasing resources assigned to the workers. The best value
may depend on type of data processed for indexing. When changing this value, consider adjusting
workerRateLimit to avoid introducing processing bottlenecks.
Modify only if instructed by Broadcom support to increase indexing throughput.

10

Maximum: 100
Minimum: 1

workerRateLimit string

workerRateLimit specifies the desired rate-limit at which the Private AI Services workers performing
indexing tasks pick up individual tasks for processing. When scaling workers via workerThreads, it is
important to adjust this value to avoid introducing processing bottlenecks.
Modify only if instructed by Broadcom support to increase indexing throughput.

10000/s

MinLength: 1
Pattern: ^[1-9][0-9]*/[smh]

InferenceEngine

Underlying type: string

InferenceEngine describes the valid types of engines for ModelEndpoint.

Validation:

  • Enum: [Infinity vLLM LlamaCPP]

Appears In:

InferenceGatewayRoute

InferenceGatewayRoute describes a routing rule for the Inference Gateway

Field Description Default Validation

apiVersion string

pais.vmware.com/v1alpha1

kind string

InferenceGatewayRoute

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec InferenceGatewayRouteSpec

status InferenceGatewayRouteStatus

MinProperties: 1

InferenceGatewayRouteBackend

InferenceGatewayRouteBackend describes a model running on an inference server either in this namespace or elsewhere.

Appears In:
Field Description Default Validation

httpBaseUrl string

httpBaseUrl defines the base url of the server hosting the model to use.

For ModelEndpoints managed by the Private AI Services instance within this namespace
the Private AI Services controller will set this to the name of the Kubernetes Service
for that ModelEndpoint (which is itself managed by this instance of Private AI Services.)

For ModelEndpoints managed by a Private AI Services instance in a different namespace,
this field should be set based on that other ingress Service’s address, e.g.
https://pais-ingress-default.other-namespace/api/v1/compatibility/openai
Inspect the PAISConfiguration.status.ingressServiceRef for that other namespace to get the
service name.

To use a model hosted on a remote API (e.g. cloud hosted model), provide the base URL of
that API, e.g. https://api.anthropic.com/ or https://api.openai.com/

Do not include the /v1 suffix: Private AI Services will append that.

Format: uri
MinLength: 1

modelId string

modelId defines the name of the model used inside a request sent to the inference server.

For requests to ModelEndpoints managed by the Private AI Services instance in this namespace,
this can be an arbitrary string as long as the inference server was started with this identifier
(using PAIH_MODEL_ID).

For models managed by a Private AI Services instance in another namespace,
this must be the "routingName" of that remote ModelEndpoint.

For a remote API (e.g. a cloud hosted model) this should be the "modelId" defined by that API.

pais

MinLength: 1

tls BackendTLS

tls configures transport level security for the HTTPS connection to this backend.

{ verification:strict }

auth BackendAuth

auth configures authentication to this backend

InferenceGatewayRouteEngine

Underlying type: string

InferenceGatewayRouteEngine describes the valid types of engines for InferenceGatewayRoute.

Validation:

  • Enum: [Infinity vLLM LlamaCPP OpenAI GoogleOpenAI GoogleGemini GoogleVertexAI Mistral]

Appears In:

InferenceGatewayRouteMatches

InferenceGatewayRouteMatches describes the matching rules for a route

Appears In:
Field Description Default Validation

routingName RoutingName

routingName is the name that this namespace’s instance of Private AI Services
will use to route requests to this model. It may be different than the backend modelId.

MaxLength: 253
MinLength: 1

InferenceGatewayRouteModelTypeWithEngine

InferenceGatewayRouteModelTypeWithEngine describes a type of model inference and an engine to use for that inference for InferenceGatewayRoute

Appears In:
Field Description Default Validation

type ModelType

type defines if the model is designed for completions or embeddings

Enum: [Completions Embeddings]

engine InferenceGatewayRouteEngine

engine describes what inference engine is running this model.

For a remote model accessible via OpenAI-compatible chat completion API
endpoints, use "OpenAI". This is recommended for most 3rd-party service
integrations or sharing models across different instances of Private AI
Services.

For a remote model hosted on the Google Cloud Gemini Enterprise Agent
Platform (formerly Vertex AI), use "GoogleVertexAI". For accessing remote
models hosted on Google Cloud, this is the recommended engine.

For a remote model hosted on Google Cloud via the native Gemini API,
use "GoogleGemini".

For a remote model hosted on Google Cloud via its OpenAI compatibility
API, use "GoogleOpenAI". Note that the Google compatibility layer does
not support all features of the official OpenAI API. It is recommended
to use the Gemini Enterprise Agent Platform for models hosted on Google
Cloud instead.

The "Mistral" engine value is reserved for future use and is not
currently supported.

Enum: [Infinity vLLM LlamaCPP OpenAI GoogleOpenAI GoogleGemini GoogleVertexAI Mistral]

InferenceGatewayRouteSpec

InferenceGatewayRouteSpec specifies the details of the routing rule

Appears In:
Field Description Default Validation

type ModelType

type defines if the model is designed for completions or embeddings

Enum: [Completions Embeddings]

engine InferenceGatewayRouteEngine

engine describes what inference engine is running this model.

For a remote model accessible via OpenAI-compatible chat completion API
endpoints, use "OpenAI". This is recommended for most 3rd-party service
integrations or sharing models across different instances of Private AI
Services.

For a remote model hosted on the Google Cloud Gemini Enterprise Agent
Platform (formerly Vertex AI), use "GoogleVertexAI". For accessing remote
models hosted on Google Cloud, this is the recommended engine.

For a remote model hosted on Google Cloud via the native Gemini API,
use "GoogleGemini".

For a remote model hosted on Google Cloud via its OpenAI compatibility
API, use "GoogleOpenAI". Note that the Google compatibility layer does
not support all features of the official OpenAI API. It is recommended
to use the Gemini Enterprise Agent Platform for models hosted on Google
Cloud instead.

The "Mistral" engine value is reserved for future use and is not
currently supported.

Enum: [Infinity vLLM LlamaCPP OpenAI GoogleOpenAI GoogleGemini GoogleVertexAI Mistral]

matches InferenceGatewayRouteMatches

matches describes how traffic will get routed to this model by the local instance of Private AI Services

backend InferenceGatewayRouteBackend

backend describes where inference requests should be forwarded to

InferenceGatewayRouteStatus

InferenceGatewayRouteStatus reports the current status of an InferenceGatewayRoute

Validation:

  • MinProperties: 1

Appears In:
Field Description Default Validation

conditions Condition array

conditions represent the current state of the InferenceGatewayRoute.
Known condition types are: "Routable", "Reachable", "Ready"

observedGeneration integer

observedGeneration is the metadata.generation of the InferenceGatewayRoute resource that
this status reflects. Clients compare it to metadata.generation to know whether status
is up to date with the current spec.

InferenceServerCustomization

InferenceServerCustomization describes the extra customization that can be provided to the inference server

Appears In:
Field Description Default Validation

cliArgs string array

cliArgs describe additional command-line arguments to append when starting the inference engine

envVars EnvVar array

envVars describe additional environment variables to set when starting the inference engine

MaxItems: 1024

engineImage string

engineImage will override the inference server container image.
This can allow use of an inference engine not included in this release of
Private AI Services. But use this feature at your own risk.
Broadcom cannot support arbitrary customer-provided engine images.
In particular, be aware of potential version mismatches with node and host drivers.
Also note that Private AI Services sets some command-line flags when running
the inference server engine that may not work for you.

MinLength: 1

engineImageCompressedSize Quantity

engineImageCompressedSize should be set to the compressed size of the engineImage, if that field is set.

The compressed size of an image is the sum of the layers, and is typically displayed on the web UI of container registries like Docker Hub.
To find the compressed size of a container image you’ve pulled locally, run:
docker manifest inspect vllm/vllm-openai:v0.9.1 | jq '[.layers[].size] | add' | numfmt --to=iec-i

This field is used when sizing the /var/lib/containerd mount on the VKS worker nodes hosting this ModelEndpoint.
The formula for setting the full mount size may vary in the future.
Currently we configure containerdMountSize = 32Gi + 3 * engineImageCompressedSize
to account for other (non-engine) images, the compression ratio, and the fact that
both compressed and uncompressed data is stored in /var/lib/containerd.

In future versions of Private AI Services, this field may no longer be required and may be deprecated.

15Gi

sharedMemoryMountSize Quantity

sharedMemoryMountSize determines the size of the /dev/shm mount point inside
the inference engine container. If unset, it will use the Kubernetes default of 64Mi.

64Mi

tempMountSize Quantity

tempMountSize determines the size in bytes of the /tmp mount point available to the inference server.
If unset, it will default to 1Gi.

1Gi

Ingress

Ingress defines the desired state for how the Private AI Services runtime is accessible in the cluster

Appears In:
Field Description Default Validation

serviceType ServiceType

serviceType determines how the Private AI Services runtime will be exposed as a Kubernetes Service.
Defaults to LoadBalancer — which will create a Service of type LoadBalancer.
Valid options are ClusterIP, and LoadBalancer. See Service.Spec.Type for details.

LoadBalancer

Enum: [ClusterIP LoadBalancer]

tlsSecretRef LocalObjectReference

tlsSecretRef references a Secret of type kubernetes.io/tls in this namespace.
The Secret must contain keys tls.crt (PEM certificate chain) and tls.key (PEM private key).
When set, the operator uses this certificate for TLS termination on the PAIS ingress
instead of the cert-manager-managed certificate.
If unset, a certificate is automatically managed via cert-manager.

IngressRuntimeConfig

IngressRuntimeConfig defines configuration/tuning parameters for the Private AI Services ingress

Appears In:
Field Description Default Validation

deployment RuntimeDeploymentConfig

deployment specifies the desired configuration for the Private AI Services ingress. Modify only if
instructed by Broadcom support to increase concurrent requests.

LLMTracesConfig

LLMTracesConfig defines the configuration for trace collection.

Appears In:
Field Description Default Validation

endpoint string

endpoint specifies the target URL or address for the OpenTelemetry backend
where traces should be sent.

Format: uri
MinLength: 1

protocol OpenTelemetryTransportProtocol

protocol specifies the OpenTelemetry transport protocol.

Enum: [grpc http/protobuf]

projectName string

projectName specifies the "openinference.project.name" resource attribute in accordance
with the OpenInference specification.

MinLength: 1

headersSecretRef SecretKeySelector

headersSecretRef selects a key field within a Secret in this namespace
that should contain HTTP headers to be sent to the OpenTelemetry backend.

The value should be a semicolon-separated list of HTTP headers
in the format "Header-Name=header-value".

For example:

Authorization=Bearer%20token123; X-Custom-Header=custom-value

See https://www.w3.org/TR/baggage/#baggage-http-header-format

ManualUpgradeStrategy

ManualUpgradeStrategy is currently unsupported

Appears In:

MistralBackend

MistralBackend enables the Mistral AI engine for InferenceGatewayRoute. It is intentionally empty - its presence is the enablement marker. Additional configuration fields may be added here in the future.

Appears In:

ModelEndpoint

ModelEndpoint is a request to serve an AI model using a particular engine on 1 or more VMs

Field Description Default Validation

apiVersion string

pais.vmware.com/v1alpha1

kind string

ModelEndpoint

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec ModelEndpointSpec

status ModelEndpointStatus

MinProperties: 1

ModelEndpointSpec

ModelEndpointSpec defines the desired state of ModelEndpoint

Appears In:
Field Description Default Validation

type ModelType

type defines if the model is designed for completions or embeddings

Enum: [Completions Embeddings]

engine InferenceEngine

engine describes what inferencing engine should be used when running a particular model

Enum: [Infinity vLLM LlamaCPP]

model ModelEndpointSpecModel

model describes the model which should be run for inference

replicas integer

replicas describes how many instances of this model should be running

Note that currently, all replicas of a ModelEndpoint will run in a single vSphere Zone
which may be customized by spec.failureDomain.

1

Minimum: 0

routingName RoutingName

routingName defines how this model will appear in the data plane API
For example, the model "id" in /api/v1/compatibility/openai/v1/models
and elsewhere in the data plane API

MaxLength: 253
MinLength: 1

virtualMachineClassName string

virtualMachineClassName specifies the virtual machine class to use for running this model endpoint
This is used to create the virtual machine for a node pool in the VKS cluster.

Note this value may interact with FailureDomain. Ensure your chosen FailureDomain has hardware
sufficient to support this choice.

MinLength: 1

storageClassName string

storageClassName specifies the storage class to use for running this model endpoint
This is used to create the virtual machine for a node pool in the VKS cluster

MinLength: 1

failureDomain string

failureDomain specifies the failure domain (vSphere Zone) to use for running this model endpoint.
This string should be the metadata.name of a topology.tanzu.vmware.com Zone resource in this namespace.
This is used to create the virtual machine(s) for the VKS node pool running this model.

This choice of Zone may limit the available hardware (e.g. GPUs) available for this ModelEndpoint.
See also spec.VirtualMachineClassName.

Note that currently, all replicas of a ModelEndpoint will run in this 1 specified failureDomain.

If this value is unset, the system will fallback to a default value, which may be customized via the special
annotation "pais.vmware.com/default-failure-domain" on the PAISConfiguration resource in this namespace.
That annotation value (if set) should be the metadata.name of a topology.tanzu.vmware.com Zone resource
in this namespace.
If unset, but Zones are in the namespce, then the PAISConfiguration controller will
initialize that annotation on the PAISConfiguration. A user may modify it.
ModelEndpoint spec.failureDomain will always take precedence over that annotation.

MinLength: 1

inferenceServerCustomization InferenceServerCustomization

inferenceServerCustomization describes additional customization that can be appended
when starting the inference engine

{ }

overrides string

overrides is not yet implemented.

Once implemented, it will enable a user to provide ytt overlays to customize the
inference components, including the underlying node settings.
Values provided here will take precedence over all other fields on this resource.
Users can easily break their system by setting this field, and should be discouraged from using it unless necessary.

ModelEndpointSpecModel

ModelEndpointSpecModel describes a model which should be run for inference

Appears In:
Field Description Default Validation

ociRef string

ociRef is a reference to an OCI artifact containing the model to run for inference.
We expect that this artifact is pushed using the Private AI Services CLI (vcf pais models push …​)

MaxLength: 1024
MinLength: 1

pullSecrets LocalObjectReference array

pullSecrets describe a list of references to Kubernetes secrets to use
when pulling this model from the remote OCI registry (e.g. Harbor).
The same secret is also available for pulling the engine image, e.g.
when setting spec.inferenceServerCustomization.engineImage to use an authenticated registry.
The secrets should have the same format as Pod spec.imagePullSecret
See: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#registry-secret-existing-credentials

Note
 Currently this list may contain at most 1 item. In the future,
multiple secrets may be supported.

We recommend the engine image be hosted in a different repository than the model
although they may be in the same registry.
If using different registries, ensure the JSON "auths" block lists both.

MaxItems: 1

ModelEndpointStatus

ModelEndpointStatus defines the observed state of ModelEndpoint

Validation:

  • MinProperties: 1

Appears In:
Field Description Default Validation

conditions Condition array

conditions update as changes occur in the status.
They display the current state of the model endpoint

observedGeneration integer

observedGeneration describes the generation observed by the ModelEndpoint controller.

children ChildStatus array

children reports status information about child resources owned by this ModelEndpoint

controllerVersion string

controllerVersion reports a version string for the controller-manager which has most recently reconciled this resource

MinLength: 1

ModelType

Underlying type: string

ModelType describes the valid types of models.

Validation:

  • Enum: [Completions Embeddings]

Appears In:

ModelTypeWithEngine

ModelTypeWithEngine describes a type of model inference and an engine to use for that inference for ModelEndpoint

Appears In:
Field Description Default Validation

type ModelType

type defines if the model is designed for completions or embeddings

Enum: [Completions Embeddings]

engine InferenceEngine

engine describes what inferencing engine should be used when running a particular model

Enum: [Infinity vLLM LlamaCPP]

NonInteractiveGrants

NonInteractiveGrants holds dev-only non-interactive grant overrides for the staticCredentials auth provider.

Appears In:
Field Description Default Validation

clientCredentials ClientCredentialsGrant

clientCredentials enables the OAuth2 client_credentials grant for all
staticCredentials providers when present (even as {}). Access tokens are
capped at a hardcoded 12 h TTL.

NvidiaGPUOperatorObservedState

NvidiaGPUOperatorObservedState holds the last-observed state of the NVIDIA GPU Operator running in the VKS guest cluster.

Appears In:
Field Description Default Validation

clusterPolicySpec string

clusterPolicySpec is the raw spec of the nvidia.com/v1 ClusterPolicy named
"cluster-policy" in the gpu-operator namespace of the VKS guest cluster. It
reflects the fully-resolved Helm values that were applied to the GPU Operator,
stored as a compact JSON string.

MinLength: 1

clusterPolicyState string

clusterPolicyState is the value of status.state on the ClusterPolicy
(e.g. "ready", "notReady"). Empty when not yet reported by the operator.

MinLength: 1

clusterPolicyConditions Condition array

clusterPolicyConditions mirrors the status.conditions[] reported by the
ClusterPolicy (e.g. type=Ready, type=Error). These follow the standard
Kubernetes condition format and are copied verbatim from the guest cluster.

NvidiaGPURuntimeConfig

NvidiaGPURuntimeConfig defines NVIDIA GPU Driver software configuration (e.g. license config, nvcr.io image pull secrets etc.)

Appears In:
Field Description Default Validation

gpuDriverType GPUDriverType

gpuDriverType determines which type of NVIDIA GPU driver to use.

Allowed values are NVAIE (default) and OSS.

NVAIE supports both vGPU and passthrough devices, and requires a license key and pull secret from NVIDIA.
In this mode, the GPU Operator will be configured to use the proprietary vGPU-capable driver.

OSS supports passthrough devices (no vGPU support). In this case the licenseConfigRef must not be set.
In this mode, the GPU Operator will use its default driver configuration,
which pulls the open-source driver from public NVIDIA repositories.
You can still customize the driver configuration using gpuOperatorOverridesRef
to specify driver versions, repositories, etc.

NVAIE

Enum: [NVAIE OSS]

licenseConfigRef LocalObjectReference

licenseConfigRef names a ConfigMap in this namespace containing Nvidia license access token and Nvidia GRID configuration.
ConfigMap data must have keys named client_configuration_token.tok and gridd.conf.
This pull secret is only for the driver image pull, and not for other gpu-operator container images.
This field is required when gpuDriverType is NVAIE or unset.
If gpuDriverType is OSS, then this field must not be set.

imagePullSecretRef LocalObjectReference

imagePullSecretRef names a Secret in this namespace containing NGC access token ("personal key") to be used as ImagePullSecret for access to Nvidia GPU operator container images (e.g. gpu-operator, vGPU driver). Secret must be of type kubernetes.io/dockerconfigjson.

gpuOperatorOverridesRef LocalObjectReference

gpuOperatorOverridesRef names a ConfigMap in this namespace containing Helm chart values for Nvidia gpu-operator. ConfigMap data must have a key named values.yaml with content as overrides for gpu-operator Helm chart input parameters.

gpuOperatorVersion string

gpuOperatorVersion specifies the version of the NVIDIA GPU Operator Package to install.
The version must match a package version available in the GPU operator PackageRepository
(e.g. "25.10.1"). Defaults to a version known to be compatible with this PAIS release.

25.10.1

MinLength: 1
Pattern: ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][a-zA-Z0-9._-]+)?$

driver Driver

driver selects the GPU driver.

MaxProperties: 1
MinProperties: 1

OIDCCustomProvider

OIDCCustomProvider describes a customizable OpenID Connect authentication provider. It supports direct discovery URL configuration, optional static discovery config, JWKS caching, response header injection, and CEL-based authentication/authorization rules.

The OIDC provider must issue Access Tokens in JWT (JSON Web Token) format; opaque tokens requiring server-side introspection are not supported.

Appears In:
Field Description Default Validation

discoveryUrl string

discoveryUrl is the URL of the OpenID Connect discovery document
(e.g. "https://my-idp.example.com/.well-known/openid-configuration").
Either discoveryUrl or discoveryConfigRef must be set.

Format: uri

insecureSkipTLSVerify boolean

insecureSkipTLSVerify disables TLS certificate verification for HTTP requests made
by this provider.
This connection method is insecure and not recommended for production use.

discoveryConfigRef ConfigMapKeySelector

discoveryConfigRef references a ConfigMap key containing a static OpenID Connect
discovery configuration document. Useful when the IdP does not expose a
well-known discovery endpoint.
Either discoveryUrl or discoveryConfigRef must be set.

signingKeysSecretRef LocalObjectReference

signingKeysSecretRef references a Secret in the current namespace containing the
PEM-encoded public keys used to verify tokens issued by the IdP. Each entry
in the Secret represents one key: the entry key is the key ID (kid) and
the entry value is the public key in PEM format.

scope string array

scope defines what scopes are requested when initiating the auth flow.
Including the "profile" scope is recommended so the PAIS UI can display
the signed-in user’s name (sourced from the "name" or "preferred_username"
ID-token claims).

tokenMatch string array

tokenMatch is a list of CEL expressions evaluated against the unverified
token to determine if this provider should handle it. All expressions must
evaluate to true for the provider to match the token. If empty, the provider
matches tokens by comparing the "iss" value against the issuer from the
discovery document.

items:MinLength: 1

validation OIDCCustomValidationRule array

validation defines CEL expression rules for authentication and authorization.
Each rule specifies a CEL expression and a status code to return when the
expression evaluates to false. Expressions are evaluated against the
authentication context.

OIDCCustomValidationDenyStatus

Underlying type: string

OIDCCustomValidationDenyStatus defines the HTTP status code returned when an OIDC custom validation rule denies a request.

Validation:

  • Enum: [UNAUTHORIZED FORBIDDEN]

Appears In:

OIDCCustomValidationDenyWith

OIDCCustomValidationDenyWith defines the response to return when a validation expression evaluates to false.

Appears In:
Field Description Default Validation

statusCode OIDCCustomValidationDenyStatus

statusCode is the HTTP status code to return when the CEL expression evaluates to false.

Enum: [UNAUTHORIZED FORBIDDEN]

message string

message is a human-readable static error message returned in the response body
when the CEL expression evaluates to false.

MinLength: 1

messageExpression string

messageExpression is a CEL expression that evaluates to a string error message
returned in the response body when the validation expression evaluates to false.
Expressions are evaluated against the authentication context.

MinLength: 1

OIDCCustomValidationRule

OIDCCustomValidationRule defines a single CEL expression validation rule with an associated HTTP status code to return on failure.

Appears In:
Field Description Default Validation

expression string

expression is a CEL expression that must evaluate to true for the request to pass this rule.
Expressions are evaluated against the authentication context.

MinLength: 1

denyWith OIDCCustomValidationDenyWith

denyWith defines the response returned when the CEL expression evaluates to false.

OIDCProvider

OIDCProvider describes the details of the upstream OIDC provider Private AI Services will use.

The OIDC provider must issue Access Tokens in JWT (JSON Web Token) format; opaque tokens requiring server-side introspection are not supported.

Appears In:
Field Description Default Validation

issuerUrl string

issuerUrl is the url of an OpenID provider endpoint that publishes the metadata for clients to use to construct a request to an OpenID server.
NOTE: The provider must support the discovery endpoint in the form of IssuerUrl + "/.well-known/openid-configuration"

Format: uri
MinLength: 1

insecureSkipTLSVerify boolean

insecureSkipTLSVerify disables TLS certificate verification for HTTP requests made
by this provider.
This connection method is insecure and not recommended for production use.

scope string array

scope defines what scopes are requested when initiating the auth flow.
Including the "profile" scope is recommended so the PAIS UI can display
the signed-in user’s name (sourced from the "name" or "preferred_username"
ID-token claims).

clientId string

clientId is the client ID used for communicating with the OIDC provider. The client must
be configured to support authorization flows with PKCE (Proof Key for Code Exchange) for
this Private AI Services instance.

MinLength: 1

extraAudiences string array

extraAudiences allows for additional OAuth2.0 client that Private AI Services will accept when validating the Access Token.

extraIssuers string array

extraIssuers allows for additional OIDC issuers that Private AI Services will accept when validating the Access Token.

groupsClaim string

groupsClaim is an OIDC claim that the Private AI Services runtime will expect to exist in the clientId Token.
This group claim should map to the groups claim for your upstream OIDC provider.

groups

MinLength: 1

authorizedGroups string array

authorizedGroups is the list of group names that are used to authorize user access
to this Private AI Services instance. If a non-empty list is provided, a successfully
authenticated user must be in at least one of the provided groups to be granted access.
If an empty list is provided, no group membership is required and any authenticated
user is granted access.

ObservabilitySpec

ObservabilitySpec configures observability features

Validation:

  • MinProperties: 1

Appears In:
Field Description Default Validation

prometheusRuntime PrometheusRuntimeConfig

prometheusRuntime deploys and configures additional components to collect metrics from
the Private AI Services instance in this namespace.
If this value is unset, metrics collection is disabled and those additional components will not be deployed.

llmTraces LLMTracesConfig

llmTraces configures collection of traces from LLM components
and forwarding to an OpenTelemetry backend.
If unset, trace collection is disabled.

OpenTelemetryTransportProtocol

Underlying type: string

OpenTelemetryTransportProtocol defines the transport protocol for OpenTelemetry export. See https://opentelemetry.io/docs/specs/otlp

Validation:

  • Enum: [grpc http/protobuf]

Appears In:

PAISConfiguration

PAISConfiguration is the Schema for the paisconfigurations API

Field Description Default Validation

apiVersion string

pais.vmware.com/v1alpha1

kind string

PAISConfiguration

metadata ObjectMeta

Refer to Kubernetes API documentation for fields of metadata.

spec PAISConfigurationSpec

status PAISConfigurationStatus

MinProperties: 1

PAISConfigurationSpec

PAISConfigurationSpec defines the desired state of the Private AI Services instance within this namespace

Appears In:
Field Description Default Validation

clientTls ClientTLS

clientTls configures TLS/SSL clients used by Private AI Services to connect to remote services

worker WorkerConfig

worker sets configuration for the Private AI Services Data Indexing and Retrieval workers

database Database

database defines the connection parameters for the PostgreSQL database used by the Private AI Services.

The database is required when at least one of the Agent Builder or Data Indexing and
Retrieval components is enabled (which is the default). It may only be omitted when
both runtimeConfig.disableAgentBuilder and runtimeConfig.disableIndexing are true.

auth Auth

auth defines the authentication configuration for the Private AI Services API and UI

ingress Ingress

ingress defines how the Private AI Services will be accessible
If unset, a Service of type LoadBalancer will be created to expose this Private AI Services instance

{ serviceType:LoadBalancer }

vksControlPlane VKSControlPlaneConfig

vksControlPlane specifies attributes of PAIS-managed vSphere Kubernetes Service cluster control plane

nvidiaConfig NvidiaGPURuntimeConfig

nvidiaConfig defines pointers to configuration needed for Nvidia NVAIE software

runtimeConfig RuntimeConfig

runtimeConfig defines the desired state for the Private AI Services runtime configuration

upgradeStrategy UpgradeStrategy

upgradeStrategy defines how this instance of Private AI Services will be upgraded
when a new version is installed into this Supervisor.

Currently only the "automatic" strategy is supported, which means that this instance will be
automatically upgraded to the latest version installed into this Supervisor.
Future versions of Private AI Services will provide namespace-users more control over this.

{ automatic:map[] }

observability ObservabilitySpec

observability configures metrics and trace collection for this instance of Private AI Services.
If unset, metrics and trace features are disabled for components in this namespace.

MinProperties: 1

defaultStorageClassName string

defaultStorageClassName sets the storage class used by components of this instance of Private AI Services.
New deployments should set this field (it is optional only for backwards compatibility).

MinLength: 1

PAISConfigurationStatus

PAISConfigurationStatus defines the observed state of PAISConfiguration

Validation:

  • MinProperties: 1

Appears In:
Field Description Default Validation

conditions Condition array

conditions update as changes occur to this resource

ingressServiceRef LocalObjectReference

ingressServiceRef references the Service where this instance of Private AI Services is reachable

observedGeneration integer

observedGeneration describes the generation of this resource observed by the PAISConfiguration controller.

children ChildStatus array

children reports status information about child resources owned by this PAISConfiguration

controllerVersion string

controllerVersion reports a version string for the controller-manager which has most recently reconciled this resource

MinLength: 1

databaseRequired boolean

databaseRequired reports whether the current spec configuration requires a
PostgreSQL database for the PAIS runtime. It is true when either Agent Builder or
Data Indexing And Retrieval is enabled.

plannedComponents string array

plannedComponents lists the component names that the controller
plans to deploy for the PAIS runtime given the current spec configuration.

gpuOperator NvidiaGPUOperatorObservedState

gpuOperator reports the last-observed state of the NVIDIA GPU Operator deployed
in the VKS guest cluster. It is populated on every reconcile when nvidiaConfig is
set and is present regardless of the overall Ready condition.

PrometheusRuntimeConfig

PrometheusRuntimeConfig defines the desired state for the metrics collection configuration.

Appears In:
Field Description Default Validation

metricsRetention string

metricsRetention defines limit on how long (in number of days) to keep observability metrics data.

90d

Pattern: ^[1-9][0-9]*[d]$

storageClassName string

storageClassName can be used to customize the storage class for metrics data.
If unset, spec.defaultStorageClassName will be used instead.

MinLength: 1

prometheusOverridesRef LocalObjectReference

prometheusOverridesRef is not yet supported.
Once support is in place it, can names a ConfigMap in this namespace with configuration overrides for
Prometheus components deployed to support metrics colletion. This ConfigMap data must have a key
named values.yaml with content as overrides for Prometheus input parameters. This field is usually
not expected to be set and should be used only for advanced use cases where Prometheus configuration
choices made by PAIS are insufficient or undesirable.

RoutingName

Underlying type: string

RoutingName a user-readable string to route to a particular model

Validation:

  • MaxLength: 253

  • MinLength: 1

Appears In:

RuntimeConfig

RuntimeConfig defines configuration/tuning parameters for all Private AI Services components

Appears In:
Field Description Default Validation

logVerbosity RuntimeConfigLogVerbosity

logVerbosity specifies the desired log verbosity used for all Private AI Services components.
Modify only if instructed by Broadcom support to collected detailed error logs.

Enum: [Debug Info Warning Error]

apiRuntimeConfig APIRuntimeConfig

apiRuntimeConfig specifies the desired state of the configuration for the Private AI Services API

ingressRuntimeConfig IngressRuntimeConfig

ingressRuntimeConfig specifies the desired state of the configuration for the Private AI Services ingress

indexingWorkersRuntimeConfig IndexingWorkersRuntimeConfig

indexingWorkersRuntimeConfig specifies the desired state of the configuration for the
Private AI Services Indexing workers.
If indexing is disabled (see disableIndexing), any overrides in this field are ignored.

indexingMCPServerRuntimeConfig IndexingMCPServerRuntimeConfig

indexingMCPServerRuntimeConfig specifies the desired state of the configuration for the
Private AI Services Indexing MCP server.
If indexing is disabled (see disableIndexing), any overrides in this field are ignored.

disableAgentBuilder boolean

disableAgentBuilder disables the Agent Builder component of Private AI Services
when set to true. Agent Builder is enabled by default; when disabled, agent-related
APIs and resources (e.g., agent creation and interactions) are not deployed. If the
component has been previously enabled, any data will remain in the database, but
new agent creation and interactions will not be possible.

Agent Builder and Data Indexing and Retrieval (see disableIndexing) can be disabled
independently. When Agent Builder is enabled but Data Indexing and Retrieval is
disabled, agents that reference a knowledge base will report an error status because
the knowledge-base integration is not available.

disableIndexing boolean

disableIndexing disables the Data Indexing and Retrieval component of Private AI
Services when set to true. Data Indexing and Retrieval is enabled by default; when
disabled, knowledge base APIs and resources are not available. If the component has
been previously enabled, any data will remain in the database, but new data source,
KB, or index declarations, or MCP tool interactions will not be possible.

telemetryRuntimeConfig TelemetryRuntimeConfig

telemetryRuntimeConfig configures telemetry data collection for this instance of Private AI Services.

RuntimeConfigLogVerbosity

Underlying type: string

RuntimeConfigLogVerbosity describes the valid types of log levels of the Private AI Services API.

Validation:

  • Enum: [Debug Info Warning Error]

Appears In:

RuntimeDeploymentConfig

RuntimeDeploymentConfig defines configuration/tuning parameters for a Private AI Services component

Appears In:
Field Description Default Validation

replicas integer

replicas specifies the desired replicas for the Private AI Services component.

1

Minimum: 1

resources ResourceRequirements

resources describes the desired compute resource requirements for the
Private AI Services component.

StaticCredentialsAPITokens

StaticCredentialsAPITokens configures Personal Access Token (PAT) issuance for a staticCredentials auth provider.

Appears In:
Field Description Default Validation

expirationDefault string

expirationDefault is the PAT lifetime applied when a mint request does not
specify a duration. Expressed as a Go duration string (e.g. "720h", "1h30m").
Supported units: h (hours), m (minutes), s (seconds). Defaults to "720h" (30 days).

720h

MaxLength: 32
Pattern: `^[0-9]+(h

m

s)([0-9]+(h

m

s))*$`

expirationMax string

expirationMax caps the maximum lifetime a caller may request when minting an
API token. Mint requests exceeding this value are rejected with HTTP 400.
Expressed as a Go duration string (e.g. "8760h", "24h"). Defaults to "8760h" (1 year).

8760h

MaxLength: 32
Pattern: `^[0-9]+(h

m

s)([0-9]+(h

m

s))*$`

StaticCredentialsAccessTokens

StaticCredentialsAccessTokens configures the lifetime of OIDC access and id tokens issued by a staticCredentials auth provider.

Appears In:
Field Description Default Validation

ttl string

ttl is the lifetime applied to issued access tokens and id tokens.
Expressed as a Go duration string (e.g. "1h", "15m", "30s"). Supported units:
h (hours), m (minutes), s (seconds). Defaults to "1h".

1h

MaxLength: 32
Pattern: `^[0-9]+(h

m

s)([0-9]+(h

m

s))*$`

StaticCredentialsProvider

StaticCredentialsProvider describes a built-in authentication provider backed by a static user database stored in a Kubernetes Secret. The provider runs an embedded OIDC issuer, enabling interactive browser login and optionally issuing long-lived Personal Access Tokens (PATs) for non-interactive API clients.

Security note: this is a built-in (embedded) IdP. Unlike external OIDC providers, all credential exchanges go through the PAIS API surface itself - there is no separate third-party identity provider. A compromise of the PAIS service is also a compromise of the credential store. This provider is designed for demos, labs, and proof-of-concept deployments only and must not be used in environments with production data or network exposure beyond a trusted lab network.

Appears In:
Field Description Default Validation

issuerBaseUrl string

issuerBaseUrl is the externally reachable HTTPS base URL for this PAIS deployment,
for example https://pais.local. The controller derives this provider’s OIDC
issuer URL as <issuerBaseUrl>/auth/static/<name>/. When omitted, the controller
derives the base URL from the LoadBalancer Service IP assigned to this PAIS
instance; omitting this field requires spec.ingress.serviceType=LoadBalancer.

MaxLength: 2048
Pattern: ^https://

credentialsSecretRef SecretKeySelector

credentialsSecretRef references the Secret key containing the user database JSON.
The Secret must exist in the same namespace as this PAISConfiguration.
See the staticCredentials documentation for the expected JSON schema.

apiTokens StaticCredentialsAPITokens

apiTokens configures API token issuance and verification.
When omitted, the provider supports interactive OIDC login only; no API tokens
are issued or accepted.

accessTokens StaticCredentialsAccessTokens

accessTokens configures the lifetime of OIDC access and id tokens issued by
this provider during the authorization_code grant and on refresh. When
omitted, defaults to "1h" for both access and id tokens.

refreshTokens StaticCredentialsRefreshTokens

refreshTokens configures OAuth2 refresh-token issuance. When omitted, refresh
tokens are not issued and the OIDC discovery document advertises only the
authorization_code grant. When set, clients that request scope=offline_access
receive a refresh_token alongside the access/id tokens.

StaticCredentialsRefreshTokens

StaticCredentialsRefreshTokens configures OAuth2 refresh-token issuance for a staticCredentials auth provider.

Appears In:
Field Description Default Validation

ttl string

ttl is the lifetime of each issued refresh token. Each successful refresh
exchange rotates the refresh token and resets this window. Expressed as a Go
duration string (e.g. "720h", "24h"). There is no hard upper bound - operators
choose this value to fit their session-security model. Defaults to "720h" (30 days).

720h

MaxLength: 32
Pattern: `^[0-9]+(h

m

s)([0-9]+(h

m

s))*$`

TLSVerification

Underlying type: string

TLSVerification describes how to verify TLS connections to the backend.

Validation:

  • Enum: [strict caOnly none mutual]

Appears In:

TelemetryRuntimeConfig

TelemetryRuntimeConfig defines configuration for telemetry data collection.

Appears In:
Field Description Default Validation

disabled boolean

disabled specifies if telemetry data collection (usage metrics) is disabled.
When false (default), usage data is sent to Broadcom to help improve the product.

schedule string

schedule is a cron schedule for the telemetry CronJob (e.g. "*/1 * * * *" for every minute).
If empty, the controller uses a random time every Sunday to avoid many instances hitting the backend at once.

supercolliderUrl string

supercolliderUrl is the URL for the SuperCollider telemetry collector. If empty, the telemetry collector uses the default SuperCollider URL.

collectionTimeoutSeconds integer

collectionTimeoutSeconds is the maximum time in seconds allowed for telemetry collection (all collectors). If unset, the app default (60s) is used.

Minimum: 1

uploadTimeoutSeconds integer

uploadTimeoutSeconds is the maximum time in seconds for uploading telemetry to SuperCollider. If unset, the app default (35s) is used.

Minimum: 1

UpgradeStrategy

UpgradeStrategy defines how this instance of Private AI Services will be upgraded

Appears In:
Field Description Default Validation

automatic AutomaticUpgradeStrategy

automatic means the Supervisor Service will manage upgrades of this instance of Private AI Services

manual ManualUpgradeStrategy

manual is currently unsupported

VCFAProvider

VCFAProvider describes an authentication provider backed by VMware Cloud Foundation Automation (VCFA).

Appears In:
Field Description Default Validation

issuerUrl string

issuerUrl is the OIDC issuer URL of the VCFA authentication endpoint.
The provider must support the discovery endpoint at issuerUrl + "/.well-known/openid-configuration".

Format: uri
MinLength: 1

clientId string

clientId identifies the VCFA relying party registered for this PAIS instance.
Users authenticate through the VCFA portal using this relying party.

MinLength: 1

insecureSkipTLSVerify boolean

insecureSkipTLSVerify disables TLS certificate verification for HTTP requests made
by this provider.
This connection method is insecure and not recommended for production use.

scope string array

scope defines what scopes are requested when initiating the auth flow.

allowedOrgs string array

allowedOrgs is a static list of VCFA organization names permitted to access
this Private AI Services instance. Mutually exclusive with orgConfigRef.
If the list is empty, no tenant will be granted access.

orgConfigRef ConfigMapKeySelector

orgConfigRef references a ConfigMap key containing a list of VCFA organization names
permitted to access this Private AI Services instance. This list supports hot-reload
without an auth-service restart. Mutually exclusive with allowedOrgs.
If the referenced list is empty, no tenant will be granted access.

authorizedRoles string array

authorizedRoles is the list of VCFA role names required to access this Private AI Services
instance. If non-empty, an authenticated user must hold at least one of the listed roles
to be granted access.

authorizedGroups string array

authorizedGroups is the list of VCFA group names required to access this Private AI Services
instance. If non-empty, an authenticated user must hold at least one of the listed groups
to be granted access.

VKSControlPlaneConfig

VKSControlPlaneConfig defines configuration for the control plane of the VKS cluster used by Private AI Services.

Appears In:
Field Description Default Validation

virtualMachineClassName string

virtualMachineClassName specifies the virtual machine class to use for the control plane node of the VKS cluster.
Note this does not affect the virtual machine class used to run ModelEndpoint inference servers.

MinLength: 1

storageClassName string

storageClassName can be used to customize the storage of the control plane node of the
VKS cluster used by Private AI Services.
If unset, spec.defaultStorageClassName will be used instead.
Note this does not affect the storage used for ModelEndpoint inference servers.

MinLength: 1

upgradeStrategy VKSUpgradeStrategy

upgradeStrategy configures how the backing VKS cluster is upgraded.
Currently, only the Manual strategy is available.
In future releases, other upgrade strategies will be available.

If unset, the cluster upgrade strategy will not be under user control.

In the current version of Private AI Services, an unset value is equivalent to a Manual strategy using
a particular VKS version known to Private AI Services at the time it was released.

Future versions of Private AI Services may change the default behavior for this field, e.g. to automatically
upgrade the VKS cluster to the latest available patch release.

VKSManualUpgradeStrategy

VKSManualUpgradeStrategy describes the manual upgrade strategy for upgrading the VKS cluster

Appears In:
Field Description Default Validation

version string

version specifies the Kubernetes Release version to use for the VKS cluster hosting ModelEndpoints.

A valid version string is formatted like "v1.32.0+vmware.6-fips-vkr.2"

To list versions available in your Supervisor cluster, run
kubectl get kubernetesreleases | grep v1.3

Changing this field will cause temporary downtime for ModelEndpoints with only 1 replica.
This is because the VKS Cluster is deployed with maxUnavailable: 1 in order to not require
customers to over-provision scarce GPUs.

Please test changes in a non-production environment, and plan for an outage window.

Only use release versions which have been documented as supported for PAIS.

Warning: Other version strings, such as "v1.31" may be accepted by the API,
but could result in unexpected behavior, including unexpected downtime for ModelEndpoints
at arbitrary times in the future (not just when this field is changed).
This issue will be fixed in a future version.

It is also possible to specify the version by setting configuration on the PAIS
supervisor service when it is installed, via the key "supervisor_service.vks.version"
If both fields are set, then this namespace-scoped custom-resource has precedence over
the supervisor-service configuration.

MinLength: 1
Pattern: ^v([0-9]+)\.([0-9]+)[\.0-9a-zA-Z\-\+]+$

VKSUpgradeStrategy

VKSUpgradeStrategy describes the strategy for upgrading the VKS cluster

Appears In:
Field Description Default Validation

manual VKSManualUpgradeStrategy

manual upgrade strategy means that the VKS Kubernetes release version is set by
the Version field.

WorkerConfig

WorkerConfig defines the configuration for Data Indexing and Retrieval workers

Appears In:
Field Description Default Validation

storageClassName string

storageClassName is now deprecated.

Deprecated: Set the top-level spec.defaultStorageClassName instead.

As of Private AI Services 2.1, Data Indexing workers use ephemeral storage (emptyDir volumes).
However, the Valkey storage will fall back to this value if spec.defaultStorageClassName is unset.

MinLength: 1