feat(controller): add s3:// model source via curl --aws-sigv4 (#1098)#1125
Merged
Merged
Conversation
…ntech#1098) Support s3:// (S3-compatible: MinIO, etc.) as a Model.spec.source, fetched by the model-downloader init container using curl SigV4. Additive to the existing string source; no CRD refactor. - isS3Source / parseS3Source in source.go; isHFRepoSource rejects s3:// so an s3 URL is never misclassified as a HuggingFace repo. - ModelSpec.SourceSecretRef (corev1.LocalObjectReference) supplies the S3-compatible credentials/endpoint/region via a Secret, wired as EnvFrom on the init container (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_ENDPOINT_URL). - Source validation Pattern widened to allow the s3 scheme. - buildModelInitCommand emits a curl --aws-sigv4 path-style download with the same idempotency wrapper as the http branch; modelInitEnvVars adds S3_BUCKET / S3_KEY. - config/samples/model_s3_source.yaml (Secret + Model). - Unit tests for parse, classification, init command, and env wiring. Full end-to-end pull requires a live S3/MinIO and is validated manually; the parse plus command/env construction is the in-workspace-provable slice. Fixes defilantech#1098 Signed-off-by: Christopher Maher <chris@mahercode.io>
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Merged
eleboucher
pushed a commit
to eleboucher/homelab
that referenced
this pull request
Jul 14, 2026
…5 ➔ 0.9.6) (#1591) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/defilantech/charts/llmkube](https://github.com/defilantech/LLMKube) | patch | `0.9.5` → `0.9.6` | --- ### Release Notes <details> <summary>defilantech/LLMKube (ghcr.io/defilantech/charts/llmkube)</summary> ### [`v0.9.6`](https://github.com/defilantech/LLMKube/blob/HEAD/CHANGELOG.md#096-2026-07-14) [Compare Source](defilantech/LLMKube@v0.9.5...v0.9.6) ##### Features - **api:** add GPUQuota CRD types for multi-tenant GPU governance ([#​1101](defilantech/LLMKube#1101)) ([5dd867a](defilantech/LLMKube@5dd867a)) - **controller:** add GPUQuota status reconciler ([#​1117](defilantech/LLMKube#1117)) ([1d583e4](defilantech/LLMKube@1d583e4)) - **controller:** add GPUQuota validating webhook for InferenceService ([#​1118](defilantech/LLMKube#1118)) ([26804bd](defilantech/LLMKube@26804bd)) - **controller:** add s3:// model source via curl --aws-sigv4 ([#​1098](defilantech/LLMKube#1098)) ([#​1125](defilantech/LLMKube#1125)) ([ed35142](defilantech/LLMKube@ed35142)) - **foreman:** preserve a coder's gate-failed branch instead of discarding it ([#​1115](defilantech/LLMKube#1115)) ([bc39c77](defilantech/LLMKube@bc39c77)) - **helm:** gate InferenceService quota webhook and tenant RBAC behind multitenancy toggle ([#​1122](defilantech/LLMKube#1122)) ([26a994e](defilantech/LLMKube@26a994e)) - **quota:** add GPUQuota admission decision function ([#​1107](defilantech/LLMKube#1107)) ([4897093](defilantech/LLMKube@4897093)) - **runtime:** close out the SGLang kitchen-sink ([#​1060](defilantech/LLMKube#1060)): minor flags, accept thresholds, typed LoRA adapters, LoRAAdapter CRD ([#​1103](defilantech/LLMKube#1103)) ([8edf8bd](defilantech/LLMKube@8edf8bd)) ##### Bug Fixes - **foreman:** honor GateProfile source extensions in scope-overlap issue-ref extraction ([#​1120](defilantech/LLMKube#1120)) ([0c20431](defilantech/LLMKube@0c20431)) ##### Documentation - **samples:** add air-gapped local file-path model source example ([#​1099](defilantech/LLMKube#1099)) ([#​1124](defilantech/LLMKube#1124)) ([913ff3d](defilantech/LLMKube@913ff3d)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1591
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
s3://(S3-compatible: MinIO, etc.) as aModel.spec.source, fetched by the model-downloader init container usingcurl --aws-sigv4. One additive slice of the #53 air-gapped epic; the existing stringsourceis untouched (no CRD refactor).Why
Operators in private/air-gapped networks want to stage models from internal S3-compatible storage so no public egress is required. This wires that path end-to-end with the runtime already in the init image (
curlimages/curl8.x supports SigV4), so no new image or air-gap mirror is needed.How
isS3Source/parseS3Sourceinsource.go;isHFRepoSourcenow rejectss3://so an s3 URL is never misclassified as a HuggingFace repo.ModelSpec.SourceSecretRef(corev1.LocalObjectReference) supplies the S3 credentials/endpoint/region via a Secret, wired asEnvFromon the init container (AWS_ACCESS_KEY_ID,AWS_SECRET_ACCESS_KEY,AWS_REGION,AWS_ENDPOINT_URL).SourcevalidationPatternwidened to allow thes3scheme (single-backslash raw-string marker; CRDs regenerated).buildModelInitCommandemits a path-stylecurl --aws-sigv4 aws:amz:${AWS_REGION}:s3 ...download with the same idempotency wrapper as the http branch;modelInitEnvVarsaddsS3_BUCKET/S3_KEY.config/samples/model_s3_source.yaml: a Secret + Model example.Testing
go build ./...,go vet ./...clean.make validate-samplespasses (24/24), including the newmodel_s3_source.yaml.make manifests && make generate && make chart-crdsproduces no drift (CRD Sync clean); regenerated deepcopy retains theLoRAAdaptermethods from feat(runtime): close out the SGLang kitchen-sink (#1060): minor flags, accept thresholds, typed LoRA adapters, LoRAAdapter CRD #1103.Checklist
make test/ envtest greenmake manifests+make chart-crdsproduce no driftmake validate-samplespassesFixes #1098AI assistance
Implemented via the Foreman agentic-coding harness (declared-then-verified coder gate), then verified and rebased onto current
mainby the author. Band-3 disclosure per the project's AI-assisted contribution policy.Fixes #1098