Merge branch 'main' into feat/enhance-evidence-collection

Author: yuanchen8911

.github/copilot-instructions.md

@@ -872,14 +872,9 @@ make e2e-tilt
 ### Agent Deployment Pattern
 
 ```bash
-# Deploy agent for automated snapshots
-kubectl apply -f deployments/aicr-agent/1-deps.yaml
-kubectl apply -f deployments/aicr-agent/2-job.yaml
-
-# Check logs
-kubectl logs -n gpu-operator job/aicr
+# Deploy agent for automated snapshots (CLI handles RBAC + Job lifecycle)
+aicr snapshot --output snapshot.yaml
 
-# Get snapshot from ConfigMap
-kubectl get configmap aicr-snapshot -n gpu-operator \
-  -o jsonpath='{.data.snapshot\.yaml}' > snapshot.yaml
+# Or write to ConfigMap
+aicr snapshot --output cm://gpu-operator/aicr-snapshot
 ```

demos/e2e.md

@@ -96,7 +96,6 @@ curl -s "https://aicr.dgxc.io/v1/recipe?service=eks&accelerator=l40&intent=train
 
 ```shell
 aicr snapshot \
-    --deploy-agent \
     --namespace gpu-operator \
     --node-selector nodeGroup=customer-gpu \
     --output cm://gpu-operator/aicr-snapshot

deployments/aicr-agent/1-deps.yaml

@@ -395,7 +395,7 @@ subjects:
 - RBAC RoleBinding must reference correct namespace
 - ConfigMap automatically created if doesn't exist
 - Supports update pattern (overwrite existing snapshots)
-- For complete examples, see [deployments/aicr-agent/](../../../deployments/aicr-agent/)
+- RBAC and Job resources are created programmatically by `pkg/k8s/agent`
 ```
 
 ### Recipe Command: `pkg/cli/recipe.go`

deployments/aicr-agent/2-job.yaml

@@ -25,7 +25,7 @@ This section is for integrators who:
 
 ```shell
 # Deploy API server to Kubernetes
-kubectl apply -k https://github.com/NVIDIA/aicr/deployments/aicrd
+kubectl apply -k https://github.com/NVIDIA/aicr/deploy/aicrd
 
 # Generate recipe via API
 curl "http://aicrd.aicr.svc/v1/recipe?service=eks&accelerator=h100"

docs/contributor/cli.md

@@ -40,8 +40,7 @@ jobs:
 
       - name: Deploy AICR Agent
         run: |
-          kubectl apply -f https://raw.githubusercontent.com/nvidia/aicr/main/deployments/aicr-agent/1-deps.yaml
-          kubectl apply -f https://raw.githubusercontent.com/nvidia/aicr/main/deployments/aicr-agent/2-job.yaml
+          aicr snapshot --output cm://gpu-operator/aicr-snapshot --timeout 300s
       
       - name: Wait for completion
         run: |
@@ -88,9 +87,7 @@ capture_snapshot:
   stage: snapshot
   image: bitnami/kubectl:latest
   script:
-    - kubectl apply -f deployments/aicr-agent/2-job.yaml
-    - kubectl wait --for=condition=complete job/aicr -n gpu-operator
-    - kubectl get configmap aicr-snapshot -n gpu-operator -o jsonpath='{.data.snapshot\.yaml}' > snapshot.yaml
+    - aicr snapshot --output snapshot.yaml --timeout 300s
   artifacts:
     paths:
       - snapshot.yaml
@@ -225,9 +222,7 @@ for cluster_config in "${CLUSTERS[@]}"; do
   kubectl config use-context "$CLUSTER"
 
   # Capture snapshot
-  kubectl apply -f deployments/aicr-agent/2-job.yaml
-  kubectl wait --for=condition=complete --timeout=300s job/aicr -n gpu-operator
-  kubectl get configmap aicr-snapshot -n gpu-operator -o jsonpath='{.data.snapshot\.yaml}' > "snapshot-${CLUSTER}.yaml"
+  aicr snapshot --output "snapshot-${CLUSTER}.yaml" --timeout 300s
 
   # Generate recipe (can use ConfigMap directly or file)
   # Option 1: Use ConfigMap
@@ -390,32 +385,15 @@ done
 ```hcl
 # modules/aicr-agent/main.tf
 
-resource "kubectl_manifest" "aicr_deps" {
-  yaml_body = file("${path.module}/manifests/1-deps.yaml")
-}
-
-resource "kubectl_manifest" "aicr_job" {
-  yaml_body = templatefile("${path.module}/manifests/2-job.yaml", {
-    node_selector = var.node_selector
-    tolerations   = var.tolerations
-    image_version = var.image_version
-  })
-  
-  depends_on = [kubectl_manifest.aicr_deps]
-}
-
-# Wait for job completion and get snapshot from ConfigMap
-resource "null_resource" "wait_for_snapshot" {
+# Deploy agent and capture snapshot using CLI
+resource "null_resource" "capture_snapshot" {
   provisioner "local-exec" {
     command = <<-EOT
-      kubectl wait --for=condition=complete \
-        --timeout=300s job/aicr -n gpu-operator
-      kubectl get configmap aicr-snapshot -n gpu-operator \
-        -o jsonpath='{.data.snapshot\.yaml}' > ${var.snapshot_output}
+      aicr snapshot \
+        --output ${var.snapshot_output} \
+        --timeout 300s
     EOT
   }
-  
-  depends_on = [kubectl_manifest.aicr_job]
 }
 
 # Generate recipe (can use ConfigMap directly)

docs/integrator/README.md

@@ -41,7 +41,7 @@ Deploy the AICR API Server in your Kubernetes cluster for self-hosted recipe gen
 kubectl create namespace aicr
 
 # Deploy API server
-kubectl apply -k https://github.com/NVIDIA/aicr/deployments/aicrd
+kubectl apply -k https://github.com/NVIDIA/aicr/deploy/aicrd
 
 # Check deployment
 kubectl get pods -n aicr