Merge branch 'main' into grpcRoutes

visheshtanksale · web-flow · commit 8cbfd1c21d8b · 2025-11-05T16:59:44.000-08:00
diff --git a/api/apps/v1alpha1/nimcache_types.go b/api/apps/v1alpha1/nimcache_types.go
@@ -48,6 +48,7 @@ type NIMCacheSpec struct {
 	GroupID *int64 `json:"groupID,omitempty"`
 	// CertConfig is the name of the ConfigMap containing the custom certificates.
 	// for secure communication.
+	//
 	// Deprecated: use `Proxy` instead to configure custom certificates for using proxy.
 	// +optional
 	CertConfig *CertConfig `json:"certConfig,omitempty"`
diff --git a/api/apps/v1alpha1/nimservice_types.go b/api/apps/v1alpha1/nimservice_types.go
@@ -227,6 +227,13 @@ type NIMServiceStorage struct {
 	HostPath *string `json:"hostPath,omitempty"`
 	// ReadOnly mode indicates if the volume should be mounted as read-only
 	ReadOnly *bool `json:"readOnly,omitempty"`
+	// EmptyDir is the empty dir volume used for caching NIM
+	EmptyDir *EmptyDirSpec `json:"emptyDir,omitempty"`
+}
+
+type EmptyDirSpec struct {
+	// SizeLimit is the size limit of the empty dir volume
+	SizeLimit *resource.Quantity `json:"sizeLimit,omitempty"`
 }
 
 // GetLWSName returns the name to be used for the LeaderWorkerSet based on the custom spec.
@@ -688,7 +695,7 @@ func (n *NIMService) GetVolumesMounts() []corev1.Volume {
 }
 
 // GetVolumes returns volumes for the NIMService container.
-func (n *NIMService) GetVolumes(modelPVC PersistentVolumeClaim) []corev1.Volume {
+func (n *NIMService) GetVolumes(modelPVC *PersistentVolumeClaim) []corev1.Volume {
 	// TODO: Fetch actual PVC name from associated NIMCache obj
 	volumes := []corev1.Volume{
 		{
@@ -700,15 +707,26 @@ func (n *NIMService) GetVolumes(modelPVC PersistentVolumeClaim) []corev1.Volume
 				},
 			},
 		},
-		{
+	}
+	if modelPVC != nil {
+		volumes = append(volumes, corev1.Volume{
 			Name: "model-store",
 			VolumeSource: corev1.VolumeSource{
 				PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
 					ClaimName: modelPVC.Name,
 					ReadOnly:  n.GetStorageReadOnly(),
 				},
 			},
-		},
+		})
+	} else if n.Spec.Storage.EmptyDir != nil {
+		volumes = append(volumes, corev1.Volume{
+			Name: "model-store",
+			VolumeSource: corev1.VolumeSource{
+				EmptyDir: &corev1.EmptyDirVolumeSource{
+					SizeLimit: n.Spec.Storage.EmptyDir.SizeLimit,
+				},
+			},
+		})
 	}
 
 	if n.GetProxySpec() != nil {
@@ -717,7 +735,7 @@ func (n *NIMService) GetVolumes(modelPVC PersistentVolumeClaim) []corev1.Volume
 	return volumes
 }
 
-func (n *NIMService) GetLeaderVolumes(modelPVC PersistentVolumeClaim) []corev1.Volume {
+func (n *NIMService) GetLeaderVolumes(modelPVC *PersistentVolumeClaim) []corev1.Volume {
 	volumes := n.GetVolumes(modelPVC)
 
 	volumes = append(volumes,
@@ -762,7 +780,7 @@ func (n *NIMService) GetLeaderVolumes(modelPVC PersistentVolumeClaim) []corev1.V
 	return volumes
 }
 
-func (n *NIMService) GetWorkerVolumes(modelPVC PersistentVolumeClaim) []corev1.Volume {
+func (n *NIMService) GetWorkerVolumes(modelPVC *PersistentVolumeClaim) []corev1.Volume {
 	volumes := n.GetVolumes(modelPVC)
 	volumes = append(volumes,
 		corev1.Volume{
@@ -802,12 +820,16 @@ func (n *NIMService) GetWorkerVolumes(modelPVC PersistentVolumeClaim) []corev1.V
 }
 
 // GetVolumeMounts returns volumes for the NIMService container.
-func (n *NIMService) GetVolumeMounts(modelPVC PersistentVolumeClaim) []corev1.VolumeMount {
+func (n *NIMService) GetVolumeMounts(modelPVC *PersistentVolumeClaim) []corev1.VolumeMount {
+	subPath := ""
+	if modelPVC != nil {
+		subPath = modelPVC.SubPath
+	}
 	volumeMounts := []corev1.VolumeMount{
 		{
 			Name:      "model-store",
 			MountPath: "/model-store",
-			SubPath:   modelPVC.SubPath,
+			SubPath:   subPath,
 		},
 		{
 			Name:      "dshm",
@@ -821,7 +843,7 @@ func (n *NIMService) GetVolumeMounts(modelPVC PersistentVolumeClaim) []corev1.Vo
 	return volumeMounts
 }
 
-func (n *NIMService) GetWorkerVolumeMounts(modelPVC PersistentVolumeClaim) []corev1.VolumeMount {
+func (n *NIMService) GetWorkerVolumeMounts(modelPVC *PersistentVolumeClaim) []corev1.VolumeMount {
 	volumeMounts := n.GetVolumeMounts(modelPVC)
 
 	volumeMounts = append(volumeMounts,
@@ -846,7 +868,7 @@ func (n *NIMService) GetWorkerVolumeMounts(modelPVC PersistentVolumeClaim) []cor
 	return volumeMounts
 }
 
-func (n *NIMService) GetLeaderVolumeMounts(modelPVC PersistentVolumeClaim) []corev1.VolumeMount {
+func (n *NIMService) GetLeaderVolumeMounts(modelPVC *PersistentVolumeClaim) []corev1.VolumeMount {
 	volumeMounts := n.GetVolumeMounts(modelPVC)
 	volumeMounts = append(volumeMounts,
 		corev1.VolumeMount{
diff --git a/api/apps/v1alpha1/nimservice_types_test.go b/api/apps/v1alpha1/nimservice_types_test.go
@@ -110,7 +110,7 @@ func TestGetVolumes(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			vols := tt.nimService.GetVolumes(tt.modelPVC)
+			vols := tt.nimService.GetVolumes(&tt.modelPVC)
 			if !reflect.DeepEqual(vols, tt.desired) {
 				t.Errorf("GetVolumes() = %v, want %v", vols, tt.desired)
 			}
diff --git a/api/apps/v1alpha1/zz_generated.deepcopy.go b/api/apps/v1alpha1/zz_generated.deepcopy.go
diff --git a/bundle/manifests/apps.nvidia.com_nimcaches.yaml b/bundle/manifests/apps.nvidia.com_nimcaches.yaml
@@ -54,6 +54,7 @@ spec:
                 description: |-
                   CertConfig is the name of the ConfigMap containing the custom certificates.
                   for secure communication.
+
                   Deprecated: use `Proxy` instead to configure custom certificates for using proxy.
                 properties:
                   mountPath:
diff --git a/bundle/manifests/apps.nvidia.com_nimpipelines.yaml b/bundle/manifests/apps.nvidia.com_nimpipelines.yaml
@@ -3488,6 +3488,19 @@ spec:
                           description: Storage is the target storage for caching NIM
                             model if NIMCache is not provided
                           properties:
+                            emptyDir:
+                              description: EmptyDir is the empty dir volume used for
+                                caching NIM
+                              properties:
+                                sizeLimit:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: SizeLimit is the size limit of the
+                                    empty dir volume
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              type: object
                             hostPath:
                               description: HostPath is the host path volume for caching
                                 NIM
diff --git a/bundle/manifests/apps.nvidia.com_nimservices.yaml b/bundle/manifests/apps.nvidia.com_nimservices.yaml
@@ -3377,6 +3377,19 @@ spec:
                 description: Storage is the target storage for caching NIM model if
                   NIMCache is not provided
                 properties:
+                  emptyDir:
+                    description: EmptyDir is the empty dir volume used for caching
+                      NIM
+                    properties:
+                      sizeLimit:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: SizeLimit is the size limit of the empty dir
+                          volume
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
+                    type: object
                   hostPath:
                     description: HostPath is the host path volume for caching NIM
                     type: string
diff --git a/config/crd/bases/apps.nvidia.com_nimcaches.yaml b/config/crd/bases/apps.nvidia.com_nimcaches.yaml
@@ -54,6 +54,7 @@ spec:
                 description: |-
                   CertConfig is the name of the ConfigMap containing the custom certificates.
                   for secure communication.
+
                   Deprecated: use `Proxy` instead to configure custom certificates for using proxy.
                 properties:
                   mountPath:
diff --git a/config/crd/bases/apps.nvidia.com_nimpipelines.yaml b/config/crd/bases/apps.nvidia.com_nimpipelines.yaml
@@ -3488,6 +3488,19 @@ spec:
                           description: Storage is the target storage for caching NIM
                             model if NIMCache is not provided
                           properties:
+                            emptyDir:
+                              description: EmptyDir is the empty dir volume used for
+                                caching NIM
+                              properties:
+                                sizeLimit:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: SizeLimit is the size limit of the
+                                    empty dir volume
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              type: object
                             hostPath:
                               description: HostPath is the host path volume for caching
                                 NIM
diff --git a/config/crd/bases/apps.nvidia.com_nimservices.yaml b/config/crd/bases/apps.nvidia.com_nimservices.yaml
@@ -3377,6 +3377,19 @@ spec:
                 description: Storage is the target storage for caching NIM model if
                   NIMCache is not provided
                 properties:
+                  emptyDir:
+                    description: EmptyDir is the empty dir volume used for caching
+                      NIM
+                    properties:
+                      sizeLimit:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: SizeLimit is the size limit of the empty dir
+                          volume
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
+                    type: object
                   hostPath:
                     description: HostPath is the host path volume for caching NIM
                     type: string
diff --git a/config/samples/nim/serving/standalone/routers/ingress/llm.yaml b/config/samples/nim/serving/standalone/routers/ingress/llm.yaml
@@ -49,7 +49,7 @@ spec:
     service:
       type: ClusterIP
       port: 8000
-    router:
-      ingress:
-        ingressClass: nginx
-      hostDomainName: demo.nvidia.example.com
+  router:
+    ingress:
+      ingressClass: nginx
+    hostDomainName: demo.example.nvidia.com
diff --git a/deployments/container/Dockerfile b/deployments/container/Dockerfile
@@ -43,7 +43,7 @@ RUN git checkout c80af13d73e36e0eedbe9b712efa85cccb64213a
 RUN go build -o crd-apply-tool cmd/apply-crds/main.go
 
 # Use distroless as minimal base image to package the manager binary
-FROM nvcr.io/nvidia/distroless/go:v3.1.13
+FROM nvcr.io/nvidia/distroless/go:v3.2.1
 
 ARG VERSION="unknown"
 
diff --git a/deployments/helm/k8s-nim-operator/crds/apps.nvidia.com_nimcaches.yaml b/deployments/helm/k8s-nim-operator/crds/apps.nvidia.com_nimcaches.yaml
@@ -54,6 +54,7 @@ spec:
                 description: |-
                   CertConfig is the name of the ConfigMap containing the custom certificates.
                   for secure communication.
+
                   Deprecated: use `Proxy` instead to configure custom certificates for using proxy.
                 properties:
                   mountPath:
diff --git a/deployments/helm/k8s-nim-operator/crds/apps.nvidia.com_nimpipelines.yaml b/deployments/helm/k8s-nim-operator/crds/apps.nvidia.com_nimpipelines.yaml
@@ -3488,6 +3488,19 @@ spec:
                           description: Storage is the target storage for caching NIM
                             model if NIMCache is not provided
                           properties:
+                            emptyDir:
+                              description: EmptyDir is the empty dir volume used for
+                                caching NIM
+                              properties:
+                                sizeLimit:
+                                  anyOf:
+                                  - type: integer
+                                  - type: string
+                                  description: SizeLimit is the size limit of the
+                                    empty dir volume
+                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                                  x-kubernetes-int-or-string: true
+                              type: object
                             hostPath:
                               description: HostPath is the host path volume for caching
                                 NIM
diff --git a/deployments/helm/k8s-nim-operator/crds/apps.nvidia.com_nimservices.yaml b/deployments/helm/k8s-nim-operator/crds/apps.nvidia.com_nimservices.yaml
@@ -3377,6 +3377,19 @@ spec:
                 description: Storage is the target storage for caching NIM model if
                   NIMCache is not provided
                 properties:
+                  emptyDir:
+                    description: EmptyDir is the empty dir volume used for caching
+                      NIM
+                    properties:
+                      sizeLimit:
+                        anyOf:
+                        - type: integer
+                        - type: string
+                        description: SizeLimit is the size limit of the empty dir
+                          volume
+                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
+                        x-kubernetes-int-or-string: true
+                    type: object
                   hostPath:
                     description: HostPath is the host path volume for caching NIM
                     type: string
diff --git a/deployments/helm/k8s-nim-operator/values.yaml b/deployments/helm/k8s-nim-operator/values.yaml
@@ -85,4 +85,4 @@ metricsService:
 
 nfd:
   nodeFeatureRules:
-    deviceID: true
+    deviceID: false
diff --git a/internal/controller/nimcache_controller.go b/internal/controller/nimcache_controller.go
@@ -1258,7 +1258,7 @@ func (r *NIMCacheReconciler) constructJob(ctx context.Context, nimCache *appsv1a
 	job.Spec.Template.Spec.Containers[0].Env = utils.MergeEnvVars(job.Spec.Template.Spec.Containers[0].Env, nimCache.Spec.Env)
 
 	// Inject custom CA certificates when running in a proxy envronment
-	if nimCache.Spec.CertConfig != nil {
+	if nimCache.Spec.CertConfig != nil { //nolint:staticcheck // checking for deprecated field
 		err := errors.NewBadRequest("Deprecated field 'CertConfig' is used. Please migrate to 'Proxy' field on NIMCache.\"")
 		logger.Error(err, err.Error())
 		return nil, err
diff --git a/internal/controller/platform/kserve/nimservice.go b/internal/controller/platform/kserve/nimservice.go
@@ -152,7 +152,7 @@ func (r *NIMServiceReconciler) reconcileNIMService(ctx context.Context, nimServi
 	modelPVC, modelProfile, nimCache, err = r.renderAndSyncCache(ctx, nimService)
 	if err != nil {
 		return ctrl.Result{}, err
-	} else if modelPVC == nil {
+	} else if nimCache == nil {
 		return ctrl.Result{}, nil
 	}
 
@@ -340,6 +340,8 @@ func (r *NIMServiceReconciler) renderAndSyncCache(ctx context.Context,
 	} else if nimService.Spec.Storage.PVC.Name != "" {
 		// Use an existing PVC
 		modelPVC = &nimService.Spec.Storage.PVC
+	} else if nimService.Spec.Storage.EmptyDir != nil {
+		modelPVC = nil
 	} else {
 		err := fmt.Errorf("neither external PVC name or NIMCache volume is provided")
 		logger.Error(err, "failed to determine PVC for model-store")
@@ -475,9 +477,31 @@ func (r *NIMServiceReconciler) renderAndSyncInferenceService(ctx context.Context
 			},
 		}, isvcParams.Env)
 	}
+	// If NIMCache is not provided, and the model is from Hugging Face, add the HF_TOKEN to the environment variables
+	if nimService.GetNIMCacheName() == "" {
+		env := utils.FindEnvByValue(isvcParams.Env, "NIM_MODEL_NAME")
+		if env != nil {
+			if strings.HasPrefix(env.Value, "hf://") {
+				isvcParams.Env = utils.RemoveEnvVar(isvcParams.Env, "NGC_API_KEY")
+				isvcParams.Env = utils.MergeEnvVars(isvcParams.Env, []corev1.EnvVar{
+					{
+						Name: "HF_TOKEN",
+						ValueFrom: &corev1.EnvVarSource{
+							SecretKeyRef: &corev1.SecretKeySelector{
+								LocalObjectReference: corev1.LocalObjectReference{
+									Name: nimService.Spec.AuthSecret,
+								},
+								Key: "HF_TOKEN",
+							},
+						},
+					},
+				})
+			}
+		}
+	}
 	// Setup volume mounts with model store
-	isvcParams.Volumes = nimService.GetVolumes(*modelPVC)
-	isvcParams.VolumeMounts = nimService.GetVolumeMounts(*modelPVC)
+	isvcParams.Volumes = nimService.GetVolumes(modelPVC)
+	isvcParams.VolumeMounts = nimService.GetVolumeMounts(modelPVC)
 	if profileEnv != nil {
 		isvcParams.Env = utils.MergeEnvVars(*profileEnv, isvcParams.Env)
 	}
diff --git a/internal/controller/platform/standalone/nimservice.go b/internal/controller/platform/standalone/nimservice.go
diff --git a/internal/utils/utils.go b/internal/utils/utils.go
diff --git a/internal/webhook/apps/v1alpha1/nimservice_webhook_validation_helper.go b/internal/webhook/apps/v1alpha1/nimservice_webhook_validation_helper.go

Original file line number	Diff line number	Diff line change
`@@ -110,7 +110,7 @@ func TestGetVolumes(t *testing.T) {`
`110`	`110`
`111`	`111`	`for _, tt := range tests {`
`112`	`112`	`t.Run(tt.name, func(t *testing.T) {`
`113`		`- vols := tt.nimService.GetVolumes(tt.modelPVC)`
	`113`	`+ vols := tt.nimService.GetVolumes(&tt.modelPVC)`
`114`	`114`	`if !reflect.DeepEqual(vols, tt.desired) {`
`115`	`115`	`t.Errorf("GetVolumes() = %v, want %v", vols, tt.desired)`
`116`	`116`	`}`