--- apiVersion: v1 items: - apiVersion: v1 data: _example: |- ################################ # # # EXAMPLE CONFIGURATION # # # ################################ # This block is not actually functional configuration, # but serves to illustrate the available configuration # options and document them in a way that is accessible # to users that `kubectl edit` this config map. # # These sample configuration options may be copied out of # this example block and unindented to be in the data block # to actually change the configuration. # ====================================== EXPLAINERS CONFIGURATION ====================================== # Example explainers: |- { "art": { "image" : "kserve/art-explainer", "defaultImageVersion": "latest" } } # Art Explainer runtime configuration explainers: |- { # Art explainer runtime configuration "art": { # image contains the default Art explainer serving runtime image uri. "image" : "kserve/art-explainer", # defautltImageVersion contains the Art explainer serving runtime default image version. "defaultImageVersion": "latest" } } # ====================================== ISVC CONFIGURATION ====================================== # Example - setting custom annotation inferenceService: |- { "serviceAnnotationDisallowedList": [ "my.custom.annotation/1" ], "serviceLabelDisallowedList": [ "my.custom.label.1" ] } # Example - setting custom annotation inferenceService: |- { # ServiceAnnotationDisallowedList is a list of annotations that are not allowed to be propagated to Knative # revisions, which prevents the reconciliation loop to be triggered if the annotations is # configured here are used. # Default values are: # "autoscaling.knative.dev/min-scale", # "autoscaling.knative.dev/max-scale", # "internal.serving.kserve.io/storage-initializer-sourceuri", # "kubectl.kubernetes.io/last-applied-configuration", # "modelFormat" # Any new value will be appended to the list. "serviceAnnotationDisallowedList": [ "my.custom.annotation/1" ], # ServiceLabelDisallowedList is a list of labels that are not allowed to be propagated to Knative revisions # which prevents the reconciliation loop to be triggered if the labels is configured here are used. "serviceLabelDisallowedList": [ "my.custom.label.1" ] } # Example - setting custom resource inferenceService: |- { "resource": { "cpuLimit": "1", "memoryLimit": "2Gi", "cpuRequest": "1", "memoryRequest": "2Gi" } } # Example - setting custom resource inferenceService: |- { # resource contains the default resource configuration for the inference service. # you can override this configuration by specifying the resources in the inference service yaml. # If you want to unbound the resource (limits and requests), you can set the value to null or "" # or just remove the specific field from the config. "resource": { # cpuLimit is the limits.cpu to set for the inference service. "cpuLimit": "1", # memoryLimit is the limits.memory to set for the inference service. "memoryLimit": "2Gi", # cpuRequest is the requests.cpu to set for the inference service. "cpuRequest": "1", # memoryRequest is the requests.memory to set for the inference service. "memoryRequest": "2Gi" } } # ====================================== MultiNode CONFIGURATION ====================================== # Example multiNode: |- { "customGPUResourceTypeList": [ "custom.com/gpu" ] } # Example of multinode configuration multiNode: |- { # CustomGPUResourceTypeList is a list of custom GPU resource types intended to identify the GPU type of a resource, # not to restrict the user from using a specific GPU type. # The MultiNode runtime pod will dynamically add GPU resources based on the registered GPU types. "customGPUResourceTypeList": [ "custom.com/gpu" ] } # ====================================== OTelCollector CONFIGURATION ====================================== # Example opentelemetryCollector: |- { # scrapeInterval is the interval at which the OpenTelemetry Collector will scrape the metrics. "scrapeInterval": "5s", # metricScalerEndpoint is the endpoint from which the KEDA's ScaledObject will scrape the metrics. "metricScalerEndpoint": "keda-otel-scaler.keda.svc:4318", # metricReceiverEndpoint is the endpoint from which the OpenTelemetry Collector will scrape the metrics. "metricReceiverEndpoint": "keda-otel-scaler.keda.svc:4317" } # ====================================== AUTOSCALER CONFIGURATION ====================================== # Example autoscaler: |- { # scaleUpStabilizationWindowSeconds is the stabilization window in seconds for scale up. "scaleUpStabilizationWindowSeconds": "0", # scaleDownStabilizationWindowSeconds is the stabilization window in seconds for scale down. "scaleDownStabilizationWindowSeconds": "300" } # ====================================== STORAGE INITIALIZER CONFIGURATION ====================================== # Example storageInitializer: |- { "image" : "kserve/storage-initializer:latest", "memoryRequest": "100Mi", "memoryLimit": "1Gi", "cpuRequest": "100m", "cpuLimit": "1", "caBundleConfigMapName": "", "caBundleVolumeMountPath": "/etc/ssl/custom-certs", "enableModelcar": false, "enableOciModelSupport": false, "ociModelMode": "modelcar", "cpuModelcar": "10m", "memoryModelcar": "15Mi" } storageInitializer: |- { # image contains the default storage initializer image uri. "image" : "kserve/storage-initializer:latest", # memoryRequest is the requests.memory to set for the storage initializer init container. "memoryRequest": "100Mi", # memoryLimit is the limits.memory to set for the storage initializer init container. "memoryLimit": "1Gi", # cpuRequest is the requests.cpu to set for the storage initializer init container. "cpuRequest": "100m", # cpuLimit is the limits.cpu to set for the storage initializer init container. "cpuLimit": "1", # caBundleConfigMapName is the ConfigMap will be copied to a user namespace for the storage initializer init container. "caBundleConfigMapName": "", # caBundleVolumeMountPath is the mount point for the configmap set by caBundleConfigMapName for the storage initializer init container. "caBundleVolumeMountPath": "/etc/ssl/custom-certs", # enableModelcar enabled allows you to directly access an OCI container image by # using a source URL with an "oci://" schema. "enableModelcar": false, # enableOciModelSupport enables any OCI-backed model storage path (modelcar, native ImageVolume, or fetch). # This is the newer master switch; enableModelcar is kept as a backcompat alias for the "modelcar" mode. "enableOciModelSupport": false, # ociModelMode selects the materialization strategy when a storageUri uses oci:// without an explicit # suffix. Valid values: "modelcar" (default sidecar), "native" (K8s ImageVolume), "fetch" (init-container). "ociModelMode": "modelcar", # cpuModelcar is the cpu request and limit that is used for the passive modelcar container. It can be # set very low, but should be allowed by any Kubernetes LimitRange that might apply. "cpuModelcar": "10m", # cpuModelcar is the memory request and limit that is used for the passive modelcar container. It can be # set very low, but should be allowed by any Kubernetes LimitRange that might apply. "memoryModelcar": "15Mi", # uidModelcar is the UID under with which the modelcar process and the main container is running. # Some Kubernetes clusters might require this to be root (0). If not set the user id is left untouched (default) "uidModelcar": 10 } # ====================================== CREDENTIALS ====================================== # Example credentials: |- { "storageSpecSecretName": "storage-config", "storageSecretNameAnnotation": "serving.kserve.io/storageSecretName", "gcs": { "gcsCredentialFileName": "gcloud-application-credentials.json" }, "s3": { "s3AccessKeyIDName": "AWS_ACCESS_KEY_ID", "s3SecretAccessKeyName": "AWS_SECRET_ACCESS_KEY", "s3Endpoint": "", "s3UseHttps": "", "s3Region": "", "s3VerifySSL": "", "s3UseVirtualBucket": "", "s3UseAccelerate": "", "s3UseAnonymousCredential": "", "s3CABundleConfigMap": "", "s3CABundle": "" } } # This is a global configuration used for downloading models from the cloud storage. # You can override this configuration by specifying the annotations on service account or static secret. # https://kserve.github.io/website/master/modelserving/storage/s3/s3/ # For a quick reference about AWS ENV variables: # AWS Cli: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html # Boto: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#using-environment-variables # # The `s3AccessKeyIDName` and `s3SecretAccessKeyName` fields are only used from this configmap when static credentials (IAM User Access Key Secret) # are used as the authentication method for AWS S3. # The rest of the fields are used in both authentication methods (IAM Role for Service Account & IAM User Access Key Secret) if a non-empty value is provided. credentials: |- { # storageSpecSecretName contains the secret name which has the credentials for downloading the model. # This option is used when specifying the storage spec on isvc yaml. "storageSpecSecretName": "storage-config", # The annotation can be specified on isvc yaml to allow overriding with the secret name reference from the annotation value. # When using storageUri the order of the precedence is: secret name reference annotation > secret name references from service account # When using storageSpec the order of the precedence is: secret name reference annotation > storageSpecSecretName in configmap # Configuration for google cloud storage "gcs": { # gcsCredentialFileName specifies the filename of the gcs credential "gcsCredentialFileName": "gcloud-application-credentials.json" }, # Configuration for aws s3 storage. This add the corresponding environmental variables to the storage initializer init container. # For more info on s3 storage see https://kserve.github.io/website/master/modelserving/storage/s3/s3/ "s3": { # s3AccessKeyIDName specifies the s3 access key id name "s3AccessKeyIDName": "AWS_ACCESS_KEY_ID", # s3SecretAccessKeyName specifies the s3 secret access key name "s3SecretAccessKeyName": "AWS_SECRET_ACCESS_KEY", # s3Endpoint specifies the s3 endpoint "s3Endpoint": "", # s3UseHttps controls whether to use secure https or unsecure http to download models. # Allowed values are 0 and 1. "s3UseHttps": "", # s3Region specifies the region of the bucket. "s3Region": "", # s3VerifySSL controls whether to verify the tls/ssl certificate. "s3VerifySSL": "", # s3UseVirtualBucket configures whether it is a virtual bucket or not. "s3UseVirtualBucket": "", # s3UseAccelerate configures whether to use transfer acceleration. "s3UseAccelerate": "", # s3UseAnonymousCredential configures whether to use anonymous credentials to download the model or not. "s3UseAnonymousCredential": "", # s3CABundleConfigMap specifies the mounted CA bundle config map name. "s3CABundleConfigMap": "", # s3CABundle specifies the full path (mount path + file name) for the mounted config map data when used with a configured CA bundle config map. # s3CABundle specifies the path to a certificate bundle to use for HTTPS certificate validation when used absent of a configured CA bundle config map. "s3CABundle": "" } } # ====================================== INGRESS CONFIGURATION ====================================== # Example ingress: |- { "enableGatewayApi": false, "kserveIngressGateway": "kserve/kserve-ingress-gateway", "ingressGateway" : "knative-serving/knative-ingress-gateway", "localGateway" : "knative-serving/knative-local-gateway", "localGatewayService" : "knative-local-gateway.istio-system.svc.cluster.local", "ingressDomain" : "example.com", "additionalIngressDomains": ["additional-example.com", "additional-example-1.com"], "ingressClassName" : "istio", "domainTemplate": "{{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }}", "urlScheme": "http", "disableIstioVirtualHost": false, "disableIngressCreation": false, "disableHTTPRouteTimeout": false } ingress: |- { # enableGatewayApi specifies whether to use Gateway API instead of Ingress to serve external traffic. "enableGatewayApi": false, # KServe implements [Gateway API](https://gateway-api.sigs.k8s.io/) to serve external traffic. # By default, KServe configures a default gateway to serve external traffic. # But, KServe can be configured to use a custom gateway by modifying this configuration. # The gateway should be specified in format / # NOTE: This configuration only applicable for raw deployment. "kserveIngressGateway": "kserve/kserve-ingress-gateway", # ingressGateway specifies the ingress gateway to serve external traffic. # The gateway should be specified in format / # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer. "ingressGateway" : "knative-serving/knative-ingress-gateway", # knativeLocalGatewayService specifies the hostname of the Knative's local gateway service. # The default KServe configurations are re-using the Istio local gateways for Knative. In this case, this # knativeLocalGatewayService field can be left unset. When unset, the value of "localGatewayService" will be used. # However, sometimes it may be better to have local gateways specifically for KServe (e.g. when enabling strict mTLS in Istio). # Under such setups where KServe is needed to have its own local gateways, the values of the "localGateway" and # "localGatewayService" should point to the KServe local gateways. Then, this knativeLocalGatewayService field # should point to the Knative's local gateway service. # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer. "knativeLocalGatewayService": "", # localGateway specifies the gateway which handles the network traffic within the cluster. # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer. "localGateway" : "knative-serving/knative-local-gateway", # localGatewayService specifies the hostname of the local gateway service. # NOTE: This configuration only applicable for serverless deployment with Istio configured as network layer. "localGatewayService" : "knative-local-gateway.istio-system.svc.cluster.local", # ingressDomain specifies the domain name which is used for creating the url. # If ingressDomain is empty then example.com is used as default domain. # NOTE: This configuration only applicable for raw deployment. "ingressDomain" : "example.com", # additionalIngressDomains specifies the additional domain names which are used for creating the url. "additionalIngressDomains": ["additional-example.com", "additional-example-1.com"] # ingressClassName specifies the ingress controller to use for ingress traffic. # This is optional and if omitted the default ingress in the cluster is used. # https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class # NOTE: This configuration only applicable for raw deployment. "ingressClassName" : "istio", # domainTemplate specifies the template for generating domain/url for each inference service by combining variable from: # Name of the inference service ( {{ .Name}} ) # Namespace of the inference service ( {{ .Namespace }} ) # Annotation of the inference service ( {{ .Annotations.key }} ) # Label of the inference service ( {{ .Labels.key }} ) # IngressDomain ( {{ .IngressDomain }} ) # If domain template is empty the default template {{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }} is used. # NOTE: This configuration only applicable for raw deployment. "domainTemplate": "{{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }}", # urlScheme specifies the url scheme to use for inference service and inference graph. # If urlScheme is empty then by default http is used. "urlScheme": "http", # disableIstioVirtualHost controls whether to use istio as network layer. # By default istio is used as the network layer. When DisableIstioVirtualHost is true, KServe does not # create the top level virtual service thus Istio is no longer required for serverless mode. # By setting this field to true, user can use other networking layers supported by knative. # For more info https://github.com/kserve/kserve/pull/2380, https://kserve.github.io/website/master/admin/serverless/kourier_networking/. # NOTE: This configuration is only applicable to serverless deployment. "disableIstioVirtualHost": false, # disableIngressCreation controls whether to disable ingress creation for raw deployment mode. "disableIngressCreation": false, # disableHTTPRouteTimeout controls whether to omit the timeout field from HTTPRoute rules. # Set to true for Gateway controllers (e.g. GKE Gateway) that do not support the optional timeouts field. "disableHTTPRouteTimeout": false, # loraModelRoutingStrategy selects how LLMInferenceService LoRA adapter expansion represents # model identities in generated HTTPRoutes. It only applies where model-based routing is in # effect, and a change reaches every LoRA service on its next reconcile unless the service pins # its own value with the spec annotation serving.kserve.io/lora-model-routing-strategy, # which a preset may carry. "exact" (the default when omitted) renders one Exact header match # per identity; "regex" collapses the base model and all adapters into a single anchored # RegularExpression match. Any other value fails config loading, like the other ingress keys. # A route the strategy cannot be applied to (a user-supplied model-routing match the regex # transform does not recognize) reports HTTPRoutesReady=False with reason # RoutingPreconditionNotMet while workload and scheduler reconciliation continue; the existing # HTTPRoute keeps serving as-is (deleted group peers are still pruned from it) but is not # recreated if removed. The practical "regex" ceiling depends on the gateway: Envoy Gateway # disables Envoy's RE2 program-size check, so the 4096-character header value limit binds # (Envoy logs a size warning past roughly 70 adapters); Istio allows a program size of 32768; # a provider left at Envoy's default of 100 fits only a couple of adapters. A proxy that # rejects the pattern reports an xDS NACK in the gateway controller's logs, not on the # HTTPRoute. "loraModelRoutingStrategy": "exact", # routeRuleNaming selects how LLMInferenceService managed HTTPRoutes name their rules. # "preset" (the default when omitted) keeps the names the route spec carries, so every service # rendered from the same preset has the same rule names. "unique" appends # "-/)>" to every named rule; unnamed rules and # routes referenced through spec.router.route.http.refs are left alone. Gateway API only requires # rule names to be unique within one route, but Istio before 1.29.9, 1.30.6 and 1.31.2 keys the # InferencePool endpoint picker by bare rule name across every HTTPRoute on a gateway, so services # sharing rule names get scheduled by each other's endpoint picker; "unique" avoids that on such an # Istio. A change reaches every service on its next reconcile and renames the rules of its existing # HTTPRoute in place. A policy that targets a rule by sectionName stops applying until it names the # new rule, and under "unique" that name differs per service. A service pins its own value with the # spec annotation serving.kserve.io/route-rule-naming, which a preset may carry. Any other value # marks every service without its own value HTTPRoutesReady=False (RoutingPreconditionNotMet) # and leaves its existing HTTPRoute as it is. "routeRuleNaming": "preset", # pathTemplate specifies the template for generating path based url for each inference service. # The following variables can be used in the template for generating url. # Name of the inference service ( {{ .Name}} ) # Namespace of the inference service ( {{ .Namespace }} ) # For more info https://github.com/kserve/kserve/issues/2257. # NOTE: This configuration only applicable to serverless deployment. "pathTemplate": "/serving/{{ .Namespace }}/{{ .Name }}" } # ====================================== LOGGER CONFIGURATION ====================================== # Example logger: |- { "image" : "kserve/agent:latest", "memoryRequest": "100Mi", "memoryLimit": "1Gi", "cpuRequest": "100m", "cpuLimit": "1", "defaultUrl": "http://default-broker" } logger: |- { # image contains the default logger image uri. "image" : "kserve/agent:latest", # memoryRequest is the requests.memory to set for the logger container. "memoryRequest": "100Mi", # memoryLimit is the limits.memory to set for the logger container. "memoryLimit": "1Gi", # cpuRequest is the requests.cpu to set for the logger container. "cpuRequest": "100m", # cpuLimit is the limits.cpu to set for the logger container. "cpuLimit": "1", # defaultUrl specifies the default logger url. If logger is not specified in the resource this url is used. "defaultUrl": "http://default-broker" } # ====================================== BATCHER CONFIGURATION ====================================== # Example batcher: |- { "image" : "kserve/agent:latest", "memoryRequest": "1Gi", "memoryLimit": "1Gi", "cpuRequest": "1", "cpuLimit": "1", "maxBatchSize": "32", "maxLatency": "5000" } batcher: |- { # image contains the default batcher image uri. "image" : "kserve/agent:latest", # memoryRequest is the requests.memory to set for the batcher container. "memoryRequest": "1Gi", # memoryLimit is the limits.memory to set for the batcher container. "memoryLimit": "1Gi", # cpuRequest is the requests.cpu to set for the batcher container. "cpuRequest": "1", # cpuLimit is the limits.cpu to set for the batcher container. "cpuLimit": "1" # maxBatchSize is the default maximum batch size for batcher. "maxBatchSize": "32", # maxLatency is the default maximum latency in milliseconds for batcher to wait and collect the batch. "maxLatency": "5000" } # ====================================== AGENT CONFIGURATION ====================================== # Example agent: |- { "image" : "kserve/agent:latest", "memoryRequest": "100Mi", "memoryLimit": "1Gi", "cpuRequest": "100m", "cpuLimit": "1" } agent: |- { # image contains the default agent image uri. "image" : "kserve/agent:latest", # memoryRequest is the requests.memory to set for the agent container. "memoryRequest": "100Mi", # memoryLimit is the limits.memory to set for the agent container. "memoryLimit": "1Gi", # cpuRequest is the requests.cpu to set for the agent container. "cpuRequest": "100m", # cpuLimit is the limits.cpu to set for the agent container. "cpuLimit": "1" } # ====================================== ROUTER CONFIGURATION ====================================== # Example router: |- { "image" : "kserve/router:latest", "memoryRequest": "100Mi", "memoryLimit": "1Gi", "cpuRequest": "100m", "cpuLimit": "1", "headers": { "propagate": [] }, "imagePullPolicy": "IfNotPresent", "imagePullSecrets": ["docker-secret"] } # router is the implementation of inference graph. router: |- { # image contains the default router image uri. "image" : "kserve/router:latest", # memoryRequest is the requests.memory to set for the router container. "memoryRequest": "100Mi", # memoryLimit is the limits.memory to set for the router container. "memoryLimit": "1Gi", # cpuRequest is the requests.cpu to set for the router container. "cpuRequest": "100m", # cpuLimit is the limits.cpu to set for the router container. "cpuLimit": "1", # Propagate the specified headers to all the steps specified in an InferenceGraph. # You can either specify the exact header names or use [Golang supported regex patterns] # (https://pkg.go.dev/regexp/syntax@go1.21.3#hdr-Syntax) to propagate multiple headers. "headers": { "propagate": [ "Authorization", "Test-Header-*", ".*Trace-Id.*" ] } # imagePullPolicy specifies when the router image should be pulled from registry. "imagePullPolicy": "IfNotPresent", # # imagePullSecrets specifies the list of secrets to be used for pulling the router image from registry. # https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ "imagePullSecrets": ["docker-secret"] } # ====================================== DEPLOYMENT CONFIGURATION ====================================== # Example deploy: |- { "defaultDeploymentMode": "Serverless", "deploymentRolloutStrategy": { "defaultRollout": { "maxSurge": "1", "maxUnavailable": "1" } } } deploy: |- { # defaultDeploymentMode specifies the default deployment mode of the kserve. The supported values are # Standard and Knative. Users can override the deployment mode at service level # by adding the annotation serving.kserve.io/deploymentMode. # "defaultDeploymentMode": "Standard", # deploymentRolloutStrategy specifies the default rollout strategy for the Standard deployment mode # "deploymentRolloutStrategy": { # defaultRollout specifies the default rollout configuration using Kubernetes deployment strategy # "defaultRollout": { # maxSurge specifies the maximum number of pods that can be created above the desired replica count # Can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%) # "maxSurge": "1", # maxUnavailable specifies the maximum number of pods that can be unavailable during the update # Can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%) # "maxUnavailable": "1" # } # } } # ====================================== SERVICE CONFIGURATION ====================================== # Example service: |- { "serviceClusterIPNone": false } service: |- { # ServiceClusterIPNone is a boolean flag to indicate if the service should have a clusterIP set to None. # If the DeploymentMode is Raw, the default value for ServiceClusterIPNone if not set is false # "serviceClusterIPNone": false } # ====================================== METRICS CONFIGURATION ====================================== # Example metricsAggregator: |- { "enableMetricAggregation": "false", "enablePrometheusScraping" : "false" } # For more info see https://github.com/kserve/kserve/blob/master/qpext/README.md metricsAggregator: |- { # enableMetricAggregation configures metric aggregation annotation. This adds the annotation serving.kserve.io/enable-metric-aggregation to every # service with the specified boolean value. If true enables metric aggregation in queue-proxy by setting env vars in the queue proxy container # to configure scraping ports. "enableMetricAggregation": "false", # enablePrometheusScraping configures metric aggregation annotation. This adds the annotation serving.kserve.io/enable-metric-aggregation to every # service with the specified boolean value. If true, prometheus annotations are added to the pod. If serving.kserve.io/enable-metric-aggregation is false, # the prometheus port is set with the default prometheus scraping port 9090, otherwise the prometheus port annotation is set with the metric aggregation port. "enablePrometheusScraping" : "false" } # ====================================== LOCALMODEL CONFIGURATION ====================================== # Example localModel: |- { "enabled": false, # jobNamespace specifies the namespace where the download job will be created. "jobNamespace": "kserve-localmodel-jobs", # defaultJobImage specifies the default image used for the download job. "defaultJobImage" : "kserve/storage-initializer:latest", # fsGroup is set on per-node download Jobs in jobNamespace. Kubernetes modifies the # filesystem group ID on the attached volume. "fsGroup": 1000, # sharedPVCImportFSGroup is set on shared-PVC import Jobs, which run in the cache's own # namespace. It is independent of fsGroup. RWX drivers with fsGroupPolicy File (e.g. # csi-driver-nfs) need it so the UID 1000 import container can write a root-owned volume. # Remove the key to omit fsGroup and let namespace admission (e.g. an OpenShift SCC) assign one. "sharedPVCImportFSGroup": 1000, # TTL for the download job after it is finished. "jobTTLSecondsAfterFinished": 3600, # The frequency at which the local model agent reconciles the local models # This is to detect if models are missing from local disk "reconcilationFrequencyInSecs": 60, # This is to disable localmodel pv and pvc management for namespaces without isvcs "disableVolumeManagement": false } # ====================================== KERNELCACHE CONFIGURATION ====================================== # Example kernelcache: |- { # enabled controls KernelCache, KernelCacheCapture, and related webhook behavior. "enabled": false, # defaultSidecarInjection controls MCV injection when a workload does not override it. "defaultSidecarInjection": true, # defaultMountType is used when KernelCache does not specify a mount type.(Currently, only OCI is supported) "defaultMountType": "oci", #defaultNodeGroup specifies the NodeGroup to use when no NodeGroup matches the workload. # If empty and no NodeGroup matches, the KernelCache is not created. "defaultNodeGroup": "", # jobNamespace is the pre-created namespace where kernel cache preparation Jobs are created. "jobNamespace": "kserve-kernelcache-jobs", # mcvImage is the MCV container image used by cache capture and preparation flows. "mcvImage": "kserve/kserve-mcv:latest-minimal", # prefetchImage is the lightweight helper image used by prefetch Jobs. "prefetchImage": "registry.access.redhat.com/ubi9/ubi-minimal:latest", # runtimeImagePrefetch optionally pulls the captured workload's runtime image on each target node. "runtimeImagePrefetch": { "enabled": false, "jobTTLSecondsAfterFinished": 86400 }, # registry defines the OCI registry used by capture and prefetch. "registry": { # endpoint is required to identify the registry used by capture and prefetch operations. # insecure defaults to false. Set it to true only for an HTTP registry. # caConfigMapRef optionally references a ConfigMap key containing the registry CA. "auth": { # type is none or serviceAccountToken. The default is none. # none does not provision registry credentials. # serviceAccountToken uses the Kubernetes TokenRequest API for short-lived credentials. "type": "none" # tokenTTLSeconds, pushRoleRef, and pullRoleRef are used with serviceAccountToken. } }, # artifactSecurity controls signing after capture and verification before preparation. "artifactSecurity": { "mode": "cert", "failurePolicy": "reject", "cert": { "signingProfileRef": "kernelcache-signer", "trustBundle": "kserve/kernelcache-root-ca", "subjectRegexp": "spiffe://kserve/kernelcache-signer" } }, # abandonedCapturePolicy controls generated captures whose producer Pod disappears # before completion. Supported values are retain and delete. "abandonedCapturePolicy": "retain", # jobTTLSecondsAfterFinished controls how long completed KernelCache artifact prefetch Jobs are retained. "jobTTLSecondsAfterFinished": 600, # mcvCaptureReadinessTimeoutSeconds limits how long MCV waits for runtime readiness before capture. Larger models may require a longer timeout. "mcvCaptureReadinessTimeoutSeconds": 600, # reconcileIntervalSeconds controls KCN status reconciliation. # Periodic Node image validation uses the node agent's internal interval. "reconcileIntervalSeconds": 300 } agent: |- { "cpuLimit": "1", "cpuRequest": "100m", "image": "quay.io/opendatahub/kserve-agent@sha256:d33200bc0981f32ecb217709acb9a16766f654ca2d164c57dc8760c1b0e72ae5", "memoryLimit": "1Gi", "memoryRequest": "100Mi" } autoscaler: |- { "scaleUpStabilizationWindowSeconds": "0", "scaleDownStabilizationWindowSeconds": "300" } autoscaling-wva-controller-config: |- { "prometheus": { "url": "https://thanos-querier.openshift-monitoring.svc.cluster.local:9091", "authModes": "bearer", "triggerAuthName": "ai-inference-keda-thanos", "triggerAuthKind": "ClusterTriggerAuthentication" } } batcher: |- { "cpuLimit": "1", "cpuRequest": "1", "image": "quay.io/opendatahub/kserve-agent@sha256:d33200bc0981f32ecb217709acb9a16766f654ca2d164c57dc8760c1b0e72ae5", "memoryLimit": "1Gi", "memoryRequest": "1Gi" } confidentialBareMetal: |- { "luksResourceId": "kbs:///default/kserve-luks-password/key", "initData": "" } credentials: |- { "storageSpecSecretName": "storage-config", "storageSecretNameAnnotation": "serving.kserve.io/storageSecretName", "gcs": { "gcsCredentialFileName": "gcloud-application-credentials.json" }, "s3": { "s3AccessKeyIDName": "AWS_ACCESS_KEY_ID", "s3SecretAccessKeyName": "AWS_SECRET_ACCESS_KEY", "s3Endpoint": "", "s3UseHttps": "", "s3Region": "", "s3VerifySSL": "", "s3UseVirtualBucket": "", "s3UseAccelerate": "", "s3UseAnonymousCredential": "", "s3CABundleConfigMap": "odh-kserve-custom-ca-bundle", "s3CABundle": "/etc/ssl/custom-certs/cabundle.crt" } } deploy: |- { "defaultDeploymentMode": "RawDeployment" } explainers: '{}' inferenceService: |- { "serviceAnnotationDisallowedList": [ "autoscaling.knative.dev/min-scale", "autoscaling.knative.dev/max-scale", "internal.serving.kserve.io/storage-initializer-sourceuri", "kubectl.kubernetes.io/last-applied-configuration", "security.opendatahub.io/enable-auth", "networking.knative.dev/visibility", "haproxy.router.openshift.io/timeout", "opendatahub.io/hardware-profile-name", "opendatahub.io/hardware-profile-namespace" ] } ingress: |- { "enableGatewayApi": false, "kserveIngressGateway": "openshift-ingress/openshift-ai-inference", "enableLLMInferenceServiceTLS": true, "loraModelRoutingStrategy": "regex", "ingressGateway": "knative-serving/knative-ingress-gateway", "knativeLocalGatewayService": "knative-local-gateway.istio-system.svc.cluster.local", "ingressService": "istio-ingressgateway.istio-system.svc.cluster.local", "localGateway": "istio-system/kserve-local-gateway", "localGatewayService": "kserve-local-gateway.istio-system.svc.cluster.local", "ingressDomain": "apps.d399f0e23551d5507c05.prod.konflux-ocp-ci.dev", "ingressClassName": "openshift-default", "domainTemplate": "{{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }}", "urlScheme": "http", "disableIstioVirtualHost": false, "disableIngressCreation": true } kernelcache: |- { "enabled": false, "defaultSidecarInjection": true, "defaultMountType": "oci", "defaultNodeGroup": "", "jobNamespace": "kserve-kernelcache-jobs", "mcvImage": "kserve/kserve-mcv:latest-minimal", "prefetchImage": "registry.access.redhat.com/ubi9/ubi-minimal:latest", "runtimeImagePrefetch": { "enabled": false, "jobTTLSecondsAfterFinished": 86400 }, "registry": { "auth": { "type": "none" } }, "artifactSecurity": { "mode": "cert", "failurePolicy": "reject", "cert": { "signingProfileRef": "kernelcache-signer", "trustBundle": "kserve/kernelcache-root-ca", "subjectRegexp": "spiffe://kserve/kernelcache-signer" } }, "abandonedCapturePolicy": "retain", "jobTTLSecondsAfterFinished": 600, "mcvCaptureReadinessTimeoutSeconds": 600, "reconcileIntervalSeconds": 300 } localModel: |- { "enabled": false, "jobNamespace": "model-serving-cache", "defaultJobImage" : "REPLACE_IMAGE", "fsGroup": 1000, "localModelAgentImage": "REPLACE_IMAGE", "localModelAgentCpuRequest": "100m", "localModelAgentMemoryRequest": "200Mi", "localModelAgentCpuLimit": "100m", "localModelAgentMemoryLimit": "300Mi" } logger: |- { "cpuLimit": "1", "cpuRequest": "100m", "defaultUrl": "http://default-broker", "image": "quay.io/opendatahub/kserve-agent@sha256:d33200bc0981f32ecb217709acb9a16766f654ca2d164c57dc8760c1b0e72ae5", "memoryLimit": "1Gi", "memoryRequest": "100Mi" } metricsAggregator: |- { "enableMetricAggregation": "false", "enablePrometheusScraping" : "false" } oauthProxy: |- { "cpuLimit": "200m", "cpuRequest": "100m", "image": "quay.io/opendatahub/odh-kube-rbac-proxy@sha256:acd9de62b8339dbacd39635317e5e596e09a70ae26ac9eccdde4a4124388740f", "memoryLimit": "128Mi", "memoryRequest": "64Mi" } openshiftConfig: |- { "auditLoggingProfile": "none", "modelcachePermissionFixImage": "REPLACE_IMAGE", "ovmsVersioningImage": "registry.redhat.io/ubi9/ubi-micro@sha256:38e934147827349f2b8b11ac9c38d7be23cb8e29f128b1c46e5c7ae54a2d23cd" } opentelemetryCollector: |- { "scrapeInterval": "5s", "metricReceiverEndpoint": "keda-otel-scaler.keda.svc:4317", "metricScalerEndpoint": "keda-otel-scaler.keda.svc:4318", "resource": { "cpuLimit": "1", "memoryLimit": "2Gi", "cpuRequest": "200m", "memoryRequest": "512Mi" } } router: |- { "cpuLimit": "1", "cpuRequest": "100m", "headers": { "propagate": [ "Authorization" ] }, "image": "quay.io/opendatahub/kserve-router@sha256:3bce75159293fb258f27fbfabc5c4cc77ba8c30ae508d11ca88d3053c4104b46", "memoryLimit": "1Gi", "memoryRequest": "100Mi" } security: |- { "autoMountServiceAccountToken": false } service: |- { "serviceClusterIPNone": false } storageInitializer: |- { "cpuLimit": "1", "cpuModelcar": "10m", "cpuRequest": "100m", "enableModelcar": true, "image": "quay.io/opendatahub/kserve-storage-initializer@sha256:ecf074ddbc6aa8779e7cc45aeacb80373811b163c50f7f97067173c4be4d3ff6", "memoryLimit": "24Gi", "memoryModelcar": "15Mi", "memoryRequest": "100Mi" } kind: ConfigMap metadata: creationTimestamp: "2026-11-03T20:15:09Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:_example: {} f:agent: {} f:autoscaler: {} f:autoscaling-wva-controller-config: {} f:batcher: {} f:confidentialBareMetal: {} f:credentials: {} f:deploy: {} f:explainers: {} f:inferenceService: {} f:kernelcache: {} f:localModel: {} f:logger: {} f:metricsAggregator: {} f:oauthProxy: {} f:openshiftConfig: {} f:opentelemetryCollector: {} f:router: {} f:security: {} f:service: {} f:storageInitializer: {} manager: kubectl operation: Apply time: "2026-11-03T20:15:09Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:ingress: {} manager: kubectl-patch operation: Update time: "2026-11-03T20:15:58Z" name: inferenceservice-config namespace: kserve resourceVersion: "11395" uid: 34dd54f0-6690-471c-b5ef-e5f7e9ab90e0 - apiVersion: v1 data: format-disk.sh: | #!/bin/bash # All key handling and disk operations run inside the attested guest. set -euo pipefail DEVICE=/dev/block-device case "${LUKS_RESOURCE_ID:-}" in kbs:///*/*/*) resource_path=${LUKS_RESOURCE_ID#kbs:///} ;; *) echo "cc-storage: LUKS_RESOURCE_ID must be a KBS resource reference" >&2; exit 1 ;; esac fetch_pass() { exec 3<>/dev/tcp/127.0.0.1/8006 || return 1 printf 'GET /cdh/resource/%s HTTP/1.0\r\nHost: 127.0.0.1\r\n\r\n' "$resource_path" >&3 local status line body IFS= read -r status <&3 || { exec 3<&- 3>&-; return 1; } while IFS= read -r line <&3; do line=${line%$'\r'} [ -z "$line" ] && break done body=$(cat <&3) exec 3<&- 3>&- case "$status" in *' 200 '*) ;; *) return 1 ;; esac case "$body" in ""|sealed.*) return 1 ;; esac printf '%s' "$body" } PASS="" for ((attempt=0; attempt<90; attempt++)); do if PASS=$(fetch_pass); then break; fi sleep 2 done [ -n "$PASS" ] || { echo "cc-storage: could not obtain LUKS passphrase from CDH" >&2; exit 1; } export PASS if cryptsetup isLuks "$DEVICE"; then printf '%s' "$PASS" | cryptsetup --key-file=- luksOpen --test-passphrase "$DEVICE" || { echo "cc-storage: LUKS key mismatch; existing volume left intact" >&2 exit 1 } elif blkid -p "$DEVICE" >/dev/null 2>&1; then echo "cc-storage: refusing to format a device with an existing signature" >&2 exit 1 fi exec /usr/local/bin/luks-helper format-disk link.sh: | #!/bin/sh # Sourced before either model download or inference. Never fall back to plain disk. DATA_DIR="${DATA_DIR:-/mnt/models}" PID_FILE=/dev/shm/luks-helper.pid WAITED=0 while [ "$WAITED" -lt 900 ]; do if [ -s "$PID_FILE" ]; then PID=$(cat "$PID_FILE") target="/proc/$PID/root/mnt/storage" if [ -e "$target/.ready" ]; then if [ -L "$DATA_DIR" ]; then [ "$(readlink "$DATA_DIR")" = "$target" ] || { echo "cc-storage: unexpected model link" >&2; exit 1; } else if [ -d "$DATA_DIR" ]; then rmdir "$DATA_DIR" || { echo "cc-storage: model directory must be empty" >&2; exit 1; } fi ln -s "$target" "$DATA_DIR" || exit 1 fi return 0 fi fi sleep 1 WAITED=$((WAITED + 1)) done echo "cc-storage: encrypted filesystem did not become ready" >&2 exit 1 role-binding.yaml: | apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: coco-cc-storage roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: openshift-ai-llmisvc-confidential-bare-metal subjects: - kind: ServiceAccount name: coco-cc-storage service-account.yaml: | apiVersion: v1 kind: ServiceAccount metadata: name: coco-cc-storage automountServiceAccountToken: false kind: ConfigMap metadata: creationTimestamp: "2026-11-03T20:15:09Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:format-disk.sh: {} f:link.sh: {} f:role-binding.yaml: {} f:service-account.yaml: {} manager: kubectl operation: Apply time: "2026-11-03T20:15:09Z" name: kserve-confidential-bare-metal-resources namespace: kserve resourceVersion: "10910" uid: cc4b9eb1-dd30-4bd8-8520-3cf9b51e2f80 - apiVersion: v1 data: kserve-agent: quay.io/opendatahub/kserve-agent@sha256:d33200bc0981f32ecb217709acb9a16766f654ca2d164c57dc8760c1b0e72ae5 kserve-controller: quay.io/opendatahub/kserve-controller@sha256:3e45b4f97fbf08b504460c841afb4c574a5fc256b3ed1c1af355621e9f467f3f kserve-llm-d: registry.redhat.io/rhaii-fast/vllm-cuda-rhel9@sha256:97c7d6f66f3f0897b3ff10ddd135de930d45bdd116cf41a43e3ad7270029116a kserve-llm-d-amd-rocm: registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:d9a48add238cc095fa43eeee17c8c4d104de60c4dc623e0bc7f8c4b53b2b2e97 kserve-llm-d-amd-rocm-fast-1: registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:d9a48add238cc095fa43eeee17c8c4d104de60c4dc623e0bc7f8c4b53b2b2e97 kserve-llm-d-amd-rocm-fast-1-upstream-version: 0.11.0+rhai5 kserve-llm-d-amd-rocm-fast-2: registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:d9a48add238cc095fa43eeee17c8c4d104de60c4dc623e0bc7f8c4b53b2b2e97 kserve-llm-d-amd-rocm-fast-2-upstream-version: 0.11.0+rhai5 kserve-llm-d-amd-rocm-upstream-version: 0.11.0+rhai5 kserve-llm-d-cpu: registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:0ec0f5ff9a5ff263f58db0cfb19e3d7eef24b94c2d8629fe5145f5a8747e28c9 kserve-llm-d-cpu-fast-1: registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:0ec0f5ff9a5ff263f58db0cfb19e3d7eef24b94c2d8629fe5145f5a8747e28c9 kserve-llm-d-cpu-fast-1-upstream-version: 0.18.0+rhaiv.11 kserve-llm-d-cpu-fast-2: registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:0ec0f5ff9a5ff263f58db0cfb19e3d7eef24b94c2d8629fe5145f5a8747e28c9 kserve-llm-d-cpu-fast-2-upstream-version: 0.18.0+rhaiv.11 kserve-llm-d-cpu-upstream-version: 0.18.0+rhaiv.11 kserve-llm-d-ibm-spyre: registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:80ae3e435a5be2c1f117f36599103ab05357917dd6e37f0df6613cb3ac2c13ea kserve-llm-d-ibm-spyre-fast-1: registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:80ae3e435a5be2c1f117f36599103ab05357917dd6e37f0df6613cb3ac2c13ea kserve-llm-d-ibm-spyre-fast-1-upstream-version: 0.10.2 kserve-llm-d-ibm-spyre-fast-2: registry.redhat.io/rhaiis/vllm-spyre-rhel9@sha256:80ae3e435a5be2c1f117f36599103ab05357917dd6e37f0df6613cb3ac2c13ea kserve-llm-d-ibm-spyre-fast-2-upstream-version: 0.10.2 kserve-llm-d-ibm-spyre-upstream-version: 0.10.2 kserve-llm-d-inference-scheduler: quay.io/opendatahub/odh-llm-d-router-endpoint-picker:odh-v3.6.0 kserve-llm-d-intel-gaudi: registry.redhat.io/rhaii-early-access/vllm-gaudi-rhel9:3.4.0-ea.2 kserve-llm-d-intel-gaudi-fast-1: registry.redhat.io/rhaii-early-access/vllm-gaudi-rhel9:3.4.0-ea.2 kserve-llm-d-intel-gaudi-fast-1-upstream-version: 0.16.0 kserve-llm-d-intel-gaudi-fast-2: registry.redhat.io/rhaii-early-access/vllm-gaudi-rhel9:3.4.0-ea.2 kserve-llm-d-intel-gaudi-fast-2-upstream-version: 0.16.0 kserve-llm-d-intel-gaudi-upstream-version: 0.16.0 kserve-llm-d-kv-pvc-evictor: quay.io/opendatahub/odh-llm-d-kv-pvc-evictor:odh-stable kserve-llm-d-nvidia-cuda: registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:fc68d623d1bfc36c8cb2fe4a71f19c8578cfb420ce8ce07b20a02c1ee0be0cf3 kserve-llm-d-nvidia-cuda-fast-1: registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:fc68d623d1bfc36c8cb2fe4a71f19c8578cfb420ce8ce07b20a02c1ee0be0cf3 kserve-llm-d-nvidia-cuda-fast-1-upstream-version: 0.11.0+rhai5 kserve-llm-d-nvidia-cuda-fast-2: registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:fc68d623d1bfc36c8cb2fe4a71f19c8578cfb420ce8ce07b20a02c1ee0be0cf3 kserve-llm-d-nvidia-cuda-fast-2-upstream-version: 0.11.0+rhai5 kserve-llm-d-nvidia-cuda-upstream-version: 0.11.0+rhai5 kserve-llm-d-routing-sidecar: quay.io/opendatahub/odh-llm-d-router-disagg-sidecar:odh-v3.6.0 kserve-llm-d-tokenizer: registry.redhat.io/rhaii/vllm-cpu-rhel9@sha256:0ec0f5ff9a5ff263f58db0cfb19e3d7eef24b94c2d8629fe5145f5a8747e28c9 kserve-localmodel-controller: quay.io/opendatahub/odh-kserve-localmodel-controller:odh-master kserve-localmodelnode-agent: quay.io/opendatahub/odh-kserve-localmodelnode-agent:odh-master kserve-osc-storage-helper: registry.redhat.io/openshift-sandboxed-containers/osc-storage-helper:1.13.1 kserve-router: quay.io/opendatahub/kserve-router@sha256:3bce75159293fb258f27fbfabc5c4cc77ba8c30ae508d11ca88d3053c4104b46 kserve-storage-initializer: quay.io/opendatahub/kserve-storage-initializer@sha256:ecf074ddbc6aa8779e7cc45aeacb80373811b163c50f7f97067173c4be4d3ff6 kube-rbac-proxy: quay.io/opendatahub/odh-kube-rbac-proxy@sha256:acd9de62b8339dbacd39635317e5e596e09a70ae26ac9eccdde4a4124388740f llmisvc-controller: quay.io/opendatahub/odh-kserve-llmisvc-controller@sha256:58d61afc6d7af401e03c1c34aeb5c0e718b2e116953c7842f02acbec9826bb41 ovms-versioning-ubi-micro: registry.redhat.io/ubi9/ubi-micro@sha256:38e934147827349f2b8b11ac9c38d7be23cb8e29f128b1c46e5c7ae54a2d23cd kind: ConfigMap metadata: creationTimestamp: "2026-11-03T20:15:09Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:kserve-agent: {} f:kserve-controller: {} f:kserve-llm-d: {} f:kserve-llm-d-amd-rocm: {} f:kserve-llm-d-amd-rocm-fast-1: {} f:kserve-llm-d-amd-rocm-fast-1-upstream-version: {} f:kserve-llm-d-amd-rocm-fast-2: {} f:kserve-llm-d-amd-rocm-fast-2-upstream-version: {} f:kserve-llm-d-amd-rocm-upstream-version: {} f:kserve-llm-d-cpu: {} f:kserve-llm-d-cpu-fast-1: {} f:kserve-llm-d-cpu-fast-1-upstream-version: {} f:kserve-llm-d-cpu-fast-2: {} f:kserve-llm-d-cpu-fast-2-upstream-version: {} f:kserve-llm-d-cpu-upstream-version: {} f:kserve-llm-d-ibm-spyre: {} f:kserve-llm-d-ibm-spyre-fast-1: {} f:kserve-llm-d-ibm-spyre-fast-1-upstream-version: {} f:kserve-llm-d-ibm-spyre-fast-2: {} f:kserve-llm-d-ibm-spyre-fast-2-upstream-version: {} f:kserve-llm-d-ibm-spyre-upstream-version: {} f:kserve-llm-d-inference-scheduler: {} f:kserve-llm-d-intel-gaudi: {} f:kserve-llm-d-intel-gaudi-fast-1: {} f:kserve-llm-d-intel-gaudi-fast-1-upstream-version: {} f:kserve-llm-d-intel-gaudi-fast-2: {} f:kserve-llm-d-intel-gaudi-fast-2-upstream-version: {} f:kserve-llm-d-intel-gaudi-upstream-version: {} f:kserve-llm-d-kv-pvc-evictor: {} f:kserve-llm-d-nvidia-cuda: {} f:kserve-llm-d-nvidia-cuda-fast-1: {} f:kserve-llm-d-nvidia-cuda-fast-1-upstream-version: {} f:kserve-llm-d-nvidia-cuda-fast-2: {} f:kserve-llm-d-nvidia-cuda-fast-2-upstream-version: {} f:kserve-llm-d-nvidia-cuda-upstream-version: {} f:kserve-llm-d-routing-sidecar: {} f:kserve-llm-d-tokenizer: {} f:kserve-localmodel-controller: {} f:kserve-localmodelnode-agent: {} f:kserve-osc-storage-helper: {} f:kserve-router: {} f:kserve-storage-initializer: {} f:kube-rbac-proxy: {} f:llmisvc-controller: {} f:ovms-versioning-ubi-micro: {} manager: kubectl operation: Apply time: "2026-11-03T20:15:09Z" name: kserve-parameters namespace: kserve resourceVersion: "10911" uid: 76f7912c-dee8-4b61-933f-152842517b54 - apiVersion: v1 data: ca.crt: | -----BEGIN CERTIFICATE----- MIIDPDCCAiSgAwIBAgIIFCH1zRGmtjwwDQYJKoZIhvcNAQELBQAwJjESMBAGA1UE CxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdyb290LWNhMB4XDTI2MTEwMzE5NTg1OFoX DTM2MTAzMTE5NTg1OFowJjESMBAGA1UECxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdy b290LWNhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvKooaunKY4A2 60h9tCvhPDDaYkT0QQAFGsVJYYXAGXquN702aLsJBUWJe2xs5TPzGPpGn6E2JxCG CYCmQE16jtm+1lcFXV8Lmhq2J22KV2+6DFPmGsPDiJ1eERjo+1KkfYWhKpJcx6oy +c/uwBioB9rnedp60sS5+g3NNMpEn8V5s6yhe0gbgryt3qiuPiOi4B9va/wsfme/ QJHT3J6BXNNK6NiMuIqag3+JFdlUS6XHrqZAlOhFkMP+PAfDMhI5j6kjKEooNh9H odDKOHmaul87TANlc//GH1aFTcfpbrKYNcb52lVP0zsb6NjIZC6Q/wnyNw5SaG2+ YrjBvXhbIQIDAQABo24wbDAOBgNVHQ8BAf8EBAMCAqQwDwYDVR0TAQH/BAUwAwEB /zBJBgNVHQ4EQgRAEH8BpCbr9uco1bXL6QrKmCfjO/euDnlFwRw/MqoETeY8+1OA A/9JcBPumS8CqFUGJOIkLoUIdnTtKyKjGIYfvTANBgkqhkiG9w0BAQsFAAOCAQEA NOTT1orhqyUIic7cUoLhcaMKK9FLViBH4sOQgO6RerZfZLEjvsQEf/zRboRfzOdE j3yNR/1r++uh70OEHa+YhVLu00SNCmOLg7jgTe+B/sdwRf8/OTSYsi36ZIo/mER3 t5clhh/Zt1tbwtg1isvWpI9wW164V/BMqCIDNxYxgEPV7pTKAn9S1A1RE0EHeOBa DStvMkRw2/g/U1oCKk2Cu3YSfhEvocqWKCyBnEGuS657lW2AqwZbczTijwvzy30C RwdT3dlC2euKPjVEyrOUbeR1dNeBlWMIg/WNEt7s0W/N6f45weERX9W+L26oie9l Gpt/lyAPckVuMdP8rk+uGA== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIID8zCCAtugAwIBAgIIA7HXBtqMuucwDQYJKoZIhvcNAQELBQAwJjESMBAGA1UE CxMJb3BlbnNoaWZ0MRAwDgYDVQQDEwdyb290LWNhMB4XDTI2MTEwMzE5NTkxNFoX DTI3MTEwMzE5NTkxNFowMDESMBAGA1UEChMJb3BlbnNoaWZ0MRowGAYDVQQDExFv cGVuc2hpZnQtaW5ncmVzczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AKQJS2qz4mYQWQ9NNRN8/ZGkUVrvH9QcDhiUlefRXXvCDJQBQcGssVFBdPZAYliy xIDb9JkwKexy9FUHGtYYqLFtGfJjbJ/MKwkgm/P/RegSx1N9ybzHqtAPvlDBiXBl XcGE9Akb9iVXYvEDSRhHh2dSInEgVMph6GpL5vWIUipJeNHx23U6+dN1aq54I4MG XjM2B8REv/lzgHITbbTmD3t5yUca7RXUaMM4UgSakbjgP0SCEWsWOBpcoCUjaZ2t Dkiu5rGZ2Ptdhm5sa63mrqCFLX+6p7bmBfJ/f+bQ7MN2kCePhGR4MtAl1Ss1bzYF i0wYrX44mdOIbwSIasjogoUCAwEAAaOCARkwggEVMA4GA1UdDwEB/wQEAwIFoDAd BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH/BAIwADBJBgNV HQ4EQgRAxBCPliOeyv9wI6vA20kDKouUVSA/dDJXe5fwTTgWHKC6W0NhtLS6FMNH vmdytxh9w08lvS11PMKN2/yPvqkHKzBLBgNVHSMERDBCgEAQfwGkJuv25yjVtcvp CsqYJ+M7964OeUXBHD8yqgRN5jz7U4AD/0lwE+6ZLwKoVQYk4iQuhQh2dO0rIqMY hh+9MD4GA1UdEQQ3MDWCMyouYXBwcy5kMzk5ZjBlMjM1NTFkNTUwN2MwNS5wcm9k LmtvbmZsdXgtb2NwLWNpLmRldjANBgkqhkiG9w0BAQsFAAOCAQEAA9s9U4ZrDXrx EN4AKPVJ5EEhYxAV1X3s6WUGS4gGt6nRNFm4zUSXnh6NMyC8W91qyX1Dr9X8sMU7 h27GhafbuguOIsqj0ozEm+IRGX5nLjrp1el6DvYQM8xr5YmAy/Y41H8dM+jgp6WM pT9nSH8pP9Z3+PFCKTWdIS99wMcPLs6sV02C/WE43NlpYOQgoHIihwhfwV7FJgvK xbt1yNymA8mPV74l0CbOxdS5xkjJzCLsKXrIh4mOJR9pY1cErKPJ2c+Yy6zRH8Js aaewnKjDaiZ50PQwgGGoKxQxg1xdSAndplXNeH3bg21K9WJVtQBTdcJv09wLUXn1 be+18uWCFA== -----END CERTIFICATE----- kind: ConfigMap metadata: annotations: kubernetes.io/description: Contains a CA bundle that can be used to verify the kube-apiserver when using internal endpoints such as the internal service IP or kubernetes.default.svc. No other usage is guaranteed across distributions of Kubernetes clusters. creationTimestamp: "2026-11-03T20:14:36Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:ca.crt: {} f:metadata: f:annotations: .: {} f:kubernetes.io/description: {} manager: kube-controller-manager operation: Update time: "2026-11-03T20:14:36Z" name: kube-root-ca.crt namespace: kserve resourceVersion: "10686" uid: fb86bdc9-e169-4474-9103-0ee9f0484345 - apiVersion: v1 data: cabundle.crt: |- -----BEGIN CERTIFICATE----- MIIDUTCCAjmgAwIBAgIIV/6X63rAnA0wDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc5MzczNjQ4NzAe Fw0yNjExMDMyMDA4MDdaFw0yOTAxMDEyMDA4MDhaMDYxNDAyBgNVBAMMK29wZW5z aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3OTM3MzY0ODcwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHIyn7GZYVVk5OTGI4BAAv6SKGYcNWZbrZ HRokIY4ulfeNkhZMwR6A+hgKWxq6xD6GOnFTvQ5RpPTdxIOZC/dvruk6uq4p8+I8 O2RwOI26STy17jBGmxVOhSdu6DgbcFxZdJBNZVct16b33nWpCch9WqETZihq0e71 6zOaAGUgyMkvFLYAp3bPXoK0mNcwKr+viwKsb2G+p/87xMWUBgyRBaJ5+qGRxOIQ CYfv8omlyip/p/rH2fRRQjnRs+ROS6wD2YME1SlOfqYMKrUn9la489pTFFeUM0y/ ZvXbUZ/JoLWgjuv8ckFVgJKjKFwKVNy7jRcyMceVNkYtYh7u8ZubAgMBAAGjYzBh MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR66ghY Hg5XgJOLmuLBFmWGJlbYCzAfBgNVHSMEGDAWgBR66ghYHg5XgJOLmuLBFmWGJlbY CzANBgkqhkiG9w0BAQsFAAOCAQEAxe9969qXNVl1YL937YY8MJa9XIsTSDHEG01P 9xzUwRbrVtgFe8bpytdspcJbVEE0sC5eiaqnxMq38HtfGr5/iWGkWn5zqK4PlV4T MO4e26Mc6z4gNn7PbwY4cTDJ7hEWMHbRgj8EvClYW+eh8YyZqy9K1CJfqWZ75BbW /4vcGvyBhFokbyLKij6qB+uOcyIGQu2svqaE6rQrlk2WYKWEmWV4tjsnjQ3utw4h KK5v9qBE5gdVOF1u+/W/fxtRzxIpGR+FWuGBXQmklelF0SwlOEjqKpeARHDyEq3M NE5ofE0r2TbmfzOzTfCrN+0XyRqBVpHh01IPXzE6knRv3BG34A== -----END CERTIFICATE----- kind: ConfigMap metadata: creationTimestamp: "2026-11-03T20:16:57Z" labels: opendatahub.io/managed: "true" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:cabundle.crt: {} f:metadata: f:labels: .: {} f:opendatahub.io/managed: {} manager: manager operation: Update time: "2026-11-03T20:16:57Z" name: odh-kserve-custom-ca-bundle namespace: kserve resourceVersion: "11824" uid: b4c86fd8-70ad-41ca-961a-5a4f01d872a3 - apiVersion: v1 data: autogluon-image: quay.io/opendatahub/odh-kserve-autogluon-server:odh-stable guardrails-detector-huggingface-runtime-image: quay.io/trustyai/guardrails-detector-huggingface-runtime:latest kserve-state: managed mlserver-cuda-image: quay.io/opendatahub/mlserver-cuda:fast mlserver-image: quay.io/opendatahub/mlserver:fast modelregistry-state: removed nim-state: managed odh-model-controller: quay.io/opendatahub/odh-model-controller:odh-incubating odh-model-serving-api: quay.io/opendatahub/odh-model-serving-api:odh-incubating ovms-image: quay.io/opendatahub/openvino_model_server:2025.1-release ray-tls-generator-image: registry.redhat.io/ubi9/ubi-minimal:latest tgis-image: quay.io/opendatahub/text-generation-inference:fast vllm-cpu-pz-image: quay.io/vllm/vllm:latest vllm-cpu-pz-image-fast-1: quay.io/vllm/vllm:latest vllm-cpu-pz-image-fast-1-upstream-version: v0.21.0 vllm-cpu-pz-image-fast-2: quay.io/vllm/vllm:latest vllm-cpu-pz-image-fast-2-upstream-version: v0.21.0 vllm-cpu-pz-image-upstream-version: v0.21.0 vllm-cpu-x86-image: quay.io/vllm/vllm:latest vllm-cpu-x86-image-fast-1: quay.io/vllm/vllm:latest vllm-cpu-x86-image-fast-1-upstream-version: v0.21.0 vllm-cpu-x86-image-fast-2: quay.io/vllm/vllm:latest vllm-cpu-x86-image-fast-2-upstream-version: v0.21.0 vllm-cpu-x86-image-upstream-version: v0.21.0 vllm-cuda-image: quay.io/vllm/vllm-cuda:latest vllm-cuda-image-fast-1: quay.io/vllm/vllm-cuda:latest vllm-cuda-image-fast-1-upstream-version: v0.21.0 vllm-cuda-image-fast-2: quay.io/vllm/vllm-cuda:latest vllm-cuda-image-fast-2-upstream-version: v0.21.0 vllm-cuda-image-upstream-version: v0.21.0 vllm-gaudi-image: quay.io/opendatahub/vllm:fast-gaudi vllm-gaudi-image-fast-1: quay.io/opendatahub/vllm:fast-gaudi vllm-gaudi-image-fast-1-upstream-version: v0.21.0 vllm-gaudi-image-fast-2: quay.io/opendatahub/vllm:fast-gaudi vllm-gaudi-image-fast-2-upstream-version: v0.21.0 vllm-gaudi-image-upstream-version: v0.21.0 vllm-omni-cuda-image: quay.io/vllm-omni/vllm-omni-cuda:latest vllm-omni-cuda-image-fast-1: quay.io/vllm-omni/vllm-omni-cuda:latest vllm-omni-cuda-image-fast-1-upstream-version: v0.26.0 vllm-omni-cuda-image-fast-2: quay.io/vllm-omni/vllm-omni-cuda:latest vllm-omni-cuda-image-fast-2-upstream-version: v0.26.0 vllm-omni-cuda-image-upstream-version: v0.26.0 vllm-rocm-image: quay.io/vllm/vllm-rocm:latest vllm-rocm-image-fast-1: quay.io/vllm/vllm-rocm:latest vllm-rocm-image-fast-1-upstream-version: v0.21.0 vllm-rocm-image-fast-2: quay.io/vllm/vllm-rocm:latest vllm-rocm-image-fast-2-upstream-version: v0.21.0 vllm-rocm-image-upstream-version: v0.21.0 vllm-spyre-image: quay.io/vllm/vllm:latest vllm-spyre-image-fast-1: quay.io/vllm/vllm:latest vllm-spyre-image-fast-1-upstream-version: v0.21.0 vllm-spyre-image-fast-2: quay.io/vllm/vllm:latest vllm-spyre-image-fast-2-upstream-version: v0.21.0 vllm-spyre-image-upstream-version: v0.21.0 kind: ConfigMap metadata: annotations: kubectl.kubernetes.io/last-applied-configuration: | {"apiVersion":"v1","data":{"autogluon-image":"quay.io/opendatahub/odh-kserve-autogluon-server:odh-stable","guardrails-detector-huggingface-runtime-image":"quay.io/trustyai/guardrails-detector-huggingface-runtime:latest","kserve-state":"managed","mlserver-cuda-image":"quay.io/opendatahub/mlserver-cuda:fast","mlserver-image":"quay.io/opendatahub/mlserver:fast","modelregistry-state":"removed","nim-state":"managed","odh-model-controller":"quay.io/opendatahub/odh-model-controller:odh-incubating","odh-model-serving-api":"quay.io/opendatahub/odh-model-serving-api:odh-incubating","ovms-image":"quay.io/opendatahub/openvino_model_server:2025.1-release","ray-tls-generator-image":"registry.redhat.io/ubi9/ubi-minimal:latest","tgis-image":"quay.io/opendatahub/text-generation-inference:fast","vllm-cpu-pz-image":"quay.io/vllm/vllm:latest","vllm-cpu-pz-image-fast-1":"quay.io/vllm/vllm:latest","vllm-cpu-pz-image-fast-1-upstream-version":"v0.21.0","vllm-cpu-pz-image-fast-2":"quay.io/vllm/vllm:latest","vllm-cpu-pz-image-fast-2-upstream-version":"v0.21.0","vllm-cpu-pz-image-upstream-version":"v0.21.0","vllm-cpu-x86-image":"quay.io/vllm/vllm:latest","vllm-cpu-x86-image-fast-1":"quay.io/vllm/vllm:latest","vllm-cpu-x86-image-fast-1-upstream-version":"v0.21.0","vllm-cpu-x86-image-fast-2":"quay.io/vllm/vllm:latest","vllm-cpu-x86-image-fast-2-upstream-version":"v0.21.0","vllm-cpu-x86-image-upstream-version":"v0.21.0","vllm-cuda-image":"quay.io/vllm/vllm-cuda:latest","vllm-cuda-image-fast-1":"quay.io/vllm/vllm-cuda:latest","vllm-cuda-image-fast-1-upstream-version":"v0.21.0","vllm-cuda-image-fast-2":"quay.io/vllm/vllm-cuda:latest","vllm-cuda-image-fast-2-upstream-version":"v0.21.0","vllm-cuda-image-upstream-version":"v0.21.0","vllm-gaudi-image":"quay.io/opendatahub/vllm:fast-gaudi","vllm-gaudi-image-fast-1":"quay.io/opendatahub/vllm:fast-gaudi","vllm-gaudi-image-fast-1-upstream-version":"v0.21.0","vllm-gaudi-image-fast-2":"quay.io/opendatahub/vllm:fast-gaudi","vllm-gaudi-image-fast-2-upstream-version":"v0.21.0","vllm-gaudi-image-upstream-version":"v0.21.0","vllm-omni-cuda-image":"quay.io/vllm-omni/vllm-omni-cuda:latest","vllm-omni-cuda-image-fast-1":"quay.io/vllm-omni/vllm-omni-cuda:latest","vllm-omni-cuda-image-fast-1-upstream-version":"v0.26.0","vllm-omni-cuda-image-fast-2":"quay.io/vllm-omni/vllm-omni-cuda:latest","vllm-omni-cuda-image-fast-2-upstream-version":"v0.26.0","vllm-omni-cuda-image-upstream-version":"v0.26.0","vllm-rocm-image":"quay.io/vllm/vllm-rocm:latest","vllm-rocm-image-fast-1":"quay.io/vllm/vllm-rocm:latest","vllm-rocm-image-fast-1-upstream-version":"v0.21.0","vllm-rocm-image-fast-2":"quay.io/vllm/vllm-rocm:latest","vllm-rocm-image-fast-2-upstream-version":"v0.21.0","vllm-rocm-image-upstream-version":"v0.21.0","vllm-spyre-image":"quay.io/vllm/vllm:latest","vllm-spyre-image-fast-1":"quay.io/vllm/vllm:latest","vllm-spyre-image-fast-1-upstream-version":"v0.21.0","vllm-spyre-image-fast-2":"quay.io/vllm/vllm:latest","vllm-spyre-image-fast-2-upstream-version":"v0.21.0","vllm-spyre-image-upstream-version":"v0.21.0"},"kind":"ConfigMap","metadata":{"annotations":{},"name":"odh-model-controller-parameters","namespace":"kserve"}} creationTimestamp: "2026-11-03T20:16:49Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: .: {} f:autogluon-image: {} f:guardrails-detector-huggingface-runtime-image: {} f:kserve-state: {} f:mlserver-cuda-image: {} f:mlserver-image: {} f:modelregistry-state: {} f:nim-state: {} f:odh-model-controller: {} f:odh-model-serving-api: {} f:ovms-image: {} f:ray-tls-generator-image: {} f:tgis-image: {} f:vllm-cpu-pz-image: {} f:vllm-cpu-pz-image-fast-1: {} f:vllm-cpu-pz-image-fast-1-upstream-version: {} f:vllm-cpu-pz-image-fast-2: {} f:vllm-cpu-pz-image-fast-2-upstream-version: {} f:vllm-cpu-pz-image-upstream-version: {} f:vllm-cpu-x86-image: {} f:vllm-cpu-x86-image-fast-1: {} f:vllm-cpu-x86-image-fast-1-upstream-version: {} f:vllm-cpu-x86-image-fast-2: {} f:vllm-cpu-x86-image-fast-2-upstream-version: {} f:vllm-cpu-x86-image-upstream-version: {} f:vllm-cuda-image: {} f:vllm-cuda-image-fast-1: {} f:vllm-cuda-image-fast-1-upstream-version: {} f:vllm-cuda-image-fast-2: {} f:vllm-cuda-image-fast-2-upstream-version: {} f:vllm-cuda-image-upstream-version: {} f:vllm-gaudi-image: {} f:vllm-gaudi-image-fast-1: {} f:vllm-gaudi-image-fast-1-upstream-version: {} f:vllm-gaudi-image-fast-2: {} f:vllm-gaudi-image-fast-2-upstream-version: {} f:vllm-gaudi-image-upstream-version: {} f:vllm-omni-cuda-image: {} f:vllm-omni-cuda-image-fast-1: {} f:vllm-omni-cuda-image-fast-1-upstream-version: {} f:vllm-omni-cuda-image-fast-2: {} f:vllm-omni-cuda-image-fast-2-upstream-version: {} f:vllm-omni-cuda-image-upstream-version: {} f:vllm-rocm-image: {} f:vllm-rocm-image-fast-1: {} f:vllm-rocm-image-fast-1-upstream-version: {} f:vllm-rocm-image-fast-2: {} f:vllm-rocm-image-fast-2-upstream-version: {} f:vllm-rocm-image-upstream-version: {} f:vllm-spyre-image: {} f:vllm-spyre-image-fast-1: {} f:vllm-spyre-image-fast-1-upstream-version: {} f:vllm-spyre-image-fast-2: {} f:vllm-spyre-image-fast-2-upstream-version: {} f:vllm-spyre-image-upstream-version: {} f:metadata: f:annotations: .: {} f:kubectl.kubernetes.io/last-applied-configuration: {} manager: kubectl-client-side-apply operation: Update time: "2026-11-03T20:16:49Z" name: odh-model-controller-parameters namespace: kserve resourceVersion: "11666" uid: fd0377ab-0141-4c04-82d2-a099016cc9d4 - apiVersion: v1 data: service-ca.crt: | -----BEGIN CERTIFICATE----- MIIDUTCCAjmgAwIBAgIIV/6X63rAnA0wDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc5MzczNjQ4NzAe Fw0yNjExMDMyMDA4MDdaFw0yOTAxMDEyMDA4MDhaMDYxNDAyBgNVBAMMK29wZW5z aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3OTM3MzY0ODcwggEiMA0GCSqG SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHIyn7GZYVVk5OTGI4BAAv6SKGYcNWZbrZ HRokIY4ulfeNkhZMwR6A+hgKWxq6xD6GOnFTvQ5RpPTdxIOZC/dvruk6uq4p8+I8 O2RwOI26STy17jBGmxVOhSdu6DgbcFxZdJBNZVct16b33nWpCch9WqETZihq0e71 6zOaAGUgyMkvFLYAp3bPXoK0mNcwKr+viwKsb2G+p/87xMWUBgyRBaJ5+qGRxOIQ CYfv8omlyip/p/rH2fRRQjnRs+ROS6wD2YME1SlOfqYMKrUn9la489pTFFeUM0y/ ZvXbUZ/JoLWgjuv8ckFVgJKjKFwKVNy7jRcyMceVNkYtYh7u8ZubAgMBAAGjYzBh MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR66ghY Hg5XgJOLmuLBFmWGJlbYCzAfBgNVHSMEGDAWgBR66ghYHg5XgJOLmuLBFmWGJlbY CzANBgkqhkiG9w0BAQsFAAOCAQEAxe9969qXNVl1YL937YY8MJa9XIsTSDHEG01P 9xzUwRbrVtgFe8bpytdspcJbVEE0sC5eiaqnxMq38HtfGr5/iWGkWn5zqK4PlV4T MO4e26Mc6z4gNn7PbwY4cTDJ7hEWMHbRgj8EvClYW+eh8YyZqy9K1CJfqWZ75BbW /4vcGvyBhFokbyLKij6qB+uOcyIGQu2svqaE6rQrlk2WYKWEmWV4tjsnjQ3utw4h KK5v9qBE5gdVOF1u+/W/fxtRzxIpGR+FWuGBXQmklelF0SwlOEjqKpeARHDyEq3M NE5ofE0r2TbmfzOzTfCrN+0XyRqBVpHh01IPXzE6knRv3BG34A== -----END CERTIFICATE----- kind: ConfigMap metadata: annotations: service.beta.openshift.io/inject-cabundle: "true" creationTimestamp: "2026-11-03T20:14:36Z" managedFields: - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: {} f:metadata: f:annotations: .: {} f:service.beta.openshift.io/inject-cabundle: {} manager: kube-controller-manager operation: Update time: "2026-11-03T20:14:36Z" - apiVersion: v1 fieldsType: FieldsV1 fieldsV1: f:data: f:service-ca.crt: {} manager: service-ca-operator operation: Update time: "2026-11-03T20:14:36Z" name: openshift-service-ca.crt namespace: kserve resourceVersion: "10699" uid: 6000650e-b265-41e7-9cbd-6d8d84dc1885 kind: ConfigMapList metadata: resourceVersion: "12366"