[glenmessenger]

Tracking: b/582753235 (internal contribution intake).

Adds an opt-in k8s_aibom switch to modules/management/kubectl-apply, default off, plus a README mention. Scope as agreed with Annie: start with the switch off and a docs mention; no example turns it on.

What k8s-aibom is. https://github.com/GoogleCloudPlatform/k8s-aibom records a CycloneDX AI bill of materials per inference or training workload (models, runtime, images, signatures) in namespaces labeled aibom.k8saibom.dev/enabled=true. It is unprivileged and reads the Kubernetes API only. NVIDIA AI Cluster Runtime ships it on its GKE recipes, pinned to 1.6.2.

Shape. Mirrors jobset and cert_manager:

      k8s_aibom:
        install: true        # default false
        version: "1.6.2"     # chart version; the chart pins the image by digest
        controller_cpu: ...  # optional
        controller_memory: ... # optional

Two helm_install blocks from oci://ghcr.io/googlecloudplatform/charts: the CRD chart first, so CRD changes stay ordinary Helm upgrades, then the controller chart into k8s-aibom-system with the gke-managed-components toleration (same reason as the jobset values file). The module installs the controller only. Namespaces are opted in by the platform admin with kubectl label namespace <name> aibom.k8saibom.dev/enabled=true; the controller's AIBOMControllerConfig status says so until one is.

Validation. terraform fmt, terraform validate (Terraform 1.12.2), tflint 0.49.0, terraform-docs 0.24.0 regenerated the README tables, tools/label-check.py, tools/validate_readme_snippets.py, tools/duplicate-diff.py, catalog-gen (no changes), yamllint on the new values file. helm template of chart 1.6.2 with the module's values renders the toleration on the controller pod.

Test plan for integration tests. On any GKE blueprint that already uses kubectl-apply, set k8s_aibom.install: true, deploy, then:

helm list -n k8s-aibom-system            # k8s-aibom-crds and k8s-aibom, both 1.6.2
kubectl -n k8s-aibom-system get pods      # one controller pod Running
kubectl get aibomcontrollerconfig default -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}'   # True
kubectl label namespace default aibom.k8saibom.dev/enabled=true
kubectl -n default create deployment vllm --image=vllm/vllm-openai:v0.11.0 -- python3 -m vllm.entrypoints.openai.api_server --model Qwen/Qwen2.5-0.5B-Instruct
kubectl get aibom -n default              # one AIBOM for the deployment within a minute

Teardown is the blueprint's own destroy; the charts uninstall with the module.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request adds support for installing k8s-aibom via the kubectl-apply module. The feature is designed to be opt-in and disabled by default, providing users with the ability to track AI bills of materials for their workloads. The implementation follows existing patterns for similar components, ensuring consistent management of CRDs and controller resources.

Highlights

• Feature Addition: Introduced an optional, opt-in installation for k8s-aibom, a tool for recording AI bills of materials in Kubernetes clusters.
• Configuration: Added a new Terraform variable k8s_aibom with configurable versioning and resource limits, defaulting to disabled.
• Infrastructure: Implemented Helm installation logic for both CRDs and the controller, including specific tolerations for GKE managed components.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds support for installing k8s-aibom (Kubernetes AI Bill of Materials) in the kubectl-apply management module. It introduces a new k8s_aibom input variable, configures the installation of its CRDs and controller via Helm, defines default Helm values with GKE tolerations, and updates the module's README.md with documentation and examples. There are no review comments, and I have no feedback to provide.

[shubpal07]

/gcbrun