docs(evidence): add VR200/RKE2 training and inference-dynamo evidence - #2573
docs(evidence): add VR200/RKE2 training and inference-dynamo evidence#2573yuanchen8911 wants to merge 2 commits into
Conversation
Hardware-validated on a VR200 NVL72 RKE2 cluster (2 GPU workers, 4 GPUs each):
vr200-rke2-ubuntu-training deployment 4/4, conformance 8/8,
performance 1/1 (NCCL NVLS all-reduce
744.63 GB/s against a >= 600 GB/s floor)
vr200-rke2-ubuntu-inference-dynamo deployment 4/4, conformance 10/10
Pointers are committed unsigned and flat; the fork signing workflow signs them
with ambient OIDC and relocates each to its per-source path.
Signed-off-by: Yuan Chen <yuanchen97@gmail.com>
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
yuanchen8911
added
the
theme/supply-chain
Recipe evidence checkOrphan evidence pointersAdded or modified, but with no matching leaf overlay (
How to refresh evidenceRun on a cluster matching the recipe's aicr snapshot -o snapshot.yaml
# Profiled families (AKS/GKE gpuStack): hydrate the recipe with the
# pointer's recorded 'profile:' selection first — validating the raw
# overlay resolves only the declaration default, and 'aicr validate'
# has no --profile flag. AKS additionally needs the pool projection
# (GKE uses the plain snapshot above):
# az aks nodepool list -g <rg> --cluster-name <cluster> -o json > pools.json
# aicr snapshot --aks-gpu-pools pools.json -o snapshot.yaml
# aicr recipe -s snapshot.yaml --intent <intent> [--platform <platform>] \
# --profile <name>=<value> -o recipe.yaml
# State the target leaf's intent/platform explicitly (the snapshot
# fingerprint supplies service/accelerator/OS but intent and platform
# default to 'any') and pass -r recipe.yaml below instead of the raw
# overlay.
aicr validate \
-r recipes/overlays/<slug>.yaml \
-s snapshot.yaml \
--emit-attestation ./out \
--push ghcr.io/<your-fork>/aicr-evidence
# Copy to the per-source path printed in the emit 'copyTo' hint:
# recipes/evidence/<slug>/<source>/<bundle-digest>.yamlThis gate is warning-only and never blocks merge. See ADR-007 for the trust model. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. 📝 WalkthroughWalkthroughAdded attestation metadata for the Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to This change publishes signed evidence pointers for the VR200 training and inference recipes without altering runtime code, configuration, or CI behavior. No current merge-blocking risk remains. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
1 participant
Summary
Adds signed recipe-evidence pointers for two VR200/RKE2 leaves, both validated end to end on real VR200 NVL72 hardware.
vr200-rke2-ubuntu-training>= 600 GB/sfloorvr200-rke2-ubuntu-inference-dynamoinference-perfTwo files, both machine-generated pointers under the existing allowlisted community source
5bf9e82f0e90a11528ac85f4bcb866c8.Motivation / Context
The VR200/RKE2 leaves had no evidence covering the compiled NVLS performance path. This records a hardware run of it.
The NCCL result is the notable part: with
nccl-benchmark-runtime-refdropped,customRuntimeis empty and the validator provisions the ComputeDomain into the per-run namespace itself. That is the mechanism that makes the benchmark work after #2443 moved each run intoaicr-nccl-perf-<variant>-<runID>, and this run exercises it on hardware.Related: #2520 (adds the VR200/RKE2 recipes and the rke2/vr200 NVLS promotion), #2569 (the runtime-ref namespace defect).
Type of Change
Component(s) Affected
docs/,examples/)Implementation Notes
Environment:
vr200-aicr-cluster-2, 2 GPU workers x 4 GPUs (8 total), RKE2 v1.35.6+rke2r1, Ubuntu 26.04, BOS 64k-page kernel, GPU operator v26.7.0.Generated with the standard fork flow:
aicr validate --emit-attestation, thenaicr evidence publish --push ghcr.io/yuanchen8911/aicr-evidence --no-sign, then the fork'sRecipe Evidence: Signworkflow signed each pointer with ambient GitHub Actions OIDC and relocated it from its flat path torecipes/evidence/<recipe>/<source>/<digest>.yaml.Signing is CI-ambient rather than local keyless, so the signer identity is the workflow — no personal identity is written to the public Rekor log. The source slug is the already-allowlisted
5bf9e82f..., soallowlist.yamlneeds no change.Evidence pointer YAMLs are machine-generated and carry no license header, consistent with every previously merged pointer.
Testing
Doc/data-only change — two generated pointer files, no Go, YAML config, or CI logic touched — so scoped checks rather than a full
make qualify:aicr evidence verifyon both pointers: exit 0 on each, which predicts the "Enforce per-source pointer contract" gate passing.One transient failure is worth recording for reviewers: an earlier run had
dra-supportfail with a dial timeout to the kube API service IP during DRA API discovery. It passed on retry, and DRA was demonstrably healthy throughout (the following performance phase provisioned ComputeDomains and completed NCCL). That run's bundle was discarded rather than submitted; the evidence here comes only from clean all-pass runs.Risk Assessment
Rollout notes: Additive data only. No code paths change. On merge,
Evidence: Ingestpublishes to GCS and the dashboard refreshes.