From 5a98c225ef62cdad1cc769f98cd49440379db524 Mon Sep 17 00:00:00 2001 From: kbhos Date: Tue, 8 Sep 2026 19:23:33 +0530 Subject: [PATCH 1/2] docs: address OpenShift deployment review feedback --- docs/ai-pod-docs/openshift-quick-reference.md | 89 ++++++++++----- docs/ai-pod-docs/openshift-readme.md | 106 +++++++++++++----- 2 files changed, 142 insertions(+), 53 deletions(-) diff --git a/docs/ai-pod-docs/openshift-quick-reference.md b/docs/ai-pod-docs/openshift-quick-reference.md index c4a7346b..d8faeb18 100644 --- a/docs/ai-pod-docs/openshift-quick-reference.md +++ b/docs/ai-pod-docs/openshift-quick-reference.md @@ -43,14 +43,15 @@ Linux-only. The installer machine also requires: - Network access to the OpenShift API, image registry, and object store - Access to Hugging Face when model staging is enabled and a model is missing -- A Hugging Face token authorized for all gated models when staging is enabled +- Hugging Face credentials when model staging must download a missing gated + model **Required tools:** - OpenShift CLI (`oc`) -- Mike Farah `yq` v4 +- Mike Farah `yq` v4.48.1 - Helm v3+ -- `curl`, `jq`, `base64`, GNU `timeout`, `python3`, and `tar` +- `curl`, `jq`, `base64`, GNU `timeout`, Python 3.8 or later, and `tar` - MinIO client (`mc`) for MinIO, SeaweedFS, or generic S3-compatible storage - AWS CLI only for AWS S3 or automatic Amazon ECR authentication - `oc-mirror` v2 only for an air-gapped deployment @@ -96,18 +97,33 @@ The final command must print `yes`. ## Step 2: Confirm minimum worker capacity -The initial deployment requires at least: +The qualified minimum deployment uses one shared AI-tier worker node for CPU +and GPU workloads. That node requires at least: | Resource | Minimum requirement | |---|---:| | System RAM | 256 GiB | | Available workload disk | 1 TiB (1024 GiB) | -| GPU memory | 2 × 96 GB VRAM | +| GPU | 2 × NVIDIA RTX PRO 6000 Blackwell, 96 GB VRAM each | | CPU | 64 allocatable vCPU | -CPU and GPU workloads use the shared AI-tier worker pool. Disk means usable -capacity available before installation, including the filesystems backing -`/var/lib/containers` and `/opt/local-path-provisioner`. +The supported accelerator profile is `RTX_PRO_6000_BLACKWELL`; other GPU models +or equivalent aggregate VRAM configurations are not qualified for this +workflow. When more than one AI-tier node is selected, CPU and GPU workloads +still share one node pool. The 1 TiB disk requirement applies separately to +every selected AI-tier node and means usable capacity available immediately +before installation, including the filesystems backing `/var/lib/containers` +and `/opt/local-path-provisioner`. A nominal 1-TB drive provides less than +1024 GiB and does not meet this requirement. GPU capacity cannot be combined +across nodes to satisfy one pod; a Ray worker requesting two GPUs must fit on +one node with two GPUs available. + +Installer preflight verifies available space on the filesystem containing +`/var/lib/containers`, or `/` when that directory is absent, on every selected +AI-tier node. It does not separately measure `/opt/local-path-provisioner` when +that path uses another filesystem. It also does not verify the required CPU, +system RAM, physical GPU model, GPU count, or GPU memory; the customer must +confirm those capacities before installation. The object store is separate from worker storage and must be provisioned independently. @@ -179,7 +195,7 @@ Edit the copy and confirm these settings: | `openshift.nodes` | Exact AI-tier worker names when strategy is `manual` | | `openshift.routes.saia.enabled` | Create the HTTP SAIA Route | | `openshift.routes.slim.enabled` | Create the HTTP SLIM Route | -| `images.*` | Tagged application and supporting images available to the cluster | +| `images.*` | Tagged application and supporting images available to the cluster; use the [release-default image table](openshift-readme.md#image-pull-secrets-and-registry-access) | | `images.registryInsecure` | Defaults to `true` for a plain-HTTP registry; set `false` for Amazon ECR, Docker Hub, Harbor, or another trusted HTTPS registry | | `storage.storageClass` | Existing class, or `local-path` managed by the installer | | `storage.objectStore.*` | Type, bucket, endpoint where required, and credentials | @@ -270,9 +286,15 @@ Run: ./openshift_with_stack.sh install ``` -The installer automatically prepares and imports its OpenShift-specific -content, applies mirror policies and internal CatalogSources, and continues the -normal installation. Do not run a separate manual bundle workflow. +The installer uses `oc-mirror` to copy the OpenShift installation dependencies +into `images.registry`. These dependencies include the selected Node Feature +Discovery and NVIDIA GPU Operator packages and their related images, plus the +cert-manager, Local Path Provisioner, KubeRay Operator, OpenTelemetry Operator, +UBI helper, and OpenShift Driver Toolkit images. The installer then applies the +generated mirror policies and internal CatalogSources and continues the normal +installation. Application images configured under `images.*` and model +artifacts remain separate customer-provided content. Do not run a separate +manual bundle workflow. --- @@ -291,6 +313,9 @@ oc get pods -n "$AI_NAMESPACE" -o wide Print the default external endpoints: +The commands below require both `openshift.routes.saia.enabled: true` and +`openshift.routes.slim.enabled: true` in the configuration. + ```bash SAIA_HOST="$(oc get route saia -n "$AI_NAMESPACE" -o jsonpath='{.spec.host}')" SLIM_HOST="$(oc get route slim -n "$AI_NAMESPACE" -o jsonpath='{.spec.host}')" @@ -302,6 +327,11 @@ The supported Routes use HTTP. HTTPS Route TLS and workload mutual TLS are not configured by this installer. Ray dashboard diagnostics are documented in [openshift-troubleshooting.md](openshift-troubleshooting.md#raycluster-or-rayservice-does-not-become-ready). +If the SAIA Route is disabled, the documented browser-based Splunk AI Assistant +connection is unavailable. If the SLIM Route is disabled, an external Splunk +instance cannot use the documented SLIM endpoint; the installer-deployed +Splunk instance can still use the internal SLIM service shown in Step 6. + --- ## Step 6: Connect the Splunk apps @@ -311,12 +341,17 @@ Use the following versions for this release: | Component | Version | |---|---| | Splunk Enterprise | 10.2 | -| Splunk AI Assistant | 2.3.2 or later | -| Splunk AI Toolkit | 6.1.0 or later | +| Splunk AI Assistant | 2.3.2 | +| Splunk AI Toolkit | 6.1.0 | -The installer deploys a Splunk Standalone instance. An external Splunk -Enterprise instance may instead use the published Routes when its network and -JWT issuer are configured correctly. +These are the Splunk-side versions documented for this AI POD release. They are +separate from the platform container-image versions listed in the +[release-default image table](openshift-readme.md#image-pull-secrets-and-registry-access). + +AI POD supports two Splunk integration choices: a bundled Splunk Standalone or +an existing externally managed Splunk Enterprise deployment. Use the procedure +for the selected choice and ensure its network access and JWT issuer are +configured correctly. ### Open installer-deployed Splunk Web @@ -326,8 +361,8 @@ same kubeconfig and configuration file, and access to the OpenShift API. Set `KUBECONFIG`, `CONFIG_FILE`, and `AI_NAMESPACE` in that shell. The port-forward listens on that machine's localhost. -Use this section for the Splunk Standalone instance created by the installer. -The port-forward provides local access to its Splunk Web interface. +Use this section when the bundled Splunk Standalone option is deployed. The +port-forward provides local access to its Splunk Web interface. Retrieve the generated password: @@ -351,7 +386,7 @@ Open `http://localhost:18001` and log in as `admin`. ### Splunk AI Assistant 1. Install [Splunk AI Assistant](https://splunkbase.splunk.com/app/7245) - version 2.3.2 or later. + version 2.3.2. 2. Open **Splunk AI Assistant** to start the onboarding wizard. On **Getting started**, select **AI tier** and click **Next**. 3. On **Configure SOK and Splunk AI Assistant**, enter the full Splunk AI @@ -365,7 +400,7 @@ Open `http://localhost:18001` and log in as `admin`. 1. Install the [platform-appropriate Python for Scientific Computing app](https://splunkbase.splunk.com/collections/machine_learning). 2. Install [Splunk AI Toolkit](https://splunkbase.splunk.com/app/2890) - version 6.1.0 or later. + version 6.1.0. 3. Create a **Splunk AI tier** endpoint connection as described in the [full setup procedure](openshift-readme.md#install-and-configure-splunk-ai-toolkit). 4. For installer-deployed Splunk, use the internal SLIM endpoint printed by: @@ -385,16 +420,19 @@ create a named Splunk AI tier LLM connection, and run the post-install `ai` and ## Step 7: Operate and troubleshoot +For symptom-based diagnosis and recovery procedures, see the +[OpenShift Troubleshooting Guide](openshift-troubleshooting.md). + ### Scale the deployment `aiPlatform.scaleFactor` increases model replica counts and corresponding GPU worker groups. It does not provision hardware. Ensure sufficient CPU, memory, GPU, and storage capacity before increasing it. -| `scaleFactor` | System RAM | Available workload disk | GPU memory | CPU | +| `scaleFactor` | System RAM | Available workload disk per selected AI-tier node | GPU | CPU | |---:|---:|---:|---:|---:| -| `1` | 256 GiB | 1 TiB | 2 × 96 GB VRAM | 64 allocatable vCPU | -| `2` | 512 GiB | 2 TiB | 4 × 96 GB VRAM | 128 allocatable vCPU | +| `1` | 256 GiB | 1 TiB | 2 × NVIDIA RTX PRO 6000 Blackwell, 96 GB each | 64 allocatable vCPU | +| `2` | 512 GiB | 2 TiB | 4 × NVIDIA RTX PRO 6000 Blackwell, 96 GB each | 128 allocatable vCPU | Run commands from `tools/ai-tier-cluster-setup` with the `CONFIG_FILE` exported in Step 3: @@ -416,8 +454,7 @@ in Step 3: > Routes, and installer-created configuration. The OpenShift cluster and its > nodes are not removed. -For the complete symptom-based command set, use -[openshift-troubleshooting.md](openshift-troubleshooting.md). Start with: +Start with: ```bash oc get aiplatform,aiservice,raycluster,rayservice -n "$AI_NAMESPACE" diff --git a/docs/ai-pod-docs/openshift-readme.md b/docs/ai-pod-docs/openshift-readme.md index 37c81d70..a51a7c7a 100644 --- a/docs/ai-pod-docs/openshift-readme.md +++ b/docs/ai-pod-docs/openshift-readme.md @@ -158,12 +158,13 @@ flowchart TB ### Minimum deployment requirements -The smallest supported deployment uses one shared AI-tier node pool for CPU and -GPU workloads. Provide at least: +The qualified minimum deployment uses one shared AI-tier worker node for CPU +and GPU workloads. That node must provide at least: - 256 GiB system RAM - 1 TiB (1024 GiB) available workload disk -- 2 GPUs with 96 GB VRAM each (192 GB total) +- 2 × NVIDIA RTX PRO 6000 Blackwell GPUs with 96 GB VRAM each (192 GB + total), using accelerator profile `RTX_PRO_6000_BLACKWELL` - 64 allocatable vCPU > [!IMPORTANT] @@ -173,6 +174,22 @@ GPU workloads. Provide at least: > `/var/lib/containers` and `/opt/local-path-provisioner`, or provide equivalent > capacity for both. +Other GPU models or equivalent aggregate VRAM configurations are not qualified +for this OpenShift workflow. When more than one AI-tier node is selected, CPU +and GPU workloads still share one node pool. The workload-disk minimum applies +separately to every selected AI-tier node. GPU capacity cannot be combined +across nodes to satisfy one pod; a Ray worker requesting two GPUs must fit on +one node with two GPUs available. + +Installer preflight verifies available space on the filesystem containing +`/var/lib/containers`, or `/` when that directory is absent, on every selected +AI-tier node. It does not separately measure `/opt/local-path-provisioner` when +that path uses another filesystem. It also does not verify the required CPU, +system RAM, physical GPU model, GPU count, or GPU memory; the customer must +confirm those capacities before installation. The later NVIDIA GPU readiness +check confirms only that the cluster exposes allocatable `nvidia.com/gpu` +capacity. + ### Reference AI worker hardware for the minimum deployment **Shared AI-tier worker:** one Cisco UCS C845A M8 AI Server @@ -193,16 +210,17 @@ Provide separate workload storage. `aiPlatform.scaleFactor` is an optional global integer capacity multiplier, with a default and minimum value of `1`. It increases model replicas and GPU workers; it does not create hardware. Plan CPU, memory, GPU, and storage -capacity before increasing it. The installer enforces an available workload-disk -minimum of `1024 GiB × scaleFactor` on every AI-tier node. +capacity before increasing it. The installer enforces a minimum of +`1024 GiB × scaleFactor` on the container-storage filesystem of every selected +AI-tier node. Set the value only at `aiPlatform.scaleFactor`. It applies uniformly to all model deployments; individual model deployments cannot be scaled separately. -| `scaleFactor` | System RAM | Available workload disk | GPU VRAM | CPU | +| `scaleFactor` | System RAM | Available workload disk per selected AI-tier node | GPU | CPU | |---:|---:|---:|---:|---:| -| `1` | 256 GiB | 1 TiB (1024 GiB) | 2 × 96 GB (192 GB total) | 64 allocatable vCPU | -| `2` | 512 GiB | 2 TiB (2048 GiB) | 4 × 96 GB (384 GB total) | 128 allocatable vCPU | +| `1` | 256 GiB | 1 TiB (1024 GiB) | 2 × NVIDIA RTX PRO 6000 Blackwell, 96 GB each | 64 allocatable vCPU | +| `2` | 512 GiB | 2 TiB (2048 GiB) | 4 × NVIDIA RTX PRO 6000 Blackwell, 96 GB each | 128 allocatable vCPU | ### Qualified installer and cluster compatibility @@ -384,7 +402,7 @@ in this installer. |---|---|---| | `storage.storageClass` | `local-path` | StorageClass used for workload PVCs | | `storage.vectorDbSize` | `50Gi` | Requested Weaviate PVC size | -| `storage.minimumDiskSpace.aiTierNode` | `1024` | Minimum available GiB on every AI-tier node at `scaleFactor: 1`; multiplied by the scale factor | +| `storage.minimumDiskSpace.aiTierNode` | `1024` | Minimum available container-storage GiB on every selected AI-tier node at `scaleFactor: 1`; multiplied by the scale factor | | `storage.modelStaging.enabled` | `true` | Stage only missing or changed models; `false` skips staging and performs a pre-check only for air-gapped installs | | `storage.objectStore.type` | `seaweedfs` in the template | `aws`, `minio`, `seaweedfs`, or `s3compat` | | `storage.objectStore.bucket` | `ai-platform-bucket` | Bucket used for model artifacts and runtime state | @@ -429,7 +447,12 @@ valid service URL such as the namespace-qualified service name. The JWT issuer endpoint and `hecEndpoint` serve different purposes: - the issuer endpoint validates Splunk JWTs on port 8089 -- `hecEndpoint` sends telemetry to Splunk HTTP Event Collector on port 8088 +- `hecEndpoint` is generated by the installer for the bundled Splunk Standalone + and sends platform telemetry to its Splunk HTTP Event Collector on port 8088 + +An external Splunk integration does not configure `hecEndpoint` through this +workflow. It requires the appropriate JWT issuer under `splunk.trustedIssuers` +and network access to the enabled SAIA and SLIM Routes. ### AI Platform @@ -506,6 +529,11 @@ The application `v1.0` tags may be mutable, and workloads use `imagePullPolicy: IfNotPresent`. For a controlled refresh, use a new immutable tag or image digest instead of reusing a changed tag. +These references are the platform-side container set documented for this AI +POD release. Splunk Enterprise and the Splunk AI Assistant and Splunk AI +Toolkit packages are versioned separately; use the matching versions listed in +[Splunk integration and authentication](#splunk-integration-and-authentication). + For Amazon ECR, enable: ```yaml @@ -570,8 +598,9 @@ not require authentication needs no pull-secret block. `openshift_with_stack.sh install` performs these phases in order: -1. **Air-gap preparation, when enabled** — mirror installer-owned OpenShift - content into the internal registry and apply the generated mirror resources. +1. **Air-gap preparation, when enabled** — mirror the required OpenShift + installation dependencies into the internal registry and apply the generated + mirror resources. 2. **Configuration** — load and validate settings, resolve images, accelerator, model staging, and print the installation plan. 3. **Preflight** — validate client tools, cluster-admin access, OpenShift and @@ -643,9 +672,10 @@ CONFIG_FILE="$CONFIG_FILE" ./openshift_with_stack.sh install ### Content mirrored by the installer -The installer uses `oc-mirror` to mirror its OpenShift-specific dependencies -into `images.registry`, applies the generated mirror policies and CatalogSource -resources, and continues the installation. It mirrors: +The installer uses `oc-mirror` to pull its OpenShift-specific dependencies from +their source registries and mirror them into `images.registry`. It then applies +the generated mirror policies and CatalogSource resources and continues the +installation. It mirrors: - Node Feature Discovery and NVIDIA GPU Operator catalogs and operand images - the OpenShift Driver Toolkit image when it is not already in the cluster's @@ -704,7 +734,12 @@ certificate trusted by the installer host and OpenShift nodes. Setting it to ## Model staging The RTX Pro 6000 Blackwell profile uses -`model_artifacts_configs_quantized.yaml`, including the quantized Gemma model. +[`tools/artifacts_download_upload_scripts/model_artifacts_configs_quantized.yaml`](../../tools/artifacts_download_upload_scripts/model_artifacts_configs_quantized.yaml), +including the quantized Gemma model. When a missing artifact in the selected +profile is marked as gated, configure `hf-username` and `hf-token` in the local +working-tree copy of that profile. The credentials are not required for +non-gated artifacts or artifacts already present with matching completion +markers. Do not commit credentials to source control. `storage.modelStaging.enabled` controls the workflow: @@ -795,6 +830,9 @@ http://-slim-slim-service..svc.cluster.local:8080/te List the Routes: +This command requires both `openshift.routes.saia.enabled: true` and +`openshift.routes.slim.enabled: true` in the configuration. + ```bash oc get route saia slim -n ai-platform ``` @@ -803,6 +841,11 @@ The installer supports and qualifies HTTP Routes only. HTTPS Route TLS and workload mTLS are not configured or supported by this deployment workflow. Use the HTTP URLs printed by the installer. +If the SAIA Route is disabled, the documented browser-based Splunk AI Assistant +connection is unavailable. If the SLIM Route is disabled, an external Splunk +instance cannot use the documented SLIM endpoint. The bundled Splunk instance +can still use the internal SLIM service shown above. + ### Open the Ray dashboard To open the Ray dashboard locally: @@ -816,10 +859,17 @@ Then open `http://localhost:8265`. Replace `openshift-ai-platform` if ## Splunk integration and authentication -The OpenShift installer always deploys a bundled Splunk Standalone. An -externally managed Splunk Enterprise instance can also use the SAIA and SLIM -Routes, but it does not replace the bundled instance in the current installer. -For external Splunk, make sure its JWT issuer is listed under +Use this Splunk-side version set with this release: + +| Component | Version | +|---|---| +| Splunk Enterprise | 10.2 | +| Splunk AI Assistant | 2.3.2 | +| Splunk AI Toolkit | 6.1.0 | + +AI POD supports two Splunk integration choices: a bundled Splunk Standalone or +an existing externally managed Splunk Enterprise deployment. For external +Splunk, make sure its JWT issuer is listed under `splunk.trustedIssuers` and that both Splunk and the user's browser can reach the required Routes. @@ -845,7 +895,7 @@ Keep the port-forward running and open `http://localhost:18001`. Log in as ### Install and configure Splunk AI Assistant Use Splunk Enterprise 10.2 and install -[Splunk AI Assistant](https://splunkbase.splunk.com/app/7245) version 2.3.2 or later +[Splunk AI Assistant](https://splunkbase.splunk.com/app/7245) version 2.3.2 (`Splunk_AI_Assistant_Cloud.tgz`): Before configuring the app, retrieve the Splunk AI Assistant Route. This @@ -875,8 +925,8 @@ supported by this installation workflow. ### Install and configure Splunk AI Toolkit Install the Python for Scientific Computing app first, then install -[Splunk AI Toolkit](https://splunkbase.splunk.com/app/2890) version 6.1.0 or -later (`Splunk_ML_Toolkit.tgz`) through **Manage Apps**. Restart Splunk if +[Splunk AI Toolkit](https://splunkbase.splunk.com/app/2890) version 6.1.0 +(`Splunk_ML_Toolkit.tgz`) through **Manage Apps**. Restart Splunk if prompted. AITK uses SLIM, not SAIA. In **Splunk AI Toolkit → Connections**, select @@ -894,7 +944,9 @@ AI_PLATFORM_NAME="$(yq eval '.aiPlatform.name // "openshift-ai-platform"' "$CONF echo "http://${AI_PLATFORM_NAME}-slim-slim-service.${NAMESPACE}.svc.cluster.local:8080/tenant/slim-api/v1alpha1" ``` -For an external Splunk instance, use the SLIM Route printed by the installer: +For an external Splunk instance, this procedure requires +`openshift.routes.slim.enabled: true`. Use the SLIM Route printed by the +installer: ```text http://slim./tenant/slim-api/v1alpha1 @@ -926,9 +978,9 @@ Splunk → SLIM → model path. ### Bring Your Own LLM -AITK can share a customer-managed LLM connection with Splunk AI Assistant. This -is an application workflow and does not change the OpenShift installation or -the SAIA and SLIM endpoints. +Bring Your Own LLM is an optional post-deployment Splunk application feature. +AITK can share a customer-managed LLM connection with Splunk AI Assistant. It +does not change the OpenShift installation or the SAIA and SLIM endpoints. 1. In **Splunk AI Toolkit → Connections**, create an **LLM → Custom provider** connection. From 2f89ab7bf9a13fb70769e06f06940dc0b0af6750 Mon Sep 17 00:00:00 2001 From: kbhos Date: Wed, 9 Sep 2026 17:07:19 +0530 Subject: [PATCH 2/2] docs: clarify OpenShift route usage --- docs/ai-pod-docs/openshift-quick-reference.md | 22 +++------ docs/ai-pod-docs/openshift-readme.md | 49 ++++++------------- 2 files changed, 22 insertions(+), 49 deletions(-) diff --git a/docs/ai-pod-docs/openshift-quick-reference.md b/docs/ai-pod-docs/openshift-quick-reference.md index d8faeb18..e587d85e 100644 --- a/docs/ai-pod-docs/openshift-quick-reference.md +++ b/docs/ai-pod-docs/openshift-quick-reference.md @@ -328,9 +328,8 @@ configured by this installer. Ray dashboard diagnostics are documented in [openshift-troubleshooting.md](openshift-troubleshooting.md#raycluster-or-rayservice-does-not-become-ready). If the SAIA Route is disabled, the documented browser-based Splunk AI Assistant -connection is unavailable. If the SLIM Route is disabled, an external Splunk -instance cannot use the documented SLIM endpoint; the installer-deployed -Splunk instance can still use the internal SLIM service shown in Step 6. +connection is unavailable. If the SLIM Route is disabled, Splunk AI Toolkit +cannot use the documented SLIM endpoint. --- @@ -403,18 +402,11 @@ Open `http://localhost:18001` and log in as `admin`. version 6.1.0. 3. Create a **Splunk AI tier** endpoint connection as described in the [full setup procedure](openshift-readme.md#install-and-configure-splunk-ai-toolkit). -4. For installer-deployed Splunk, use the internal SLIM endpoint printed by: - -```bash -printf 'http://%s-slim-slim-service.%s.svc.cluster.local:8080/tenant/slim-api/v1alpha1\n' \ - "$AI_PLATFORM_NAME" "$AI_NAMESPACE" -``` - -For external Splunk, use the SLIM Route printed in -[Step 5](#step-5-verify-and-access-the-platform). Confirm that models appear, -create a named Splunk AI tier LLM connection, and run the post-install `ai` and -`apply CDTSM` verification searches in -[openshift-readme.md](openshift-readme.md#install-and-configure-splunk-ai-toolkit). +4. For both installer-deployed and external Splunk, use the SLIM Route printed + in [Step 5](#step-5-verify-and-access-the-platform). +5. Confirm that models appear, create a named Splunk AI tier LLM connection, + and run the post-install `ai` and `apply CDTSM` verification searches in + [openshift-readme.md](openshift-readme.md#install-and-configure-splunk-ai-toolkit). --- diff --git a/docs/ai-pod-docs/openshift-readme.md b/docs/ai-pod-docs/openshift-readme.md index a51a7c7a..0ae54a59 100644 --- a/docs/ai-pod-docs/openshift-readme.md +++ b/docs/ai-pod-docs/openshift-readme.md @@ -304,14 +304,14 @@ Allow these flows for the selected installation and integration path: | Installer machine | Hugging Face | Download a required model that is missing when model staging is enabled | | Installer machine and AI workloads | Object-store endpoint | Stage and read models and runtime state | | OpenShift nodes | Configured image registries | Pull Operator and workload images | -| User browser and external Splunk | OpenShift router on TCP 80 | Reach the supported HTTP SAIA and SLIM Routes | +| User browser and Splunk Enterprise | OpenShift router on TCP 80 | Reach the supported HTTP SAIA and SLIM Routes | | SAIA and SLIM workloads | Bundled Splunk management service on TCP 8089 | Fetch signing keys and validate JWTs | | Internal OpenTelemetry collectors | Bundled Splunk HEC service on TCP 8088 | Send internal telemetry | | Splunk Enterprise, only when using Bring Your Own LLM | Customer OIDC token endpoint and LLM endpoint | Authenticate to and invoke the custom model provider | -An external Splunk server and the user's browser must each be able to resolve -and reach the appropriate Route. A laptop VPN does not provide connectivity for -the external Splunk server or for workloads running inside OpenShift. +The Splunk instance and the user's browser must each be able to resolve and +reach the appropriate Route. A laptop VPN does not provide connectivity for an +external Splunk server or for workloads running inside OpenShift. The supported SAIA and SLIM exposure uses HTTP on TCP 80. HTTPS Route TLS and workload mTLS are not configured or qualified by this installation workflow. @@ -437,22 +437,15 @@ Before installation, validate that the configured credentials can access the selected bucket with the required read and write permissions. Preflight does not verify bucket authorization or bucket-level permissions. -### Splunk issuers and HEC +### Splunk issuers The installer adds the primary short Splunk management service URL to `SPLUNK_ISSUERS`. Values under `splunk.trustedIssuers` are additional accepted management/JWT issuer URLs; use them when a client token contains a different, valid service URL such as the namespace-qualified service name. -The JWT issuer endpoint and `hecEndpoint` serve different purposes: - -- the issuer endpoint validates Splunk JWTs on port 8089 -- `hecEndpoint` is generated by the installer for the bundled Splunk Standalone - and sends platform telemetry to its Splunk HTTP Event Collector on port 8088 - -An external Splunk integration does not configure `hecEndpoint` through this -workflow. It requires the appropriate JWT issuer under `splunk.trustedIssuers` -and network access to the enabled SAIA and SLIM Routes. +An external Splunk integration requires the appropriate JWT issuer under +`splunk.trustedIssuers` and network access to the enabled SAIA and SLIM Routes. ### AI Platform @@ -818,15 +811,10 @@ SLIM: http://slim./tenant/slim-api/v1alpha1 ``` Use the SAIA URL in the Splunk AI Assistant app and the full SLIM URL in Splunk -AI Toolkit. An existing external Splunk Enterprise deployment can use these -URLs when its network can resolve and reach the OpenShift Routes. - -When Splunk runs inside the same cluster, AITK can use the internal SLIM -endpoint instead: - -```text -http://-slim-slim-service..svc.cluster.local:8080/tenant/slim-api/v1alpha1 -``` +AI Toolkit. Both the installer-deployed Splunk Standalone and an externally +managed Splunk Enterprise deployment use these published Routes. The user's +browser must reach the SAIA Route, and the Splunk instance must reach the SLIM +Route. List the Routes: @@ -842,9 +830,8 @@ workload mTLS are not configured or supported by this deployment workflow. Use the HTTP URLs printed by the installer. If the SAIA Route is disabled, the documented browser-based Splunk AI Assistant -connection is unavailable. If the SLIM Route is disabled, an external Splunk -instance cannot use the documented SLIM endpoint. The bundled Splunk instance -can still use the internal SLIM service shown above. +connection is unavailable. If the SLIM Route is disabled, Splunk AI Toolkit +cannot use the documented SLIM endpoint. ### Open the Ray dashboard @@ -937,14 +924,8 @@ the complete API path: http:///tenant/slim-api/v1alpha1 ``` -For the bundled Splunk instance, use the internal endpoint: - -```bash -AI_PLATFORM_NAME="$(yq eval '.aiPlatform.name // "openshift-ai-platform"' "$CONFIG_FILE")" -echo "http://${AI_PLATFORM_NAME}-slim-slim-service.${NAMESPACE}.svc.cluster.local:8080/tenant/slim-api/v1alpha1" -``` - -For an external Splunk instance, this procedure requires +For both the installer-deployed Splunk Standalone and an externally managed +Splunk Enterprise deployment, this procedure requires `openshift.routes.slim.enabled: true`. Use the SLIM Route printed by the installer: