Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ Lightspeed Core Stack (LCS) supports the large language models from the provider
| -------- | ---------------------------------------------- | ------------ | -------------- | -------------------------------------------------------------------------- |
| OpenAI | gpt-5, gpt-4o, gpt4-turbo, gpt-4.1, o1, o3, o4 | Yes | remote::openai | [1](examples/openai-faiss-run.yaml) [2](examples/openai-pgvector-run.yaml) |
| OpenAI | gpt-3.5-turbo, gpt-4 | No | remote::openai | |
| RHOAI (vLLM)| meta-llama/Llama-3.2-1B-Instruct | Yes | remote::vllm | [1](tests/e2e-prow/rhoai/configs/run.yaml) |
| RHAIIS (vLLM)| meta-llama/Llama-3.1-8B-Instruct | Yes | remote::vllm | [1](tests/e2e/configs/run-rhaiis.yaml) |
| Azure | gpt-5, gpt-5-mini, gpt-5-nano, gpt-5-chat, gpt-4.1, gpt-4.1-mini, gpt-4.1-nano, o3-mini, o4-mini | Yes | remote::azure | [1](examples/azure-run.yaml) |
| Azure | o1, o1-mini | No | remote::azure | |
Expand Down
1 change: 1 addition & 0 deletions docs/providers.md
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,7 @@ Red Hat providers:

| Name | Version Tested | Type | Pip Dependencies | Supported in LCS |
|---|---|---|---|:---:|
| RHOAI (vllm) | latest operator | remote | `openai` | ✅ |
| RHAIIS (vllm) | 3.2.3 (on RHEL 9.20250429.0.4) | remote | `openai` | ✅ |


Expand Down
25 changes: 25 additions & 0 deletions tests/e2e-prow/rhoai/configs/lightspeed-stack.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Lightspeed Core Service (LCS)
service:
host: 0.0.0.0
port: 8080
auth_enabled: false
workers: 1
color_log: true
access_log: true
llama_stack:
# Uses a remote llama-stack service
# The instance would have already been started with a llama-stack-run.yaml file
use_as_library_client: false
# Alternative for "as library use"
# use_as_library_client: true
# library_client_config_path: <path-to-llama-stack-run.yaml-file>
url: http://${env.E2E_LLAMA_HOSTNAME}:8321
api_key: xyzzy
user_data_collection:
feedback_enabled: true
feedback_storage: "/tmp/data/feedback"
transcripts_enabled: true
transcripts_storage: "/tmp/data/transcripts"

authentication:
module: "noop"
120 changes: 120 additions & 0 deletions tests/e2e-prow/rhoai/configs/run.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,120 @@
version: '2'
image_name: minimal-viable-llama-stack-configuration

apis:
- agents
- datasetio
- eval
- inference
- post_training
- safety
- scoring
- telemetry
- tool_runtime
- vector_io
benchmarks: []
container_image: null
datasets: []
external_providers_dir: null
inference_store:
db_path: .llama/distributions/ollama/inference_store.db
type: sqlite
logging: null
metadata_store:
db_path: .llama/distributions/ollama/registry.db
namespace: null
type: sqlite
providers:
agents:
- config:
persistence_store:
db_path: .llama/distributions/ollama/agents_store.db
namespace: null
type: sqlite
responses_store:
db_path: .llama/distributions/ollama/responses_store.db
type: sqlite
provider_id: meta-reference
provider_type: inline::meta-reference
datasetio:
- config:
kvstore:
db_path: .llama/distributions/ollama/huggingface_datasetio.db
namespace: null
type: sqlite
provider_id: huggingface
provider_type: remote::huggingface
- config:
kvstore:
db_path: .llama/distributions/ollama/localfs_datasetio.db
namespace: null
type: sqlite
provider_id: localfs
provider_type: inline::localfs
eval:
- config:
kvstore:
db_path: .llama/distributions/ollama/meta_reference_eval.db
namespace: null
type: sqlite
provider_id: meta-reference
provider_type: inline::meta-reference
inference:
- provider_id: vllm
provider_type: remote::vllm
config:
url: ${env.KSVC_URL}/v1/
api_token: ${env.VLLM_API_KEY}
tls_verify: false
max_tokens: 1024
post_training:
- config:
checkpoint_format: huggingface
device: cpu
distributed_backend: null
dpo_output_dir: "."
provider_id: huggingface
provider_type: inline::huggingface-gpu
safety:
- config:
excluded_categories: []
provider_id: llama-guard
provider_type: inline::llama-guard
scoring:
- config: {}
provider_id: basic
provider_type: inline::basic
- config: {}
provider_id: llm-as-judge
provider_type: inline::llm-as-judge
- config:
openai_api_key: '********'
provider_id: braintrust
provider_type: inline::braintrust
telemetry:
- config:
service_name: 'lightspeed-stack-telemetry'
sinks: sqlite
sqlite_db_path: .llama/distributions/ollama/trace_store.db
provider_id: meta-reference
provider_type: inline::meta-reference
tool_runtime: []
vector_io: []
scoring_fns: []
server:
auth: null
host: null
port: 8321
quota: null
tls_cafile: null
tls_certfile: null
tls_keyfile: null
shields: []
vector_dbs: []

models:
- model_id: meta-llama/Llama-3.2-1B-Instruct
provider_id: vllm
model_type: llm
provider_model_id: null

25 changes: 25 additions & 0 deletions tests/e2e-prow/rhoai/manifests/lightspeed/lightspeed-stack.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
apiVersion: v1
kind: Pod
metadata:
name: lightspeed-stack-service
namespace: e2e-rhoai-dsc
spec:
containers:
- name: lightspeed-stack-container
env:
- name: E2E_LLAMA_HOSTNAME
valueFrom:
secretKeyRef:
name: llama-stack-ip-secret
key: key
image: quay.io/lightspeed-core/lightspeed-stack:dev-latest
ports:
- containerPort: 8080
volumeMounts:
- name: config
mountPath: /app-root/lightspeed-stack.yaml
subPath: lightspeed-stack.yaml
volumes:
- name: config
configMap:
name: lightspeed-stack-config
34 changes: 34 additions & 0 deletions tests/e2e-prow/rhoai/manifests/lightspeed/llama-stack.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
apiVersion: v1
kind: Pod
metadata:
name: llama-stack-service
namespace: e2e-rhoai-dsc
spec:
containers:
- name: llama-stack-container
env:
- name: KSVC_URL
valueFrom:
secretKeyRef:
name: api-url-secret
key: key
- name: VLLM_API_KEY
valueFrom:
secretKeyRef:
name: vllm-api-key-secret
key: key
image: quay.io/opendatahub/llama-stack:rhoai-v2.25-latest
ports:
- containerPort: 8321
volumeMounts:
- name: app-root
mountPath: /opt/app-root/src/.llama
- name: config
mountPath: /opt/app-root/run.yaml
subPath: run.yaml
volumes:
- name: app-root
emptyDir: {}
- name: config
configMap:
name: llama-stack-config
Comment on lines +1 to +34
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add security hardening: securityContext and resource limits.

This Pod lacks security controls and resource management like other manifests in the PR:

  1. No securityContext — container runs as root
  2. No resource requests/limits — unbounded resource usage

Apply this diff to add hardening:

 spec:
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    fsGroup: 1000
   containers:
     - name: llama-stack-container
+      securityContext:
+        allowPrivilegeEscalation: false
+      resources:
+        requests:
+          memory: "2Gi"
+          cpu: "500m"
+        limits:
+          memory: "4Gi"
+          cpu: "2"
       env:
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
apiVersion: v1
kind: Pod
metadata:
name: llama-stack-service
namespace: e2e-rhoai-dsc
spec:
containers:
- name: llama-stack-container
env:
- name: KSVC_URL
valueFrom:
secretKeyRef:
name: api-url-secret
key: key
- name: VLLM_API_KEY
valueFrom:
secretKeyRef:
name: vllm-api-key-secret
key: key
image: quay.io/opendatahub/llama-stack:rhoai-v2.25-latest
ports:
- containerPort: 8321
volumeMounts:
- name: app-root
mountPath: /opt/app-root/src/.llama
- name: config
mountPath: /opt/app-root/run.yaml
subPath: run.yaml
volumes:
- name: app-root
emptyDir: {}
- name: config
configMap:
name: llama-stack-config
apiVersion: v1
kind: Pod
metadata:
name: llama-stack-service
namespace: e2e-rhoai-dsc
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
containers:
- name: llama-stack-container
securityContext:
allowPrivilegeEscalation: false
resources:
requests:
memory: "2Gi"
cpu: "500m"
limits:
memory: "4Gi"
cpu: "2"
env:
- name: KSVC_URL
valueFrom:
secretKeyRef:
name: api-url-secret
key: key
- name: VLLM_API_KEY
valueFrom:
secretKeyRef:
name: vllm-api-key-secret
key: key
image: quay.io/opendatahub/llama-stack:rhoai-v2.25-latest
ports:
- containerPort: 8321
volumeMounts:
- name: app-root
mountPath: /opt/app-root/src/.llama
- name: config
mountPath: /opt/app-root/run.yaml
subPath: run.yaml
volumes:
- name: app-root
emptyDir: {}
- name: config
configMap:
name: llama-stack-config
🧰 Tools
🪛 Checkov (3.2.334)

[medium] 1-34: Containers should not run with allowPrivilegeEscalation

(CKV_K8S_20)


[medium] 1-34: Minimize the admission of root containers

(CKV_K8S_23)

🤖 Prompt for AI Agents
In tests/e2e-prow/rhoai/manifests/lightspeed/llama-stack.yaml lines 1-34, the
Pod is missing security hardening and resource management; add a pod-level
securityContext (e.g., runAsNonRoot: true, runAsUser: 1000, fsGroup: 1000) and a
container-level securityContext (allowPrivilegeEscalation: false, privileged:
false, capabilities: drop: ["ALL"], and keep readOnlyRootFilesystem appropriate
for the mounted volume), and add resources.requests and resources.limits for CPU
and memory (example requests cpu: "100m", memory: "128Mi"; limits cpu: "500m",
memory: "1Gi") to the container spec so the Pod does not run as root and has
bounded resources.

17 changes: 17 additions & 0 deletions tests/e2e-prow/rhoai/manifests/operators/ds-cluster.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
apiVersion: datasciencecluster.opendatahub.io/v1
kind: DataScienceCluster
metadata:
name: default-dsc
namespace: e2e-rhoai-dsc
spec:
serviceMesh:
managementState: Managed
components:
kserve:
managementState: Managed
workbenches:
managementState: Removed
dashboard:
managementState: Removed
dataSciencePipelines:
managementState: Removed
6 changes: 6 additions & 0 deletions tests/e2e-prow/rhoai/manifests/operators/operatorgroup.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: global-operators
namespace: openshift-operators
spec:
35 changes: 35 additions & 0 deletions tests/e2e-prow/rhoai/manifests/operators/operators.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# Service Mesh Operator Subscription
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: servicemeshoperator
namespace: openshift-operators
spec:
channel: "stable"
name: "servicemeshoperator"
source: "redhat-operators"
sourceNamespace: "openshift-marketplace"
---
# Serverless Operator Subscription
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: serverless-operator
namespace: openshift-operators
spec:
channel: "stable"
name: "serverless-operator"
source: "redhat-operators"
sourceNamespace: "openshift-marketplace"
---
# RHODS Operator Subscription
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: rhods-operator
namespace: openshift-operators
spec:
channel: stable
name: rhods-operator
source: redhat-operators
sourceNamespace: openshift-marketplace
30 changes: 30 additions & 0 deletions tests/e2e-prow/rhoai/manifests/test-pod/spin-up.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
apiVersion: v1
kind: Pod
metadata:
name: test-pod
namespace: e2e-rhoai-dsc
spec:
containers:
- name: test-container
env:
- name: E2E_LSC_HOSTNAME
valueFrom:
secretKeyRef:
name: lcs-ip-secret
key: key
- name: E2E_LLAMA_HOSTNAME
valueFrom:
secretKeyRef:
name: llama-stack-ip-secret
key: key
image: registry.access.redhat.com/ubi9/python-312
command: ["/bin/sh", "/scripts/run-tests.sh"]
volumeMounts:
- name: script-volume
mountPath: /scripts
volumes:
- name: script-volume
configMap:
name: test-script-cm
defaultMode: 0755 # Make the script executable
restartPolicy: Never
13 changes: 13 additions & 0 deletions tests/e2e-prow/rhoai/manifests/vllm/inference-service.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
apiVersion: serving.kserve.io/v1beta1
kind: InferenceService
metadata:
name: vllm-model
namespace: e2e-rhoai-dsc
spec:
predictor:
model:
modelFormat:
name: pytorch
runtime: vllm
storage:
key: localModel
Loading
Loading