Architecture
Architecture
Control Flow
This flow uses Gateway API Inference Extension (GAIE) objects as upstream inputs.
InferenceIdentityBinding
│
Deleted? ──yes──▶ Clean up ClusterSPIFFEIDs
│ Remove finalizer
no
│
Ensure finalizer
│
InferencePool ───────▶ Resolve poolRef → Pool
│
Derive selectors from pool
Validate boundary + selectors
Render SPIFFE ID
│
Evaluate peer bindings
│
Conflict? ──yes──▶ Withdraw all conflict output
│ Confirm absence + patch conflict
no
│
Reconcile
ClusterSPIFFEID
│
ClusterSPIFFEID
│
SPIRE Controller Manager
│
SPIRE registration entries
│
Patch status
emit eventsExternal Contracts
InferencePoolAPI: serving pool selector source used bykleym-operator.- Gateway API Inference Extension (GAIE) API types: canonical schema reference for GAIE resources.
- SPIFFE overview: identity model and SPIFFE ID/SVID concepts.
- SPIRE concepts: server/agent architecture and attestation model.
- SPIRE Controller Manager: Kubernetes reconciler that applies
ClusterSPIFFEID. ClusterSPIFFEIDCRD: output resource shape reconciled bykleym-operator.
See Also
- Read Concepts for the resolved inference target identity and selector model.
- Read Managed Resources for the concrete output object shape.
- Read Reconciliation for the controller flow in more detail.
Last updated on