Concepts
Inference Workload Identity
Kleym uses inference workload identity to mean identity registration derived from a Kubernetes inference serving boundary, not from a pod alone. In the current contract, that serving boundary is a Gateway API Inference Extension (GAIE) InferencePool referenced by an InferenceIdentityBinding.
The binding namespace and required service account constrain which workloads may match. Selectors from the referenced pool provide workload provenance, while the required spec.identityBoundary selects one label-defined workload variant. kleym-operator resolves the pool, validates structural exclusivity against peer bindings, and reconciles a managed SPIRE Controller Manager ClusterSPIFFEID only when the variant is exclusive. SPIRE Controller Manager translates that resource into registration entries; SPIRE Server issues SVIDs, while SPIRE Agent attests workloads and delivers credentials.
This stops at identity registration. Kleym does not deploy inference workloads, route traffic, configure gateways, evaluate request policy, issue credentials, or prove runtime SVID use. The authoritative behavior is defined in the Operator Spec.
GAIE Resources
InferencePool(GAIE API type): serving pool intent.kleym-operatorresolves the pool named byspec.poolRef.nameand derives selector input fromspec.selector.- GAIE API types index: canonical reference for GAIE resource schemas and status fields.
kleym-operator supports the documented InferencePool GVK in GAIE Compatibility.
Resolved Inference Target Identity
Kleym renders one identity for the required service account and resolved inference target. The SPIFFE ID form is:
spiffe://<trustDomain>/ns/<namespace>/sa/<serviceAccountName>/inference/pool/<pool-name>/variant/<variant>The current GAIE InferencePool source resolves to anchor kind pool and an
anchor name equal to the pool name. The source GVK and binding name remain
provenance rather than identity path material. The same pool rendered for two
different service accounts therefore produces two distinct SPIFFE IDs. The
declared variant identifies the workload subset within the pool.
Safety Selectors
Safety selectors constrain the rendered workload match; they do not authorize who may create bindings or assign workload labels.
Every rendered identity must include:
- the binding namespace selector
- the workload service account selector
- selectors derived from the referenced pool
- exactly one canonical
k8s:pod-label:identity.kleym.sonda.red/variant:<variant>boundary selector
kleym-operator refuses to reconcile when it cannot prove those constraints.
Within one namespace and service account, different SPIFFE IDs are structurally
exclusive only when they declare different variants under the fixed boundary key.
Duplicate SPIFFE IDs and reused variants fail closed.
The controller withdraws managed output for every member of a conflict group and
confirms it is absent before reporting the conflict as settled. A deleting peer
remains a competitor until its output is confirmed absent.
Structural exclusivity assumes that cluster admission restricts reserved boundary labels to platform-controlled actors and keeps them immutable for each Pod lifetime. See Identity Boundary Admission Policy.