Skip to content
Reference
Compatibility

Compatibility

This page records the compatibility surfaces that matter when installing, upgrading, or changing Kleym. The Operator Spec remains the behavior contract.

Current Baseline

SurfaceCurrent source of truth
Go toolchaingo.mod, README, and Install
Kubernetes librariesgo.mod
GAIE inputsGAIE Compatibility
ClusterSPIFFEID outputManaged Resources
Runtime dependenciesDependencies
ConditionsConditions

The main branch is the development baseline until a versioned release is published. Released installs should pin the manifest ref and controller image tag to the same release version.

Compatibility Policy

Kleym supports only the documented input and output surface:

  • supported GAIE InferencePool and InferenceObjective GVKs and consumed fields
  • Kleym-owned InferenceIdentityBinding API fields and status conditions
  • rendered ClusterSPIFFEID fields documented in Managed Resources

Inference workloads, schedulers, routes, gateways, SPIRE installation details, and policy systems are external compatibility surfaces. Validate those with the owning project or platform.

Change Checklist

ChangeUpdateValidate
Go, Kubernetes, controller-runtime, build, or CI dependencyREADME or install docs when the public floor changesmake test, make lint
GAIE GVK or consumed fieldGAIE compatibility, API reference, operator spec, troubleshootingresolver and partial-CRD tests
Rendered ClusterSPIFFEID fieldManaged resources and operator speccreate, update, delete, and resync tests
Reconciliation or status behaviorOperator spec, conditions, troubleshootingmake test; e2e when cluster behavior changes
Docs-only compatibility guidanceThis page and linked reference pagemake docs-build

Upgrade Checks

Before promoting a dependency or external API upgrade:

  1. Pin component versions for Kubernetes libraries, GAIE CRDs, SPIRE Controller Manager, and SPIRE.
  2. Confirm required CRDs are served in the target cluster.
  3. Apply a representative InferenceIdentityBinding.
  4. Confirm the binding reaches Ready=True.
  5. Inspect managed ClusterSPIFFEID output for expected SPIFFE IDs, selectors, labels, and rendered fields.
  6. Validate downstream identity consumption outside Kleym.
Last updated on
Managed ResourcesGAIE Compatibility