Skip to main content

​
Kubernetes

The Kubernetes provider maps one durable replica intent to either a Deployment plus Service, or one standard KServe InferenceService. Kubernetes owns scheduling and Pods. InferCrane owns revision lifecycle, rollout policy, routing membership, evidence, and deletion of its exact labeled resources.
The adapter has hermetic and Kind lifecycle qualification. Real GPU, vLLM, SGLang, and custom OCI compatibility remains deferred to consolidated manual qualification. Registration is not a real-cluster support claim.

​
Choose the workload API

InferCrane does not create child Pods directly. It does not install KServe, Gateway API, a GPU device plugin, model storage, or a Kubernetes distribution.

​
Bootstrap a namespace

Review the manifests before applying them:
The included Role is namespace-scoped and contains no wildcard, Secret, Pod, cluster-wide, or RBAC mutation permission. If the control plane runs outside the cluster, bind the same Role to the user or identity in its kubeconfig instead of the included service account subject. Create the worker credential without putting it in Git or shell history. Its value must equal the control-plane worker credential used for health checks and routing:

​
Configure the control plane

Configuration is all-or-nothing. The image must be immutable. The adapter always passes an explicit context and namespace to kubectl; it never relies on or changes the current context. Validate the Kubernetes API, optional KServe CRD, and every required namespaced permission without creating a workload:

​
Deploy

The GPU value maps to the configured product-label value. It is never silently substituted.
Provisioning uses strict server-side dry-run followed by server-side apply with the infercrane-provider-v1 field manager. InferCrane does not use --force-conflicts; ownership drift fails visibly. A lost apply response is safe to retry because resource names and ownership metadata derive from the durable replica key.

​
KServe Standard mode

Install and operate a compatible KServe release separately, apply deploy/kubernetes/kserve/provider-rbac.yaml, then set:
The provider verifies the InferenceService API and required permissions during doctor. KServe owns generated Deployments, Services, and Pods; InferCrane inventories and deletes only the parent InferenceService. Raw KServe condition metadata remains available through infercrane inspect. KServe LLMInferenceService, llm-d, and Dynamo are not enabled because each can own routing, scheduling, or disaggregation. They require a future explicit ownership contract rather than a hidden second router.

​
Expose the logical endpoint

deploy/kubernetes/gateway-api/httproute.yaml is an optional placeholder. Replace the Gateway and hostname, then apply it only if your cluster already has Gateway API and a controller. It routes to the InferCrane gateway—not directly to revisions or workers—so safe rollout ownership stays singular.

​
Local conformance

The disposable Kind test proves strict apply, restart observation, lost-state repair, foreign field ownership rejection, idempotent deletion, and zero remaining run-owned resources. It schedules no GPU and sends no paid provider request.