# kserve

![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![AppVersion: v0.14.0-rc1](https://img.shields.io/badge/AppVersion-v0.14.0--rc1-informational?style=flat-square)

## Requirements

| Repository | Name | Version |
|------------|------|---------|
| file://../hopsworkslib | hopsworkslib | 0.1.0 |

## Values

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| activator.serviceAccount.annotations | object | `{}` | service account annotations |
| cainjector.serviceAccount.annotations | object | `{}` | service account annotations |
| cert_manager.enabled | bool | `true` |  |
| cert_manager.jobResources.cainjector | object | `{"limits":{"cpu":"200m"}}` | cainjector resources configuration |
| cert_manager.jobResources.cainjector.limits | object | `{"cpu":"200m"}` | cainjector resources limits configuration |
| cert_manager.jobResources.controller | object | `{"limits":{"cpu":"500m","memory":"2Gi"}}` | controller resources configuration |
| cert_manager.jobResources.webhook | object | `{"limits":{"cpu":"200m"}}` | webhook resources configuration |
| cert_manager.jobResources.webhook.limits | object | `{"cpu":"200m"}` | webhook resources limits configuration |
| cert_manager.nodeSelector | object | `{}` | node selector configuration |
| cert_manager.tolerations | list | `[]` |  |
| cert_manager.topologySpreadConstraint | object | `{}` | The default topology spread constraint. If not defined the global topology spread constraint would be used instead. |
| cert_manager.version | string | `"v1.11.1"` |  |
| dependencies.hopsworks.consulServiceName | string | `"glassfish"` |  |
| dependencies.hopsworks.consulServiceTag | string | `"hopsworks"` |  |
| dependencies.hopsworks.port | int | `8182` |  |
| dependencies.registry.consulServiceName | string | `"registry"` |  |
| dependencies.registry.port | int | `30443` |  |
| dependencies.registry.registryProtocol | string | `"https"` |  |
| hopsworkslib | object | `{}` | override hopsworkslib values |
| inferenceLogger.image | string | `"hopsworks/inference-logger"` |  |
| inferenceLogger.tag | string | `"4.7.0-SNAPSHOT"` |  |
| istio.crdClassInstallServiceAccount.apiGroups[0] | string | `"networking.istio.io"` |  |
| istio.crdClassInstallServiceAccount.apiGroups[1] | string | `"security.istio.io"` |  |
| istio.crdClassInstallServiceAccount.apiGroups[2] | string | `"rbac.istio.io"` |  |
| istio.crdClassInstallServiceAccount.apiGroups[3] | string | `"authentication.istio.io"` |  |
| istio.crdClassInstallServiceAccount.name | string | `"istio-crd-class-install-sa"` |  |
| istio.crdClassInstallServiceAccount.resources[0] | string | `"*"` |  |
| istio.crdClassInstallServiceAccount.verbs[0] | string | `"get"` |  |
| istio.crdClassInstallServiceAccount.verbs[1] | string | `"list"` |  |
| istio.crdClassInstallServiceAccount.verbs[2] | string | `"watch"` |  |
| istio.crdClassInstallServiceAccount.verbs[3] | string | `"create"` |  |
| istio.crdClassInstallServiceAccount.verbs[4] | string | `"update"` |  |
| istio.crdClassInstallServiceAccount.verbs[5] | string | `"patch"` |  |
| istio.crdClassInstallServiceAccount.verbs[6] | string | `"delete"` |  |
| istio.envoyFilter.jobName | string | `"envoyfilterjob"` |  |
| istio.envoyFilter.resources | object | `{"limits":{"cpu":"200m"}}` | resources configuration |
| istio.envoyFilter.resources.limits | object | `{"cpu":"200m"}` | resources limits configuration |
| istio.gateways.http10 | bool | `false` |  |
| istio.gateways.ingress.http10 | bool | `false` |  |
| istio.gateways.ingress.http2Port | int | `32080` |  |
| istio.gateways.ingress.httpsPort | int | `32443` |  |
| istio.gateways.ingress.name | string | `"istio-ingressgateway"` |  |
| istio.gateways.ingress.statusPort | int | `32021` |  |
| istio.gateways.jobName | string | `"gateway-operator-job"` |  |
| istio.gateways.operatorConfigFileName | string | `"istiooperator.yaml"` |  |
| istio.gateways.operatorConfigMountPath | string | `"/tmp"` |  |
| istio.istioctl.currentVersion | string | `"1.20.3"` |  |
| istio.istioctl.installJobName | string | `"istioctl-install-job"` |  |
| istio.istioctl.jobRetries | int | `4` |  |
| istio.istioctl.name | string | `"istioctl"` |  |
| istio.istioctl.readinessTimeout | string | `"15m0s"` |  |
| istio.istioctl.resources | object | `{"requests":{"cpu":"200m","memory":"256Mi"}}` | resources configuration |
| istio.istioctl.serviceAccount.annotations."helm.sh/resource-policy" | string | `"keep"` |  |
| istio.istioctl.targetVersion | string | `"1.20.3"` |  |
| istio.istioctl.uninstallJobName | string | `"istioctl-uninstall-job"` |  |
| istio.nodeSelector | object | `{}` | node selector configuration |
| istio.tolerations | list | `[]` |  |
| istioCRD.serviceAccount.annotations | object | `{}` | service account annotations |
| knative.autoscaler.scaleToZeroGracePeriod | string | `"30s"` |  |
| knative.autoscaler.scaleToZeroPodRetentionPeriod | string | `"0s"` |  |
| knative.configFeatures.affinity | string | `"enabled"` |  |
| knative.configFeatures.emptyDir | string | `"enabled"` |  |
| knative.configFeatures.initContainers | string | `"enabled"` |  |
| knative.configFeatures.nodeSelectors | string | `"enabled"` |  |
| knative.configFeatures.priorityClassName | string | `"enabled"` |  |
| knative.configFeatures.securityContext | string | `"enabled"` |  |
| knative.configFeatures.tolerations | string | `"enabled"` |  |
| knative.deployment.progressDeadline | string | `"1800s"` |  |
| knative.domainName | string | `"hopsworks.ai"` |  |
| knative.gateways.jobName | string | `"knative-gateways-job"` |  |
| knative.gateways.resources | object | `{"limits":{"cpu":"400m"}}` | resources configuration |
| knative.gateways.resources.limits | object | `{"cpu":"400m"}` | resources limits configuration |
| knative.http.enabled | bool | `true` |  |
| knative.https.credentialsName | string | `""` |  |
| knative.https.enabled | bool | `false` |  |
| knative.initialDelaySeconds | int | `180` |  |
| knative.netIstioController.resources.limits.cpu | string | `"300m"` |  |
| knative.netIstioController.resources.limits.memory | string | `"400Mi"` |  |
| knative.netIstioController.resources.requests.cpu | string | `"30m"` |  |
| knative.netIstioController.resources.requests.memory | string | `"40Mi"` |  |
| knative.nodeSelector | object | `{}` | node selector configuration |
| knative.peerAuthenticationsJob.name | string | `"knative-serving-peer-authentications-job"` |  |
| knative.peerAuthenticationsJob.resources | object | `{}` | resources configuration |
| knative.queueSidecarImage.name | string | `"kserve/qpext"` |  |
| knative.queueSidecarImage.tag | string | `"v0.14.0-rc1"` |  |
| knative.registryCertMount.certFileName | string | `"ca.crt"` |  |
| knative.registryCertMount.external | bool | `false` |  |
| knative.registryCertMount.mountDir | string | `"/etc/registry_certs"` |  |
| knative.registryCertMount.volumeName | string | `"registry-certs"` |  |
| knative.serviceAccount.annotations | object | `{}` | service account annotations |
| knative.serviceAnnotations."prometheus.io/path" | string | `"/metrics"` |  |
| knative.serviceAnnotations."prometheus.io/port" | int | `9090` |  |
| knative.serviceAnnotations."prometheus.io/scheme" | string | `"http"` |  |
| knative.serviceAnnotations."prometheus.io/scrape" | string | `"true"` |  |
| knative.tolerations | list | `[]` |  |
| knative.topologySpreadConstraint | object | `{}` | The default topology spread constraint. If not defined the global topology spread constraint would be used instead. |
| knative.validatingWebhookDeleteJobName | string | `"knative-serving-validating-webhook-delete-job"` |  |
| knative.validatingWebhookName | string | `"validation.webhook.serving.knative.dev"` |  |
| knative.version | string | `"v1.13.1"` |  |
| kserve.agent.image | string | `"kserve/agent"` |  |
| kserve.agent.tag | string | `"v0.14.0-rc1"` |  |
| kserve.controller.affinity | object | `{}` | A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).  For example:   affinity:     nodeAffinity:      requiredDuringSchedulingIgnoredDuringExecution:        nodeSelectorTerms:        - matchExpressions:          - key: foo.bar.com/role            operator: In            values:            - master |
| kserve.controller.annotations | object | `{}` | Optional additional annotations to add to the controller deployment. |
| kserve.controller.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | Container Security Context to be set on the controller component container. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). |
| kserve.controller.deploymentMode | string | `"Serverless"` | KServe deployment mode: "Serverless", "RawDeployment". |
| kserve.controller.gateway.additionalIngressDomains | list | `[]` | Optional additional domains for ingress routing. |
| kserve.controller.gateway.disableIngressCreation | bool | `false` | Whether to disable ingress creation for RawDeployment mode. |
| kserve.controller.gateway.disableIstioVirtualHost | bool | `false` | DisableIstioVirtualHost controls whether to use istio as network layer for top level component routing or path based routing. This configuration is only applicable for Serverless mode, when disabled Istio is no longer required. |
| kserve.controller.gateway.domain | string | `"example.com"` | Ingress domain for RawDeployment mode, for Serverless it is configured in Knative. |
| kserve.controller.gateway.domainTemplate | string | `"{{ .Name }}-{{ .Namespace }}.{{ .IngressDomain }}"` | Ingress domain template for RawDeployment mode, for Serverless mode it is configured in Knative. |
| kserve.controller.gateway.ingressGateway.className | string | `"istio"` |  |
| kserve.controller.gateway.ingressGateway.gateway | string | `"knative-ingress-gateway"` |  |
| kserve.controller.gateway.localGateway.gateway | string | `"knative-local-gateway"` | localGateway specifies the gateway which handles the network traffic within the cluster. |
| kserve.controller.gateway.localGateway.gatewayService | string | `"knative-local-gateway"` | localGatewayService specifies the hostname of the local gateway service. |
| kserve.controller.gateway.localGateway.knativeGatewayService | string | `""` | knativeLocalGatewayService specifies the hostname of the Knative's local gateway service. When unset, the value of "localGatewayService" will be used. When enabling strict mTLS in Istio, KServe local gateway should be created and pointed to the Knative local gateway. |
| kserve.controller.gateway.urlScheme | string | `"http"` | HTTP endpoint url scheme. |
| kserve.controller.image | string | `"hopsworks/kserve-controller"` | KServe controller container image name. |
| kserve.controller.knativeAddressableResolver | object | `{"enabled":false}` | Indicates whether to create an addressable resolver ClusterRole for Knative Eventing. This ClusterRole grants the necessary permissions for the Knative's DomainMapping reconciler to resolve InferenceService addressables. |
| kserve.controller.labels | object | `{}` | Optional additional labels to add to the controller deployment. |
| kserve.controller.nodeSelector | object | `{}` | The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).  |
| kserve.controller.podAnnotations | object | `{}` | Optional additional labels to add to the controller Pods. |
| kserve.controller.podLabels | object | `{}` | Optional additional labels to add to the controller Pods. |
| kserve.controller.rbacProxy.resources.limits.cpu | string | `"100m"` |  |
| kserve.controller.rbacProxy.resources.limits.memory | string | `"300Mi"` |  |
| kserve.controller.rbacProxy.resources.requests.cpu | string | `"100m"` |  |
| kserve.controller.rbacProxy.resources.requests.memory | string | `"300Mi"` |  |
| kserve.controller.rbacProxy.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}` | security context configuration |
| kserve.controller.rbacProxyImage | string | `"quay.io/brancz/kube-rbac-proxy:v0.18.0"` | KServe controller manager rbac proxy contrainer image |
| kserve.controller.resources | object | `{"limits":{"cpu":"100m","memory":"300Mi"},"requests":{"cpu":"100m","memory":"300Mi"}}` | Resources to provide to the kserve controller pod.  For example:  requests:    cpu: 10m    memory: 32Mi  For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). |
| kserve.controller.securityContext | object | `{"runAsNonRoot":true}` | Pod Security Context. For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). |
| kserve.controller.serviceAccount.annotations | object | `{}` | service account annotations |
| kserve.controller.tag | string | `"0.14.0"` | KServe controller contrainer image tag. |
| kserve.controller.tolerations | list | `[]` | A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).  For example:   tolerations:   - key: foo.bar.com/role     operator: Equal     value: master     effect: NoSchedule |
| kserve.controller.topologySpreadConstraint | object | `{}` | The default topology spread constraint. If not defined the global topology spread constraint would be used instead only if topologySpreadConstraints list is empty. |
| kserve.controller.topologySpreadConstraints | list | `[]` | A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core  For example:   topologySpreadConstraints:   - maxSkew: 2     topologyKey: topology.kubernetes.io/zone     whenUnsatisfiable: ScheduleAnyway     labelSelector:       matchLabels:         app.kubernetes.io/instance: kserve-controller-manager         app.kubernetes.io/component: controller |
| kserve.localmodel.controller.image | string | `"kserve/kserve-localmodel-controller"` |  |
| kserve.localmodel.controller.tag | string | `"v0.14.0-rc1"` |  |
| kserve.localmodel.enabled | bool | `false` |  |
| kserve.localmodel.jobNamespace | string | `"kserve-localmodel-jobs"` |  |
| kserve.localmodel.securityContext | object | `{"FSGroup":1000}` | security context configuration |
| kserve.localmodel.serviceAccount.annotations | object | `{}` | service account annotations |
| kserve.metricsaggregator.enableMetricAggregation | string | `"true"` | configures metric aggregation annotation. This adds the annotation serving.kserve.io/enable-metric-aggregation to every service with the specified boolean value. If true enables metric aggregation in queue-proxy by setting env vars in the queue proxy container to configure scraping ports. |
| kserve.metricsaggregator.enablePrometheusScraping | string | `"true"` | If true, prometheus annotations are added to the pod to scrape the metrics. If serving.kserve.io/enable-metric-aggregation is false, the prometheus port is set with the default prometheus scraping port 9090, otherwise the prometheus port annotation is set with the metric aggregation port. |
| kserve.nodeSelector | object | `{}` | node selector configuration |
| kserve.router.image | string | `"kserve/router"` |  |
| kserve.router.tag | string | `"v0.14.0-rc1"` |  |
| kserve.serviceAccount.annotations | object | `{}` | service account annotations |
| kserve.servingruntime.modelNamePlaceholder | string | `"{{.Name}}"` |  |
| kserve.servingruntime.sklearnserver.image | string | `"hopsworks/sklearnserver"` |  |
| kserve.servingruntime.sklearnserver.tag | string | `"0.14.0"` |  |
| kserve.servingruntime.tensorflow.image | string | `"tensorflow/serving"` |  |
| kserve.servingruntime.tensorflow.tag | string | `"2.17.0"` |  |
| kserve.servingruntime.vllmopenai.env | list | `[]` | Additional environment variables for vllm-openai container |
| kserve.servingruntime.vllmopenai.image | string | `"vllm/vllm-openai"` |  |
| kserve.servingruntime.vllmopenai.tag | string | `"v0.10.2"` |  |
| kserve.storage.caBundleConfigMapName | string | `""` | Mounted CA bundle config map name for storage initializer. |
| kserve.storage.caBundleVolumeMountPath | string | `"/etc/ssl/custom-certs"` | Mounted path for CA bundle config map. |
| kserve.storage.cpuModelcar | string | `"10m"` | Model sidecar cpu requirement. |
| kserve.storage.enableModelcar | bool | `false` | Flag for enabling model sidecar feature. |
| kserve.storage.image | string | `"hopsworks/storage-initializer"` |  |
| kserve.storage.memoryModelcar | string | `"15Mi"` | Model sidecar memory requirement. |
| kserve.storage.s3 | object | `{"CABundle":"","accessKeyIdName":"AWS_ACCESS_KEY_ID","endpoint":"","region":"","secretAccessKeyName":"AWS_SECRET_ACCESS_KEY","useAnonymousCredential":"","useHttps":"","useVirtualBucket":"","verifySSL":""}` | Configurations for S3 storage |
| kserve.storage.s3.CABundle | string | `""` | The path to the certificate bundle to use for HTTPS certificate validation. |
| kserve.storage.s3.accessKeyIdName | string | `"AWS_ACCESS_KEY_ID"` | AWS S3 static access key id. |
| kserve.storage.s3.endpoint | string | `""` | AWS S3 endpoint. |
| kserve.storage.s3.region | string | `""` | Default region name of AWS S3. |
| kserve.storage.s3.secretAccessKeyName | string | `"AWS_SECRET_ACCESS_KEY"` | AWS S3 static secret access key. |
| kserve.storage.s3.useAnonymousCredential | string | `""` | Whether to use anonymous credentials to download the model or not, default to false. |
| kserve.storage.s3.useHttps | string | `""` | Whether to use secured https or http to download models, allowed values are 0 and 1 and default to 1. |
| kserve.storage.s3.useVirtualBucket | string | `""` | Whether to use virtual bucket or not, default to false. |
| kserve.storage.s3.verifySSL | string | `""` | Whether to verify the tls/ssl certificate, default to true. |
| kserve.storage.storageSecretNameAnnotation | string | `"serving.kserve.io/secretName"` | Storage secret name reference for storage initializer. |
| kserve.storage.storageSpecSecretName | string | `"storage-config"` | Storage spec secret name. |
| kserve.storage.tag | string | `"v0.14.0-rc1"` |  |
| kserve.tolerations | list | `[]` |  |
| kserve.topologySpreadConstraint | object | `{}` | The default topology spread constraint. If not defined the global topology spread constraint would be used instead only if topologySpreadConstraints list is empty. |
| kserve.version | string | `"v0.14.0-rc1"` |  |
| kserveUtilsImage.name | string | `"hopsworks/kserve-utils"` |  |
| kserveUtilsImage.tag | string | `"0.1.2"` |  |
| manager.serviceAccount.annotations | object | `{}` | service account annotations |
| servingAuthenticator.image | string | `"hopsworks/model-serving-authenticator"` |  |
| servingAuthenticator.name | string | `"model-serving-authenticator"` |  |
| servingAuthenticator.requireExternalUserLoginAfterHours | int | `720` | Number of hours after which external users are required to sign in to Hopsworks to refresh their external user groups. Allowed values are -1, 0 and greater than 0, where -1 skips the periodic sign-in requirement and 0 disables external access completely. |
| servingAuthenticator.serviceAccount.annotations | object | `{}` | service account annotations |
| servingAuthenticator.tag | string | `"4.7.0-SNAPSHOT"` |  |
| servingWebhook.image | string | `"hopsworks/model-serving-webhook"` |  |
| servingWebhook.name | string | `"model-serving-webhook"` |  |
| servingWebhook.serviceAccount.annotations | object | `{}` | service account annotations |
| servingWebhook.tag | string | `"4.7.0-SNAPSHOT"` |  |
| storageInitializer.image | string | `"hopsworks/storage-initializer"` |  |
| storageInitializer.tag | string | `"4.7.0-SNAPSHOT"` |  |
| webhook.serviceAccount.annotations | object | `{}` | service account annotations |