{"schema":"c8s.allowlist/v1","workloads":{"armtls-mesh-3fce8c123911-f67ba13f":{"label":"ghcr.io/confidential-dot-ai/armtls-mesh@sha256:3fce8c123911f7242cab3f323edc11a4e73b764e8475e6e8128d3bd0248423e1","initContainers":[],"containers":[{"digest":"sha256:3fce8c123911f7242cab3f323edc11a4e73b764e8475e6e8128d3bd0248423e1","image":"ghcr.io/confidential-dot-ai/armtls-mesh@sha256:3fce8c123911f7242cab3f323edc11a4e73b764e8475e6e8128d3bd0248423e1","command":{"policy":"exact","argv":["/app/c8s","armtls-mesh"]},"args":{"policy":"exact","argv":["--platform","tdx","--attestation-api-url","unix:///run/nri-image-policy/attestation-api.sock","--outbound-port","15001","--inbound-port","15006","--health-port","15021","--drain-timeout","30s","--iptables-metrics-file","/tmp/armtls-iptables-metrics.json","--log-level","info","--measured-policies-file=/run/nri-image-policy/measured-policies","--image-policy-file=/run/c8s-node/peers.json","--max-conns","10000","--cert-mode","cds","--cds-url","https://c8s-cds.c8s-system.svc:8443","--cert-dns-san","armtls-mesh.c8s-system.svc","--ca-poll-interval","5m","--cds-image-policy-file=/run/c8s-node/cds.json"]},"mounts":{"policy":"exact","rules":[{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true},{"destination":"/tmp","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"NODE_IP":{"present":true},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}}}},{"digest":"sha256:3fce8c123911f7242cab3f323edc11a4e73b764e8475e6e8128d3bd0248423e1","image":"ghcr.io/confidential-dot-ai/armtls-mesh@sha256:3fce8c123911f7242cab3f323edc11a4e73b764e8475e6e8128d3bd0248423e1","command":{"policy":"exact","argv":["/app/c8s","armtls-mesh"]},"args":{"policy":"exact","argv":["iptables-cleanup","--keep-guard","--on-shutdown","--settle-delay=5s"]},"mounts":{"policy":"exact","rules":[{"destination":"/run/xtables.lock","kind":"host","source":"/run/xtables.lock"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}}}},{"digest":"sha256:3fce8c123911f7242cab3f323edc11a4e73b764e8475e6e8128d3bd0248423e1","image":"ghcr.io/confidential-dot-ai/armtls-mesh@sha256:3fce8c123911f7242cab3f323edc11a4e73b764e8475e6e8128d3bd0248423e1","command":{"policy":"exact","argv":["/app/c8s","armtls-mesh"]},"args":{"policy":"exact","argv":["iptables-sync","--outbound-port","15001","--uid","1337","--exclude-uids","0","--exclude-source-namespaces","kube-system","--resync-period","30s","--watchdog-period","2s","--ipset-maxelem","262144","--cw-inbound-passthrough=udp:53,tcp:53","--ready-file","/tmp/armtls-iptables-ready","--ready-addr","127.0.0.1:15022","--iptables-metrics-file","/tmp/armtls-iptables-metrics.json","--log-level","info"]},"mounts":{"policy":"exact","rules":[{"destination":"/run/xtables.lock","kind":"host","source":"/run/xtables.lock"},{"destination":"/tmp","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"NODE_IP":{"present":true},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}}}}]},"busybox-fd8d9aa63ba2-7859552d":{"label":"busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d","initContainers":[],"containers":[{"digest":"sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d","image":"busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d","command":{"policy":"exact","argv":["/bin/sh","/script/setup"]},"args":{"policy":"any"},"mounts":{"policy":"any"},"env":{"policy":"any"}},{"digest":"sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d","image":"busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d","command":{"policy":"exact","argv":["/bin/sh","/script/teardown"]},"args":{"policy":"any"},"mounts":{"policy":"any"},"env":{"policy":"any"}}]},"c8s-operator-593dea857bfd-d6af87e3":{"label":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","initContainers":[],"containers":[{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-cert"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/c8s-reload-watch","kind":"data"},{"destination":"/run/c8s/discovery","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-cert"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/c8s-reload-watch","kind":"data"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-cert"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/run/c8s/discovery","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-cert"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-secret"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/run/c8s/discovery","kind":"emptyDir"},{"destination":"/run/c8s/secrets","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-secret"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/run/c8s/secrets","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-volume"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/run/c8s/discovery","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","get-volume"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"C8S_POD_NAME":{"present":true},"C8S_POD_UID":{"present":true},"C8S_WORKLOAD_ID":{"present":true},"HOSTNAME":{"present":true},"HOST_IP":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","probe-file"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/run/c8s/discovery","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s","probe-file"]},"args":{"policy":"any"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["acme","--domains-file=/run/c8s-node/router/hostnames","--acme-email-file=/run/c8s-node/router/acme-email","--acme-directory-url-file=/run/c8s-node/router/acme-directory-url","--standby-cert-dir=/tls","--challenge-port=8402","--http-port=8080","--cert-dir=/etc/c8s-acme-tls","--ready-port=8403"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s-acme-tls","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["allowlist-proxy","--host=127.0.0.1","--port=8801","--cds-url=https://c8s-cds.c8s-system.svc:8443","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--image-policy-file=/run/c8s-node/cds.json"]},"mounts":{"policy":"exact","rules":[{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=127.0.0.1","--port=8800","--platform=tdx","--generation=","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--front-door-mode-file=/run/c8s-node/router/front-door-mode","--serving-cert-file=/tls/cert.pem","--acme-serving-cert-file=/etc/c8s-acme-tls/cert.pem","--measured-policies-file=/run/nri-image-policy/measured-policies","--mesh-identity-cert-file=/tls/cert.pem","--mesh-identity-key-file=/tls/key.pem","--mesh-identity-ca-file=/tls/ca.pem","--cds-url=https://c8s-cds.c8s-system.svc:8443","--image-policy-file=/run/c8s-node/cds.json","--operator-keys-file=/run/c8s-node/operator-pubkey","--routes-poll-interval=30s","--routing-host=127.0.0.1","--routing-port=8802","--backend-timeout=1h","--reserved-paths=/allowlist,/.well-known/c8s/,/.well-known/acme-challenge/,/v1/discovery,/.well-known/cds-cert.pem,/.well-known/mesh-ca.pem,/readyz,/healthz","--publish-routes"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s-acme-tls","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true},{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["get-cert","--cds-url=https://c8s-cds.c8s-system.svc:8443","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--san-file=/run/c8s-node/tls-san","--out=/tls/cert.pem","--key-out=/tls/key.pem","--ca-out=/tls/ca.pem","--initial-retry-timeout=2m","--renew-interval=1h","--reload-nginx=true","--continue-on-initial-error","--discovery-out=/discovery/discovery.json","--discovery-cds-cert-url=/.well-known/cds-cert.pem","--discovery-public-tls-mode-file=/run/c8s-node/router/front-door-mode","--discovery-public-tls-hostnames-file=/run/c8s-node/router/hostnames","--discovery-mesh-ca-url=/.well-known/mesh-ca.pem","--ca-watch-interval=1m","--image-policy-file=/run/c8s-node/cds.json","--workload-claims","--expected-workload=c8s-router-fb21f5cac23c"]},"mounts":{"policy":"exact","rules":[{"destination":"/discovery","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/c8s/workload-claims","kind":"host","source":"/run/nri-image-policy","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true},{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["operator","--leader-election-namespace=c8s-system","--status-mirror-enabled=true","--get-cert-image=ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","--cds-url=https://c8s-cds.c8s-system.svc:8443","--webhook-config-name=c8s-pod-injector","--webhook-service-name=c8s-operator","--webhook-service-namespace=c8s-system","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--image-policy-file=/run/c8s-node/cds.json","--mesh-outbound-port=15001","--mesh-exclude-source-namespaces=kube-system","--cert-fs-group=65532","--get-cert-renew-interval=2h","--get-cert-run-as-user=65532","--get-cert-run-as-group=65532","--get-cert-run-as-non-root=true","--workload-claims-host-dir=/run/nri-image-policy"]},"mounts":{"policy":"exact","rules":[{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/tmp","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"POD_NAME":{"present":true},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["probe-file","--wait","--timeout=3m","/tls/cert.pem"]},"mounts":{"policy":"exact","rules":[{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}}]},"c8s-router-fb21f5cac23c":{"initContainers":[{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["acme","--domains-file=/run/c8s-node/router/hostnames","--acme-email-file=/run/c8s-node/router/acme-email","--acme-directory-url-file=/run/c8s-node/router/acme-directory-url","--standby-cert-dir=/tls","--challenge-port=8402","--http-port=8080","--cert-dir=/etc/c8s-acme-tls","--ready-port=8403"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s-acme-tls","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["get-cert","--cds-url=https://c8s-cds.c8s-system.svc:8443","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--san-file=/run/c8s-node/tls-san","--out=/tls/cert.pem","--key-out=/tls/key.pem","--ca-out=/tls/ca.pem","--initial-retry-timeout=2m","--renew-interval=1h","--reload-nginx=true","--continue-on-initial-error","--discovery-out=/discovery/discovery.json","--discovery-cds-cert-url=/.well-known/cds-cert.pem","--discovery-public-tls-mode-file=/run/c8s-node/router/front-door-mode","--discovery-public-tls-hostnames-file=/run/c8s-node/router/hostnames","--discovery-mesh-ca-url=/.well-known/mesh-ca.pem","--ca-watch-interval=1m","--image-policy-file=/run/c8s-node/cds.json","--workload-claims","--expected-workload=c8s-router-fb21f5cac23c"]},"mounts":{"policy":"exact","rules":[{"destination":"/discovery","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/c8s/workload-claims","kind":"host","source":"/run/nri-image-policy","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true},{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["probe-file","--wait","--timeout=3m","/tls/cert.pem"]},"mounts":{"policy":"exact","rules":[{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}}],"containers":[{"digest":"sha256:3af0c10d960cc2502427fe1219c52989d309e7d65596869c60a34fd2fa2406f0","image":"nginxinc/nginx-unprivileged@sha256:3af0c10d960cc2502427fe1219c52989d309e7d65596869c60a34fd2fa2406f0","command":{"policy":"exact","argv":["/docker-entrypoint.sh","nginx"]},"args":{"policy":"exact","argv":["-c","/usr/lib/c8s/router-nginx/nginx.conf","-g","daemon off;"]},"mounts":{"policy":"exact","rules":[{"destination":"/discovery","kind":"emptyDir"},{"destination":"/etc/c8s-acme-tls","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/tls","kind":"emptyDir"},{"destination":"/tmp","kind":"emptyDir"},{"destination":"/usr/lib/c8s/router-nginx","kind":"host","source":"/usr/lib/c8s/router-nginx","readOnly":true},{"destination":"/var/cache/nginx","kind":"emptyDir"},{"destination":"/var/lib/c8s-tunnel-body","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"DYNPKG_RELEASE":{"exact":"1"},"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"NGINX_VERSION":{"exact":"1.30.5"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"PKG_RELEASE":{"exact":"1"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["allowlist-proxy","--host=127.0.0.1","--port=8801","--cds-url=https://c8s-cds.c8s-system.svc:8443","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--image-policy-file=/run/c8s-node/cds.json"]},"mounts":{"policy":"exact","rules":[{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=127.0.0.1","--port=8800","--platform=tdx","--generation=","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--front-door-mode-file=/run/c8s-node/router/front-door-mode","--serving-cert-file=/tls/cert.pem","--acme-serving-cert-file=/etc/c8s-acme-tls/cert.pem","--measured-policies-file=/run/nri-image-policy/measured-policies","--mesh-identity-cert-file=/tls/cert.pem","--mesh-identity-key-file=/tls/key.pem","--mesh-identity-ca-file=/tls/ca.pem","--cds-url=https://c8s-cds.c8s-system.svc:8443","--image-policy-file=/run/c8s-node/cds.json","--operator-keys-file=/run/c8s-node/operator-pubkey","--routes-poll-interval=30s","--routing-host=127.0.0.1","--routing-port=8802","--backend-timeout=1h","--reserved-paths=/allowlist,/.well-known/c8s/,/.well-known/acme-challenge/,/v1/discovery,/.well-known/cds-cert.pem,/.well-known/mesh-ca.pem,/readyz,/healthz","--publish-routes"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s-acme-tls","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true},{"destination":"/tls","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}}]},"cds-aaf6a581487d-f8b96f8c":{"label":"ghcr.io/confidential-dot-ai/cds@sha256:aaf6a581487d27b24228ceb10e4a600e1ae1a4b405d0f6f4b8f95422ae8ba204","initContainers":[],"containers":[{"digest":"sha256:aaf6a581487d27b24228ceb10e4a600e1ae1a4b405d0f6f4b8f95422ae8ba204","image":"ghcr.io/confidential-dot-ai/cds@sha256:aaf6a581487d27b24228ceb10e4a600e1ae1a4b405d0f6f4b8f95422ae8ba204","command":{"policy":"exact","argv":["/c8s","cds"]},"args":{"policy":"exact","argv":["--port=8443","--log-level=info","--attestation-api-url=unix:///run/nri-image-policy/attestation-api.sock","--allowlist-db=/mnt/c8s-data/cds/allowlist.db","--allowlist-persistent=false","--allowlist-seed=/run/c8s-node/allowlist-seed.json","--follow-seed","--operator-keys=/run/c8s-node/operator-pubkey","--dns-san-file=/run/c8s-node/tls-san","--jwt-clock-skew=30","--ca-common-name=c8s Mesh CA","--ca-cert-validity=8760h","--min-ca-validity=1h","--cert-ttl=24h","--named-cert-ttl=6h","--challenge-ttl=60s","--request-timeout=5s","--max-request-size=262144","--secrets-max-paths=1024","--secrets-max-paths-per-workload=64","--readiness-interval=10s","--san-validation=false","--dns-san-pattern=^[a-z0-9-]+[.][a-z0-9-]+[.]svc$","--image-policy-file=/run/c8s-node/peers.json","--rate-limit=10","--rate-burst=20","--rate-limiter-max-entries=10000","--rate-limiter-evict-interval=1m","--rate-limiter-idle-timeout=5m","--armtls-platform=tdx","--armtls-cert-ttl=24h","--measured-policies-file=/run/nri-image-policy/measured-policies"]},"mounts":{"policy":"exact","rules":[{"destination":"/mnt/c8s-data/cds","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/run/nri-image-policy","kind":"host","source":"/run/nri-image-policy","readOnly":true}]},"env":{"policy":"match","variables":{"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"SSL_CERT_FILE":{"exact":"/etc/ssl/certs/ca-certificates.crt"}}}}]},"gateway":{"initContainers":[],"containers":[{"digest":"sha256:3be8f7a02c0b41470456999e51905e705c534ee32e8983549e666bb31e87418c","image":"ghcr.io/confidential-dot-ai/confidential-inference/gateway@sha256:3be8f7a02c0b41470456999e51905e705c534ee32e8983549e666bb31e87418c","command":{"policy":"exact","argv":["/usr/local/bin/confidential-gateway"]},"args":{"policy":"deny"},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/admin-auth","kind":"data"},{"destination":"/mnt/c8s-data/gwstate","kind":"data"},{"destination":"/mnt/c8s-data/release-identity","kind":"data"},{"destination":"/mnt/c8s-data/release-selection","kind":"data"},{"destination":"/mnt/c8s-data/runtime","kind":"data"},{"destination":"/run/c8s/secrets","kind":"emptyDir"},{"destination":"/run/confidential-gateway","kind":"emptyDir"},{"destination":"/tmp","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"DEPLOYMENT_ENVIRONMENT":"production","GATEWAY_ADMIN_SIGNER_CERTIFICATE_FILE":"/mnt/c8s-data/admin-auth/..data/client.crt","GATEWAY_ALLOW_DIRECT_INFERENCE_URL":"true","GATEWAY_API_KEY_PEPPER_FILE":"/run/c8s/secrets/GATEWAY_API_KEY_PEPPER","GATEWAY_C8S_CDS_URL":"https://c8s-cds.c8s-system.svc.cluster.local:8443","GATEWAY_C8S_IMAGE_POLICY":"/mnt/c8s-data/release-identity/..data/cds-image-policy.json","GATEWAY_C8S_POLICY_MODE":"operator","GATEWAY_C8S_RECEIPT_TARGETS":"gateway|gateway|gateway=http://127.0.0.1:8800,sglang-router|sglang-router|sglang-router=http://sglang-router:8801,inference-worker-0|inference-worker-0|inference-worker-0=http://inference-worker-0-0.inference-workers:8802,inference-worker-1|inference-worker-1|inference-worker-1=http://inference-worker-1-0.inference-workers:8802,metrics-collector|metrics-collector|metrics-collector=http://metrics-collector:8803,kube-state-metrics|kube-state-metrics|kube-state-metrics=http://kube-state-metrics:8804","GATEWAY_C8S_SERVED_IMAGE_POLICY":"/mnt/c8s-data/release-identity/..data/served-image-policy.json","GATEWAY_ENDPOINT_DRAIN_SECONDS":"35","GATEWAY_HEADER_TIMEOUT_SECONDS":"5","GATEWAY_INFERENCE_URL":"http://router-v0-15-15.confidential-inference.svc.cluster.local:30000","GATEWAY_INSTANCE_ID":"gateway","GATEWAY_KEY_REGISTRY_MODE":"registry","GATEWAY_LISTEN":"0.0.0.0:9443","GATEWAY_MAXIMUM_HEADERS":"64","GATEWAY_MAXIMUM_HEADER_BYTES":"16384","GATEWAY_MAXIMUM_URI_BYTES":"2048","GATEWAY_METRICS_API_KEY_LABEL_ALLOWLIST":"unassigned","GATEWAY_METRICS_LISTEN":"0.0.0.0:9090","GATEWAY_RELEASE_IDENTITY_FILE":"/mnt/c8s-data/release-identity/..data/release-identity.json","GATEWAY_RELEASE_SELECTION_FILE":"/mnt/c8s-data/release-selection/releases.json","GATEWAY_RELEASE_URL":"https://github.com/confidential-dot-ai/confidential-inference/releases/tag/v0.15.15","GATEWAY_ROUTER_NAMESPACE":"confidential-inference","GATEWAY_RUNTIME_CONFIG_FILE":"/mnt/c8s-data/runtime/settings.json","GATEWAY_SHUTDOWN_GRACE_SECONDS":"900","GATEWAY_STATE_ABSENCE_POLICY":"fail-closed","GATEWAY_STATE_DATABASE":"/mnt/c8s-data/gwstate/gateway.sqlite3","GATEWAY_STATE_ENABLED":"true","GATEWAY_STATE_STARTUP_TIMEOUT_SECONDS":"300","GATEWAY_STATE_VOLUME":"c8s","GATEWAY_STATE_VOLUME_NAME":"gwstate","GATEWAY_TLS_LISTEN":"0.0.0.0:9444","GATEWAY_TRUSTED_PROXY_CIDRS":"10.52.0.0/16","HOSTNAME":"gateway","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=0.0.0.0","--port=8800","--platform=tdx","--front-door-mode=webpki","--expected-workload=gateway","--attestation-api-url=unix:///run/c8s/workload-claims/attestation-api.sock","--serving-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-key-file=/etc/c8s/certs/tls.key","--mesh-identity-ca-file=/etc/c8s/certs/tls.crt","--cds-url=https://c8s-cds.c8s-system.svc.cluster.local:8443","--cds-measurements=9309eaae9c151e766de0f97b1d1aaeb76b8c8c366080803943fb566521c8f0cf00a142d8b7b0683ed1d42c5a27198ba1","--cds-rtmrs=1=0e2febd1f16c7818973ee6b5d84c7e3a54c5b2cd298d39073881be95fb7237ec1f8a88d262b0da0874133c5d74aef65a,2=f452ccd152bc49b92fa595c1ca3dd592fe3f8c02e7a25f820315105bb4b36e12fac2ac718ac0d1788f6df0102c5020fa"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/gwstate","kind":"data"},{"destination":"/run/c8s/secrets","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"HOSTNAME":"gateway","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}}],"secrets":{"policy":"allow","read":["/confidential-inference/gateway/api-key-pepper","/confidential-inference/volumes/gwstate"]}},"inference-worker-0-u200b5c252a":{"initContainers":[],"containers":[{"digest":"sha256:1244f1cf550c656889d5c80f9c9388ba4bd54bac00e3af394cdddd03e01edc68","image":"ghcr.io/confidential-dot-ai/confidential-inference/sglang@sha256:1244f1cf550c656889d5c80f9c9388ba4bd54bac00e3af394cdddd03e01edc68","command":{"policy":"exact","argv":["/usr/local/bin/wait-for-model"]},"args":{"policy":"exact","argv":["--path=/mnt/c8s-data/models/md7b0eb3196a","--timeout-seconds=900","--poll-seconds=1","--expected-repository=deepseek-ai/DeepSeek-V4-Flash-0731","--expected-revision=9e165c30e2704aec5d9d593cce3eebd58bbef1cb","--revision-metadata=.model-lock-local-manifest.json","--expected-file=.model-lock-local-manifest.json=cd9eecd89a3d31dedd7b707158e86ebeab241c68d55e9661d3efa508015a697c","--expected-file=config.json=6c8f3d2d3b48707541b88f32f22ef3f0f8a6b57d8523281e2b8d3cdb0ae9a023","--expected-file=model.safetensors.index.json=98efab455cf08dfbbbaaba6f570e1bf10bf927d2b4c3c453a59c2f6f0e3be92b","--expected-file=tokenizer_config.json=6ac8c8dc065ed118161d02dd532749ae3f52c243deac27872134fae2f50d8547","--gpu-metrics-port=29000","--gpu-metrics-worker=sglang-0","--","python3","-m","sglang.launch_server","--model-path=/mnt/c8s-data/models/md7b0eb3196a","--served-model-name=deepseek-ai/DeepSeek-V4-Flash-0731-rehearsal-worker-uf0b4c47afe","--revision=9e165c30e2704aec5d9d593cce3eebd58bbef1cb","--tool-call-parser=deepseekv4","--reasoning-parser=deepseek-v4","--tp=4","--moe-runner-backend=flashinfer_mxfp4","--speculative-algorithm=DSPARK","--mem-fraction-static=0.90","--chunked-prefill-size=4096","--swa-full-tokens-ratio=0.1","--trust-remote-code","--enable-metrics","--enable-cache-report","--host=0.0.0.0","--port=30000"]},"mounts":{"policy":"exact","rules":[{"destination":"/dev/shm","kind":"emptyDir"},{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/models/md7b0eb3196a","kind":"data"},{"destination":"/usr/bin/nvidia-persistenced","kind":"nodeRootFile","source":"/usr/bin/nvidia-persistenced","readOnly":true},{"destination":"/usr/bin/nvidia-smi","kind":"nodeRootFile","source":"/usr/bin/nvidia-smi","readOnly":true},{"destination":"/usr/lib/firmware/nvidia/595.71.05/gsp_ga10x.bin","kind":"nodeRootFile","source":"/usr/lib/firmware/nvidia/595.71.05/gsp_ga10x.bin","readOnly":true},{"destination":"/usr/lib/firmware/nvidia/595.71.05/gsp_tu10x.bin","kind":"nodeRootFile","source":"/usr/lib/firmware/nvidia/595.71.05/gsp_tu10x.bin","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libcuda.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libcuda.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libcudadebugger.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libcudadebugger.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-allocator.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-allocator.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-cfg.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-cfg.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-gpucomp.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-gpucomp.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11-openssl3.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11-openssl3.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so.595.71.05","readOnly":true}]},"env":{"policy":"exact","values":{"CUDA_HOME":"/usr/local/cuda","CUDA_VERSION":"13.0.3","DEBIAN_FRONTEND":"noninteractive","FLASHINFER_VERSION":"0.6.17","GDRCOPY_HOME":"/usr/src/gdrdrv-2.5.1/","HOME":"/tmp","HOSTNAME":"inference-worker-0-u200b5c252a","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","LANG":"en_US.UTF-8","LANGUAGE":"en_US:en","LC_ALL":"en_US.UTF-8","LD_LIBRARY_PATH":"/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/local/cuda/lib64:/usr/local/nvidia/lib:/usr/local/nvidia/lib64","LIBRARY_PATH":"/usr/local/cuda/lib64/stubs","NCCL_VERSION":"2.28.3-1","NVARCH":"x86_64","NVIDIA_CTK_LIBCUDA_DIR":"/usr/lib/x86_64-linux-gnu","NVIDIA_DRIVER_CAPABILITIES":"compute,utility","NVIDIA_PRODUCT_NAME":"CUDA","NVIDIA_REQUIRE_CUDA":"cuda\u003e=13.0 brand=unknown,driver\u003e=535,driver\u003c536 brand=grid,driver\u003e=535,driver\u003c536 brand=tesla,driver\u003e=535,driver\u003c536 brand=nvidia,driver\u003e=535,driver\u003c536 brand=quadro,driver\u003e=535,driver\u003c536 brand=quadrortx,driver\u003e=535,driver\u003c536 brand=nvidiartx,driver\u003e=535,driver\u003c536 brand=vapps,driver\u003e=535,driver\u003c536 brand=vpc,driver\u003e=535,driver\u003c536 brand=vcs,driver\u003e=535,driver\u003c536 brand=vws,driver\u003e=535,driver\u003c536 brand=cloudgaming,driver\u003e=535,driver\u003c536 brand=unknown,driver\u003e=550,driver\u003c551 brand=grid,driver\u003e=550,driver\u003c551 brand=tesla,driver\u003e=550,driver\u003c551 brand=nvidia,driver\u003e=550,driver\u003c551 brand=quadro,driver\u003e=550,driver\u003c551 brand=quadrortx,driver\u003e=550,driver\u003c551 brand=nvidiartx,driver\u003e=550,driver\u003c551 brand=vapps,driver\u003e=550,driver\u003c551 brand=vpc,driver\u003e=550,driver\u003c551 brand=vcs,driver\u003e=550,driver\u003c551 brand=vws,driver\u003e=550,driver\u003c551 brand=cloudgaming,driver\u003e=550,driver\u003c551 brand=unknown,driver\u003e=565,driver\u003c566 brand=grid,driver\u003e=565,driver\u003c566 brand=tesla,driver\u003e=565,driver\u003c566 brand=nvidia,driver\u003e=565,driver\u003c566 brand=quadro,driver\u003e=565,driver\u003c566 brand=quadrortx,driver\u003e=565,driver\u003c566 brand=nvidiartx,driver\u003e=565,driver\u003c566 brand=vapps,driver\u003e=565,driver\u003c566 brand=vpc,driver\u003e=565,driver\u003c566 brand=vcs,driver\u003e=565,driver\u003c566 brand=vws,driver\u003e=565,driver\u003c566 brand=cloudgaming,driver\u003e=565,driver\u003c566 brand=unknown,driver\u003e=570,driver\u003c571 brand=grid,driver\u003e=570,driver\u003c571 brand=tesla,driver\u003e=570,driver\u003c571 brand=nvidia,driver\u003e=570,driver\u003c571 brand=quadro,driver\u003e=570,driver\u003c571 brand=quadrortx,driver\u003e=570,driver\u003c571 brand=nvidiartx,driver\u003e=570,driver\u003c571 brand=vapps,driver\u003e=570,driver\u003c571 brand=vpc,driver\u003e=570,driver\u003c571 brand=vcs,driver\u003e=570,driver\u003c571 brand=vws,driver\u003e=570,driver\u003c571 brand=cloudgaming,driver\u003e=570,driver\u003c571 brand=unknown,driver\u003e=575,driver\u003c576 brand=grid,driver\u003e=575,driver\u003c576 brand=tesla,driver\u003e=575,driver\u003c576 brand=nvidia,driver\u003e=575,driver\u003c576 brand=quadro,driver\u003e=575,driver\u003c576 brand=quadrortx,driver\u003e=575,driver\u003c576 brand=nvidiartx,driver\u003e=575,driver\u003c576 brand=vapps,driver\u003e=575,driver\u003c576 brand=vpc,driver\u003e=575,driver\u003c576 brand=vcs,driver\u003e=575,driver\u003c576 brand=vws,driver\u003e=575,driver\u003c576 brand=cloudgaming,driver\u003e=575,driver\u003c576","NVIDIA_VISIBLE_DEVICES":"void","NV_CUDA_CUDART_DEV_VERSION":"13.0.96-1","NV_CUDA_CUDART_VERSION":"13.0.96-1","NV_CUDA_LIB_VERSION":"13.0.3-1","NV_CUDA_NSIGHT_COMPUTE_DEV_PACKAGE":"cuda-nsight-compute-13-0=13.0.3-1","NV_CUDA_NSIGHT_COMPUTE_VERSION":"13.0.3-1","NV_CUDNN_PACKAGE":"libcudnn9-cuda-13=9.14.0.64-1","NV_CUDNN_PACKAGE_DEV":"libcudnn9-dev-cuda-13=9.14.0.64-1","NV_CUDNN_PACKAGE_DEV_HEADERS":"libcudnn9-headers-cuda-13=9.14.0.64-1","NV_CUDNN_PACKAGE_NAME":"libcudnn9-cuda-13","NV_CUDNN_VERSION":"9.14.0.64-1","NV_LIBCUBLAS_DEV_PACKAGE":"libcublas-dev-13-0=13.1.1.3-1","NV_LIBCUBLAS_DEV_PACKAGE_NAME":"libcublas-dev-13-0","NV_LIBCUBLAS_DEV_VERSION":"13.1.1.3-1","NV_LIBCUBLAS_PACKAGE":"libcublas-13-0=13.1.1.3-1","NV_LIBCUBLAS_PACKAGE_NAME":"libcublas-13-0","NV_LIBCUBLAS_VERSION":"13.1.1.3-1","NV_LIBCUSPARSE_DEV_VERSION":"12.6.3.3-1","NV_LIBCUSPARSE_VERSION":"12.6.3.3-1","NV_LIBNCCL_DEV_PACKAGE":"libnccl-dev=2.28.3-1+cuda13.0","NV_LIBNCCL_DEV_PACKAGE_NAME":"libnccl-dev","NV_LIBNCCL_DEV_PACKAGE_VERSION":"2.28.3-1","NV_LIBNCCL_PACKAGE":"libnccl2=2.28.3-1+cuda13.0","NV_LIBNCCL_PACKAGE_NAME":"libnccl2","NV_LIBNCCL_PACKAGE_VERSION":"2.28.3-1","NV_LIBNPP_DEV_PACKAGE":"libnpp-dev-13-0=13.0.1.2-1","NV_LIBNPP_DEV_VERSION":"13.0.1.2-1","NV_LIBNPP_PACKAGE":"libnpp-13-0=13.0.1.2-1","NV_LIBNPP_VERSION":"13.0.1.2-1","NV_NVML_DEV_VERSION":"13.0.87-1","NV_NVTX_VERSION":"13.0.85-1","PATH":"/root/.cargo/bin:/usr/local/nvidia/bin:/usr/local/cuda/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/nvidia/bin","SGLANG_BUILD_COMMIT":"71de97b264b04dcd514cf904003028aefe9775c8","SGLANG_BUILD_URL":"https://github.com/sgl-project/sglang/actions/runs/32520522511","SGLANG_IMAGE_TAG":"lmsysorg/sglang:v0.5.18","WORKER_DRAIN_DEADLINE_SECONDS":"570"}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=0.0.0.0","--port=8802","--platform=tdx","--front-door-mode=webpki","--expected-workload=inference-worker-0-u200b5c252a","--attestation-api-url=unix:///run/c8s/workload-claims/attestation-api.sock","--serving-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-key-file=/etc/c8s/certs/tls.key","--mesh-identity-ca-file=/etc/c8s/certs/tls.crt","--cds-url=https://c8s-cds.c8s-system.svc.cluster.local:8443","--cds-measurements=9309eaae9c151e766de0f97b1d1aaeb76b8c8c366080803943fb566521c8f0cf00a142d8b7b0683ed1d42c5a27198ba1","--cds-rtmrs=1=0e2febd1f16c7818973ee6b5d84c7e3a54c5b2cd298d39073881be95fb7237ec1f8a88d262b0da0874133c5d74aef65a,2=f452ccd152bc49b92fa595c1ca3dd592fe3f8c02e7a25f820315105bb4b36e12fac2ac718ac0d1788f6df0102c5020fa"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/models/md7b0eb3196a","kind":"data"}]},"env":{"policy":"exact","values":{"HOSTNAME":"inference-worker-0-0","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}}],"secrets":{"policy":"allow","read":["/confidential-inference/model-updates/worker-uf0b4c47afe"]}},"inference-worker-1-u5f71fa321d":{"initContainers":[],"containers":[{"digest":"sha256:1244f1cf550c656889d5c80f9c9388ba4bd54bac00e3af394cdddd03e01edc68","image":"ghcr.io/confidential-dot-ai/confidential-inference/sglang@sha256:1244f1cf550c656889d5c80f9c9388ba4bd54bac00e3af394cdddd03e01edc68","command":{"policy":"exact","argv":["/usr/local/bin/wait-for-model"]},"args":{"policy":"exact","argv":["--path=/mnt/c8s-data/models/md5bca183f9f","--timeout-seconds=900","--poll-seconds=1","--expected-repository=deepseek-ai/DeepSeek-V4-Flash-0731","--expected-revision=9e165c30e2704aec5d9d593cce3eebd58bbef1cb","--revision-metadata=.model-lock-local-manifest.json","--expected-file=.model-lock-local-manifest.json=cd9eecd89a3d31dedd7b707158e86ebeab241c68d55e9661d3efa508015a697c","--expected-file=config.json=6c8f3d2d3b48707541b88f32f22ef3f0f8a6b57d8523281e2b8d3cdb0ae9a023","--expected-file=model.safetensors.index.json=98efab455cf08dfbbbaaba6f570e1bf10bf927d2b4c3c453a59c2f6f0e3be92b","--expected-file=tokenizer_config.json=6ac8c8dc065ed118161d02dd532749ae3f52c243deac27872134fae2f50d8547","--gpu-metrics-port=29000","--gpu-metrics-worker=sglang-1","--","python3","-m","sglang.launch_server","--model-path=/mnt/c8s-data/models/md5bca183f9f","--served-model-name=deepseek-ai/DeepSeek-V4-Flash-0731-rehearsal-worker-uf0b4c47afe","--revision=9e165c30e2704aec5d9d593cce3eebd58bbef1cb","--tool-call-parser=deepseekv4","--reasoning-parser=deepseek-v4","--tp=4","--moe-runner-backend=flashinfer_mxfp4","--speculative-algorithm=DSPARK","--mem-fraction-static=0.90","--chunked-prefill-size=4096","--swa-full-tokens-ratio=0.1","--trust-remote-code","--enable-metrics","--enable-cache-report","--host=0.0.0.0","--port=30000"]},"mounts":{"policy":"exact","rules":[{"destination":"/dev/shm","kind":"emptyDir"},{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/models/md5bca183f9f","kind":"data"},{"destination":"/usr/bin/nvidia-persistenced","kind":"nodeRootFile","source":"/usr/bin/nvidia-persistenced","readOnly":true},{"destination":"/usr/bin/nvidia-smi","kind":"nodeRootFile","source":"/usr/bin/nvidia-smi","readOnly":true},{"destination":"/usr/lib/firmware/nvidia/595.71.05/gsp_ga10x.bin","kind":"nodeRootFile","source":"/usr/lib/firmware/nvidia/595.71.05/gsp_ga10x.bin","readOnly":true},{"destination":"/usr/lib/firmware/nvidia/595.71.05/gsp_tu10x.bin","kind":"nodeRootFile","source":"/usr/lib/firmware/nvidia/595.71.05/gsp_tu10x.bin","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libcuda.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libcuda.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libcudadebugger.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libcudadebugger.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-allocator.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-allocator.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-cfg.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-cfg.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-gpucomp.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-gpucomp.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-ml.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-nvvm.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11-openssl3.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11-openssl3.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-pkcs11.so.595.71.05","readOnly":true},{"destination":"/usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so.595.71.05","kind":"nodeRootFile","source":"/usr/lib/x86_64-linux-gnu/libnvidia-ptxjitcompiler.so.595.71.05","readOnly":true}]},"env":{"policy":"exact","values":{"CUDA_HOME":"/usr/local/cuda","CUDA_VERSION":"13.0.3","DEBIAN_FRONTEND":"noninteractive","FLASHINFER_VERSION":"0.6.17","GDRCOPY_HOME":"/usr/src/gdrdrv-2.5.1/","HOME":"/tmp","HOSTNAME":"inference-worker-1-u5f71fa321d","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","LANG":"en_US.UTF-8","LANGUAGE":"en_US:en","LC_ALL":"en_US.UTF-8","LD_LIBRARY_PATH":"/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/local/cuda/lib64:/usr/local/nvidia/lib:/usr/local/nvidia/lib64","LIBRARY_PATH":"/usr/local/cuda/lib64/stubs","NCCL_VERSION":"2.28.3-1","NVARCH":"x86_64","NVIDIA_CTK_LIBCUDA_DIR":"/usr/lib/x86_64-linux-gnu","NVIDIA_DRIVER_CAPABILITIES":"compute,utility","NVIDIA_PRODUCT_NAME":"CUDA","NVIDIA_REQUIRE_CUDA":"cuda\u003e=13.0 brand=unknown,driver\u003e=535,driver\u003c536 brand=grid,driver\u003e=535,driver\u003c536 brand=tesla,driver\u003e=535,driver\u003c536 brand=nvidia,driver\u003e=535,driver\u003c536 brand=quadro,driver\u003e=535,driver\u003c536 brand=quadrortx,driver\u003e=535,driver\u003c536 brand=nvidiartx,driver\u003e=535,driver\u003c536 brand=vapps,driver\u003e=535,driver\u003c536 brand=vpc,driver\u003e=535,driver\u003c536 brand=vcs,driver\u003e=535,driver\u003c536 brand=vws,driver\u003e=535,driver\u003c536 brand=cloudgaming,driver\u003e=535,driver\u003c536 brand=unknown,driver\u003e=550,driver\u003c551 brand=grid,driver\u003e=550,driver\u003c551 brand=tesla,driver\u003e=550,driver\u003c551 brand=nvidia,driver\u003e=550,driver\u003c551 brand=quadro,driver\u003e=550,driver\u003c551 brand=quadrortx,driver\u003e=550,driver\u003c551 brand=nvidiartx,driver\u003e=550,driver\u003c551 brand=vapps,driver\u003e=550,driver\u003c551 brand=vpc,driver\u003e=550,driver\u003c551 brand=vcs,driver\u003e=550,driver\u003c551 brand=vws,driver\u003e=550,driver\u003c551 brand=cloudgaming,driver\u003e=550,driver\u003c551 brand=unknown,driver\u003e=565,driver\u003c566 brand=grid,driver\u003e=565,driver\u003c566 brand=tesla,driver\u003e=565,driver\u003c566 brand=nvidia,driver\u003e=565,driver\u003c566 brand=quadro,driver\u003e=565,driver\u003c566 brand=quadrortx,driver\u003e=565,driver\u003c566 brand=nvidiartx,driver\u003e=565,driver\u003c566 brand=vapps,driver\u003e=565,driver\u003c566 brand=vpc,driver\u003e=565,driver\u003c566 brand=vcs,driver\u003e=565,driver\u003c566 brand=vws,driver\u003e=565,driver\u003c566 brand=cloudgaming,driver\u003e=565,driver\u003c566 brand=unknown,driver\u003e=570,driver\u003c571 brand=grid,driver\u003e=570,driver\u003c571 brand=tesla,driver\u003e=570,driver\u003c571 brand=nvidia,driver\u003e=570,driver\u003c571 brand=quadro,driver\u003e=570,driver\u003c571 brand=quadrortx,driver\u003e=570,driver\u003c571 brand=nvidiartx,driver\u003e=570,driver\u003c571 brand=vapps,driver\u003e=570,driver\u003c571 brand=vpc,driver\u003e=570,driver\u003c571 brand=vcs,driver\u003e=570,driver\u003c571 brand=vws,driver\u003e=570,driver\u003c571 brand=cloudgaming,driver\u003e=570,driver\u003c571 brand=unknown,driver\u003e=575,driver\u003c576 brand=grid,driver\u003e=575,driver\u003c576 brand=tesla,driver\u003e=575,driver\u003c576 brand=nvidia,driver\u003e=575,driver\u003c576 brand=quadro,driver\u003e=575,driver\u003c576 brand=quadrortx,driver\u003e=575,driver\u003c576 brand=nvidiartx,driver\u003e=575,driver\u003c576 brand=vapps,driver\u003e=575,driver\u003c576 brand=vpc,driver\u003e=575,driver\u003c576 brand=vcs,driver\u003e=575,driver\u003c576 brand=vws,driver\u003e=575,driver\u003c576 brand=cloudgaming,driver\u003e=575,driver\u003c576","NVIDIA_VISIBLE_DEVICES":"void","NV_CUDA_CUDART_DEV_VERSION":"13.0.96-1","NV_CUDA_CUDART_VERSION":"13.0.96-1","NV_CUDA_LIB_VERSION":"13.0.3-1","NV_CUDA_NSIGHT_COMPUTE_DEV_PACKAGE":"cuda-nsight-compute-13-0=13.0.3-1","NV_CUDA_NSIGHT_COMPUTE_VERSION":"13.0.3-1","NV_CUDNN_PACKAGE":"libcudnn9-cuda-13=9.14.0.64-1","NV_CUDNN_PACKAGE_DEV":"libcudnn9-dev-cuda-13=9.14.0.64-1","NV_CUDNN_PACKAGE_DEV_HEADERS":"libcudnn9-headers-cuda-13=9.14.0.64-1","NV_CUDNN_PACKAGE_NAME":"libcudnn9-cuda-13","NV_CUDNN_VERSION":"9.14.0.64-1","NV_LIBCUBLAS_DEV_PACKAGE":"libcublas-dev-13-0=13.1.1.3-1","NV_LIBCUBLAS_DEV_PACKAGE_NAME":"libcublas-dev-13-0","NV_LIBCUBLAS_DEV_VERSION":"13.1.1.3-1","NV_LIBCUBLAS_PACKAGE":"libcublas-13-0=13.1.1.3-1","NV_LIBCUBLAS_PACKAGE_NAME":"libcublas-13-0","NV_LIBCUBLAS_VERSION":"13.1.1.3-1","NV_LIBCUSPARSE_DEV_VERSION":"12.6.3.3-1","NV_LIBCUSPARSE_VERSION":"12.6.3.3-1","NV_LIBNCCL_DEV_PACKAGE":"libnccl-dev=2.28.3-1+cuda13.0","NV_LIBNCCL_DEV_PACKAGE_NAME":"libnccl-dev","NV_LIBNCCL_DEV_PACKAGE_VERSION":"2.28.3-1","NV_LIBNCCL_PACKAGE":"libnccl2=2.28.3-1+cuda13.0","NV_LIBNCCL_PACKAGE_NAME":"libnccl2","NV_LIBNCCL_PACKAGE_VERSION":"2.28.3-1","NV_LIBNPP_DEV_PACKAGE":"libnpp-dev-13-0=13.0.1.2-1","NV_LIBNPP_DEV_VERSION":"13.0.1.2-1","NV_LIBNPP_PACKAGE":"libnpp-13-0=13.0.1.2-1","NV_LIBNPP_VERSION":"13.0.1.2-1","NV_NVML_DEV_VERSION":"13.0.87-1","NV_NVTX_VERSION":"13.0.85-1","PATH":"/root/.cargo/bin:/usr/local/nvidia/bin:/usr/local/cuda/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/nvidia/bin","SGLANG_BUILD_COMMIT":"71de97b264b04dcd514cf904003028aefe9775c8","SGLANG_BUILD_URL":"https://github.com/sgl-project/sglang/actions/runs/32520522511","SGLANG_IMAGE_TAG":"lmsysorg/sglang:v0.5.18","WORKER_DRAIN_DEADLINE_SECONDS":"570"}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=0.0.0.0","--port=8802","--platform=tdx","--front-door-mode=webpki","--expected-workload=inference-worker-1-u5f71fa321d","--attestation-api-url=unix:///run/c8s/workload-claims/attestation-api.sock","--serving-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-key-file=/etc/c8s/certs/tls.key","--mesh-identity-ca-file=/etc/c8s/certs/tls.crt","--cds-url=https://c8s-cds.c8s-system.svc.cluster.local:8443","--cds-measurements=9309eaae9c151e766de0f97b1d1aaeb76b8c8c366080803943fb566521c8f0cf00a142d8b7b0683ed1d42c5a27198ba1","--cds-rtmrs=1=0e2febd1f16c7818973ee6b5d84c7e3a54c5b2cd298d39073881be95fb7237ec1f8a88d262b0da0874133c5d74aef65a,2=f452ccd152bc49b92fa595c1ca3dd592fe3f8c02e7a25f820315105bb4b36e12fac2ac718ac0d1788f6df0102c5020fa"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/models/md5bca183f9f","kind":"data"}]},"env":{"policy":"exact","values":{"HOSTNAME":"inference-worker-1-0","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}}],"secrets":{"policy":"allow","read":["/confidential-inference/model-updates/worker-uf0b4c47afe"]}},"kube-state-metrics":{"initContainers":[],"containers":[{"digest":"sha256:44cfc22900bf545fb9a073adea2132b80558b7e9b6a6f687a8f23b4d7fc438c9","image":"registry.k8s.io/kube-state-metrics/kube-state-metrics@sha256:44cfc22900bf545fb9a073adea2132b80558b7e9b6a6f687a8f23b4d7fc438c9","command":{"policy":"exact","argv":["/kube-state-metrics","--port=8080","--telemetry-port=8081"]},"args":{"policy":"exact","argv":["--host=0.0.0.0","--port=8080","--resources=deployments,daemonsets,statefulsets,pods","--namespaces=confidential-inference"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"HOSTNAME":"kube-state-metrics","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=0.0.0.0","--port=8804","--platform=tdx","--front-door-mode=webpki","--expected-workload=kube-state-metrics","--attestation-api-url=unix:///run/c8s/workload-claims/attestation-api.sock","--serving-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-key-file=/etc/c8s/certs/tls.key","--mesh-identity-ca-file=/etc/c8s/certs/tls.crt","--cds-url=https://c8s-cds.c8s-system.svc.cluster.local:8443","--cds-measurements=9309eaae9c151e766de0f97b1d1aaeb76b8c8c366080803943fb566521c8f0cf00a142d8b7b0683ed1d42c5a27198ba1","--cds-rtmrs=1=0e2febd1f16c7818973ee6b5d84c7e3a54c5b2cd298d39073881be95fb7237ec1f8a88d262b0da0874133c5d74aef65a,2=f452ccd152bc49b92fa595c1ca3dd592fe3f8c02e7a25f820315105bb4b36e12fac2ac718ac0d1788f6df0102c5020fa"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"HOSTNAME":"kube-state-metrics","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}}]},"log-collector-ua59410a16b":{"initContainers":[],"containers":[{"digest":"sha256:a64a7f515267e6552ffc9e6a9f4679a0e977a8ccd9c7649074af73752af22718","image":"ghcr.io/confidential-dot-ai/confidential-inference/log-collector@sha256:a64a7f515267e6552ffc9e6a9f4679a0e977a8ccd9c7649074af73752af22718","command":{"policy":"exact","argv":["/bin/alloy"]},"args":{"policy":"exact","argv":["run","/etc/alloy/config.alloy","--storage.path=/tmp/alloy","--server.http.listen-addr=127.0.0.1:12345","--server.http.enable-pprof=false","--disable-reporting"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/admin-client","kind":"data"},{"destination":"/tmp","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"ALLOY_DEPLOY_MODE":"docker","DEPLOYMENT_ID":"production-20260926","HOSTNAME":"log-collector-ua59410a16b","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","KUBE_API_URL":"https://kubernetes.default.svc:443","LOG_APPLICATION":"confidential-inference","LOG_NAMESPACE":"confidential-inference","LOKI_URL":"https://admin.api.confidential.ai:9443/deployments/production-20260926/loki/api/v1/push","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}}}]},"metrics-collector":{"initContainers":[],"containers":[{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=0.0.0.0","--port=8803","--platform=tdx","--front-door-mode=webpki","--expected-workload=metrics-collector","--attestation-api-url=unix:///run/c8s/workload-claims/attestation-api.sock","--serving-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-key-file=/etc/c8s/certs/tls.key","--mesh-identity-ca-file=/etc/c8s/certs/tls.crt","--cds-url=https://c8s-cds.c8s-system.svc.cluster.local:8443","--cds-measurements=9309eaae9c151e766de0f97b1d1aaeb76b8c8c366080803943fb566521c8f0cf00a142d8b7b0683ed1d42c5a27198ba1","--cds-rtmrs=1=0e2febd1f16c7818973ee6b5d84c7e3a54c5b2cd298d39073881be95fb7237ec1f8a88d262b0da0874133c5d74aef65a,2=f452ccd152bc49b92fa595c1ca3dd592fe3f8c02e7a25f820315105bb4b36e12fac2ac718ac0d1788f6df0102c5020fa"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"HOSTNAME":"metrics-collector","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}},{"digest":"sha256:8672a850efe2f9874702406c8318704edb363587f8c2ca88586b4c8fdb5cea24","image":"docker.io/prom/prometheus@sha256:8672a850efe2f9874702406c8318704edb363587f8c2ca88586b4c8fdb5cea24","command":{"policy":"exact","argv":["/bin/prometheus"]},"args":{"policy":"exact","argv":["--config.file=/mnt/c8s-data/prometheus/prometheus.yml","--storage.tsdb.path=/prometheus"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/prometheus","kind":"data"},{"destination":"/mnt/c8s-data/prometheus-remote-write","kind":"data"},{"destination":"/prometheus","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"HOSTNAME":"metrics-collector","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}}}]},"nginx-unprivileged-3af0c10d960c-ce5a9610":{"label":"nginxinc/nginx-unprivileged@sha256:3af0c10d960cc2502427fe1219c52989d309e7d65596869c60a34fd2fa2406f0","initContainers":[],"containers":[{"digest":"sha256:3af0c10d960cc2502427fe1219c52989d309e7d65596869c60a34fd2fa2406f0","image":"nginxinc/nginx-unprivileged@sha256:3af0c10d960cc2502427fe1219c52989d309e7d65596869c60a34fd2fa2406f0","command":{"policy":"exact","argv":["/docker-entrypoint.sh","nginx"]},"args":{"policy":"exact","argv":["-c","/usr/lib/c8s/router-nginx/nginx.conf","-g","daemon off;"]},"mounts":{"policy":"exact","rules":[{"destination":"/discovery","kind":"emptyDir"},{"destination":"/etc/c8s-acme-tls","kind":"emptyDir"},{"destination":"/run/c8s-node","kind":"host","source":"/run/c8s-node","readOnly":true},{"destination":"/tls","kind":"emptyDir"},{"destination":"/tmp","kind":"emptyDir"},{"destination":"/usr/lib/c8s/router-nginx","kind":"host","source":"/usr/lib/c8s/router-nginx","readOnly":true},{"destination":"/var/cache/nginx","kind":"emptyDir"},{"destination":"/var/lib/c8s-tunnel-body","kind":"emptyDir"}]},"env":{"policy":"match","variables":{"DYNPKG_RELEASE":{"exact":"1"},"HOSTNAME":{"present":true},"KUBERNETES_PORT":{"present":true},"KUBERNETES_PORT_443_TCP":{"present":true},"KUBERNETES_PORT_443_TCP_ADDR":{"present":true},"KUBERNETES_PORT_443_TCP_PORT":{"exact":"443"},"KUBERNETES_PORT_443_TCP_PROTO":{"exact":"tcp"},"KUBERNETES_SERVICE_HOST":{"present":true},"KUBERNETES_SERVICE_PORT":{"exact":"443"},"KUBERNETES_SERVICE_PORT_HTTPS":{"exact":"443"},"NGINX_VERSION":{"exact":"1.30.5"},"PATH":{"exact":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},"PKG_RELEASE":{"exact":"1"}}}}]},"router-v0-15-15":{"initContainers":[],"containers":[{"digest":"sha256:328c42e8b54b29dc0574c5d21fbf85704fb77e75c12cd394080b0d5ae0e4c4de","image":"ghcr.io/confidential-dot-ai/confidential-inference/sglang-router@sha256:328c42e8b54b29dc0574c5d21fbf85704fb77e75c12cd394080b0d5ae0e4c4de","command":{"policy":"exact","argv":["python3","-m","sglang_router.launch_router"]},"args":{"policy":"exact","argv":["--service-discovery","--service-discovery-namespace=confidential-inference","--service-discovery-port=30000","--policy=cache_aware","--cache-threshold=0.3","--balance-abs-threshold=64","--balance-rel-threshold=1.5","--eviction-interval-secs=60","--max-tree-size=67108864","--health-check-endpoint=/health","--worker-startup-timeout-secs=3600","--host=0.0.0.0","--port=30000","--prometheus-host=0.0.0.0","--prometheus-port=29000","--enable-igw","--selector","app.kubernetes.io/component=inference-worker","confidential.ai/traffic-eligible=true"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"},{"destination":"/mnt/c8s-data/model-routes","kind":"data"}]},"env":{"policy":"exact","values":{"CI_ROUTER_MODEL_ROUTES_FILE":"/mnt/c8s-data/model-routes/routes.json","GPG_KEY":"7169605F62C751356D054A26A821E680E5FA6305","HOSTNAME":"router-v0-15-15","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","LANG":"C.UTF-8","PATH":"/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","PYTHON_SHA256":"c2c4321961fab0fb999d66e0cecf521c2ab3994c7992873ea99e306c1094fd5a","PYTHON_VERSION":"3.12.15"}}},{"digest":"sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","image":"ghcr.io/confidential-dot-ai/c8s-operator@sha256:593dea857bfdb2512af5dcfbbec34b10c08de66bbd67f7d33d23a1f8581429b5","command":{"policy":"exact","argv":["/c8s"]},"args":{"policy":"exact","argv":["cds-attest","--host=0.0.0.0","--port=8801","--platform=tdx","--front-door-mode=webpki","--expected-workload=router-v0-15-15","--attestation-api-url=unix:///run/c8s/workload-claims/attestation-api.sock","--serving-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-cert-file=/etc/c8s/certs/tls.crt","--mesh-identity-key-file=/etc/c8s/certs/tls.key","--mesh-identity-ca-file=/etc/c8s/certs/tls.crt","--cds-url=https://c8s-cds.c8s-system.svc.cluster.local:8443","--cds-measurements=9309eaae9c151e766de0f97b1d1aaeb76b8c8c366080803943fb566521c8f0cf00a142d8b7b0683ed1d42c5a27198ba1","--cds-rtmrs=1=0e2febd1f16c7818973ee6b5d84c7e3a54c5b2cd298d39073881be95fb7237ec1f8a88d262b0da0874133c5d74aef65a,2=f452ccd152bc49b92fa595c1ca3dd592fe3f8c02e7a25f820315105bb4b36e12fac2ac718ac0d1788f6df0102c5020fa"]},"mounts":{"policy":"exact","rules":[{"destination":"/etc/c8s/certs","kind":"emptyDir"}]},"env":{"policy":"exact","values":{"HOSTNAME":"router-v0-15-15","KUBERNETES_PORT":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP":"tcp://10.53.0.1:443","KUBERNETES_PORT_443_TCP_ADDR":"10.53.0.1","KUBERNETES_PORT_443_TCP_PORT":"443","KUBERNETES_PORT_443_TCP_PROTO":"tcp","KUBERNETES_SERVICE_HOST":"10.53.0.1","KUBERNETES_SERVICE_PORT":"443","KUBERNETES_SERVICE_PORT_HTTPS":"443","PATH":"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","SSL_CERT_FILE":"/etc/ssl/certs/ca-certificates.crt"}}}]}}}