Skip to main content

H-06 Kubernetes platform

Brick H of the Enterprise AI Platform. Technology: Kubernetes (upstream, OpenShift, EKS, AKS, GKE, RKE2, K3s) with namespaces per domain, Helm chart deploy/helm/enterprise-ai. French version: ../../fr/bricks/H-06-kubernetes.md.

Role and responsibilities​

  • Run every component with namespaces (eai-system, eai-data, eai-security, eai-inference, eai-sandbox, observability), PDBs, resource limits, probes.

Position and interactions​

  • Execution path: deployment substrate.
  • Probes use /healthz and /readyz; GPU nodes labeled and tainted for inference and media workers.

Open source and developed parts​

  • Open source reused: Kubernetes, Helm, NVIDIA GPU operator.
  • Developed in the platform: Helm chart, values per profile (values-prod.yaml, values-onprem-gpu.yaml).

Data model​

No dedicated table: state lives in Kubernetes objects, Git and the tool's own storage; actions are audited in eai.audit_events through the Control Plane when they go through the API.

Contract: contracts/v1/model-manifest.schema.json (schema_version 1.0). Usage is always reported with contracts/v1/usage-event.schema.json, audit with contracts/v1/audit-event.schema.json.

API endpoints​

MethodPath
GET/readyz
GET/v1/meta
GET/v1/catalog/bricks/{id}

GET /readyz​

Response:

{
  "status": "ready",
  "checks": {
    "postgres": "ok",
    "redis": "ok",
    "clickhouse": "ok"
  }
}

GET /v1/meta​

Response:

{
  "version": "1.0.0",
  "features": [
    "finops",
    "multimodal"
  ],
  "locales": [
    "en",
    "fr"
  ]
}

GET /v1/catalog/bricks/{id}​

Response:

{
  "id": "H-06",
  "name": "Kubernetes",
  "status": "implemented"
}

SDK examples​

Python​

from enterprise_ai import EnterpriseAI

client = EnterpriseAI(base_url="<control-plane-url>", api_key="eai_live_xxx", tenant="acme", locale="en")
client.system.readyz()
client.system.meta()
client.system.brick(brick_id="H-06")

TypeScript​

import { EnterpriseAI } from "@enterprise-ai/sdk";

const client = new EnterpriseAI({ baseUrl: "<control-plane-url>", apiKey: process.env.EAI_API_KEY, tenant: "acme", locale: "en" });
await client.meta.ready();
await client.meta.get();
await client.catalog.getBrick({ brickId: "H-06" });

Java​

EnterpriseAIClient client = EnterpriseAIClient.builder()
    .baseUrl("<control-plane-url>")
    .apiKey(System.getenv("EAI_API_KEY"))
    .tenant("acme")
    .locale(Locale.ENGLISH)
    .build();
client.meta().ready();
client.meta().get();
client.catalog().brick("H-06");

Go​

client, err := eai.NewClient(eai.WithBaseURL("<control-plane-url>"), eai.WithAPIKey(os.Getenv("EAI_API_KEY")), eai.WithTenant("acme"), eai.WithLocale("en"))
if err != nil { log.Fatal(err) }
ctx := context.Background()
_, err = client.Meta.Ready(ctx, nil)
_, err = client.Meta.Get(ctx, nil)
_, err = client.Catalog.Brick(ctx, "H-06")

Configuration​

Environment variables: EAI_ENV.

Helm values keys (deploy/helm/enterprise-ai/values.yaml): global.namespaces, controlPlane.pdb, controlPlane.resources, sandbox.runtimeClasses.

Security​

  • Pod Security restricted, non root, read-only root filesystem, gVisor/Kata for sandbox.
  • Tenant resolved from the credential, never from the body; PostgreSQL row level security on every tenant table.
  • Every mutation and policy decision writes a hash chained audit event (G-11).
  • Errors use the standard envelope with message_i18n en and fr.

Observability​

  • kube-state-metrics, events exported to OpenSearch.
  • W3C traceparent propagated, X-Request-Id returned, spans carry eai.tenant_id, eai.project, eai.agent_id, eai.run_id.

FinOps units​

  • Namespace and label tenantLabel/owner drive infrastructure cost allocation.

Failure modes and resilience​

  • Node loss -> PDB and anti-affinity keep at least one replica per service.

Standalone adoption​

Each component can be installed alone by disabling the others in values.

Acceptance tests​

  1. helm template with each values profile renders and passes kubeconform.
  2. Draining a node keeps /readyz green.

Implementation roadmap