kinfctl

kinfctl is the Kinference CLI tool.

Currently it provides one subcommand: check.

check #

kinfctl check takes one or more InferencePolicy manifests and validates and lints them. If provided, check also reads InferencePool, InferenceWorkerSet, and InferenceProvider manifests in order to evaluate the names referenced in the policy. (See Name checks.)

Usage #

kinfctl check [FILE|-]... [--pool NAMESPACE/NAME] [-n NAMESPACE] [-o text|json]

Argument	Default	Effect
`FILE`	required	One or more manifest files. `-` reads standard input.
`--pool`	none	Check policies as if they are attached to a specific InferencePool
`-n`, `--namespace`	`default`	Namespace for objects that don’t set one
`-o`, `--output`	`text`	`text` for people, `json` for programs

Examples #

Check one policy:

kinfctl check policy.yaml

Check all policies matching the glob policies/policy-*.yaml, and also validate names against the live resources on the cluster:

kubectl get infpool,iws,infprov,refgrant -A -o yaml | kinfctl check --pool default/inference-pool - policies/policy-*.yaml

Input #

kinfctl check can take multiple inputs, and expects one or more YAML or JSON documents in each input. (Note that multiple documents in one input require a --- separator between documents.)

Input type	Used for
`InferencePolicy`	Policy checks
`InferencePool`, `InferenceWorkerSet`, `InferenceProvider`, `ReferenceGrant`	Name checks
Anything else	Skipped

Output #

Any finding are reported, one per line, prefixed by E for error or W for warning. A warnings is an issues with the policy when evaluated against a specific pool (e.g. a backend or model name not in the pool); as one policy can serve multiple pools, warnings may or may not be indicative of an issue.

Code	Meaning
`SchemaError`	The policy spec does not deserialize. Nothing else is checked for that policy.
`DuplicatePolicy`	Two inputs define the same `namespace/name`. Applying both would keep only the last
`UnknownField`	The policy includes a key the schema does not declare.

Name checks #

When given the other Kinference resources on the cluster (InferenceWorkerSet, InferenceProvider, and InferencePool) the kinfctl check command can also validate that the names a policy uses (backends, labels, backend classes, models) are valid.

By default, check will evaluate names in the policy against every input pool whose policyRef names the policy. With --pool, it will evaluate against that pool instead (i.e. regardless of whether that pool names the policy).

Exit status #

Status	Means
`0`	Nothing to fix. Skipped name checks are a note, not a finding
`1`	At least one finding, `E` or `W`
`2`	The input could not be checked: The reason is printed to stdout.

JSON output #

With -o json, kinfctl check will provide output as a JSON object, with fields as described in the table below.

Field	Type	Meaning
`ok`	boolean	`true` exactly when the exit status is `0`
`policies[].source`	string	The file, or `<stdin>`
`policies[].policy`	string	`namespace/name`
`policies[].checkedAgainstPools`	string[]	Pools whose destinations the name checks used
`policies[].nameChecks.ran`	boolean	Whether name checks ran
`policies[].nameChecks.skipped`	string, optional	Why they did not: no pool among the inputs serves the policy. Says how to run them
`policies[].nameChecks.modelsUnchecked`	string, optional	Why model names went unchecked when the rest ran
`policies[].nameChecks.unresolved[]`	`{pool, kind, name, reason}`	Destinations of the pools checked against that did not resolve. A name only they would supply counts as unknown
`policies[].errors[]`	`{path, code, message, suggestion?}`	The `E` findings. `suggestion` is the nearest valid key, for an `UnknownField`
`policies[].warnings[]`	`{path, code, message}`	The `W` findings
`otherErrors[]`	`{source, document, kind, code, message}`	Pools, worker sets, providers or grants that could not be read. `code` is `SchemaError`
`skippedDocuments[]`	`{source, document, kind}`	Documents of other kinds. `document` is 1-based