Skip to content

README.md

Latest commit

 

History

History
171 lines (116 loc) · 4.54 KB

README.md

File metadata and controls

171 lines (116 loc) · 4.54 KB
Raw

ExploitIQStack Samples

This directory contains sample Custom Resource (CR) manifests for the ExploitIQStack operator.

Important Notes

⚠️ These samples contain CR definitions only - no Secrets are included.

Before deploying any sample, you must create the required Secrets as documented in the main README.md.

Available Samples

1. exploitiq_v1alpha1_exploitiqstack.yaml (Default)

Platform: OpenShift
Use Case: Minimal production deployment
Features:

  • OpenShift Routes for external access
  • OpenShift OAuth integration
  • Automatic TLS certificate management

Use this when: You are using NVIDIA NIM

oc apply -f exploitiq_v1alpha1_exploitiqstack.yaml

2. exploitiq_v1alpha1_exploitiqstack_self_hosted_llm.yaml

Platform: OpenShift or Kubernetes
Use Case: Self-hosted LLM deployment (NOT NVIDIA NIM)
Features:

  • OpenAI-compatible API integration
  • Self-hosted LLM endpoint configuration
  • Custom model selection
  • Optional API key authentication

Use this when:

  • You have a self-hosted LLM service (Ollama, vLLM, LocalAI, etc.)
  • You want to use OpenAI-compatible API
  • You need to specify custom model names
  • You're NOT using NVIDIA NIM

Before applying:

  1. Replace baseURL with your self-hosted LLM endpoint (e.g., http://ollama.ai-namespace.svc:11434/v1)
  2. Replace modelName with your model identifier (e.g., llama3.1:latest, mistral:latest)
  3. If your LLM requires authentication, add openai_api_key to exploit-iq-secret:

Generate the HMAC_SECRET_KEY:

export HMAC_SECRET_KEY=$(openssl rand -base64 32)
oc create secret generic exploit-iq-secret \
  --from-literal=ghsa_api_key=YOUR_GITHUB_TOKEN \
  --from-literal=nvidia_api_key=YOUR_NVIDIA_KEY \
  --from-literal=serpapi_api_key=YOUR_SERPAPI_KEY \
  --from-literal=openai_api_key=YOUR_OPENAI_API_KEY \
  --from-literal=hmac-secret-key="$HMAC_SECRET_KEY"
  1. (Optional) To self-host the text embedding model, set spec.embedding.baseURL and modelName to your embedding NIM endpoint. Omit the embedding block to use the NVIDIA-hosted embedding endpoint.

Common self-hosted LLM endpoints:

  • Ollama: http://ollama.ai-namespace.svc:11434/v1
  • vLLM: http://vllm.ai-namespace.svc:8000/v1
  • LocalAI: http://localai.ai-namespace.svc:8080/v1
  • Text Generation Inference: http://tgi.ai-namespace.svc:8080/v1
oc apply -f exploitiq_v1alpha1_exploitiqstack_self_hosted_llm.yaml

Quick Start Workflow

Generate the HMAC_SECRET_KEY:

export HMAC_SECRET_KEY=$(openssl rand -base64 32)
# 1. Create required secrets (see main README.md)
oc create secret generic exploit-iq-secret \
  --from-literal=ghsa_api_key=YOUR_GITHUB_TOKEN \
  --from-literal=nvidia_api_key=YOUR_NVIDIA_KEY \
  --from-literal=serpapi_api_key=YOUR_SERPAPI_KEY \
  --from-literal=hmac-secret-key="$HMAC_SECRET_KEY"

# 2. Create image pull secrets (see main README.md)
# ... (docker-registry secrets)

# 3. Deploy the stack
oc apply -f exploitiq_v1alpha1_exploitiqstack.yaml

Verification

After deploying, check the status:

# Check CR status
oc get exploitiqstack -o wide

# Check component status
oc get pods
oc get deployments
oc get services

# Check conditions
oc get exploitiqstack exploitiqstack-sample -o jsonpath='{.status.conditions}' | jq

Troubleshooting

Stack not ready?

# Check operator logs
oc logs -n exploit-iq-operator-system deployment/exploit-iq-operator-controller-manager

# Check component conditions
oc describe exploitiqstack exploitiqstack-sample

# Check pod events
oc get events --sort-by='.lastTimestamp'

Missing secrets?

The operator will report missing secrets in the CR status conditions:

oc get exploitiqstack exploitiqstack-sample -o yaml | grep -A 5 "conditions:"

Customization

All samples can be customized by adding optional fields from the API documentation.

Common customizations:

  • Resource limits: spec.<component>.container.resources
  • Replica counts: spec.<component>.deployment.replicas
  • Custom images: spec.<component>.container.image
  • Environment variables: spec.<component>.container.extraEnv

Related Documentation