Area
Terminal / headless operation
User problem
A workload running on a Kubernetes cluster (a web app, a cron job, an agent) wants to use PAIR's endpoint, but PAIR runs on desktops and there is no documented way to put a node on the cluster. The two obvious attempts fail: a container on the pod network discovers nothing, because mDNS never leaves the local link; and pointing the workload at a node elsewhere on the LAN returns 403 loopback-only, by design.
Desired outcome
A documented, supported way to run a services-only node as a container, and as a pod on Kubernetes, that joins an existing cluster and gives the cluster's workloads an OpenAI-compatible endpoint that routes to the nodes with engines. Concretely: a Dockerfile built from the release asset, a page in docs/ that explains host networking and the loopback relay, and reference manifests.
Alternatives considered
- Issuing in-cluster workloads mTLS client certificates so they can talk to a node's TLS personality directly. Rejected: that hands out a cluster identity per consumer.
- Running the node on the Kubernetes host outside Kubernetes (systemd). Works, but is invisible to the cluster's scheduling, policy and lifecycle, and needs a relay anyway.
Additional context
CONTRIBUTING.md asks for maintainer alignment before adding a distribution channel. I have a validated implementation (PAIR v0.1.1 on OpenShift 4.22 with OVN-Kubernetes, paired with a Linux GPU node and a macOS node, five-minute soak with no failed requests) and will open it as a documentation PR with the files under services/container/. Happy to adjust the base image, drop the Dockerfile and keep only the page, or port the relay to Go if that is what you would accept.
Related: #30 fixes the address a node on an OVN-Kubernetes host advertises, which this work uncovered.
Area
Terminal / headless operation
User problem
A workload running on a Kubernetes cluster (a web app, a cron job, an agent) wants to use PAIR's endpoint, but PAIR runs on desktops and there is no documented way to put a node on the cluster. The two obvious attempts fail: a container on the pod network discovers nothing, because mDNS never leaves the local link; and pointing the workload at a node elsewhere on the LAN returns
403 loopback-only, by design.Desired outcome
A documented, supported way to run a services-only node as a container, and as a pod on Kubernetes, that joins an existing cluster and gives the cluster's workloads an OpenAI-compatible endpoint that routes to the nodes with engines. Concretely: a Dockerfile built from the release asset, a page in
docs/that explains host networking and the loopback relay, and reference manifests.Alternatives considered
Additional context
CONTRIBUTING.mdasks for maintainer alignment before adding a distribution channel. I have a validated implementation (PAIR v0.1.1 on OpenShift 4.22 with OVN-Kubernetes, paired with a Linux GPU node and a macOS node, five-minute soak with no failed requests) and will open it as a documentation PR with the files underservices/container/. Happy to adjust the base image, drop the Dockerfile and keep only the page, or port the relay to Go if that is what you would accept.Related: #30 fixes the address a node on an OVN-Kubernetes host advertises, which this work uncovered.