[glenmessenger]

This adds k8s-aibom — an open-source, unprivileged controller that
generates CycloneDX 1.6 ML-BOMs for AI workloads at runtime — as an
optional chart dependency, following the same OCI + condition
pattern as kube-prometheus-stack and prometheus-adapter.

Default is off, and even when enabled, inventory is namespace-opt-in
via a label — installing the stack changes nothing unless the
operator makes both decisions. vLLM is a natively detected runtime,
so deployments managed by this chart produce complete BOMs out of
the box: served model (declared, from --model/HF_MODEL_ID), runtime
and version (inferred from the image), and resolved image digests.

Context on maturity: the chart is digest-pinned and attested, and
ships as a qualified component in NVIDIA AI Cluster Runtime (default
in their stock GKE inference recipe since v0.20). Happy to adjust
naming, placement, or the values shape to match maintainer
preferences.

Validation: helm lint clean; helm dependency update resolves the
chart anonymously from ghcr; helm template renders k8s-aibom
resources only with --set k8s-aibom.enabled=true and is unchanged
with the default values.

[gemini-code-assist]

Code Review

This pull request adds k8s-aibom as an optional dependency to the Helm chart, allowing users to generate runtime AI inventories (CycloneDX 1.6 ML-BOM) for their workloads. It updates the Helm chart configuration, lockfile, default values, and adds documentation in README.md. Feedback suggests updating the installation example in README.md to use the release name llmstack instead of vllm-stack to maintain consistency with the rest of the documentation.

[gemini-code-assist]

For consistency with the rest of the documentation (e.g., lines 19 and 25), the release name llmstack should be used instead of vllm-stack in the installation example.

Suggested change

	helm install vllm-stack . --set k8s-aibom.enabled=true
	helm install llmstack . --set k8s-aibom.enabled=true

[ruizhang0101]

LGTM

[glenmessenger]

Pre-commit and schema checks are green after the last commit (regenerated values.schema.json with the pinned helm-schema version; fenced the README code blocks). Secure-Minimal-Example has now failed three times with the identical error — minikube unreachable (i/o timeout) during the Helm-uninstall teardown step, after the test itself: runs 36039619460, 36042053779, and 36080504447. Our change renders no resources in that scenario (k8s-aibom.enabled defaults to false), so it looks environmental rather than related to this PR. Happy to rebase or retrigger if useful.

[glenmessenger]

Bumped the pin to k8s-aibom 1.5.1 — a security patch release (details in the project's #97/#98); the delta over 1.5.0 is exactly the two fixes. Re-requesting review since my earlier force-push dismissed the approval — apologies for the churn, and thanks again for the review.

[glenmessenger]

@ruizhang0101 gentle ping on the above — the pin now points at the patched 1.5.1 and the earlier CI failures were resolved (pre-commit/schema fixed; the remaining Secure-Minimal-Example failures were the environmental minikube teardown timeouts noted earlier). Nothing else outstanding from our side.

[ruizhang0101]

Hi, we are taking a look at the CI machine issue and will try to solve the issue ASAP.

[ruizhang0101]

LGTM