Sync upstream to odh march 18

.github/actions/docker-build-and-push/action.yml

@@ -27,7 +27,7 @@ runs:
   using: "composite"
   steps:
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
 
     - name: Login to GitHub Container Registry
       run: echo "${{ inputs.github-token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin

.github/actions/trivy-scan/action.yml

@@ -1,19 +1,17 @@
 name: Trivy Scan
-description: Scan container image with Trivy
+description: Scan container image with official Aqua Security Trivy action
 inputs:
   image:
     required: true
+    description: "Image to scan (e.g., 'my-repo/my-image:latest')"
+
 runs:
   using: "composite"
   steps:
-    - name: Install Trivy
-      run: |
-        wget https://github.com/aquasecurity/trivy/releases/download/v0.44.1/trivy_0.44.1_Linux-64bit.deb
-        sudo dpkg -i trivy_0.44.1_Linux-64bit.deb
-      shell: bash
-
-
-    - name: Scan image
-      run: |
-        trivy image --severity HIGH,CRITICAL --no-progress ${{ inputs.image }}
-      shell: bash
+    - name: Run Trivy vulnerability scanner
+      uses: aquasecurity/trivy-action@0.35.0
+      with:
+        image-ref: ${{ inputs.image }}
+        format: 'table'
+        severity: 'HIGH,CRITICAL'
+        exit-code: '1'

.github/dependabot.yml

@@ -24,9 +24,9 @@ updates:
         update-types: ["version-update:semver-major", "version-update:semver-minor"]
       - dependency-name: "sigs.k8s.io/*"
         update-types: ["version-update:semver-major", "version-update:semver-minor"]
-      # Ignore major updates for all packages
+      # Ignore major updates for all Go packages
       - dependency-name: "*"
-        update-types: ["version-update:semver-major"]        
+        update-types: ["version-update:semver-major"]
     groups:
       go-dependencies:
         patterns:
@@ -46,8 +46,13 @@ updates:
       - "release-note-none"
     commit-message:
       prefix: "deps(actions)"
+    # No "ignore" block here: This allows major version updates
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
-  # 3. Docker base image updates (e.g., for Dockerfile FROM lines)
+  # 3. Docker base image updates
   - package-ecosystem: "docker"
     directory: "/"
     schedule:

.github/workflows/check-typos.yaml

@@ -13,5 +13,5 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Check typos
-        uses: crate-ci/typos@v1.43.5
+        uses: crate-ci/typos@v1.44.0
 

.github/workflows/ci-build-images.yaml

@@ -0,0 +1,62 @@
+name: Build and Push Container Images
+
+on:
+  workflow_call:
+    inputs:
+      epp-image-name:
+        required: true
+        type: string
+      sidecar-image-name:
+        required: true
+        type: string
+      tag:
+        required: true
+        type: string
+      prerelease:
+        required: true
+        type: string
+    secrets:
+      GHCR_TOKEN:
+        required: true
+
+jobs:
+  docker-build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Free Disk Space (Ubuntu)
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: false
+
+      - name: Checkout source
+        uses: actions/checkout@v6
+
+      - name: Build and push EPP image
+        uses: ./.github/actions/docker-build-and-push
+        with:
+          docker-file: Dockerfile.epp
+          tag: ${{ inputs.tag }}
+          image-name: ${{ inputs.epp-image-name }}
+          registry: ghcr.io/llm-d
+          github-token: ${{ secrets.GHCR_TOKEN }}
+          prerelease: ${{ inputs.prerelease }}
+
+      - name: Build and push sidecar image
+        uses: ./.github/actions/docker-build-and-push
+        with:
+          docker-file: Dockerfile.sidecar
+          tag: ${{ inputs.tag }}
+          image-name: ${{ inputs.sidecar-image-name }}
+          registry: ghcr.io/llm-d
+          github-token: ${{ secrets.GHCR_TOKEN }}
+          prerelease: ${{ inputs.prerelease }}
+
+      - name: Run Trivy scan on EPP image
+        uses: ./.github/actions/trivy-scan
+        with:
+          image: ghcr.io/llm-d/${{ inputs.epp-image-name }}:${{ inputs.tag }}
+
+      - name: Run Trivy scan on sidecar image
+        uses: ./.github/actions/trivy-scan
+        with:
+          image: ghcr.io/llm-d/${{ inputs.sidecar-image-name }}:${{ inputs.tag }}

.github/workflows/ci-dev.yaml

@@ -0,0 +1,39 @@
+name: CI - Dev - Docker Container Image
+
+on:
+  push:
+    branches:
+      - main
+      - 'release-*'
+  workflow_dispatch:
+
+jobs:
+  set-params:
+    runs-on: ubuntu-latest
+    outputs:
+      project_name: ${{ steps.version.outputs.project_name }}
+      sidecar_name: ${{ steps.version.outputs.sidecar_name }}
+      tag: ${{ steps.tag.outputs.tag }}
+    steps:
+      - name: Set image names
+        id: version
+        run: |
+          repo="${GITHUB_REPOSITORY##*/}"
+          echo "project_name=${repo}-dev" >> "$GITHUB_OUTPUT"
+          echo "sidecar_name=llm-d-routing-sidecar-dev" >> "$GITHUB_OUTPUT"
+
+      - name: Set branch name as tag
+        id: tag
+        run: |
+          echo "tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+
+  build-and-push:
+    needs: set-params
+    uses: ./.github/workflows/ci-build-images.yaml
+    with:
+      epp-image-name: ${{ needs.set-params.outputs.project_name }}
+      sidecar-image-name: ${{ needs.set-params.outputs.sidecar_name }}
+      tag: ${{ needs.set-params.outputs.tag }}
+      prerelease: "true"
+    secrets:
+      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}

.github/workflows/ci-pr-checks.yaml

@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Checkout source
         uses: actions/checkout@v6
-      - uses: dorny/paths-filter@v3
+      - uses: dorny/paths-filter@v4
         id: filter
         with:
           filters: |
@@ -52,25 +52,15 @@ jobs:
           go-version: "${{ env.GO_VERSION }}"
           cache-dependency-path: ./go.sum
 
-      - name: Configure CGO for ZMQ
-        run: |
-          echo "CGO_ENABLED=1" >> $GITHUB_ENV
-          echo "PKG_CONFIG_PATH=/usr/lib/pkgconfig" >> $GITHUB_ENV
-
       - name: Install dependencies
-        run: |
-          go mod tidy
-          sudo -E env "PATH=$PATH" make install-dependencies
+        run: go mod tidy
 
       - name: Run lint checks
         uses: golangci/golangci-lint-action@v9
         with:
           version: "v2.8.0"
           args: "--config=./.golangci.yml"
           skip-cache: true
-        env:
-          CGO_ENABLED: ${{ env.CGO_ENABLED }}
-          PKG_CONFIG_PATH: ${{ env.PKG_CONFIG_PATH }}
 
       - name: Run make build
         shell: bash

.github/workflows/ci-release.yaml

@@ -8,27 +8,21 @@ on:
     types: [published]  # Also runs when a GitHub release is published
 
 jobs:
-  docker-build-and-push:
+  set-params:
     runs-on: ubuntu-latest
+    outputs:
+      project_name: ${{ steps.version.outputs.project_name }}
+      sidecar_name: ${{ steps.version.outputs.sidecar_name }}
+      tag: ${{ steps.tag.outputs.tag }}
+      prerelease: ${{ steps.tag.outputs.prerelease }}
     steps:
-      - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
-        with:
-          tool-cache: false
-
-      - name: Checkout source
-        uses: actions/checkout@v6
-
       - name: Set image names
         id: version
         run: |
           repo="${GITHUB_REPOSITORY##*/}"
           echo "project_name=$repo" >> "$GITHUB_OUTPUT"
           echo "sidecar_name=llm-d-routing-sidecar" >> "$GITHUB_OUTPUT"
 
-      - name: Print project name
-        run: echo "Project is ${{ steps.version.outputs.project_name }}"
-
       - name: Determine tag name
         id: tag
         run: |
@@ -43,32 +37,13 @@ jobs:
           echo "prerelease=${PRE_RELEASE}" >> "$GITHUB_OUTPUT"
         shell: bash
 
-      - name: Build and push EPP image
-        uses: ./.github/actions/docker-build-and-push
-        with:
-          docker-file: Dockerfile.epp
-          tag: ${{ steps.tag.outputs.tag }}
-          image-name: ${{ steps.version.outputs.project_name }}
-          registry: ghcr.io/llm-d
-          github-token: ${{ secrets.GHCR_TOKEN }}
-          prerelease: ${{ steps.tag.outputs.prerelease }}
-
-      - name: Build and push sidecar image
-        uses: ./.github/actions/docker-build-and-push
-        with:
-          docker-file: Dockerfile.sidecar
-          tag: ${{ steps.tag.outputs.tag }}
-          image-name: ${{ steps.version.outputs.sidecar_name }}
-          registry: ghcr.io/llm-d
-          github-token: ${{ secrets.GHCR_TOKEN }}
-          prerelease: ${{ steps.tag.outputs.prerelease }}
-
-      - name: Run Trivy scan on EPP image
-        uses: ./.github/actions/trivy-scan
-        with:
-          image: ghcr.io/llm-d/${{ steps.version.outputs.project_name }}:${{ steps.tag.outputs.tag }}
-
-      - name: Run Trivy scan on sidecar image
-        uses: ./.github/actions/trivy-scan
-        with:
-          image: ghcr.io/llm-d/${{ steps.version.outputs.sidecar_name }}:${{ steps.tag.outputs.tag }}
+  build-and-push:
+    needs: set-params
+    uses: ./.github/workflows/ci-build-images.yaml
+    with:
+      epp-image-name: ${{ needs.set-params.outputs.project_name }}
+      sidecar-image-name: ${{ needs.set-params.outputs.sidecar_name }}
+      tag: ${{ needs.set-params.outputs.tag }}
+      prerelease: ${{ needs.set-params.outputs.prerelease }}
+    secrets:
+      GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}

.github/workflows/md-link-check.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Run lychee link checker
-        uses: lycheeverse/lychee-action@v2.7.0
+        uses: lycheeverse/lychee-action@v2.8.0
         with:
           args: '--config .lychee.toml --verbose --no-progress **/*.md'
           fail: true

DEVELOPMENT.md

@@ -8,16 +8,20 @@ Documentation for developing the inference scheduler.
 - [Golang] `v1.24`+
 - [Docker] (or [Podman])
 - [Kubernetes in Docker (KIND)]
-- [Kustomize]
-- [ZeroMQ]
+- [Kubectl] `v1.14`+
 
 [Make]:https://www.gnu.org/software/make/
 [Golang]:https://go.dev/
 [Docker]:https://www.docker.com/
 [Podman]:https://podman.io/
 [Kubernetes in Docker (KIND)]:https://github.com/kubernetes-sigs/kind
-[Kustomize]:https://kubectl.docs.kubernetes.io/installation/kustomize/
-[ZeroMQ]:https://zeromq.org/
+[Kubectl]:https://kubectl.docs.kubernetes.io/installation/kubectl/
+
+> [!NOTE]
+> Before committing and pushing changes to an upstream repository, you may want to 
+> explicitly run the `make presubmit` target to avoid failing PR checks. The checks
+> are also performed as part of a GitHub action, but running locally can save time
+> and an iteration.
 
 > [!NOTE]
 > **Python is NOT required** as of v0.5.1. Tokenization is handled by a separate UDS (Unix Domain Socket) tokenizer sidecar container. Previous versions (< v0.5.1) used embedded Python tokenizers with daulet/tokenizers bindings, but these are now deprecated.
@@ -59,30 +63,30 @@ There are several ways to access the gateway:
 **Port forward**:
 
 ```bash
-$ kubectl --context llm-d-inference-scheduler-dev port-forward service/inference-gateway 8080:80
+kubectl --context kind-llm-d-inference-scheduler-dev port-forward service/inference-gateway-istio 8080:80
 ```
 
 **NodePort**
 
 ```bash
 # Determine the k8s node address
-$ kubectl --context llm-d-inference-scheduler-dev get node -o yaml | grep address
+kubectl --context kind-llm-d-inference-scheduler-dev get node -o yaml | grep address
 # The service is accessible over port 80 of the worker IP address.
 ```
 
 **LoadBalancer**
 
 ```bash
 # Install and run cloud-provider-kind:
-$ go install sigs.k8s.io/cloud-provider-kind@latest && cloud-provider-kind &
-$ kubectl --context llm-d-inference-scheduler-dev get service inference-gateway
+go install sigs.k8s.io/cloud-provider-kind@latest && cloud-provider-kind &
+kubectl --context kind-llm-d-inference-scheduler-dev get service inference-gateway-istio
 # Wait for the LoadBalancer External-IP to become available. The service is accessible over port 80.
 ```
 
 You can now make requests matching the IP:port of one of the access mode above:
 
 ```bash
-$ curl -s -w '\n' http://<IP:port>/v1/completions -H 'Content-Type: application/json' -d '{"model":"food-review","prompt":"hi","max_tokens":10,"temperature":0}' | jq
+curl -s -w '\n' http://<IP:port>/v1/completions -H 'Content-Type: application/json' -d '{"model":"food-review","prompt":"hi","max_tokens":10,"temperature":0}' | jq
 ```
 
 By default the created inference gateway, can be accessed on port 30080. This can