proxy

package
v0.9.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jun 23, 2026 License: Apache-2.0 Imports: 60 Imported by: 0

Documentation

Overview

Package proxy contains the disaggregated prefilling routing proxy implementation

Index

Constants

View Source
const (
	// ChatCompletionsPath is the OpenAI chat completions path
	ChatCompletionsPath = "/v1/chat/completions"

	// CompletionsPath is the legacy completions path
	CompletionsPath = "/v1/completions"

	// ResponsesPath is the OpenAI Responses API path
	ResponsesPath = "/v1/responses"

	// MessagesPath is the Anthropic Messages API path
	MessagesPath = "/v1/messages"

	// GeneratePath is vLLM's token-in generate endpoint
	GeneratePath = "/inference/v1/generate"
)
View Source
const (
	KVConnectorNIXLV2        = constants.KVConnectorNIXLV2
	KVConnectorSharedStorage = constants.KVConnectorSharedStorage
	KVConnectorSGLang        = constants.KVConnectorSGLang
	KVConnectorMooncake      = constants.KVConnectorMooncake
	ECExampleConnector       = constants.ECExampleConnector
	ECConnectorNIXL          = constants.ECConnectorNIXL
)
View Source
const (
	// MoRIIOFeatureEnabled controls whether MoRI-IO WRITE-mode and Wide-EP
	// features are available. Set to false to keep the feature dormant until
	// full validation and CI integration is complete in a future RC.
	//
	// When false, any attempt to use --moriio-write-mode or related flags will
	// fail with a clear error message directing users to wait for the feature
	// to be officially released.
	//
	// TODO(AMD-MoRI-IO): Set to true once CI tests and production validation
	// are complete in a future release candidate.
	MoRIIOFeatureEnabled = false
)

Variables

This section is empty.

Functions

func CreateSelfSignedTLSCertificate

func CreateSelfSignedTLSCertificate() (tls.Certificate, error)

CreateSelfSignedTLSCertificate creates a self-signed cert the server can use to serve TLS. Original code: https://github.com/kubernetes-sigs/gateway-api-inference-extension/blob/8d01161ec48d6b49cd371f179551b35da46e6fd6/internal/tls/tls.go

Types

type APIType

type APIType int

APIType represents the type of OpenAI API being used.

const (
	// APITypeChatCompletions is the Chat Completions API (/v1/chat/completions, /v1/completions)
	APITypeChatCompletions APIType = iota
	// APITypeResponses is the Responses API (/v1/responses)
	APITypeResponses
	// APITypeGenerate is vLLM's token-in generate API (/inference/v1/generate)
	APITypeGenerate
)

func (APIType) String

func (a APIType) String() string

String implements fmt.Stringer so structured logs show readable API names.

type AllowlistValidator

type AllowlistValidator struct {
	// contains filtered or unexported fields
}

AllowlistValidator manages allowed prefill targets based on InferencePool resources

func NewAllowlistValidator

func NewAllowlistValidator(enabled bool, poolGroup, namespace, poolName string) (*AllowlistValidator, error)

NewAllowlistValidator creates a new SSRF protection validator

func (*AllowlistValidator) IsAllowed

func (av *AllowlistValidator) IsAllowed(hostPort string) bool

IsAllowed checks if a given host:port combination is in the allowlist

func (*AllowlistValidator) Start

func (av *AllowlistValidator) Start(ctx context.Context) error

Start begins watching InferencePool resources and managing the allowlist

func (*AllowlistValidator) Stop

func (av *AllowlistValidator) Stop()

Stop stops all watchers and cleans up resources

type Config

type Config struct {
	// Port is the port the sidecar is listening on.
	Port string
	// DecoderURL is the URL of the local decoder (vLLM) instance.
	DecoderURL *url.URL

	// KVConnector is the name of the KV protocol between prefiller and decoder.
	KVConnector string
	// ECConnector is the name of the EC protocol between encoder and prefiller (for EPD mode).
	// If empty, encoder stage is skipped.
	ECConnector string
	// DataParallelSize is the value passed to the vLLM server's --DATA_PARALLEL-SIZE argument.
	DataParallelSize int

	// MaxIdleConnsPerHost controls how many idle keep-alive connections are
	// maintained per host for the reverse proxy transports. Set this to at
	// least the expected concurrency level to avoid connection churn.
	MaxIdleConnsPerHost int

	// EnablePrefillerSampling configures the proxy to randomly choose from the set
	// of provided prefill hosts instead of always using the first one.
	EnablePrefillerSampling bool

	// PrefillMaxRetries is the number of additional attempts when a prefill
	// request fails with a 5xx error (e.g. connection reset → 502).
	// 0 means no retries (original behavior).
	PrefillMaxRetries int
	// PrefillRetryBackoff is the delay between prefill retry attempts.
	PrefillRetryBackoff time.Duration

	// UseTLSForPrefiller indicates whether to use TLS when sending requests to prefillers.
	UseTLSForPrefiller bool
	// UseTLSForDecoder indicates whether to use TLS when sending requests to the decoder.
	UseTLSForDecoder bool
	// UseTLSForEncoder indicates whether to use TLS when sending requests to encoders.
	UseTLSForEncoder bool
	// InsecureSkipVerifyForPrefiller configures the proxy to skip TLS verification for requests to the prefiller.
	InsecureSkipVerifyForPrefiller bool
	// InsecureSkipVerifyForEncoder configures the proxy to skip TLS verification for requests to the encoder.
	InsecureSkipVerifyForEncoder bool
	// InsecureSkipVerifyForDecoder configures the proxy to skip TLS verification for requests to the decoder.
	InsecureSkipVerifyForDecoder bool

	// SecureServing enables TLS for the sidecar server itself.
	SecureServing bool
	// CertPath is the path to TLS certificates for the sidecar server.
	CertPath string

	// MooncakeBootstrapPort is the port used to query the Mooncake bootstrap endpoint on prefill pods.
	MooncakeBootstrapPort int

	// EnableSSRFProtection enables SSRF protection using InferencePool allowlisting.
	EnableSSRFProtection bool
	// InferencePoolNamespace is the Kubernetes namespace of the InferencePool to watch.
	InferencePoolNamespace string
	// InferencePoolName is the name of the InferencePool to watch.
	InferencePoolName string
	// PoolGroup is the API group of the InferencePool resource.
	PoolGroup string

	// DecodeChunkSize is the token budget per decode chunk.
	// Chunked decode is enabled when this value is > 0.
	DecodeChunkSize int

	// Tracing enables OpenTelemetry tracing.
	Tracing bool
	// MoRIIOWriteMode enables MoRI-IO WRITE-mode: the sidecar populates the
	// prefill leg's kv_transfer_params so the prefill engine pushes KV to decode
	// via RDMA Write. Only meaningful with --kv-connector=nixlv2.
	MoRIIOWriteMode bool
	// MoRIIODecodeNotifyPort is the decode pod's base MoRI-IO notify port.
	MoRIIODecodeNotifyPort int
	// MoRIIODecodeHandshakePort is the decode pod's base MoRI-IO handshake port.
	MoRIIODecodeHandshakePort int
	// MoRIIODecodePodIP is decode's routable pod IP, used as the prefill leg's
	// remote_host so prefill handshakes with decode (not itself). Must not be
	// localhost; typically the POD_IP downward-API value.
	MoRIIODecodePodIP string

	// MoRIIOParallelDispatch fires the prefill and decode legs concurrently,
	// synthesising decode's kv_transfer_params from config instead of reading
	// them from the prefill response. Requires MoRIIOWriteMode.
	MoRIIOParallelDispatch bool
	// MoRIIOPrefillHandshakePort is the prefill pod's base MoRI-IO handshake port.
	MoRIIOPrefillHandshakePort int
	// MoRIIOPrefillNotifyPort is the prefill pod's base MoRI-IO notify port.
	MoRIIOPrefillNotifyPort int
	// MoRIIOTPSize is the tensor-parallel size of the engines, echoed into
	// kv_transfer_params[tp_size] in parallel-dispatch mode.
	MoRIIOTPSize int
	// MoRIIODPSize is the data-parallel world size, emitted as remote_dp_size on
	// both legs. Wide-EP (TP=1, DP>1) must set this so the decode connector
	// registers RDMA notifies against every DP rank; 1 leaves the wire unchanged.
	MoRIIODPSize int

	// MoRIIORemoteHosts is the ordered list of prefill-side pod IPs across which
	// vLLM fans out its per-DP-rank handshake, emitted as the decode leg's
	// remote_hosts. host[i] serves DP ranks [i*MoRIIODPSizeLocal, (i+1)*...).
	// Empty disables fan-out (single-host fallback).
	MoRIIORemoteHosts []string
	// MoRIIODPSizeLocal is the per-pod DP size, mapping a global DP rank to a pod
	// via pod_idx = dp_rank / MoRIIODPSizeLocal. 0 means single-pod.
	MoRIIODPSizeLocal int
	// MoRIIODecodeHosts is the decode-side counterpart of MoRIIORemoteHosts,
	// emitted as the prefill leg's remote_hosts. A multi-pod deployment sets
	// both; the lists must use opposite sides or every cross-pod handshake hangs.
	MoRIIODecodeHosts []string
}

Config represents the complete runtime configuration for the proxy server.

func (Config) MarshalJSON

func (c Config) MarshalJSON() ([]byte, error)

MarshalJSON implements json.Marshaler for Config. It overrides the default marshaling of DecoderURL (*url.URL) to serialize it as a string.

func (Config) String

func (c Config) String() string

String returns a JSON representation of Config for logging and debugging. It implements fmt.Stringer.

type Options

type Options struct {
	// Config holds the processed runtime configuration (populated by Complete()).
	// Fields with direct CLI flags are bound here via embedding; derived fields are set in Complete().
	Config
	// contains filtered or unexported fields
}

Options holds the CLI-facing configuration for the pd-sidecar proxy. It embeds Config which represents the complete processed runtime configuration. After Options.Complete(), the embedded Config is fully populated and ready to pass directly to NewProxy.

func NewOptions

func NewOptions() *Options

NewOptions returns a new Options struct initialized with default values.

func (*Options) AddFlags

func (opts *Options) AddFlags(fs *pflag.FlagSet)

AddFlags binds the Options fields to command-line flags on the given FlagSet. It also sets up zap logging flags and integrates Go flags with pflag.

func (*Options) Complete

func (opts *Options) Complete() error

Complete performs post-processing of parsed command-line arguments. It extracts YAML configuration (if provided), handles migration from deprecated flags, parses the InferencePool field, computes boolean TLS fields, and builds Config.DecoderURL. After Complete(), opts.Config is fully populated.

func (*Options) NewLogger

func (opts *Options) NewLogger() logr.Logger

NewLogger returns a logger configured from the Options logging flags, with a custom level encoder that maps verbosity levels to their semantic names instead of always rendering V(n) as "debug".

func (*Options) Validate

func (opts *Options) Validate() error

Validate checks the Options for invalid or conflicting values. Complete must be called before Validate.

type Server

type Server struct {
	// contains filtered or unexported fields
}

Server is the reverse proxy server

func NewProxy

func NewProxy(config Config) *Server

NewProxy creates a new routing reverse proxy from the given Config.

func (*Server) Clone

func (s *Server) Clone() *Server

Clone returns a clone of the current Server struct. Note: decoderURL and decoderProxy are intentionally not copied — callers (e.g. startDataParallel) always set them explicitly after cloning.

func (*Server) Start

func (s *Server) Start(ctx context.Context) error

Start the HTTP reverse proxy. allowlistValidator is constructed from s.config on first call; inject an alternative before calling Start to override.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL