|
| 1 | +/* |
| 2 | +Copyright 2025 The llm-d Authors. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | +package main |
| 17 | + |
| 18 | +import ( |
| 19 | + "flag" |
| 20 | + "net/url" |
| 21 | + "os" |
| 22 | + |
| 23 | + "k8s.io/klog/v2" |
| 24 | + ctrl "sigs.k8s.io/controller-runtime" |
| 25 | + |
| 26 | + "github.com/llm-d/llm-d-inference-scheduler/pkg/sidecar/proxy" |
| 27 | + "github.com/llm-d/llm-d-inference-scheduler/pkg/sidecar/version" |
| 28 | +) |
| 29 | + |
| 30 | +func main() { |
| 31 | + port := flag.String("port", "8000", "the port the sidecar is listening on") |
| 32 | + vLLMPort := flag.String("vllm-port", "8001", "the port vLLM is listening on") |
| 33 | + connector := flag.String("connector", "nixlv2", "the P/D connector being used. Either nixl, nixlv2 or lmcache") |
| 34 | + prefillerUseTLS := flag.Bool("prefiller-use-tls", false, "whether to use TLS when sending requests to prefillers") |
| 35 | + decoderUseTLS := flag.Bool("decoder-use-tls", false, "whether to use TLS when sending requests to the decoder") |
| 36 | + prefillerInsecureSkipVerify := flag.Bool("prefiller-tls-insecure-skip-verify", false, "configures the proxy to skip TLS verification for requests to prefiller") |
| 37 | + decoderInsecureSkipVerify := flag.Bool("decoder-tls-insecure-skip-verify", false, "configures the proxy to skip TLS verification for requests to decoder") |
| 38 | + secureProxy := flag.Bool("secure-proxy", true, "Enables secure proxy. Defaults to true.") |
| 39 | + certPath := flag.String( |
| 40 | + "cert-path", "", "The path to the certificate for secure proxy. The certificate and private key files "+ |
| 41 | + "are assumed to be named tls.crt and tls.key, respectively. If not set, and secureProxy is enabled, "+ |
| 42 | + "then a self-signed certificate is used (for testing).") |
| 43 | + enableSSRFProtection := flag.Bool("enable-ssrf-protection", false, "enable SSRF protection using InferencePool allowlisting") |
| 44 | + inferencePoolNamespace := flag.String("inference-pool-namespace", os.Getenv("INFERENCE_POOL_NAMESPACE"), "the Kubernetes namespace to watch for InferencePool resources (defaults to INFERENCE_POOL_NAMESPACE env var)") |
| 45 | + inferencePoolName := flag.String("inference-pool-name", os.Getenv("INFERENCE_POOL_NAME"), "the specific InferencePool name to watch (defaults to INFERENCE_POOL_NAME env var)") |
| 46 | + |
| 47 | + klog.InitFlags(nil) |
| 48 | + flag.Parse() |
| 49 | + |
| 50 | + // make sure to flush logs before exiting |
| 51 | + defer klog.Flush() |
| 52 | + |
| 53 | + ctx := ctrl.SetupSignalHandler() |
| 54 | + logger := klog.FromContext(ctx) |
| 55 | + |
| 56 | + logger.Info("Proxy starting", "Built on", version.BuildRef, "From Git SHA", version.CommitSHA) |
| 57 | + |
| 58 | + if *connector != proxy.ConnectorNIXLV2 && *connector != proxy.ConnectorLMCache { |
| 59 | + logger.Info("Error: --connector must either be 'nixlv2' or 'lmcache'") |
| 60 | + return |
| 61 | + } |
| 62 | + logger.Info("p/d connector validated", "connector", connector) |
| 63 | + |
| 64 | + // Determine namespace and pool name for SSRF protection |
| 65 | + if *enableSSRFProtection { |
| 66 | + if *inferencePoolNamespace == "" { |
| 67 | + logger.Info("Error: --inference-pool-namespace or INFERENCE_POOL_NAMESPACE environment variable is required when --enable-ssrf-protection is true") |
| 68 | + return |
| 69 | + } |
| 70 | + if *inferencePoolName == "" { |
| 71 | + logger.Info("Error: --inference-pool-name or INFERENCE_POOL_NAME environment variable is required when --enable-ssrf-protection is true") |
| 72 | + return |
| 73 | + } |
| 74 | + |
| 75 | + logger.Info("SSRF protection enabled", "namespace", inferencePoolNamespace, "poolName", inferencePoolName) |
| 76 | + } |
| 77 | + |
| 78 | + // start reverse proxy HTTP server |
| 79 | + scheme := "http" |
| 80 | + if *decoderUseTLS { |
| 81 | + scheme = "https" |
| 82 | + } |
| 83 | + targetURL, err := url.Parse(scheme + "://localhost:" + *vLLMPort) |
| 84 | + if err != nil { |
| 85 | + logger.Error(err, "failed to create targetURL") |
| 86 | + return |
| 87 | + } |
| 88 | + |
| 89 | + config := proxy.Config{ |
| 90 | + Connector: *connector, |
| 91 | + PrefillerUseTLS: *prefillerUseTLS, |
| 92 | + SecureProxy: *secureProxy, |
| 93 | + CertPath: *certPath, |
| 94 | + PrefillerInsecureSkipVerify: *prefillerInsecureSkipVerify, |
| 95 | + DecoderInsecureSkipVerify: *decoderInsecureSkipVerify, |
| 96 | + EnableSSRFProtection: *enableSSRFProtection, |
| 97 | + InferencePoolNamespace: *inferencePoolNamespace, |
| 98 | + InferencePoolName: *inferencePoolName, |
| 99 | + } |
| 100 | + |
| 101 | + proxy, err := proxy.NewProxy(*port, targetURL, config) |
| 102 | + if err != nil { |
| 103 | + logger.Error(err, "Failed to create proxy") |
| 104 | + } |
| 105 | + if err := proxy.Start(ctx); err != nil { |
| 106 | + logger.Error(err, "failed to start proxy server") |
| 107 | + } |
| 108 | +} |
0 commit comments