{
  "format": "agent-article-v0",
  "article_id": "EA-087",
  "canonical_url": "/tools/ea-087-kubernetes-private-ai",
  "page_type": "reference",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-087-URL-D03FC373D69B",
    "EVD-EA-087-URL-953450B4076F",
    "EVD-EA-087-URL-72EE73FD95E8",
    "EVD-EA-087-URL-D7631603C516",
    "EVD-EA-087-URL-2FFF647653E4",
    "EVD-EA-087-URL-88607476C706",
    "EA-087-R11-RESEARCH",
    "EA-087-R11-WEB-READBACK"
  ],
  "unknown_ids": [
    "EA-087-UNKNOWN-01",
    "EA-087-UNKNOWN-CURRENTNESS"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "UNKNOWN",
  "observation_status": "SPEC_ONLY",
  "freshness": "UNKNOWN",
  "last_verified": null,
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "COMM-079-EA0087",
    "SRC-EA-087-URL-D03FC373D69B",
    "SRC-EA-087-URL-953450B4076F",
    "SRC-EA-087-URL-72EE73FD95E8",
    "SRC-EA-087-URL-D7631603C516",
    "SRC-EA-087-URL-2FFF647653E4",
    "SRC-EA-087-URL-88607476C706",
    "WEBBODY-EA0087-R8-399A585E"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-087-URL-D03FC373D69B",
      "evidence_class": "RESEARCH",
      "title": "1. official project docs | Schedule GPUs | Kubernetes |",
      "href": "https://kubernetes.io/docs/tasks/manage-gpus/scheduling-gpus/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-087-URL-D03FC373D69B"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "1. official project docs | Schedule GPUs | Kubernetes | https://kubernetes.io/docs/tasks/manage-gpus/scheduling-gpus/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-087-URL-953450B4076F",
      "evidence_class": "RESEARCH",
      "title": "2. official project docs | Network Policies | Kubernetes |",
      "href": "https://kubernetes.io/docs/concepts/services-networking/network-policies/",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-087-URL-953450B4076F"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "2. official project docs | Network Policies | Kubernetes | https://kubernetes.io/docs/concepts/services-networking/network-policies/"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-087-URL-72EE73FD95E8",
      "evidence_class": "RESEARCH",
      "title": "3. author-maintained release/docs | Announcing KServe v0.20 | KServe |",
      "href": "https://github.com/kserve/website/blob/main/blog/2026-08-06-KServe-0.20-release.md",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-087-URL-72EE73FD95E8"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "3. author-maintained release/docs | Announcing KServe v0.20 | KServe | https://github.com/kserve/website/blob/main/blog/2026-08-06-KServe-0.20-release.md"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-087-URL-D7631603C516",
      "evidence_class": "RESEARCH",
      "title": "4. official project docs | Runtime Overview | KServe |",
      "href": "https://kserve.github.io/website/docs/model-serving/generative-inference/overview",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-087-URL-D7631603C516"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "4. official project docs | Runtime Overview | KServe | https://kserve.github.io/website/docs/model-serving/generative-inference/overview"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-087-URL-2FFF647653E4",
      "evidence_class": "RESEARCH",
      "title": "5. official project docs | Understanding LLMInferenceService | KServe |",
      "href": "https://kserve.github.io/website/docs/model-serving/generative-inference/llmisvc/llmisvc-overview",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-087-URL-2FFF647653E4"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "5. official project docs | Understanding LLMInferenceService | KServe | https://kserve.github.io/website/docs/model-serving/generative-inference/llmisvc/llmisvc-overview"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-087-URL-88607476C706",
      "evidence_class": "RESEARCH",
      "title": "6. official project docs | KServe Administrator Guide | KServe |",
      "href": "https://kserve.github.io/website/docs/admin-guide/overview",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-087-URL-88607476C706"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "6. official project docs | KServe Administrator Guide | KServe | https://kserve.github.io/website/docs/admin-guide/overview"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-087-R11-RESEARCH",
      "evidence_class": "RESEARCH",
      "title": "EA-087 監査済みresearch / canonical revision binding",
      "supports": [
        "1. KubernetesはGPUをnative hardware abstractionだけで完結させない。administratorがvendor driverとdevice pluginを導入し、custom resourceとしてscheduleする。従って「Kubernetes対応＝GPU ready」ではない。\n2. Private AIのsecurityはcluster内だから自動的に成立しない。Kubernetes NetworkPolicyは対応CNI/pluginがなければ作成してもenforcementされず、policy不在時はpod ingress/egressが既定でnon-isolatedである。\n3. KServe v0.20は2026-08-06公開で、generative inferenceにvLLM/llm-d、LLMInferenceService、traffic splitting/canary、KV cache offload、tracing、DRA等を提供する実装例である。これはKubernetes上でLLM servingがproduction-oriented OSS stackとして成立している証拠だが、個別clusterのSLO/securityを保証しない。\n4. generative workloadはpredictive serverlessと同じdeployment profileではない。KServe admin guide自身がgenerative workloadにより高いcompute/memory、streaming、GPUを挙げ、Standard Kubernetes Deployment/Gateway APIを推奨している。\n5. Private AIの主要trade-offはdata localityだけではなく責任移転である。model image/weights、driver/CUDA等のcompatibility、Kubernetes/KServe/runtime upgrade、GPU capacity、autoscaling、network segmentation、secret/IAM、telemetry、backup、incident responseを組織側が所有する。"
      ],
      "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "COMM-079-EA0087"
      ],
      "supporting_locators": [
        "COMM-079-EA0087",
        "EA-087-R5-LEGACY-MIGRATION-20261008-R1",
        "content/staging/EA-087.md"
      ],
      "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。",
      "provenance_status": "AUDIT_PASS_CANONICAL_BINDING"
    },
    {
      "id": "EA-087-R11-WEB-READBACK",
      "evidence_class": "IMPL",
      "title": "EA-087 Web body identity / canonical readback",
      "supports": [
        "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。"
      ],
      "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。",
      "checked_at": null,
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "WEBBODY-EA0087-R8-399A585E"
      ],
      "supporting_locators": [
        "WEBBODY-EA0087-R8-399A585E",
        "content/staging/EA-087.md",
        "EA-087-R5-LEGACY-MIGRATION-20261008-R1"
      ],
      "scope": "R9/R10 canonical readback後のProduction生成時body identity。",
      "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "WHY_THIS_MATTERS_TO_UPDATE",
      "text": "Private AIは「クラウドを使わない」ことではなく、model weights、inference runtime、retrieval store、network、identity、telemetry、upgradeを組織側がより多く管理する運用形態である。Kubernetesはその共通control planeになり得るが、GPU plugin、model serving、network policy、storage、supply chain、observabilityまで責任が組織へ戻る。"
    },
    {
      "heading": "SCOPE_ROUTING",
      "text": "Enterprise AI Core / infrastructure / implementation / organization overlay / governance / security / operability / non-LLM component"
    },
    {
      "heading": "CLAIM_OR_RESEARCH_QUESTION",
      "text": "KubernetesをPrivate AIの共通substrateとして採用する際、何がplatform capabilityで、何が追加component/organization responsibilityか。KServe/vLLM等のmodel servingを含め、private deploymentを「安全・可用」と断定しないための境界は何か。"
    },
    {
      "heading": "EVIDENCE TABLE",
      "text": "1. official project docs | Schedule GPUs | Kubernetes | https://kubernetes.io/docs/tasks/manage-gpus/scheduling-gpus/ | accessed 2026-09-16 | GPU scheduling stable since Kubernetes v1.26 | locator: GPU access via device plugins; vendor drivers/device plugin must be installed by administrator; GPU custom resources exposed to pods | VERIFIED_SPEC | support + implementation limit\n2. official project docs | Network Policies | Kubernetes | https://kubernetes.io/docs/concepts/services-networking/network-policies/ | accessed 2026-09-16 | current docs | locator: NetworkPolicy requires network plugin that enforces it; without implementation resource has no effect; default pods are non-isolated absent policy | VERIFIED_SPEC | support + security limit\n3. author-maintained release/docs | Announcing KServe v0.20 | KServe | https://github.com/kserve/website/blob/main/blog/2026-08-06-KServe-0.20-release.md | published 2026-08-06 | v0.20 | locator: confidential model serving, traffic splitting, canary, KV cache offloading, distributed tracing, managed DRA | OSS_PRACTICE / PRODUCT_VOLATILE | support\n4. official project docs | Runtime Overview | KServe | https://kserve.github.io/website/docs/model-serving/generative-inference/overview | accessed 2026-09-16 | v0.20 docs | locator: Hugging Face runtime uses vLLM; supports generation, embeddings, reranking; OpenAI-compatible endpoints; continuous batching/PagedAttention etc. | OSS_PRACTICE | support\n5. official project docs | Understanding LLMInferenceService | KServe | https://kserve.github.io/website/docs/model-serving/generative-inference/llmisvc/llmisvc-overview | accessed 2026-09-16 | v0.20 | locator: Kubernetes CRD; vLLM/llm-d; intelligent routing, disaggregated prefill-decode, distributed inference, monitoring/RBAC/storage integration | OSS_PRACTICE | support + context\n6. official project docs | KServe Administrator Guide | KServe | https://kserve.github.io/website/docs/admin-guide/overview | accessed 2026-09-16 | v0.20 | locator: Standard InferenceService recommended for GPU/production; Knative/serverless mode for predictive scale-to-zero; LLMInferenceService for advanced generative workloads | OSS_PRACTICE | context + limit"
    },
    {
      "heading": "FINDINGS",
      "text": "1. KubernetesはGPUをnative hardware abstractionだけで完結させない。administratorがvendor driverとdevice pluginを導入し、custom resourceとしてscheduleする。従って「Kubernetes対応＝GPU ready」ではない。\n2. Private AIのsecurityはcluster内だから自動的に成立しない。Kubernetes NetworkPolicyは対応CNI/pluginがなければ作成してもenforcementされず、policy不在時はpod ingress/egressが既定でnon-isolatedである。\n3. KServe v0.20は2026-08-06公開で、generative inferenceにvLLM/llm-d、LLMInferenceService、traffic splitting/canary、KV cache offload、tracing、DRA等を提供する実装例である。これはKubernetes上でLLM servingがproduction-oriented OSS stackとして成立している証拠だが、個別clusterのSLO/securityを保証しない。\n4. generative workloadはpredictive serverlessと同じdeployment profileではない。KServe admin guide自身がgenerative workloadにより高いcompute/memory、streaming、GPUを挙げ、Standard Kubernetes Deployment/Gateway APIを推奨している。\n5. Private AIの主要trade-offはdata localityだけではなく責任移転である。model image/weights、driver/CUDA等のcompatibility、Kubernetes/KServe/runtime upgrade、GPU capacity、autoscaling、network segmentation、secret/IAM、telemetry、backup、incident responseを組織側が所有する。"
    },
    {
      "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE",
      "text": "- cluster内配置だけではdata residency、confidentiality、tenant isolation、egress controlの証明にならない。\n- NetworkPolicy YAMLの存在だけではenforcement証明にならない。CNI/plugin capabilityと実測が必要。\n- GPU resourceがschedule可能でもmodelがVRAMへ収まる、driver/runtime互換、期待throughputを満たすことは別問題。\n- KServe/vLLMの機能存在を任意model/hardware/backendの互換性へ一般化しない。\n- self-hostingはprovider outage依存を減らし得るが、patch lag、supply-chain、capacity shortage、operator errorを新たなfailure surfaceとして持つ。\n- OpenAI-compatible APIはsemantic/behavioral equivalenceを意味しない。"
    },
    {
      "heading": "AVAILABILITY_GATES",
      "text": "Kubernetes version / CNI and NetworkPolicy enforcement / GPU vendor-driver-device-plugin / container runtime / node OS/kernel / CUDA-ROCm-XPU等runtime / KServe version / vLLM/backend compatibility / model license and weight access / registry access / storage class / Gateway/API / observability stack / secret/KMS / air-gap level / cluster capacity。"
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "OBSERVED_EXTERNALではなくOSS_PRACTICEとして、Kubernetes GPU scheduling + KServe v0.20 generative servingを確認。PROPOSAL: `PRIVATE_AI_DEPLOYMENT_CONTRACT` をCore候補とする。fields: cluster/version, node image/kernel, accelerator/driver/plugin, model ID/revision/license/hash, inference runtime/version/image digest, serving CRD/config, quantization, replicas/parallelism, storage/weight source, ingress/gateway, authn/authz, NetworkPolicy+CNI enforcement evidence, egress policy, secrets/KMS, telemetry destinations, autoscaling/capacity, upgrade/rollback, SBOM/signature, backup/restore, SLO and incident owner。"
    },
    {
      "heading": "BENCHMARK_OR_EVAL",
      "text": "TEST_PROFILE（未実施）: single-node/multi-node、cold model load、steady concurrency、burst、node drain、pod restart、GPU loss/OOM、network partition、registry unavailable、model storage unavailable、CNI deny/allow fixture、unauthorized namespace access、upgrade/canary/rollbackを実施。TTFT、tokens/s、throughput/GPU、VRAM headroom、queue time、recovery time、failed request rate、cross-namespace unauthorized reachability、egress leakage、rollout error、cost/GPU-hour、operator toilを別軸化。"
    },
    {
      "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY",
      "text": "Security: default-deny ingress/egress、service identity/RBAC、network enforcement実測、signed image/SBOM、secret rotation、model weight accessを要求。Privacy: telemetry/log/traces/KV cache/vector DBへのdata spillを対象化。Audit: model hash、container digest、cluster config、policy、request traceを結ぶ。Cost: GPU purchase/reservation/idle、storage/network、operator/SRE、upgrade/test costを含むTCOで比較。Operability: capacity planning、driver/runtime matrix、canary、rollback、backup/restore、security patch SLAが必須。"
    },
    {
      "heading": "SAFE_WORDING_FOR_FUTURE_BOOK",
      "text": "「KubernetesはPrivate AIの共通control planeになり得、KServe等によりLLMを含むmodel servingを構成できる。ただしGPU driver/device plugin、network enforcement、model/runtime互換性、capacity、patching、observabilityは組織側の責任となる。『private』は配置場所ではなく、identity・network・data flow・supply chainを含む検証可能な運用境界として扱う。」"
    },
    {
      "heading": "UPDATE_WORK_HANDOFF",
      "text": "1. EA-088 GPU/NPU Capacity Planningへ、accelerator/driver/runtime/model compatibility matrixとthroughput/VRAM測定を引き渡す。\n2. EA-090 Air-gapped AIではregistry/model/OS/package/update経路を切断した場合のartifact promotionとpatch運用を追加採集する。\n3. KServe/vLLM exact current release、Kubernetes current supported minor、CNI実装差は公開後更新時に再pinする。\n4. managed Kubernetes/private cloud/on-premを同義にせずorganization overlayで分離する。"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "upstream vLLM exact current stable tag/commit（今回検索では派生hardware plugin情報が混在したため未固定）、Kubernetes current support window、主要CNIのNetworkPolicy feature差、KServe v0.20の各backend/hardware compatibility matrix。STOP_CONDITION: Kubernetes GPU scheduling、network enforcement boundary、KServe v0.20 generative serving、Private AI responsibility shiftが一次/author-maintained資料で確立したため初回bounded packetは完了。\n\n---"
    }
  ],
  "human_url": "/tools/ea-087-kubernetes-private-ai",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-087-kubernetes-private-ai",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-087-kubernetes-private-ai"
}