From e6ee2f1479fd5279afa5bc23a28416358280e39c Mon Sep 17 00:00:00 2001
From: blik616287 <mforde84@gmail.com>
Date: Thu, 11 Jun 2026 23:18:44 +0000
Subject: [PATCH 1/3] Add nvidia-vss-vllm 1.0.0 (upstream VSS 2.4.1)

Validated on NVIDIA GB10 / DGX Spark. Pack 1.0.0 / appVersion 2.4.1.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 packs/nvidia-vss-vllm-1.0.0/README.md         |  21 +++
 packs/nvidia-vss-vllm-1.0.0/logo.png          | Bin 0 -> 7892 bytes
 .../manifests/llm-vllm.yaml                   | 129 ++++++++++++++++++
 packs/nvidia-vss-vllm-1.0.0/pack.json         |  31 +++++
 packs/nvidia-vss-vllm-1.0.0/presets.yaml      | 124 +++++++++++++++++
 packs/nvidia-vss-vllm-1.0.0/schema.yaml       |  16 +++
 packs/nvidia-vss-vllm-1.0.0/values.yaml       |  68 +++++++++
 7 files changed, 389 insertions(+)
 create mode 100644 packs/nvidia-vss-vllm-1.0.0/README.md
 create mode 100644 packs/nvidia-vss-vllm-1.0.0/logo.png
 create mode 100644 packs/nvidia-vss-vllm-1.0.0/manifests/llm-vllm.yaml
 create mode 100644 packs/nvidia-vss-vllm-1.0.0/pack.json
 create mode 100644 packs/nvidia-vss-vllm-1.0.0/presets.yaml
 create mode 100644 packs/nvidia-vss-vllm-1.0.0/schema.yaml
 create mode 100644 packs/nvidia-vss-vllm-1.0.0/values.yaml

diff --git a/packs/nvidia-vss-vllm-1.0.0/README.md b/packs/nvidia-vss-vllm-1.0.0/README.md
new file mode 100644
index 00000000..7235671b
--- /dev/null
+++ b/packs/nvidia-vss-vllm-1.0.0/README.md
@@ -0,0 +1,21 @@
+# NVIDIA VSS LLM (vLLM)
+
+The bounded raw vLLM LLM backend for NVIDIA VSS on platforms where the TensorRT-LLM NIM is unsupported (DGX Spark / GB10 sm_121). Serves the OpenAI API as `llm-nim-svc:8000` for the CA-RAG pipeline. Part of the upstream **VSS 2.4.1** blueprint.
+
+## Prerequisites
+
+- An NGC API key (the vLLM image is `nvcr.io/nvidia/vllm`).
+- A GPU node (validated on NVIDIA GB10 / DGX Spark).
+
+## Parameters
+
+| **Parameter** | **Description** | **Type** | **Default** | **Required** |
+|---|---|---|---|---|
+| `spectro.var.VSS_PLATFORM` | Hardware platform preset | String | `DGX-SPARK` | No |
+
+## Usage
+
+Add to vLLM-backed VSS profiles at install-priority 12 (after `nvidia-vss-core-nims`). Omit on trtllm profiles (H100/L40S) which use the NIM-LLM subchart instead.
+
+---
+**Upstream:** NVIDIA VSS Blueprint 2.4.1 (`vllm:25.12.post1-py3`). **Pack version:** 1.0.x.
diff --git a/packs/nvidia-vss-vllm-1.0.0/logo.png b/packs/nvidia-vss-vllm-1.0.0/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..a98c78690812d65f46914a8f9319c7ed2a32fefe
GIT binary patch
literal 7892
zcmc(EWmFv97G*a90u2PW0HK2f_XKIQgS!Ws;O^2i(l`wPf<th3OMu`Z2@%|ayG!E`
z+#w8k@0<5#{?1x6b8Fq&r%vs=&pB1K*1c8rRzppm0Q49H000OS6=byTvHNew!M@*D
z>R0951EvjB6$${<#NpkTVcj2tEflm=0RW$806<VE0C08h3fcq!Ja_?sZBqaMk_G@!
zx@LXW6uUnWYNfAet*Q!OzqfG!SU?iMgL?~jzX5=c0e{u*Er1e`=0CO;ko6x91^^Il
z2f+M?V{nguTl{_hJLcc`AP@Lo#XOAvu)Fgf{MY_F?5)MzU%+)$fVl$z6wH4+P*IEN
z;9d=8r=yS1S5<*nxHxf}S-O~8aeF(t{-p!Nydn3dlNG`Y?Cs>}><;l3XZRNba&P~2
z^Duz_ML{@-Gw7>ofTdmFR$xJHUT$6n2@n_z7K2+_L$qY%{uzFMB+g)qK)6D9c)Yy4
zxV;3pUEnr6d?F$uJiPoo{QO+^3@&%1Gs4W9%h{dr-y;80N5;zC0&eGuuyb(+|J5}!
zckw`oGcf!O^q=<cJP~%*|BdAA{!dx=1@ino!^6kT%kv-Y`=Mfgy%2S{oz;Ehzxon<
zV*g_PZ@z!xi1GXl{=X#i?@IsWy)RV)B*ycf%O(M$HeP-R0MP0x%0P9zfqO>t@Hsh8
z=lC&o&M#sWVnI@pQqRvkYB6=!8d@m%)*k97ex9X?f`47mvF~HjZSI~ie%t$NL9vKl
zszAH^qFRae)o&|y!n|N((~io9maC^WNB&gLryl@gu(1WQaz{I)PX@O}W2&za=XTF|
zmEMwKVgjL3L`45zfyy59Ykt*ygwF4GE@QPvV|&Eqzkj@+&e0Oh{a(pU@O23U%BqkG
ziy*@6qyTEh*Ekt8*RT^2VU=UZCh#@lM4+ObMtfs)gM(NV$XO$!Yh<O!EFCjnIe!3Q
z%0MfmG%cgKFbcpHv-NNbT`(A=g%!zQ;YgfDJuAAi8gsid+3V7v+ag}bU6zue>(mgq
zS>9)?yvGvNp^ctND&_VL-~O7RMLDZ<Df~@C{YcSUn3xEw$1XM5x5D%6LxnVuV(RB~
zb3W}0>*JwWxAxFLuRj;D1{PWGulKwX68oWYL1H>o^i0m(_ZchN5wUlayW0~h;u$=3
z)lFk#ch9}k+JjPUQM?JbX#jm(FhY?GJlzyfo9kf&gGid7samc&)f&`>8JAJ#IuHDq
zv|(jMD{4f+Z}o_#NTCi&Mjep1O2k~*Y9GZ53L0wjoE<6$KD?AYRR3)JPCuX?p4Lut
zhko5KbT&3Vg}sT3(LIG($@1o=%a>iHGnwG-%%K6TTCR&e@9PyV_bc?9^Ist=>WZak
zoYluxEf=TSjw5{i@o7%Q?Py>rw*|IRAbq>`wSMKES<_DbMmc?65~0O)p=+Sgv}VJo
z`gmkUXS5JgU3Q;p1nN^BqE)PzEF}9&apN$xmx-9}EKRD(Lg$)OvbPy~Xu<Om!f^`g
zbU97i0w?P?Ms?-3jQO@_!N*Z3d|LQ9hMfhi+WT<^Wwrs5ywi|Udmd%B{>MogL;}8~
z!KZ@@ny;;kqV87r$JWXlKLd>y-`o{>%RtpYNag15cdvd)wAFUO_;_EJNqg*EYBwww
zkXa9lvqw;no6AjQK_aY^HRRWgns*_mDwSrJo-g9gi$>&O(2u7Q0l(kvk8iuHi@Rz)
zVwY2{l)O{?6>yegz)?X<Ua(R4#9>PFOB?~_Zv&C$7-YlU<rn+nwQ|Dvr-)uAl>waS
zal!rX{)Ov=wwz70DYWAKR0EqS7Fn{5s;oWRI?6`ydED!j)a`|?#R_rt@-JYCbV@xS
zhDAQuuiNX2yul~$W83PIsmZQN(-`^WKq?E#(acoGOxvCRK^VF#u{7-Bag_wBsKA+`
zu7|NdY$vzn_J{(W@sVdiv)*Rm26IsTqv31S)r3#xIHn(|oz92Pw|}Lle2)5Z;J)9k
zt<L+!@NU<rA)znxXWpO&RE;kC`=gEnH-*Cm`UPD*{#sV{1N;GZ<mfiT5f|7bz9W-(
zk&{1Dqw~98WtFPBEVf@*_fOflS_1wN(9z+!Jr><YiG?=hZ%YH`deX4ANN<g%w6hyv
z;{aVI%2wpc-f?u`>A>Wn$mBCYVu`C=y(v#m#PHJatMk$AUDg5;LCtt2Qv~Hv=H06e
z6Y-b^&sirX?8WuE@8u4%_y@MrXZ9yj&dk*z<hn%ur8Nbd<lYC9og+QSo({NaYQH(l
zy2MwBHkM^M7&K_!RwOpEIvYNhzdbhtkvq52Tgx+drQAIc8E=Q%a;b~>K;s07yaq}h
zjc2kt^g&Y|e$$;83>GraH$oj7rV`;89pfzWVK5eh4YhtQcn57?cQwUt6>j+v5H3yd
zi$sS)*~2s)(J|y!xTh@`nPFkyerYOB1e~{g@qemh9x|FENCHC5g9&GIgz%<loM?%g
zSL~x#jiUReu&(omqKCJ-v+H1<(b?LXi=x7-rxg65$aL4h$pa?w+Z#P4Yt2M54cY>+
zhdHEHZ1ygBwFz*)KRGk~?}e?tdp`4Vu8r^NL$I<FvO9kl)-iFSV)2M!+45bQ&USw9
z)DI${Ot%xOry1hq9u(-EX7Y}h87#Iq%8{GKrnbjovok$195tv-NL*%^ZPURY^0~>8
z)6$tR>#)YF(|?td8p^~FaQuBL;sQ1=|6rU{vB%VmIr!zE1)F@EKiD~m+|o8x|5oRb
z&Fip1Rnx8|)-J!du@a&k7K~W<_H|8vwsObb(VMvOSBZxC2CuT|_wJdBG&`rT{6S!b
zy@Ce#F!R5<J+UusZyYD&7I^5G{zCqB$=mtjCd0k7q{n;}2UYLbHueK!7hL-VW<=Lm
zUpTBcT=LQQ*kcoNb*wS))`N~p1KYn)86Jy5IAuML^~-6OdKMYp)QaE1T6BjslVTJ7
zRz30M79ZFQZDemyB9%F*<efu8Qf|NO2LW?7cRm`{5mOmp{iF)_iX1!Lt?()hLe_|u
zh?2!*aEDWs(*|m%8s=sqQWL3<TqT88E!fjlAi?3>hg@8fd%MpTaF-R0SvJHJgcWH5
zOO|zsOyihIV^+f~1ja75vN(;i0#{niIXH~Eno7q5I(qYEIkKjE=TnOPLrHs_yQEDS
z&6+p;R`ilq%h<BSr7OXQoJYm0^WF>5S7V*ZZ$eadGM;3A8VC;)6e%7R%c|ewJl2xs
z{WUCM9uQ4eKwB>Lib`Y-grboxU1(><T!SEf{}7DQSiYDrjm<muw*8dYHmZCSE*4@1
zS~{lM^_-VB{N_K_GliTOy}Za`V;|=ckZ0#qOOUPxYnHAP;|ryVM%|q1vMLO4q6#Ds
z993kKmu=~*#S|t4ozu0~STXB6+=MS-qMET<PKYGC3vx_dF7qh#F9yGFOT1BI2fURo
zbrDsJ^sgZMI&?2!C&A$jtEP?WNsKf!lSv60L<0<1p7j-JvY&QN>=qq~#pr)Zw~Gq+
z=}CL=G;tE>Z5~*$twju`!nS$c6btjgwkeWBKVCWW;B65@-oFruqJ6UN{4`hcxMF^D
zFma!1zl{MtkMAnsr|644DDpe+QPo*=l{2Z_otPl*dd*zl{N8AK=PiUE)ao>oqD3z<
zMd(;J2Sdks?+Lo#QDar<$NYhwJaSw!zw+zrSRXpW|Lst2I$qGkb=e{BfAZw~8$Pue
zRK%i7f*<q}jkKIKL&rUSTNg1N8`PS=y4Di-vv_C^T{Q~ug(BuU*0hV6_o$<VwvA`X
zf$U6<-=`<?KZjitJoFxv)*Vw|!%1+bzO)Es6m6YorXzQzSj_r7EAPwHAbs#+xjr_t
zGn(Z@4{t`mpdXS_ML+c<I^d9_fv=~pDnXkFAIZ)5{Wrkqbp>SPYrybj>s$X{F%SI&
zHs%(W1lB0ex>zENj7eh`Q0-Bc8YM9pXZUd%63ZkYf%XjL+ml+nNPbbfvz|>h9D^}8
zbli-DOS$aqdUbV~1Fy!pV>Z@Cc1n$<@6cd6W@B6I4zBqOjdxyi2!wJzwuCRBr=vu1
zC7&EiV7uL~!;OhNl%Okto{oLLTo~3o_SsC7b@S#omNf~Y_hF+I4Ibz61$<m=LDUVR
z*TGCKSs4l6mhCOTfKRWRk4~YFIAZJ7c{4xEUUWWnvLp{>yo=i?zy{GhZf)a7S5;bQ
zD}Ge=WOI22g<VC3zZXP4@?cOVtq&bI3+uy!WxdFw6@8PcBSy4{JbXW*-Fw4;$Lrg6
zXe^&dkV#dzS0F@av{>UQ+&iFWWO6M60o5)Asho(?PZ9V=pI%lxkld)-6q4u7aA{`6
zvVz0Bu5>wz4f{5$6i836^Cn@1uPs?*-gGDieZhg*)M^H-d7{ZfRdvyH4j*#&P2ai}
zkG4<WMfojKFkU_TR_Kc-ufP3Kcl&_8r7}D{mM36u)q>D>Px^F7mkset>GnW9D_wv<
zBCW}Jws>TXtVNC<l#7B3i|vwOu|+!5U*t3OQDwV)iSX1VnIsg=W2Cq`DO0Aa@#DB@
zlMI{7k)Sf`M)uJBvcAv|Cdm?dct3y1O<*fF(tc-Kvwsek?_JB(5?Y8gwi@rWP2;TF
z<`t#4!JnZ{dt>W>DciU70V@4<Q)NwSVEDWZ#2OwoXSPlq#hilcnqN$u!ytJLGjfBW
zhQN|K>^~lU5b?RPPH!0iXK@(_*gxt^p4$gxu6bUXnJgE&)1ON73BOx;Z6egm%DE%l
zE6_c~hC@>nkr>o+ptp#Wz|-C**^LyrUl_7RyaG+JK&NB7d^>7uH*ygX=%Sm|pIz>y
z2eQgmfs2yN4thzf3Y4^M#H<xeWgg}9Bj|pVS2yKH$M^Y+Z{nr5;Z)NOd(<94<sUHC
zaoK1k56aa>Wd;5pg<H&l+I(#6)UjT_F0@D2Y@SP(u|@zpd69)C!MeP2be;zKE}Xf}
z64#nWUNCt2Im|NTN55Y0qI^e0N<xkS@KID%TJu~RD+dmC%b|zg%FY#^Z9&kn;^ajU
zEe{RXBRY1SXo=e?)>PlaPASsakt`8=X|FpLo&0oCb}!S8qdAHvwnjb^o$4=r*<D$^
zDa5YipI?fG5rm7~nk@??QRL+6f5S6uH03T-%Z|cEVc|2>hqM=idCx$tzJJaK;$9C>
z)+>7#Sw5^&BxO*VW?}Q*knd0ezP7sVP`7`-3FoN>3{Zrp<i6|cleF8iXpXXSXiuc?
z_)SavljHkB@YVLEz&Nj{v$~+d2O{B$BO*Gl>!tD;0jt^H9WPXA=Ee8ZnkmwjXsl=~
zSIA_V=DY4f=mFWCKB9*z(xsw?%_q|x3X3O?#*qlrc}-}a&!AY5*un8*bCF{zj*Nph
zr~>Nm0xxqavYJC*BB8qQzHVYHwvZVj^l}w}TH%pUhcAEcFpxviUJE<NmeSs!CGIO8
zOC_20?fp{tSt~XlP2b5e7C1C@sAi%<gG~Dje3QjIuyQ`hnAxhmzxw22NXzgIj!Hes
zmR41^2clMhRKI#mJv};Xw~X~6ZpRNtq-F;Vd>(dxN8uk>Gb3hHp0MyuVXwzT?+CE}
zAYmR-U%G!fVCJSyU{E5^!*8?tr=^(8DjwARekB=H+TTJ?nm-g;cpJp({By!=*CZ&{
zivLkp<&q3rMC*_2{sCriX{#yI`5~haWyzy4&V{Mju7pr*nKxvVgEGUJK_7_=N=L#+
z^+9wpNc(#7_zeuQU_1H9A758D<)#%VvC8x0&rWEIP)FfL?SCI22{%*_IR4H3J0t}^
z2@ehcs7bVijS9lLM?B#~ru(-{1$rV(&U@7Vk-!9%B9pla0-Hjma*AI6a8qp^-DkP5
zm2OK89J%;PxxHL8UpH3`2IJsh+^hbd!4EzRmeXPEyHB8EKeKYfL`5PhAZA(8O|Lfj
z$piFm(1aAQdtIL!>9qD|`WcwfNkabFx1-V1kmr3OH|N^DJ$)8mN?GDd-DZLUf$f6?
z&5)G|OsnLd*LYG^h6&e7ZN)0-(z)S5Ho@}_H;moJ_27>w+JZE*56RseOdH3qjbG{;
zmn!VwAd!x1HpTPMmK&M*5!4fg%sft!c1{4f2NM2nEt#v-w&n9h*WR0Q*xdZHi0uA{
z%=6Ct49xw+6XP`ri%q<B2~AvEEa~;3t@OdK)XPYKy{C9d+2I~Q&9+~?G^(+WZgJ`k
z-znp!%=fe9_O5MP|FnJYi?<c<atf}NQ-5@PG_@U{+6k$8wrz_oj+t>Eyq`WOQn+^x
z)2gRGa)U&8x+G#dm!^rjUB;dwc-C5G_l});Ai9EaX$B`aov&k2$}o*YQblw3!+So0
z3gh-k!DH+3kjwR2l51kg0np2@6jDI(n$_;4Qm|v_=K<5^T8rB{=4>k`*hn~=B8MVx
zo>GlbgnI@aadU1;knqH@y_|tbLHKF*$q>Bh8#7nBjFcqSi)hTNX#k9%U5s}Aah@0@
zns;}-NH2LVDDO0scfo|NomdF4*8Kd#(NU73jmY;#OGoe?pY4kf7AdiPCrL(sbRjO0
z{3Pc}#>B&ETABddvHRkN50m7j8Z0hpz}Y#T{zd6rlb5vA=K@FEsoklm8=i77$V|8m
zX_9BPHEqoiwB(q`7NsIFIw%J09{+_J?svIji*gcmS$=x=*cR-pldA74WkZU<B|{y}
zp?*pQ9jCw~ycJ-v*`1AH*3@^&$(NWb(n-yj2KNc<JM?r8Sv+2=Hn99?q!^Rts^~#q
z(s}k2u0t*(Jsi3b`N-06nw65&&N1{>#*qJ0e6&KS6X@l{9_Ae{W;r+}EAobcrDYP`
zj1Q#Maqh4?*|$F6`-~0R+-jonz<MeXleResuVx`BqiuwRDp?8q@Gp8-JNJa7^+P*p
zv`yES9PI#cmX=gBv*j5VhDz~JZ(`@b+2wPt{OwO}8bsztybq})69!_<wTWtHAxcu%
zQ35nGt)2{u1WCO>hQ9ImB^%~5qCvG=2jzf9dE278SOUhZ6YL06qwDQXD0FK2n2d>_
z9h>18q7<LVSDg>btxWQ3BOC87kIsE({4AY6Bs#j?Q8b}bIFqi+Q(qBXE++g4^irdh
zq+3JejPr5|VCN}Ea2U*N67f9KP<bMl`Ifn~2%Y#me4Y(C+)B>C<)kq!BR0#{cRH`1
zYl*dtb81C#<aT4I<P%R~Be%viud-lvnp^$JoYv71G}6r)*PD>s$%zahNBY253&2*;
zsevASc?b>k%LkZjsrJ@=(kHh%9t7a-K_Y9Kvb3{Y>PxC$XPY~m{9B+}!XO%O=4%C}
z0p?a~UYR^IIsEdwmufAoStkrV$hwDp_WGFoF?&gC7))s)`V=PR7m9jBu^Py*yi3Ep
zM*)i{L|dYuisBytM_Vn0KriE;M(UR~vm-f49LW}J%-<5r?&+vc=^<!T!V{`LMX52j
zR{U_BHsCgTW6Xhvr9}ZA-_~F2hi4=;Bdw8g9B=Atot!+#7NAea0nz=&P~zWh7lfga
z@%|}4U=QU;K+Mnrd~Dq{kn|#B$A^?qi#&F1`pG7re<=!u(G7kfmHfF}sW_&DH}+=t
z1{NDb6?AhEsa)Yu)cHsc&0g`Y6fDRYxu8l%eN&LGbWj&F(uh`$*dAa2jr_EDPm_}R
z(mev#I8r<|FOlH*H@VHvOfY-IuS1DOCw#1tDZ6TlrTt_NVhr!xWC+aMV+r5w>1Ez?
zN-$iK>uIdTj3PUZXc+yZtO?b#ai}b0ko)32+@E?}fL$IxMT&-ctGGZG3i;@Up2Mg#
z&@lX1q&r>C*<tz2NDfr4*Mti+tA4q1qx`9M)Vi6M<0pwa62>oHG%Po#fM$_=7;&7Z
zs(}OdEC6?DB=4bhs`f1S7<U{B)+aeC#6{olnKJPClGdAi{E9qSY(nG4%h?BQT0@(l
zgiy|?zW&#F*xfyE3E=qJ4;BgtO56jB#TkA4Q9gkH5J$y#LXluuibM7gj|Z18HBt)A
zGx|P@gbG0^&1X7K*}JFTq7c#z<8%m6vXdjr@&nVAemC5DJx$nd(R&J*Q&CM}iU%@e
zm;rOreEDmw1fn|RLL*Jjh6M!2C#T^iys`KlTRqvS)=OjQP5-7cWC3GO*YF@q_DLU?
z0Fh>qGL0r1;*v95pjU7cvWZ=$F>M|K;A?xaWb=T;Qm<*J*Spp4Y41kMUa<bgo^Z5s
zu`}+7UzAMBY?K37V81ZsX}h#oswVAjPEb|wD=DBY-WcHj(Kl%!%!@x&pHMhi;=U8=
zeMcu-+TS=-+0m@~OG`h_#a!+>q9}c3`33fum(603y=W_mF;TQ`7I;ViV>7<4R4v>7
zb=li`QP%E3whx|HCtKs`>FF%Eus9;){+{>oJb*<t2A-WYtwxMRcvh1v47sNG8N3u4
z6oRr{Lt+L8glVu-lPeyV7+uQ#&<TIklJaiym7tYRyxU;Bn?M8jt=LsriqvuhfE-i#
zv8U9yb5j#kesLrtBg2PoSUC?8QT5h}@VlrL_ZKmQO5KBSg+<#2gFxsXz@KyIa3Zd9
z)#=7yZuL_?bi5aJ@T@%X1sr_zyVI%~ybw1!(mOF-mNzWkPOPpmD6}NBQ;u9?$N9u)
zIsm5a(T2kj3qyqhDVj!Nqobp#9*?UC?OjWv^}iW=-cs9HLz0yT#kjhSd5>EMPk!kK
z;7umW_>jrm!26|PobTWGX!3P16QwDIGEa$OI8n{*5Y?$`rkVAd6t@;F{pygdcWbF7
zqzo^_!(V@PG#9yQzxgR6*HfDAFd(b(?X;EX*^V-e08lcC0`(;14=@Swgh3*jk>(Q|
z`-Jy_QOqjZ91J#j_54TKP@mdhY!lA?y!R#VL5fkS(XWsl<X-s7Se_}qR`VbAE|w}o
z?qAPV`t#xd<OC}-uRm$o!3F_34{Cm|m}6REZw2a^mWskRqan0UWS@!Y7g&|py_%x4
zg7BvX`jp`CjlPibji>Hu#cwED>uU%JV(oT4$Bg|QU_eexU(&JB@ie#b#bZ96WJUw)
zWqa<2tLUC@5hxXnYl|}+*Dn$geeZePibs{Xu0o~;@=a*(Km1b<I|mux`uwbL7c8iR
zQgT&8jEkeKD3BD0uZFVFuv)^+LdG&$`E%aFMEOo%IUfT={Z|ypu9@hxP#N}mJhev7
z!m_#RO7^b#X*r&2sJwj9NjE?+5=ndQ&sfzL_0^}Tf@1;S^mQY)EPvsLKU08G1`S+p
z#{IQu{1@CEwm)o&)OG4PYp%xTG-7=?eFix(vX2$a%rk$el+eTCQeNVRW&m$y)N@QW
zFWQsUd%Vm)6PF@cC&vM$j!xYyGU~<}WJQEdv9Vu4H4+hn9F0;leEoEc5KkFT(_CQN
z_;9+%!{SQUBGbe2S#0FbI@k67baF=emW_NWFE;`y_q=d0gx-n^@ztJ`klsdnlb}e*
zJV(~hp(e0^XF+Ds|83@mCXqh{-Zaf-*%t$R$WzgASq-ADLoqVZoGou!v;+f6n7=(4
z{={M$kw7OITZ-L+pup=Dit}ENqrI8+es)Bpm!jHnR2VuS^0CY@sVVx?EI7i&q}M<K
zYL}uJ9zn?8j6d2-8<i9Vjt`OYd&RzY;>7<O7;`@d&~60+n2%}SytDbFBBGHvH~Lj>
zT1UZXf>B#7GWT?3<40@~?;G_3%wPnjBM23HjaeU}*2%0?^<a^t3>Tt>zy1&lnGTEl
z#3{hjXQE6SRHRyf6c(MLO|}zQcL~-^feF?#Iq~9rly+}dM>uY@rl+E_pj24@*MGa=
bWB#FUokt+KSayW}{;O4#Rg<ZDX^Q$EhPv$7

literal 0
HcmV?d00001

diff --git a/packs/nvidia-vss-vllm-1.0.0/manifests/llm-vllm.yaml b/packs/nvidia-vss-vllm-1.0.0/manifests/llm-vllm.yaml
new file mode 100644
index 00000000..84b670a4
--- /dev/null
+++ b/packs/nvidia-vss-vllm-1.0.0/manifests/llm-vllm.yaml
@@ -0,0 +1,129 @@
+# Raw bounded vLLM LLM backend, Go-templated against the manifests.llm-vllm.*
+# values block (Palette renders kubeManifests as Helm templates + resolves
+# spectro.var / spectro.macro macros at deploy time). vLLM serves the OpenAI API on :8001; the
+# nginx sidecar on :8000 answers /v1/health/live (the path the vss-engine
+# check-llm-up init container probes, which raw vLLM lacks) and proxies the rest.
+# Service llm-nim-svc:8000 is what the application pack's egress (llm-openai-api)
+# targets. hf-token-secret is created by the data-infrastructure pack (priority 5).
+# Mirrors the validated ansible harness (roles/vss_deploy/templates/llm-vllm.yaml.j2).
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: llm-vllm-cache
+  namespace: {{ .Values.namespace }}
+spec:
+  accessModes: [ReadWriteOnce]
+  resources:
+    requests:
+      storage: {{ .Values.cacheSize }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: llm-vllm-nginx
+  namespace: {{ .Values.namespace }}
+data:
+  default.conf: |
+    server {
+      listen 8000;
+      location = /v1/health/live  { proxy_pass http://127.0.0.1:8001/health; }
+      location = /v1/health/ready { proxy_pass http://127.0.0.1:8001/health; }
+      location / {
+        proxy_pass http://127.0.0.1:8001;
+        proxy_read_timeout 600s;
+        proxy_buffering off;
+      }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: llm-vllm
+  namespace: {{ .Values.namespace }}
+  labels: { app: llm-vllm }
+spec:
+  replicas: {{ .Values.replicas }}
+  selector: { matchLabels: { app: llm-vllm } }
+  strategy: { type: Recreate }
+  template:
+    metadata:
+      labels: { app: llm-vllm }
+    spec:
+      nodeSelector:
+        nvidia.com/gpu.present: "true"
+      tolerations:
+        - key: nvidia.com/gpu
+          operator: Exists
+          effect: NoSchedule
+      imagePullSecrets:
+        - name: ngc-pull-secret
+      containers:
+        - name: vllm
+          image: {{ .Values.image }}
+          command: ["python3", "-m", "vllm.entrypoints.openai.api_server"]
+          args:
+            - --model
+            - {{ .Values.hfModel }}
+            - --served-model-name
+            - {{ .Values.servedModelName }}
+            - --tensor-parallel-size
+            - "{{ .Values.tensorParallel }}"
+            - --gpu-memory-utilization
+            - "{{ .Values.gpuMemUtil }}"
+            - --max-model-len
+            - "{{ .Values.maxModelLen }}"
+            - --max-num-seqs
+            - "{{ .Values.maxNumSeqs }}"
+            {{- range .Values.extraArgs }}
+            - {{ . | quote }}
+            {{- end }}
+            - --host
+            - 0.0.0.0
+            - --port
+            - "8001"
+          env:
+            - name: HF_HOME
+              value: /cache
+            - name: HF_TOKEN
+              valueFrom:
+                secretKeyRef: { name: hf-token-secret, key: HF_TOKEN, optional: true }
+            - name: HUGGING_FACE_HUB_TOKEN
+              valueFrom:
+                secretKeyRef: { name: hf-token-secret, key: HF_TOKEN, optional: true }
+          ports:
+            - { containerPort: 8001, name: openai }
+          resources:
+            limits:
+              nvidia.com/gpu: {{ .Values.gpuCount }}
+            requests:
+              memory: {{ .Values.memRequest | quote }}
+              cpu: {{ .Values.cpuRequest | quote }}
+          volumeMounts:
+            - { name: cache, mountPath: /cache }
+            - { name: dshm, mountPath: /dev/shm }
+        - name: nginx
+          image: {{ .Values.nginxImage }}
+          ports:
+            - { containerPort: 8000, name: http }
+          volumeMounts:
+            - { name: nginx-conf, mountPath: /etc/nginx/conf.d }
+      volumes:
+        - name: cache
+          persistentVolumeClaim: { claimName: llm-vllm-cache }
+        - name: dshm
+          emptyDir: { medium: Memory, sizeLimit: {{ .Values.dshmSize }} }
+        - name: nginx-conf
+          configMap: { name: llm-vllm-nginx }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: llm-nim-svc
+  namespace: {{ .Values.namespace }}
+spec:
+  selector: { app: llm-vllm }
+  ports:
+    - name: openai
+      port: 8000
+      targetPort: 8000
diff --git a/packs/nvidia-vss-vllm-1.0.0/pack.json b/packs/nvidia-vss-vllm-1.0.0/pack.json
new file mode 100644
index 00000000..c4a7b2cc
--- /dev/null
+++ b/packs/nvidia-vss-vllm-1.0.0/pack.json
@@ -0,0 +1,31 @@
+{
+  "addonType": "system app",
+  "annotations": {
+    "source": "community",
+    "contributor": "spectrocloud",
+    "docsURL": "https://docs.nvidia.com/vss/latest/index.html",
+    "description": "NVIDIA VSS LLM backend (bounded vLLM) serving the OpenAI API as llm-nim-svc.",
+    "upstreamVersion": "2.4.1",
+    "upstreamRef": "NVIDIA VSS Blueprint 2.4.1"
+  },
+  "cloudTypes": [
+    "all"
+  ],
+  "displayName": "NVIDIA VSS LLM (vLLM) (VSS 2.4.1)",
+  "kubeManifests": [
+    "manifests/llm-vllm.yaml"
+  ],
+  "layer": "addon",
+  "name": "nvidia-vss-vllm",
+  "version": "1.0.0",
+  "constraints": {
+    "dependencies": [
+      {
+        "packName": "nvidia-vss-core-nims",
+        "layer": "addon",
+        "minVersion": "1.0.0",
+        "type": "optional"
+      }
+    ]
+  }
+}
\ No newline at end of file
diff --git a/packs/nvidia-vss-vllm-1.0.0/presets.yaml b/packs/nvidia-vss-vllm-1.0.0/presets.yaml
new file mode 100644
index 00000000..bdebe72e
--- /dev/null
+++ b/packs/nvidia-vss-vllm-1.0.0/presets.yaml
@@ -0,0 +1,124 @@
+# VSS Platform profiles for the vLLM LLM backend (the vLLM-backed hardware only).
+#
+# ⚠️ OPERATOR CONTRACT: add this pack ONLY to vLLM profiles (DGX-SPARK / OTHER /
+#    RTXPRO6000BW / AGX-THOR / IGX-THOR), and select the SAME "VSS Platform" preset
+#    here as in the other VSS packs. NEVER add this pack to an H100/L40S (trtllm)
+#    profile — the core-nims nim-llm subchart already creates llm-nim-svc there, and
+#    two Services with the same name collide. See P1-P5-IMPLEMENTATION.md.
+#
+# Mutually-exclusive presets (group "VSS Platform"); DGX-SPARK is the default and
+# is the empirically-validated GB10 config (P1). The others (P3/P4) are authored
+# from the NVIDIA blueprint but NOT hardware-validated here — verify NGC/GHCR image
+# tags and tool-call-parser flags against an authenticated registry before use.
+#
+# NOTE: H100 / L40S are NOT in this group — they use the TensorRT-LLM nim-llm
+# subchart in nvidia-vss-core-nims and must NOT include this pack in their profile.
+presets:
+  - name: "DGX-SPARK"
+    displayName: "DGX Spark (GB10, arm64, sm_121) — llama-3.1-8b"
+    group: "VSS Platform"
+    remove: []
+    add: |
+      manifests:
+        llm-vllm:
+          replicas: 1
+          gpuCount: 1
+          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
+          hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
+          servedModelName: "meta/llama-3.1-8b-instruct"
+          tensorParallel: "1"
+          gpuMemUtil: "0.35"
+          maxModelLen: "8192"
+          maxNumSeqs: "4"
+          extraArgs:
+            - "--enforce-eager"
+
+  - name: "OTHER"
+    displayName: "Other / generic single GPU — llama-3.1-8b"
+    group: "VSS Platform"
+    remove: []
+    add: |
+      manifests:
+        llm-vllm:
+          replicas: 1
+          gpuCount: 1
+          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
+          hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
+          servedModelName: "meta/llama-3.1-8b-instruct"
+          tensorParallel: "1"
+          gpuMemUtil: "0.5"
+          maxModelLen: "8192"
+          maxNumSeqs: "4"
+          extraArgs:
+            - "--enforce-eager"
+
+  # ── P3 — RTX PRO 6000 Blackwell (sm_120) workstation. UNVALIDATED. ───────────
+  - name: "RTXPRO6000BW"
+    displayName: "RTX PRO 6000 Blackwell — nemotron-nano-9b-fp8 (unvalidated)"
+    group: "VSS Platform"
+    remove: []
+    add: |
+      manifests:
+        llm-vllm:
+          replicas: 1
+          gpuCount: 1
+          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
+          hfModel: "nvidia/NVIDIA-Nemotron-Nano-9B-v2-FP8"
+          servedModelName: "nvidia/nemotron-nano-9b-v2-fp8"
+          tensorParallel: "1"
+          gpuMemUtil: "0.5"
+          maxModelLen: "16384"
+          maxNumSeqs: "4"
+          extraArgs:
+            - "--trust-remote-code"
+            - "--enable-auto-tool-choice"
+            - "--tool-call-parser"
+            - "nemotron_json"
+
+  # ── P4 — Jetson AGX/IGX Thor (arm64 Tegra/iGPU). UNVALIDATED. ────────────────
+  # Uses the Jetson-specific vLLM image; the host's NVIDIA container runtime injects
+  # the L4T/Tegra libs+devices (no manual hostPath mounts). The application pack's
+  # Thor preset also sets runtimeClassName: nvidia on the engine pod.
+  - name: "AGX-THOR"
+    displayName: "Jetson AGX Thor (arm64, iGPU) — nemotron-nano-9b-v2-fp8 (unvalidated)"
+    group: "VSS Platform"
+    remove: []
+    add: |
+      manifests:
+        llm-vllm:
+          replicas: 1
+          gpuCount: 1
+          image: "ghcr.io/nvidia-ai-iot/vllm:latest-jetson-thor"
+          hfModel: "nvidia/NVIDIA-Nemotron-Nano-9B-v2-FP8"
+          servedModelName: "nvidia/nemotron-nano-9b-v2-fp8"
+          tensorParallel: "1"
+          gpuMemUtil: "0.25"
+          maxModelLen: "16384"
+          maxNumSeqs: "4"
+          extraArgs:
+            - "--trust-remote-code"
+            - "--enable-auto-tool-choice"
+            - "--tool-call-parser"
+            - "nemotron_json"
+
+  - name: "IGX-THOR"
+    displayName: "IGX + Thor iGPU (arm64) — nemotron-nano-9b-v2-fp8 (unvalidated)"
+    group: "VSS Platform"
+    remove: []
+    add: |
+      manifests:
+        llm-vllm:
+          replicas: 1
+          gpuCount: 1
+          image: "ghcr.io/nvidia-ai-iot/vllm:latest-jetson-thor"
+          hfModel: "nvidia/NVIDIA-Nemotron-Nano-9B-v2-FP8"
+          servedModelName: "nvidia/nemotron-nano-9b-v2-fp8"
+          tensorParallel: "1"
+          gpuMemUtil: "0.25"
+          maxModelLen: "16384"
+          maxNumSeqs: "4"
+          extraArgs:
+            - "--trust-remote-code"
+            - "--enable-auto-tool-choice"
+            - "--tool-call-parser"
+            - "nemotron_json"
diff --git a/packs/nvidia-vss-vllm-1.0.0/schema.yaml b/packs/nvidia-vss-vllm-1.0.0/schema.yaml
new file mode 100644
index 00000000..e520081c
--- /dev/null
+++ b/packs/nvidia-vss-vllm-1.0.0/schema.yaml
@@ -0,0 +1,16 @@
+# Pack value constraints for the vLLM LLM backend.
+# Keys are full dotted paths into values.yaml (the manifests.llm-vllm.* sub-tree).
+manifests.llm-vllm.image:
+  schema: '{{ required | format "${string}" | hints "vLLM container image (nvcr.io/nvidia/vllm:* on x86/SBSA; ghcr.io/nvidia-ai-iot/vllm:*-jetson-thor on Tegra)." }}'
+manifests.llm-vllm.hfModel:
+  schema: '{{ required | format "${string}" | hints "HF model id vLLM loads (e.g. NousResearch/Meta-Llama-3.1-8B-Instruct)." }}'
+manifests.llm-vllm.servedModelName:
+  schema: '{{ required | format "${string}" | hints "OpenAI served-model name the application pack references via llmModel." }}'
+manifests.llm-vllm.gpuMemUtil:
+  schema: '{{ format "${number}" | hints "vLLM --gpu-memory-utilization (LLM share of the GPU pool, e.g. 0.35 on GB10)." }}'
+manifests.llm-vllm.maxModelLen:
+  schema: '{{ format "${number}" | hints "vLLM --max-model-len." }}'
+manifests.llm-vllm.maxNumSeqs:
+  schema: '{{ format "${number}" | hints "vLLM --max-num-seqs." }}'
+manifests.llm-vllm.replicas:
+  schema: '{{ format "${number}" | hints "vLLM Deployment replicas (1)." }}'
diff --git a/packs/nvidia-vss-vllm-1.0.0/values.yaml b/packs/nvidia-vss-vllm-1.0.0/values.yaml
new file mode 100644
index 00000000..080382b5
--- /dev/null
+++ b/packs/nvidia-vss-vllm-1.0.0/values.yaml
@@ -0,0 +1,68 @@
+# spectrocloud.com/enabled-presets: VSS Platform:DGX-SPARK
+#
+# ┌─ VSS PLATFORM MATRIX (canonical — keep identical across all VSS packs) ───────
+# │ Set ONE profile variable VSS_PLATFORM and select the matching "VSS Platform"
+# │ preset in EVERY VSS pack. Packs per profile: data-infra + core-nims +
+# │ application (always) + nvidia-vss-vllm (vLLM profiles only; H100/L40S omit it).
+# │
+# │ Platform          LLM backend   LLM model              VLM mem/len  decode    validated
+# │ DGX-SPARK         vLLM          llama-3.1-8b           0.28/10240   disabled  YES (GB10)
+# │ OTHER             vLLM          llama-3.1-8b           0.4 /16384   disabled  no
+# │ H100              nim (trtllm)  llama-3.1-70b (gpu 4)  0.8 /32768   dGPU      no
+# │ L40S              nim (trtllm)  llama-3.1-8b  (gpu 2)  0.8 /32768   dGPU      no
+# │ RTXPRO6000BW      vLLM          nemotron-nano-9b-fp8   0.4 /32768   dGPU      no
+# │ AGX-THOR/IGX-THOR vLLM (jetson) nemotron-nano-9b-fp8   0.4 /16384   Tegra*    no
+# │ "VLM mem/len" = the application vss-engine VLM; the vLLM LLM engine has its own
+# │   gpu-mem/max-len in the nvidia-vss-vllm presets (do not conflate the two).
+# │ * Tegra: runtimeClassName nvidia; the NVIDIA container runtime injects L4T libs.
+# └──────────────────────────────────────────────────────────────────────────────
+# NVIDIA VSS LLM backend — raw bounded vLLM (manifest-only pack).
+#
+# ═══════════════════════════════════════════════════════════════════════════════
+# WHY A SEPARATE PACK (P2-P4, see PLATFORM-SUPPORT-PLAN.md §6.4 / §8)
+# ═══════════════════════════════════════════════════════════════════════════════
+# VSS needs one of two mutually-exclusive LLM backends, selected by hardware:
+#   - raw vLLM (THIS pack)         → DGX-SPARK / RTXPRO6000BW / AGX-THOR / IGX-THOR / OTHER
+#   - nim-llm TensorRT-LLM subchart → H100 / L40S   (in nvidia-vss-core-nims)
+# Palette presets can parameterize a kubeManifest but cannot EXCLUDE one, and both
+# backends create a Service named llm-nim-svc — so they must never coexist. We make
+# the choice by PROFILE COMPOSITION: add this pack only to vLLM profiles; trtllm
+# profiles simply omit it. (Confirmed against docs.spectrocloud.com.)
+#
+# The manifest (manifests/llm-vllm.yaml) is Go-templated against the
+# manifests.llm-vllm.* block below; the "VSS Platform" presets set per-profile
+# values. install-priority 12 → after core-nims (10, creates ngc-pull-secret) and
+# data-infra (5, creates hf-token-secret), before application (15).
+
+pack:
+  namespace: nvidia-vss
+  spectrocloud.com/install-priority: "12"
+  content:
+    images:
+      - image: nvcr.io/nvidia/vllm:25.12.post1-py3
+      - image: nginx:1.27-alpine
+      # Jetson Thor (AGX-THOR/IGX-THOR presets) — floating tag, verify before use
+      - image: ghcr.io/nvidia-ai-iot/vllm:latest-jetson-thor
+
+manifests:
+  llm-vllm:
+    namespace: nvidia-vss
+    # DGX-SPARK (GB10) default — the empirically-validated config.
+    replicas: 1
+    gpuCount: 1
+    image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
+    nginxImage: "nginx:1.27-alpine"
+    hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
+    servedModelName: "meta/llama-3.1-8b-instruct"
+    tensorParallel: "1"
+    gpuMemUtil: "0.35"
+    maxModelLen: "8192"
+    maxNumSeqs: "4"
+    cacheSize: "80Gi"
+    dshmSize: "16Gi"
+    memRequest: "8Gi"
+    cpuRequest: "2"
+    # Extra vLLM args appended verbatim. DGX-SPARK uses --enforce-eager.
+    # Nemotron/Edge models also need their tool-call parser flags (see presets).
+    extraArgs:
+      - "--enforce-eager"

From 1fdb2d4e3b8ef90c51dfd45bcbec4b1f6b1b88dc Mon Sep 17 00:00:00 2001
From: blik616287 <mforde84@gmail.com>
Date: Fri, 12 Jun 2026 00:52:34 +0000
Subject: [PATCH 2/3] nvidia-vss-vllm: bump vLLM 26.05.post1 + nginx
 1.30.2-alpine (CVE), verified on GB10

---
 packs/nvidia-vss-vllm-1.0.0/README.md    | 2 ++
 packs/nvidia-vss-vllm-1.0.0/presets.yaml | 6 +++---
 packs/nvidia-vss-vllm-1.0.0/values.yaml  | 8 ++++----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/packs/nvidia-vss-vllm-1.0.0/README.md b/packs/nvidia-vss-vllm-1.0.0/README.md
index 7235671b..a91fed2f 100644
--- a/packs/nvidia-vss-vllm-1.0.0/README.md
+++ b/packs/nvidia-vss-vllm-1.0.0/README.md
@@ -19,3 +19,5 @@ Add to vLLM-backed VSS profiles at install-priority 12 (after `nvidia-vss-core-n
 
 ---
 **Upstream:** NVIDIA VSS Blueprint 2.4.1 (`vllm:25.12.post1-py3`). **Pack version:** 1.0.x.
+
+> **CVE bumps (public images):** vLLM `nvcr.io/nvidia/vllm` `25.12.post1-py3` → `26.05.post1-py3` and the nginx health-proxy sidecar `1.27-alpine` → `1.30.2-alpine`. Both verified on the DGX Spark (GB10): vLLM loads `meta/llama-3.1-8b-instruct` and serves the OpenAI API, nginx `/v1/health/live` → 200, vss-engine ready. The Jetson-Thor `ghcr.io/nvidia-ai-iot/vllm` tag is left floating (Tegra-only, verify before use).
diff --git a/packs/nvidia-vss-vllm-1.0.0/presets.yaml b/packs/nvidia-vss-vllm-1.0.0/presets.yaml
index bdebe72e..3a58860c 100644
--- a/packs/nvidia-vss-vllm-1.0.0/presets.yaml
+++ b/packs/nvidia-vss-vllm-1.0.0/presets.yaml
@@ -23,7 +23,7 @@ presets:
         llm-vllm:
           replicas: 1
           gpuCount: 1
-          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
+          image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
           hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
           servedModelName: "meta/llama-3.1-8b-instruct"
           tensorParallel: "1"
@@ -42,7 +42,7 @@ presets:
         llm-vllm:
           replicas: 1
           gpuCount: 1
-          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
+          image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
           hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
           servedModelName: "meta/llama-3.1-8b-instruct"
           tensorParallel: "1"
@@ -62,7 +62,7 @@ presets:
         llm-vllm:
           replicas: 1
           gpuCount: 1
-          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
+          image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
           hfModel: "nvidia/NVIDIA-Nemotron-Nano-9B-v2-FP8"
           servedModelName: "nvidia/nemotron-nano-9b-v2-fp8"
           tensorParallel: "1"
diff --git a/packs/nvidia-vss-vllm-1.0.0/values.yaml b/packs/nvidia-vss-vllm-1.0.0/values.yaml
index 080382b5..63f8796b 100644
--- a/packs/nvidia-vss-vllm-1.0.0/values.yaml
+++ b/packs/nvidia-vss-vllm-1.0.0/values.yaml
@@ -39,8 +39,8 @@ pack:
   spectrocloud.com/install-priority: "12"
   content:
     images:
-      - image: nvcr.io/nvidia/vllm:25.12.post1-py3
-      - image: nginx:1.27-alpine
+      - image: nvcr.io/nvidia/vllm:26.05.post1-py3
+      - image: nginx:1.30.2-alpine
       # Jetson Thor (AGX-THOR/IGX-THOR presets) — floating tag, verify before use
       - image: ghcr.io/nvidia-ai-iot/vllm:latest-jetson-thor
 
@@ -50,8 +50,8 @@ manifests:
     # DGX-SPARK (GB10) default — the empirically-validated config.
     replicas: 1
     gpuCount: 1
-    image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
-    nginxImage: "nginx:1.27-alpine"
+    image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
+    nginxImage: "nginx:1.30.2-alpine"
     hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
     servedModelName: "meta/llama-3.1-8b-instruct"
     tensorParallel: "1"

From 8eea83446f4f19650978470799f7a521a9fe8c21 Mon Sep 17 00:00:00 2001
From: blik616287 <mforde84@gmail.com>
Date: Fri, 12 Jun 2026 01:46:57 +0000
Subject: [PATCH 3/3] nvidia-vss-vllm: keep nginx 1.30.2-alpine CVE bump;
 revert vLLM to clean 25.12.post1 (26.05 ships upstream JWT, no CVE gain)

---
 packs/nvidia-vss-vllm-1.0.0/README.md    | 2 +-
 packs/nvidia-vss-vllm-1.0.0/presets.yaml | 6 +++---
 packs/nvidia-vss-vllm-1.0.0/values.yaml  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/packs/nvidia-vss-vllm-1.0.0/README.md b/packs/nvidia-vss-vllm-1.0.0/README.md
index a91fed2f..0f1865ea 100644
--- a/packs/nvidia-vss-vllm-1.0.0/README.md
+++ b/packs/nvidia-vss-vllm-1.0.0/README.md
@@ -20,4 +20,4 @@ Add to vLLM-backed VSS profiles at install-priority 12 (after `nvidia-vss-core-n
 ---
 **Upstream:** NVIDIA VSS Blueprint 2.4.1 (`vllm:25.12.post1-py3`). **Pack version:** 1.0.x.
 
-> **CVE bumps (public images):** vLLM `nvcr.io/nvidia/vllm` `25.12.post1-py3` → `26.05.post1-py3` and the nginx health-proxy sidecar `1.27-alpine` → `1.30.2-alpine`. Both verified on the DGX Spark (GB10): vLLM loads `meta/llama-3.1-8b-instruct` and serves the OpenAI API, nginx `/v1/health/live` → 200, vss-engine ready. The Jetson-Thor `ghcr.io/nvidia-ai-iot/vllm` tag is left floating (Tegra-only, verify before use).
+> **CVE bump:** nginx health-proxy sidecar `1.27-alpine` → `1.30.2-alpine` (verified on GB10, `/v1/health/live` → 200; pack-central pax-cve confirms **0 Critical**, down from `1.27`'s 3 / 137 total). The vLLM image stays at `nvcr.io/nvidia/vllm:25.12.post1-py3` — a bump to `26.05.post1-py3` was tested on the GB10 (serves fine) but **reverted**: that image ships a JWT in its pip HTTP-cache (`/root/.cache/pip/...`, an upstream NVIDIA build-hygiene leak flagged by the secret scan) and gives **no CVE benefit** (the runtime image scans clean at both versions). The Jetson-Thor `ghcr.io/nvidia-ai-iot/vllm` tag is left floating (Tegra-only, verify before use).
diff --git a/packs/nvidia-vss-vllm-1.0.0/presets.yaml b/packs/nvidia-vss-vllm-1.0.0/presets.yaml
index 3a58860c..bdebe72e 100644
--- a/packs/nvidia-vss-vllm-1.0.0/presets.yaml
+++ b/packs/nvidia-vss-vllm-1.0.0/presets.yaml
@@ -23,7 +23,7 @@ presets:
         llm-vllm:
           replicas: 1
           gpuCount: 1
-          image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
+          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
           hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
           servedModelName: "meta/llama-3.1-8b-instruct"
           tensorParallel: "1"
@@ -42,7 +42,7 @@ presets:
         llm-vllm:
           replicas: 1
           gpuCount: 1
-          image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
+          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
           hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
           servedModelName: "meta/llama-3.1-8b-instruct"
           tensorParallel: "1"
@@ -62,7 +62,7 @@ presets:
         llm-vllm:
           replicas: 1
           gpuCount: 1
-          image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
+          image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
           hfModel: "nvidia/NVIDIA-Nemotron-Nano-9B-v2-FP8"
           servedModelName: "nvidia/nemotron-nano-9b-v2-fp8"
           tensorParallel: "1"
diff --git a/packs/nvidia-vss-vllm-1.0.0/values.yaml b/packs/nvidia-vss-vllm-1.0.0/values.yaml
index 63f8796b..a762f704 100644
--- a/packs/nvidia-vss-vllm-1.0.0/values.yaml
+++ b/packs/nvidia-vss-vllm-1.0.0/values.yaml
@@ -39,7 +39,7 @@ pack:
   spectrocloud.com/install-priority: "12"
   content:
     images:
-      - image: nvcr.io/nvidia/vllm:26.05.post1-py3
+      - image: nvcr.io/nvidia/vllm:25.12.post1-py3
       - image: nginx:1.30.2-alpine
       # Jetson Thor (AGX-THOR/IGX-THOR presets) — floating tag, verify before use
       - image: ghcr.io/nvidia-ai-iot/vllm:latest-jetson-thor
@@ -50,7 +50,7 @@ manifests:
     # DGX-SPARK (GB10) default — the empirically-validated config.
     replicas: 1
     gpuCount: 1
-    image: "nvcr.io/nvidia/vllm:26.05.post1-py3"
+    image: "nvcr.io/nvidia/vllm:25.12.post1-py3"
     nginxImage: "nginx:1.30.2-alpine"
     hfModel: "NousResearch/Meta-Llama-3.1-8B-Instruct"
     servedModelName: "meta/llama-3.1-8b-instruct"