Skip to content

Add nvidia-vss-nims 3.1.15 (NVIDIA VSS Blueprint 3.1.0)#241

Open
blik616287 wants to merge 12 commits into
spectrocloud:mainfrom
blik616287:add-nvidia-vss-nims-3.1.1
Open

Add nvidia-vss-nims 3.1.15 (NVIDIA VSS Blueprint 3.1.0)#241
blik616287 wants to merge 12 commits into
spectrocloud:mainfrom
blik616287:add-nvidia-vss-nims-3.1.1

Conversation

@blik616287

Copy link
Copy Markdown
Contributor

nvidia-vss-nims — VSS 3.x, pack 3.1.1

VSS 3.x NIM model backends as a Helm chart — the Cosmos-Reason2-8B VLM (nvcr.io/nim/nvidia/cosmos-reason2-8b) that the vss-agent calls for visual understanding, plus the rt-embed NIM. Gated nvcr.io images (pulled on-cluster via ngc-pull-secret).

Versioning: chart/pack version: 3.1.1 (our packaging) · appVersion: 3.1.0 (upstream NVIDIA VSS Blueprint 3.x). Helm chart; images pinned in values.yaml pack.content.images.

Tested on NVIDIA GB10 / DGX Spark (arm64 SBSA)

Deployed via Palette add-on cluster profile vss-dgx-spark-3x on edge cluster edge-gx10 (single GB10). Full VSS 3.x route green — all 5 packs report Pack services are ready, cluster Running:

cosmos-reason2-8b-846f9747c9-b2z44           1/1 Running
elasticsearch-0                              1/1 Running
envoy-proxy-8654778857-4lh9r                 1/1 Running
kibana-6c48bf74cb-nlrm9                      1/1 Running
llm-vllm-66f78ff858-l5ftt                    2/2 Running
phoenix-0                                    1/1 Running
postgres-0                                   1/1 Running
redis-0                                      1/1 Running
vss-agent-669d5b5fd6-tzc7d                   1/1 Running
vss-agent-ui-98789c556-zq257                 1/1 Running
vss-proxy-6f8dc9d698-4rmmt                   1/1 Running
vss-vios-ingress-56485ddc44-s7pnf            1/1 Running
vss-vios-mcp-5d579cc49b-fjs68                1/1 Running
vss-vios-sensor-57d86f8dcb-9thct             1/1 Running
vss-vios-streamprocessing-789ccd7c59-xkfrc   1/1 Running

Validation: pack.json JSON-syntax/schema/version, logo, README, and pack.content.images all pass. The content.images pull (crane) fails for the gated nvcr.io/nim/* and nvcr.io/nvidia/vss-core/* images — the CI runner has no NGC credentials (same image-pull exception as the 2.4 PRs #233–236; the cluster pulls them via ngc-pull-secret).

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 2
  • Clean images: 2
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

…base)

Drop the gated nvcr cosmos-reason2-8b + vss-rt-embed images from pack content;
content.images is now just cgr.dev/chainguard/wolfi-base (0/0). Each gated NIM rootfs is
crane-fetched as runtime DATA at deploy and its native entrypoint (start_server.sh /
start_rtvi_embed.sh) is run NON-PRIVILEGED on wolfi-base via the SAME matched-ld + CUDA
toolchain block GB10-validated for the vLLM pack (real ptxas/cuda paths, gcc --sysroot
wrappers, comprehensive lib path, triton paths).

NOTE: live functional validation of these two GPU NIMs is pending a free GPU slot — the
GB10s two GPUs are held by the running route (cosmos is the live VLM). The build-on-deploy
mechanics are those proven serving nemotron via vLLM (HTTP 200). The running containers
carry NVIDIA CUDA-stack CVEs as runtime data, not pack images.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

…out)

GPU NIMs under RollingUpdate deadlock (new pod Pending on Insufficient nvidia.com/gpu
while the old holds the slot); Recreate terminates the old first. Found on live GB10 deploy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

cosmos nvidia_entrypoint.sh does exec /bin/bash + start_server.sh is #!/bin/bash; the
rootfs bash was only swapped to /bin/sh. cp it to /bin/bash too. Found on live GB10 deploy.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

…ths)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

blik616287 and others added 2 commits June 14, 2026 07:54
…lves nim_llm_sdk)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

mforde84 and others added 2 commits June 15, 2026 05:49
3.1.14 validated serving cosmos VLM (nim 3.1.14, bf16) on a GB10 edge cluster, 200 on /v1/health/ready. Merged upstream/main (crane-manifest validator fix).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@blik616287 blik616287 changed the title Add nvidia-vss-nims 3.1.1 (NVIDIA VSS Blueprint 3.1.0) Add nvidia-vss-nims 3.1.14 (NVIDIA VSS Blueprint 3.1.0) Jun 15, 2026

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

Adds a self-contained dGPU NVDEC decode backend for rtvi-embed (PyNvVideoCodec via libnvcuvid, chroot build-on-deploy + cosmos.enabled gate) so the search-profile embedder runs on DGX-Spark dGPU-mode nodes where the stock DeepStream/pyds decoder can't load. rtvi-embed reached 1/1 ready with the NVDEC DecoderProcess warmed up while pyds plugins failed — confirming the NVDEC path. Live-validated on a GB10 (DGX Spark) edge cluster via the cluster-profile pipeline.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@blik616287 blik616287 changed the title Add nvidia-vss-nims 3.1.14 (NVIDIA VSS Blueprint 3.1.0) Add nvidia-vss-nims 3.1.15 (NVIDIA VSS Blueprint 3.1.0) Jun 15, 2026

@bulwark-spectrocloud bulwark-spectrocloud Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ CVE scan completed successfully.

Scan Summary:

  • Total images scanned: 1
  • Clean images: 1
  • Images with CVEs: 0
  • Total CVEs found: 0

🔴 Critical CVEs: 0
🟠 High CVEs: 0
🟡 Medium CVEs: 0
🟢 Low CVEs: 0

✅ All scanned images are clean with no CVEs found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants