Summary
Migrate the AICR artifact API domain from aicr.nvidia.com to aicr.run across every surface where it appears (artifact apiVersion group, K8s label/annotation keys, in-toto/SLSA attestation URIs, provenance, docs). Vendor-neutral, shorter, and a breaking change we want to land before v1 while we are still on v1alpha1/v1beta1.
kind: RecipeResult
apiVersion: aicr.nvidia.com/v1alpha1 ──▶ apiVersion: aicr.run/v1alpha1
Decision record
The migration decision — drivers, scope, transition window, and impact — is recorded in ADR-013: Migrate Artifact API Domain to aicr.run (merged in #1492). That ADR is the authoritative reference; the summary below mirrors it.
Why
- Vendor-neutral — decouples the artifact contract from NVIDIA branding (CNCF-style neutrality; outlives any single org domain).
- Shorter in every
apiVersion, label key, and attestation URI.
- Timing — a group rename breaks every persisted artifact pinning the old
apiVersion. Per docs/design/011-artifact-apiversion-policy.md, breaking changes belong to a version bump; doing the domain flip before v1 is cheapest.
Decisions (confirmed)
- ✅ Domain
aicr.run is owned/controlled by the maintainer.
- ✅ Transition window: dual-accept old + new
apiVersion on read for one release, warn, always write new.
- ✅ Host-only change for attestation/provenance URIs — path segments (
/bundle/v1, /recipe-evidence/v1, /recipe-catalog/v1) stay.
- ✅ External attestation consumers are demo-only — owner handles offline (not tracked as an issue here).
Scope — 5 semantic roles
| Role |
Examples |
Risk |
| Artifact API group |
pkg/header.APIGroup, pkg/build/spec.go (v1beta1), localformat/provenance.go |
Low — centralized |
| K8s label keys |
pkg/validator/labels aicr.nvidia.com/{job-type,run-id,…} |
Low — ephemeral Jobs |
| Annotations |
bundler.go /gpu-operator-chart-version, validate.go /job |
Low |
| Attestation predicate/buildType URIs |
https://aicr.nvidia.com/{bundle,recipe-evidence,recipe-catalog}/v1 |
High — signed, published |
| UUIDv5 namespace seed |
aicrBundleNamespace derived from https://aicr.nvidia.com/bundle/v1 |
High — deterministic bundle IDs reset |
Approach
Centralize → flip → regenerate, with a dual-accept transition window (see ADR-013). Tracked as the sub-issues below.
Out of scope / owner-handled
Summary
Migrate the AICR artifact API domain from
aicr.nvidia.comtoaicr.runacross every surface where it appears (artifactapiVersiongroup, K8s label/annotation keys, in-toto/SLSA attestation URIs, provenance, docs). Vendor-neutral, shorter, and a breaking change we want to land before v1 while we are still onv1alpha1/v1beta1.Decision record
The migration decision — drivers, scope, transition window, and impact — is recorded in ADR-013: Migrate Artifact API Domain to
aicr.run(merged in #1492). That ADR is the authoritative reference; the summary below mirrors it.Why
apiVersion, label key, and attestation URI.apiVersion. Perdocs/design/011-artifact-apiversion-policy.md, breaking changes belong to a version bump; doing the domain flip before v1 is cheapest.Decisions (confirmed)
aicr.runis owned/controlled by the maintainer.apiVersionon read for one release, warn, always write new./bundle/v1,/recipe-evidence/v1,/recipe-catalog/v1) stay.Scope — 5 semantic roles
pkg/header.APIGroup,pkg/build/spec.go(v1beta1),localformat/provenance.gopkg/validator/labelsaicr.nvidia.com/{job-type,run-id,…}bundler.go/gpu-operator-chart-version,validate.go/jobhttps://aicr.nvidia.com/{bundle,recipe-evidence,recipe-catalog}/v1aicrBundleNamespacederived fromhttps://aicr.nvidia.com/bundle/v1Approach
Centralize → flip → regenerate, with a dual-accept transition window (see ADR-013). Tracked as the sub-issues below.
Out of scope / owner-handled