📝 docs: SECURITY-MODEL.md §3 - mark local LLM providers registered and active by clubanderson · Pull Request #8250 · kubestellar/console

clubanderson · 2026-04-15T23:54:42Z

Summary

Refreshes docs/security/SECURITY-MODEL.md §3 to reflect #8248, which registers local LLM providers in the agent dropdown.

Provider table flips the Registered column from "no" to "yes (chat only)" for Groq, OpenRouter, and Open WebUI.
Adds rows for the six new local LLM runners (Ollama, llama.cpp, LocalAI, vLLM, LM Studio, RHAIIS) with their env vars and loopback defaults.
Explains the chat-only capability flag and why missions still route through the tool-capable CLI agents.
Adds a "Local LLM strategy" cross-link to the docs.kubestellar.io page and the eight install missions on kubestellar/console-kb.
Replaces the "Planned follow-up" subsection with active recipes for each runner.

Threat model claims about kubeconfig and credentials staying out of the request body are unchanged.

Test plan

Document builds and renders
After merge, visit https://github.com/kubestellar/console/blob/main/docs/security/SECURITY-MODEL.md and verify all the new provider-table rows render correctly

Depends on #8248 landing first (or merging in parallel — the doc description matches the new code, and if #8248 reverts, this PR should revert too).

🤖 Generated with Claude Code

Updates SECURITY-MODEL.md §3 to reflect #8248, which registers Ollama, llama.cpp, LocalAI, vLLM, LM Studio, RHAIIS, Groq, OpenRouter and Open WebUI as chat-only agent providers in InitializeProviders. Changes: - Provider table flips the Registered column from "no" to "yes (chat only)" for the nine HTTP providers that are now wired into the agent dropdown, and adds rows for the six new local LLM runners with their env vars and default URLs. - Explains the chat-only capability flag and why missions still route through the tool-capable CLI agents (registry.go:303 rationale). - Adds a "Local LLM strategy" subsection that cross-links the docs.kubestellar.io local-llm-strategy page and the eight install missions on kubestellar/console-kb. - Replaces the "Planned follow-up" subsection with active recipes for each runner — Ollama loopback default, in-cluster Service URLs for llama.cpp/LocalAI/vLLM/RHAIIS, LM Studio workstation default, and Groq/OpenRouter/Open WebUI gateway overrides. The "# PLANNED — not yet wired at runtime" bash comments are removed. The threat model claims about kubeconfig and credentials staying out of the request body are unchanged and still authoritative. Signed-off-by: Andrew Anderson <[email protected]>

kubestellar-prow · 2026-04-15T23:54:45Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign clubanderson for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2026-04-15T23:54:47Z

✅ Deploy Preview for kubestellarconsole canceled.

Name	Link
🔨 Latest commit	`b30010f`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69e02545fb3f3d000824abcc

github-actions · 2026-04-15T23:54:51Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

Copilot

Pull request overview

Updates the Security Model documentation to reflect a newer AI-provider registration model (chat-only local/OpenAI-compatible providers becoming selectable in the agent dropdown) and adds operator-facing recipes for using local LLM runners.

Changes:

Updates the provider/env-var reference table to mark previously-staged HTTP providers as registered (chat-only) and adds local runner rows with URL env vars + loopback defaults.
Replaces the prior “planned follow-up” content with an active “Local LLM strategy” section, including cross-links and configuration recipes.
Adds narrative explanation of “chat only” vs mission/tool-exec routing.

Copilot · 2026-04-15T23:58:00Z

+"Chat only" means the provider reports `CapabilityChat` but not `CapabilityToolExec`. AI missions that need to execute cluster commands (kubectl, helm) still route through the tool-capable CLI agents (`claude`, `codex`, `gemini-cli`, `antigravity`, `goose`, `copilot-cli`, `bob`); local LLM providers are selectable in the agent dropdown for analysis and chat workflows but do not drive missions. See `pkg/agent/registry.go:303` for the rationale comment and `promoteExecutingDefault()` which keeps a mission-capable agent as the default whenever one is available.

-### Planned follow-up: wire up OpenAI-compatible local LLMs
+The upstream Anthropic, OpenAI, and Gemini HTTP providers remain intentionally unregistered — they cannot execute commands AND they route traffic to a specific vendor the operator has no say over, so they offer strictly less than the CLI agent equivalents. The `pkg/agent/provider_openai.go:15` hostname is still hard-coded.


The tool-capable agent list includes claude, but the registered tool-capable provider name is claude-code (and claude is the unregistered HTTP provider). Also, promoteExecutingDefault() currently only promotes away from “suggest-only” defaults (e.g., copilot-cli); it doesn’t generally enforce a tool-exec-capable default. Please adjust this explanation to match the current registry behavior.

Copilot · 2026-04-15T23:58:00Z

+The examples below are **active recipes** as of this revision of the document — the providers they rely on are registered in `InitializeProviders` and the `Available` field in the agent dropdown honors these env vars.
+


This claims the referenced providers are registered in InitializeProviders and that the dropdown “Available” state honors the runner URL env vars. In the current code, InitializeProviders only registers CLI tool agents (no groq/openrouter/open-webui), and availability for groq/openrouter/open-webui is API-key based. Please ensure this statement matches the implementation present when this doc is merged.

Copilot · 2026-04-15T23:58:00Z

-#### Planned: routing a local LLM through an overridable provider slot
+The registered local LLM providers unlock a "chat stays inside the cluster" posture: when `OLLAMA_URL` (or any of the six runner-specific env vars) points at an in-cluster Service or a workstation-local server, user prompts and the model's responses never reach a public vendor. The `docs/security/SECURITY-MODEL.md` threat model still applies: kubeconfig files, bearer tokens, and cluster credentials are never put into the chat request body regardless of which provider is selected.
+
+For a decision matrix on which runner fits which deployment profile, the install missions, and three topology diagrams, see the [Local LLM Strategy](https://docs.kubestellar.io/console/local-llm-strategy/) page on docs.kubestellar.io. Each runner has a companion install mission in `kubestellar/console-kb` (for example `install-ollama`, `install-llama-cpp`, `install-localai`, `install-vllm`, `install-rhaiis`, `install-lm-studio`, `install-open-webui`, `install-claude-desktop`), reachable from the agent selector dropdown when the runner is not yet configured.


The doc says the agent selector dropdown links to runner-specific install missions (e.g., install-ollama, install-open-webui) when a runner is unavailable. I can’t find these mission IDs referenced anywhere in web/src in the current repo state, so this may be inaccurate unless the corresponding UI change lands with it.

Suggested change

For a decision matrix on which runner fits which deployment profile, the install missions, and three topology diagrams, see the [Local LLM Strategy](https://docs.kubestellar.io/console/local-llm-strategy/) page on docs.kubestellar.io. Each runner has a companion install mission in `kubestellar/console-kb` (for example `install-ollama`, `install-llama-cpp`, `install-localai`, `install-vllm`, `install-rhaiis`, `install-lm-studio`, `install-open-webui`, `install-claude-desktop`), reachable from the agent selector dropdown when the runner is not yet configured.

For a decision matrix on which runner fits which deployment profile, the install missions, and three topology diagrams, see the [Local LLM Strategy](https://docs.kubestellar.io/console/local-llm-strategy/) page on docs.kubestellar.io. Each runner has a companion install mission in `kubestellar/console-kb` (for example `install-ollama`, `install-llama-cpp`, `install-localai`, `install-vllm`, `install-rhaiis`, `install-lm-studio`, `install-open-webui`, `install-claude-desktop`).

Copilot · 2026-04-15T23:58:00Z

+| Groq (OpenAI-compatible, HTTP) | `groq` | `GROQ_API_KEY` | `GROQ_MODEL` | `GROQ_BASE_URL` | **yes (chat only)** | `pkg/agent/provider_groq.go` |
+| OpenRouter (OpenAI-compatible, HTTP) | `openrouter` | `OPENROUTER_API_KEY` | `OPENROUTER_MODEL` | `OPENROUTER_BASE_URL` | **yes (chat only)** | `pkg/agent/provider_openrouter.go` |
+| Open WebUI (OpenAI-compatible, HTTP) | `open-webui` | `OPEN_WEBUI_API_KEY` | `OPEN_WEBUI_MODEL` | `OPEN_WEBUI_URL` | **yes (chat only)** | `pkg/agent/provider_openwebui.go` |


The provider table marks Groq/OpenRouter/Open WebUI as registered, but the earlier “Important: current registration status” section still states these HTTP providers are not registered/selected at runtime. Please update or remove that earlier paragraph so the document doesn’t contradict itself.

Copilot · 2026-04-15T23:58:01Z

+| Ollama (local, OpenAI-compatible) | `ollama` | `OLLAMA_API_KEY` (optional) | `OLLAMA_MODEL` | `OLLAMA_URL` (default `http://127.0.0.1:11434`) | **yes (chat only)** | `pkg/agent/provider_local_openai_compat.go` |
+| llama.cpp server | `llamacpp` | `LLAMACPP_API_KEY` (optional) | `LLAMACPP_MODEL` | `LLAMACPP_URL` | **yes (chat only)** | `pkg/agent/provider_local_openai_compat.go` |
+| LocalAI | `localai` | `LOCALAI_API_KEY` (optional) | `LOCALAI_MODEL` | `LOCALAI_URL` | **yes (chat only)** | `pkg/agent/provider_local_openai_compat.go` |
+| vLLM | `vllm` | `VLLM_API_KEY` (optional) | `VLLM_MODEL` | `VLLM_URL` | **yes (chat only)** | `pkg/agent/provider_local_openai_compat.go` |
+| LM Studio | `lm-studio` | `LM_STUDIO_API_KEY` (optional) | `LM_STUDIO_MODEL` | `LM_STUDIO_URL` (default `http://127.0.0.1:1234`) | **yes (chat only)** | `pkg/agent/provider_local_openai_compat.go` |
+| Red Hat AI Inference Server | `rhaiis` | `RHAIIS_API_KEY` (optional) | `RHAIIS_MODEL` | `RHAIIS_URL` | **yes (chat only)** | `pkg/agent/provider_local_openai_compat.go` |


This table introduces local providers (ollama/llamacpp/localai/vllm/lm-studio/rhaiis) and points to pkg/agent/provider_local_openai_compat.go, but that file/providers aren’t present in the current repo state. Either gate this section on the code landing (e.g., explicitly reference #8248 / version) or adjust the docs to match what’s actually in-tree at merge time.

github-actions · 2026-04-16T00:14:59Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

github-actions · 2026-04-16T00:17:35Z

Post-merge build verification passed ✅

Both Go and frontend builds compiled successfully against merge commit ee309415b17c7dad179ca7f8d88e0718420d15f4.

Copilot AI review requested due to automatic review settings April 15, 2026 23:54

kubestellar-prow Bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 15, 2026

kubestellar-prow Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 15, 2026

Copilot started reviewing on behalf of clubanderson April 15, 2026 23:55 View session

Copilot AI reviewed Apr 15, 2026

View reviewed changes

clubanderson mentioned this pull request Apr 15, 2026

📝 docs(console): add Local LLM Strategy page with decision matrix and 3 topology diagrams kubestellar/docs#1479

Merged

3 tasks

clubanderson merged commit ee30941 into main Apr 16, 2026
40 of 41 checks passed

clubanderson deleted the docs/security-model-local-llm-refresh branch April 16, 2026 00:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

📝 docs: SECURITY-MODEL.md §3 - mark local LLM providers registered and active#8250

📝 docs: SECURITY-MODEL.md §3 - mark local LLM providers registered and active#8250
clubanderson merged 1 commit intomainfrom
docs/security-model-local-llm-refresh

clubanderson commented Apr 15, 2026

Uh oh!

kubestellar-prow Bot commented Apr 15, 2026

Uh oh!

netlify Bot commented Apr 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Copilot AI Apr 15, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		The examples below are active recipes as of this revision of the document — the providers they rely on are registered in `InitializeProviders` and the `Available` field in the agent dropdown honors these env vars.

Conversation

clubanderson commented Apr 15, 2026

Summary

Test plan

Uh oh!

kubestellar-prow Bot commented Apr 15, 2026

Uh oh!

netlify Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole canceled.

Uh oh!

github-actions Bot commented Apr 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

github-actions Bot commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify Bot commented Apr 15, 2026 •

edited

Loading