The rapid proliferation of generative AI across enterprise environments has given rise to the challenge of "shadow models," where the actual composition of deployed components diverges from official design documentation. Amidst intensifying regulatory pressure and stringent requirements for supply chain transparency, traditional source code analysis is no longer sufficient. To bridge this gap, Google introduces k8s-aibom—a tool for the dynamic inventory of AI workloads directly within a live cluster. This controller transforms deployment sprawl into a structured component registry, providing the critical level of observability essential for modern MLOps.
In modern machine learning infrastructure, the discrepancy between what is planned during the CI/CD phase and what is actually executed in production can become a critical blind spot. To bridge this gap, Google has released k8s-aibom—a specialized Kubernetes controller designed to automate the generation of Machine Learning Bills of Materials (ML-BOM) aligned with the CycloneDX 1.6 standard. Unlike static scanners, this tool operates on the live state of the cluster, identifying workloads that may have been deployed outside official registration systems.
The controller's mechanism relies on a deep analysis of standard Kubernetes resources, ranging from Deployments and StatefulSets to KServe’s specialized InferenceService. k8s-aibom acts as a digital detective, reconstructing the full stack by analyzing heuristics such as container image names, environment variables, command-line arguments, and volume configurations.
The spectrum of recognized components covers nearly every key layer of the modern AI pipeline:
— Model runtimes, such as vLLM, NVIDIA Triton, Hugging Face TGI, and Ollama;
— Agentic frameworks, including LangChain, AutoGen, and CrewAI;
— Vector databases and RAG tools (Milvus, Qdrant, pgvector);
— Training and fine-tuning toolsets based on PyTorch, JAX, KubeRay, and Hugging Face Accelerate;
— Model evaluation systems, such as Ragas and lm-evaluation-harness.
The output is an AIBOM resource, where the status.bomDocument field stores a detailed inventory of the system's composition. For seamless integration with external ecosystems, data can be exported to Google Cloud Storage or transmitted via webhooks.
The tool's deployment philosophy is particularly noteworthy. k8s-aibom is designed as an unprivileged Deployment that requires no sidecar containers, eBPF implementation, or node kernel access. This ensures maximum security and ease of adoption; it interacts with the cluster exclusively via the standard Kubernetes API and activates only in namespaces marked with a specific label. However, this architecture introduces certain constraints—the controller observes resource configurations but cannot analyze network traffic or internal container processes.
To ensure data integrity, k8s-aibom implements a confidence-level system for every detected property. If a parameter was explicitly defined by the developer in the configuration (e.g., via a --model flag), it is assigned the status declared. If the runtime is identified by the image name, it is marked as inferred. In cases where an AI component is evident but its exact parameters cannot be determined, it is flagged as unresolved. This approach allows auditors to clearly distinguish between explicit developer intent and scanner hypotheses.
A key conceptual departure from traditional SBOM tools is the shift in focus from the build phase to the execution phase. While a conventional scanner reveals what should be deployed, this controller captures what is actually running. This transforms the tool into a powerful mechanism for monitoring configuration drift, fitting perfectly into GitOps workflows by enabling real-time comparison of ML-BOM versions and tracking dependency evolution.
From a compliance perspective, the solution is engineered to meet stringent international standards, including the EU AI Act, the NIST AI Risk Management Framework, and ISO/IEC 42001. While not a certification tool itself, it provides the essential data foundation required for auditing. To protect log integrity during cloud export, the DoesNotExist condition is utilized, preventing the silent overwriting of previous BOM versions and guaranteeing an immutable history of changes.
Currently in alpha (v1.0), the project is intended for non-critical observation scenarios. It requires Kubernetes version 1.27 or higher and, despite its origins, remains entirely cloud-agnostic. It can be deployed across GKE, Amazon EKS, Azure AKS, OpenShift, or on-premises clusters, positioning k8s-aibom as a universal standard for AI infrastructure transparency regardless of the provider.
The Evolution of the KytyPS5 Compatibility Layer
