Address PR review comments: security, config cleanup, and naming improvements

This commit addresses all requested changes from reviewers:

**Security (vhpintel):**
- Change vLLM pod to run as non-root (UID 1001) with supplementalGroups for GPU access
- Add seccompProfile: RuntimeDefault for enhanced security
- Add detailed comments on validating render/video GIDs per host

**Config Cleanup (AhmedSeemalK):**
- Remove hardcoded proxy settings (proxy-dmz.intel.com) from all.yml
- Remove hardcoded DNS servers (10.248.x.x, 10.45.x.x, 10.2.x.x) from all.yml
- Remove hardcoded domains (intel.com, bmgaisolutions.com) from no_proxy
- Remove hardcoded ansible_user from hosts.yaml
- Convert all config values to placeholders/comments

**Naming & Extensibility (amberjain1):**
- Rename all BMG models from "bmg-*" to "xpu-*" for future GPU support
- Updated 6 model identifiers (llama-8b, mistral-7b, deepseek, qwen-2-5-7b, falcon3-7b, qwen-coder-3b)
- Updated all ansible playbook tasks, helm releases, and service names

**Resource Naming (vhpintel):**
- Rename accelDeviceResource → xpuDeviceResource across all helm charts
- Add driver compatibility notes (gpu.intel.com/xe vs i915)

**Documentation:**
- Add cpu_or_gpu → device migration guide with before/after examples
- Document all accepted device values (cpu/hpu/xpu/gaudi2/gaudi3)
- Update vLLM image version to 0.17.0-xpu (fixes torch.compile crash in 0.14.1)
- Fix circular doc reference (intel-arc-bmg-setup.md → prerequisites.md)
- Fix typo: "Enteprise" → "Enterprise"

**Bug Fixes:**
- Remove merge conflict marker from README.md

Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>

Author: gta

README.md

@@ -1,4 +1,3 @@
-<<<<<<< HEAD
 # Intel® AI for Enterprise Inference
 
 Unleash the power of AI Inference on Intel Silicon

core/helm-charts/vllm/bmg-values.yaml

@@ -7,25 +7,49 @@
 
 # Intel XPU accelerator device (Arc GPU)
 accelDevice: "xpu"
-# Kubernetes resource name exposed by the Intel GPU device plugin
-accelDeviceResource: "gpu.intel.com/xe"
+# Kubernetes resource name exposed by the Intel GPU device plugin.
+# Use "gpu.intel.com/xe" with the newer Xe kernel driver (Ubuntu 25.10 / Arc B-series),
+# or "gpu.intel.com/i915" on hosts still using the i915 driver.
+xpuDeviceResource: "gpu.intel.com/xe"
 
 block_size: 64           # XPU-optimised KV cache block size (must be >= 64 for 0.14.1-xpu IPEX chunked prefill)
 max_num_seqs: 128        # Max concurrent sequences (tuned for Arc B-series VRAM)
 max_seq_len_to_capture: 2048
 d_type: "float16"
 max_model_len: 8192
+tensor_parallel_size: "1" # Arc Pro B50 has 1 GPU; adjust for multi-GPU setups
 
 image:
   repository: intel/vllm
-  tag: "0.14.1-xpu"
+  tag: "0.17.0-xpu"
   pullPolicy: IfNotPresent
   command: ["vllm", "serve"]
 
-# intel/vllm:0.14.1-xpu runs as root (no user defined in image)
+# --- Security context (non-root, scanner-compliant) ---
+# The intel/vllm:0.17.0-xpu image defaults to root, but the workload runs fine as
+# a non-root user (UID 1001) provided it can reach the Arc render node
+# (/dev/dri/renderD*). That device is owned by root:render on the host, so the pod
+# must join the host's "render" (and typically "video") group via supplementalGroups.
+# HF_HOME is set to /data (the model-volume mount); fsGroup: 1001 makes that volume
+# and the /tmp + /dev/shm emptyDirs group-writable, so caches work without root.
+#
+# IMPORTANT — validate the host GIDs on the BMG node before deploying (they vary by
+# distro/kernel). On the target node run:
+#   getent group render video          # e.g. render:x:993   video:x:44
+#   stat -c '%g %G' /dev/dri/renderD128
+# then set supplementalGroups below to the matching numeric GIDs. A GPU permission
+# error at startup almost always means the render GID here does not match the host.
 podSecurityContext:
-  fsGroup: 0
-  runAsUser: 0
+  runAsNonRoot: true
+  runAsUser: 1001
+  runAsGroup: 1001
+  fsGroup: 1001
+  # [<render GID>, <video GID>] — verify per host with `getent group render video`.
+  # Validated on the Arc Pro B50 test host (Ubuntu 25.10): render=992, video=44.
+  # These GIDs are NOT guaranteed across distros/kernels — re-check on each node.
+  supplementalGroups: [992, 44]
+  seccompProfile:
+    type: RuntimeDefault
 
 securityContext:
   allowPrivilegeEscalation: false
@@ -34,9 +58,12 @@ securityContext:
       - ALL
     add:
       - SYS_NICE
+  # vLLM/IPEX writes SYCL and compile caches at runtime, so the root filesystem
+  # cannot be fully read-only; model/HF caches live on the mounted /data volume.
   readOnlyRootFilesystem: false
-  runAsNonRoot: false
-  runAsUser: 0
+  runAsNonRoot: true
+  runAsUser: 1001
+  runAsGroup: 1001
 
 # Node affinity for BMG inference nodes
 affinity:
@@ -181,6 +208,8 @@ defaultModelConfigs:
     DO_NOT_TRACK: "1"
     VLLM_WORKER_MULTIPROC_METHOD: "spawn"
     HF_HUB_DISABLE_XET: "1"
+    HOME: "/tmp"  # Non-root UID 1001 not in /etc/passwd; HOME avoids getpass.getuser() in PyTorch cache
+    PYTORCH_DISABLE_TORCH_INDUCTOR: "1"  # Workaround: inductor cache requires getpass.getuser(), which fails for non-root UID 1001
   extraCmdArgs:
     [
       "--dtype", "float16",

core/helm-charts/vllm/templates/deployment.yaml

@@ -196,7 +196,7 @@ spec:
             {{- end }}
             {{- else }}
             limits:
-              {{ .Values.accelDeviceResource | default "habana.ai/gaudi" }}: {{ .Values.tensor_parallel_size | default (index .Values.modelConfigs .Values.LLM_MODEL_ID | default dict).tensor_parallel_size | default .Values.defaultModelConfigs.tensor_parallel_size | quote}}
+              {{ .Values.xpuDeviceResource | default "habana.ai/gaudi" }}: {{ .Values.tensor_parallel_size | default (index .Values.modelConfigs .Values.LLM_MODEL_ID | default dict).tensor_parallel_size | default .Values.defaultModelConfigs.tensor_parallel_size | quote}}
             {{- end }}
           {{- end }}
 

core/helm-charts/vllm/values.yaml

@@ -17,8 +17,8 @@ autoscaling:
 
 # empty for CPU (longer latencies are tolerated before HPA scaling unaccelerated service)
 accelDevice: ""
-# Kubernetes resource name for the accelerator (e.g. habana.ai/gaudi, gpu.intel.com/xe)
-accelDeviceResource: ""
+# Kubernetes resource name for the accelerator (e.g. habana.ai/gaudi, gpu.intel.com/xe or gpu.intel.com/i915)
+xpuDeviceResource: ""
 
 port: 2080
 shmSize: 1Gi

core/inventory/hosts.yaml

@@ -2,7 +2,7 @@ all:
   hosts:
     master1:
       ansible_connection: local
-      ansible_user: gta
+      # ansible_user: your-username
       ansible_become: true
   children:
     kube_control_plane:

core/inventory/metadata/all.yml

@@ -38,10 +38,7 @@ loadbalancer_apiserver_healthcheck_port: 8081
 # disable_host_nameservers: false
 
 ## Upstream dns servers
-upstream_dns_servers:
-  - "10.248.2.1"
-  - "10.45.15.7"
-  - "10.2.71.6"
+# upstream_dns_servers:
 #   - 8.8.8.8
 #   - 8.8.4.4
 
@@ -58,15 +55,15 @@ upstream_dns_servers:
 # external_cloud_provider:
 
 ## Set these proxy values in order to update package manager and docker daemon to use proxies and custom CA for https_proxy if needed
-http_proxy: "http://proxy-dmz.intel.com:912"
-https_proxy: "http://proxy-dmz.intel.com:912"
+# http_proxy: ""
+# https_proxy: ""
 # https_proxy_cert_file: ""
 
 # DO NOT CHANGE INDENTATION - used by Automation
-env_proxy:
-  http_proxy: "http://proxy-dmz.intel.com:912"
-  https_proxy: "http://proxy-dmz.intel.com:912"
-  no_proxy: "localhost,127.0.0.1,10.96.0.0/12,10.244.0.0/16,192.168.0.0/16,.svc,.cluster.local,10.233.0.1,10.233.0.0/18,10.0.0.0/8,intel.com,bmgaisolutions.com,api.example.com"
+# env_proxy:
+#   http_proxy: ""
+#   https_proxy: ""
+#   no_proxy: "localhost,127.0.0.1,10.96.0.0/12,10.244.0.0/16,192.168.0.0/16,.svc,.cluster.local,10.233.0.1,10.233.0.0/18,10.0.0.0/8"
 
 ## Refer to roles/kubespray-defaults/defaults/main/main.yml before modifying no_proxy
 # no_proxy: ""

core/lib/models/model-selection.sh

@@ -275,42 +275,42 @@ get_model_names() {
                     echo "Error: XPU model identifier provided for cpu/hpu deployment/removal." >&2
                     exit 1
                 fi
-                model_names+=("bmg-llama-8b")
+                model_names+=("xpu-llama-8b")
                 ;;
             32)
                 if [ "$device" = "cpu" ] || [ "$device" = "hpu" ]; then
                     echo "Error: XPU model identifier provided for cpu/hpu deployment/removal." >&2
                     exit 1
                 fi
-                model_names+=("bmg-mistral-7b")
+                model_names+=("xpu-mistral-7b")
                 ;;
             33)
                 if [ "$device" = "cpu" ] || [ "$device" = "hpu" ]; then
                     echo "Error: XPU model identifier provided for cpu/hpu deployment/removal." >&2
                     exit 1
                 fi
-                model_names+=("bmg-deepseek-r1-distill-llama8b")
+                model_names+=("xpu-deepseek-r1-distill-llama8b")
                 ;;
             34)
                 if [ "$device" = "cpu" ] || [ "$device" = "hpu" ]; then
                     echo "Error: XPU model identifier provided for cpu/hpu deployment/removal." >&2
                     exit 1
                 fi
-                model_names+=("bmg-qwen-2-5-7b")
+                model_names+=("xpu-qwen-2-5-7b")
                 ;;
             35)
                 if [ "$device" = "cpu" ] || [ "$device" = "hpu" ]; then
                     echo "Error: XPU model identifier provided for cpu/hpu deployment/removal." >&2
                     exit 1
                 fi
-                model_names+=("bmg-falcon3-7b")
+                model_names+=("xpu-falcon3-7b")
                 ;;
             36)
                 if [ "$device" = "cpu" ] || [ "$device" = "hpu" ]; then
                     echo "Error: XPU model identifier provided for cpu/hpu deployment/removal." >&2
                     exit 1
                 fi
-                model_names+=("bmg-qwen-2-5-coder-3b")
+                model_names+=("xpu-qwen-2-5-coder-3b")
                 ;;
             "llama-8b"|"llama-70b"|"codellama-34b"|"mixtral-8x-7b"|"mistral-7b"|"tei"|"tei-rerank"|"falcon3-7b"|"deepseek-r1-distill-qwen-32b"|"deepseek-r1-distill-llama8b"|"llama3-405b"|"llama-3-3-70b"|"llama-4-scout-17b"|"qwen-2-5-32b")
                 if [ "$device" = "cpu" ] || [ "$device" = "xpu" ]; then
@@ -326,7 +326,7 @@ get_model_names() {
                 fi
                 model_names+=("$model")
                 ;;
-            "bmg-llama-8b"|"bmg-mistral-7b"|"bmg-deepseek-r1-distill-llama8b"|"bmg-qwen-2-5-7b"|"bmg-falcon3-7b"|"bmg-qwen-2-5-coder-3b")
+            "xpu-llama-8b"|"xpu-mistral-7b"|"xpu-deepseek-r1-distill-llama8b"|"xpu-qwen-2-5-7b"|"xpu-falcon3-7b"|"xpu-qwen-2-5-coder-3b")
                 if [ "$device" = "cpu" ] || [ "$device" = "hpu" ]; then
                     echo "Error: XPU model identifier provided for cpu/hpu deployment/removal." >&2
                     exit 1