[Defilan]

What

llmkube benchmark now sends Authorization: Bearer <key> on every request, so it benchmarks an InferenceService that sets spec.endpoint.apiKeySecretRef instead of getting 401.

The key comes from the Secret the controller wired into the server, read through the user's kubeconfig. --api-key-file and LLMKUBE_API_KEY override it (flag beats variable beats ref). A service that needs a key the CLI cannot read gets one advisory line naming the two overrides, and a Secret the CLI cannot read aborts the run with a cause before any request is sent. The key is never printed or written to a report.

Why

Fixes #2042

An operator who protects an endpoint with an API key could not benchmark it with the same tool they use for open endpoints, so timeouts and capacity had to be sized some other way. The benchmark client set only Content-Type, so every request to a keyed endpoint got 401.

How

Commit	What it did
d4c8fc82 feat(cli): send the endpoint API key from llmkube benchmark	New pkg/cli/benchmark_auth.go (key selection, Secret read, override loading); one Authorization header site in sendBenchmarkRequestWithPrompt, which every mode funnels through; key resolution in getEndpoint after the Ready check; --api-key-file flag; --endpoint without a SERVICE_NAME; docs
407b9b8d fix(cli): send a header-safe key and report a ref the controller did not wire	Strip the bytes a header cannot carry; report a ref the controller vetoed via extraArgs
3852a785 fix(cli): report a key whose trailing bytes a header cannot carry	Warn when a Secret or variable is trimmed, because vLLM hashes the stored bytes unstripped
d5b75cd3 fix(cli): refuse a Secret value that is only whitespace	Abort with a cause instead of reporting a key source while sending none
a214c133 fix(cli): treat a whitespace-only API key variable as unset	Same shape on the env path; the ref still applies
9693c74a fix(cli): isolate the catalog key per model and pin the env trim warning	Per-model opts copy; test for the env trim warning; ambient env cleared in fixtures
107c30e2 test(cli): pin that an --endpoint benchmark needs no kubeconfig	The pin the first commit's ledger already claimed
2d315d57 fix(cli): pass the command context to catalog and suite runs	Both modes take cmd.Context() like the rest. No runtime change today, since the entrypoint calls Execute()
40f0e29e docs(cli): state that an --endpoint run takes the exported key	The documented answer for an exported key plus --endpoint

Key design decisions, argued from the audit trail in the commit bodies:

• Header shape is Authorization: Bearer <key>, checked against vLLM v0.32.0 vllm/entrypoints/serve/middleware/authenticate.py and SGLang v0.5.22 python/sglang/srt/utils/auth.py. Both compare the value whole and case-insensitively on the scheme.
• /health stays unkeyed. vLLM guards only /v1, /v2, /inference, /cohere; SGLang always allows /health, /ready, /metrics. The port-forward readiness and model-load waits therefore send nothing, so a keyed service cannot hang them.
• The CLI only sends a key the server actually uses. selectAPIKeyRef mirrors the controller's endpointAPIKeyRef, including the rule that an --api-key in spec.extraArgs means LLMKube wired no Secret.
• Unreadable Secret aborts, unreadable source does not. A missing Secret, missing key, empty value or whitespace-only value fails the run with a cause. A source the CLI cannot read (extraArgs, args with command, VLLM_API_KEY in env) prints one advisory and lets the run proceed unkeyed.
• Trimming is reported, not silent. A header cannot carry CR or LF, so the CLI strips them; because the pod receives the Secret bytes verbatim and vLLM hashes them unstripped, a value that needed trimming cannot match, so the CLI says it trimmed rather than reporting phantom successes.
• --endpoint stays cluster-blind. A run pointed at an explicit URL reads nothing from the cluster, so it works with no kubeconfig; the override still applies, and the help and guide say so.

AI assistance

Assisted-by: DeepSeek-V4.1-Flash (deepseek-ai/DeepSeek-V4.1-Flash, vllm runtime, self-hosted with LLMKube on 3x NVIDIA GB10; roles: planning, code, tests and commit messages, executing review: base-vs-head probes and mutation checks)
Assisted-by: qwen38-flash-next (unsloth/Qwen3.8-Flash-Next-GGUF UD-Q3_K_XL, generic (llmkube-gufo-rocm-gfx1151) runtime, self-hosted with LLMKube on AMD Strix Halo (Ryzen AI Max, Radeon iGPU); roles: read-only review)

Verified by the author: Read the diffs and supervised the build

Checklist

• Tests added/updated
• make test passes locally
• make lint passes locally
• Commit messages follow conventional commits
• All commits are signed off (git commit -s) per DCO
• AI assistance (if any) is disclosed above, per CONTRIBUTING.md
• Documentation updated (if user-facing change)

[codecov]

Codecov Report

❌ Patch coverage is 86.95652% with 15 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/cli/benchmark.go	83.33%	6 Missing ⚠️
pkg/cli/benchmark_catalog.go	0.00%	6 Missing ⚠️
pkg/cli/benchmark_auth.go	95.65%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!