ReleaseBytes
gcp Google Cloud Blog ·

k8s-aibom open-sourced for automated AI Bill of Materials on GKE

blogaiinfragaengineergcp-gkegcp-cloud-storage
feature announcement

Google Cloud has open-sourced k8s-aibom, a Kubernetes controller designed to automatically detect AI runtimes and generate CycloneDX Machine Learning Bill of Materials (ML-BOMs). This innovation addresses the challenge of managing 'shadow AI' by providing runtime visibility without slowing development or requiring privileged cluster access. The controller works by monitoring cluster workloads and container environments, producing standards-conformant BOMs that can be exported to sinks like Google Cloud Storage, aiding compliance with regulations like the EU AI Act and NIST AI RMF.

  • →Automated AI artifact discovery and ML-BOM generation
  • →Deterministic Confidence Model for audit-grade visibility
  • →Immutable ML-BOMs for enhanced auditability
  • →Unprivileged controller for zero developer friction
  • →Streamlined governance and regulatory compliance
Features (3) ›
  • Automated AI artifact discovery and ML-BOM generation

    k8s-aibom continuously monitors Kubernetes cluster resources and container environments to automatically detect AI runtimes, agent frameworks, and vector databases. It then generates standard CycloneDX 1.6 Machine Learning Bill of Materials (ML-BOMs).

  • Deterministic Confidence Model for audit-grade visibility

    k8s-aibom employs a Confidence Model to categorize discovered AI assets as 'Declared' (explicitly defined) or 'Inferred' (autonomously detected). This helps compliance auditors distinguish between explicit engineering intent and runtime inference, establishing a chain of trust.

  • Immutable ML-BOMs for enhanced auditability

    Generated ML-BOMs can be exported to sinks like Google Cloud Storage with preconditions that enforce immutability. This ensures that once written, BOMs cannot be silently overwritten or tampered with, providing an unalterable audit log.

Enhancements (2) ›
  • Unprivileged controller for zero developer friction

    The k8s-aibom controller deploys as a single, unprivileged Deployment, requiring no modifications to developer pod specifications, sidecars, or CI/CD pipelines. This approach respects SRE mandates for cluster stability and avoids compromising security by demanding privileged access.

  • Streamlined governance and regulatory compliance

    By automating the generation of standardized ML-BOMs from runtime state, k8s-aibom provides foundational data to help organizations align with global regulatory frameworks such as the EU AI Act and NIST AI Risk Management Framework.

Notes (1) ›
  • Open-source release aims to manage shadow AI

    The open-sourcing of k8s-aibom is intended to help security teams manage 'shadow AI' by providing automated visibility into AI workloads deployed without formal registration, thereby mitigating risks without hindering developer velocity.

Read the original announcement →

https://cloud.google.com/blog/products/identity-security/introducing-k8s-aibom-on-gke-for-automated-ai-bills-of-materials/

Related releases