[remotego]

What type of PR is this?

• feature

What this PR does and why

The SLO CRDs have moved on and slo-api had not followed:

• JobSLORequirement. decision-gen already sizes job services from it, and the chart's slo-api ClusterRole already grants jobslorequirements, but slo-api only watched LLMSLORequirement, so job services had no front door.
• pdengine bounds (feat(llm-slo-decision-gen): add pdengine bound type to LLMSLORequirement CRD helm-charts#95, consumed by feat: PD engine scaling for pdengine LLMSLORequirements slo-scaler-decision-gen#11): new bound type, plus CEL rules that both bounds share a type and that a pdengine max is not 1.
• Scale-to-zero (helm-charts#20): the CRD allows bound value 0; slo-api still refused it with 400.

Changes:

• CRIndex runs one watch per kind, keyed by (plural, ns, name). A route resolves across both kinds, since decision-gen sizes them side by side; a serviceId on more than one CR is 409, as before. A cluster without the JobSLO CRD (404 on list) indexes that kind as empty and looks again every 60s, so /readyz is not held at 503.
• Validation is per kind (translate.SECTIONS, ALLOWED_DEPLOY_TYPES_*): a job route takes queue: {maxDepth, promql} instead of ttft/otps, with bounds replica (or concurrency for the minimum). promql may be left out of a PUT to keep the stored one (it is a merge patch). DELETE on a job route keeps queue, which its CRD requires.
• Cross-field rules are not duplicated in Python. They depend on the merged spec, which the API server checks anyway; its 422 now maps to 400 invalid_request. The message is built from the Status details.causes, not the top-level message, which names the CR — callers never see a CR name. A single cause's spec.x.y field becomes the API's x.y.
• config/rbac/rbac.yaml grants jobslorequirements; README, OpenAPI, CHANGELOG and the demo form's bound types follow. The README also no longer says reads of an ambiguous route return the first CR — they have always been 409.

What existing LLM clients see. Requests and responses that worked before are unchanged. The differences:

• A write the CRD rejects is 400 invalid_request with the API server's reason, where it was 502 upstream_error (the error path only; 400 is also the correct "don't retry").
• GET /config also lists job routes, in the same summary shape (route, highPriority, bounds).
• A serviceId on both an LLM and a job CR is 409. That setup is new, and decision-gen would size both under one key anyway.
• The 409 message says "SLO requirement CRs"; its code is unchanged.

Without this: job SLOs can only be changed with kubectl, a pdengine or zero bound cannot be written through the API, and a bound-type mismatch shows up as an opaque 502.

Which issue(s) this PR fixes

Refs modelsphere/helm-charts#95, modelsphere/slo-scaler-decision-gen#11. Until helm-charts#95 lands, a pdengine bound is refused by the cluster's CRD and comes back as 400 with the API server's reason.

How it was tested

$ python -m pytest -q
76 passed in 12.93s
$ python tests/smoke_run.py   # all steps ✓

20 new tests: job routes (GET/PUT keeps promql, LLM fields refused, DELETE keeps queue, list), a serviceId shared across kinds is 409, a missing JobSLO CRD still syncs, a relist of one kind keeps the other, pdengine/zero bounds, queue validation, and 422 → 400 without the CR name. The fake API is now plural-aware (it returned every CR for every plural). The new guards were checked against broken code: with the 404 handling, the 422 mapping, or the causes-based message reverted, their tests fail.

Not tested on a cluster.

Checks

• Tests and linters for what changed pass locally (see the repository's README or CONTRIBUTING)
• Docs updated where behaviour, a config key or a chart value moved
• No internal hostnames, IPs, registries or credentials

Release note

slo-api serves JobSLORequirement routes (`queue` in place of ttft/otps), accepts `pdengine` and zero bounds, and answers a write the CRD's rules reject with 400 instead of 502. action required: if slo-api's RBAC is not the chart's, grant get/list/watch/patch/update on jobslorequirements.

🤖 Generated with Claude Code