Validate model connectivity, credentials, certificates, and configuration settings before installation to identify and resolve Model Gateway issues before deploying Bob on-premises.

Before installing Bob on-premises, verify that your model endpoints, authentication credentials, TLS certificates, and Model Gateway configuration are correctly configured and accessible from the target OpenShift cluster. Performing these validation checks helps identify connectivity issues, invalid credentials, certificate trust problems, and configuration errors before deployment, reducing installation failures and troubleshooting effort.

Run through this checklist before executing bobctl install to catch missing configurations early.

Connectivity testing to model endpoints

Confirm the OpenShift cluster can reach each model endpoint before any Bob component is deployed. Spin up a temporary debug pod in the target namespace and test HTTPS reachability directly:

# openai_compatible
oc run curl-test --image=curlimages/curl --restart=Never --rm -it -- \
  curl -v https://<model-endpoint>/v1/models

# bedrock
oc run curl-test --image=curlimages/curl --restart=Never --rm -it -- \
  curl -k https://bedrock.<AWS_REGION>.amazonaws.com/foundation-models \
  --aws-sigv4 "aws:amz:${REGION}:bedrock" \
  --user "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY"

For openai_compatible endpoints, test against the base_url value from your model gateway config. For air-gapped or private infrastructure, this is the only way to validate connectivity since there is no external reachability by design.

Authentication validation

Validate credentials before encoding them as secrets in config.yaml. A bad credential produces a failed Inference Service startup, often with a cryptic log message.

openai_compatible — test the API key directly from a debug pod:

curl -s https://<base_url>/v1/models \
  -H "Authorization: Bearer <api_key>" | jq '.data[].id'

bedrock — verify the AWS_ACCESS_KEY and AWS_SECRET_ACCESS_KEY values using the AWS CLI before adding them to config.yaml:
```
aws bedrock list-foundation-models --region us-east-1
```
vertex — decode the GEMINI_CREDENTIALS base64 value and confirm it is valid service-account JSON before supplying it:
```
base64 -d <<< "$GEMINI_CREDENTIALS" | jq '.type'
# Expected output: "service_account"
```

TLS certificate validation

If using ca_cert_pem with an openai_compatible endpoint, validate the certificate before supplying it as a secret.

Verify the cert is PEM-encoded and not expired:

echo "<cert content>" | openssl x509 -noout -dates

Confirm the cert matches the endpoint's CA chain:

openssl s_client -connect <host>:<port> -CAfile ca.pem

Warning:

insecure_skip_verify: true may be used temporarily during initial connectivity debugging only. Remove it before going live. If ca_cert_pem references an environment variable that is not present in bob.modelGateway.secrets, the Inference Service starts successfully but TLS fails at inference time.

Model discovery validation

Confirm the model ID in your provider block exactly matches what the provider exposes. A mismatch results in a 404 or model-not-found error at inference time, not at startup.

For openai_compatible endpoints, check available model IDs before install:

curl -s https://<base_url>/v1/models \
  -H "Authorization: Bearer <api_key>" | jq '.data[].id'

Common misconfiguration checks

Misconfiguration	Symptom	Check
Secret name in model config doesn't match key in `config.yaml` `secrets` block	Auth fails at request time, not startup	Diff every `env.*` reference in model config against `bob.modelGateway.secrets` keys
`GEMINI_CREDENTIALS` not base64-encoded	Vertex provider fails to parse credentials on startup	Run `base64 -d <<< "$VALUE"` and confirm it is valid JSON with `"type": "service_account"`
`base_url` includes a trailing `/` or path suffix	Provider returns 404	Strip trailing slashes — the gateway appends paths like `/v1/chat/completions` itself
Duplicate `model_name` values in the `models` list	Undefined routing behavior	Ensure all `model_name` values are unique across the config
`bobctl install` run without `--model-config`	Empty gateway, no inferencing	Confirm `--model-config` is passed and the file is readable at the specified path
`ca_cert_pem` env var defined in model config but missing from `secrets`	TLS failure at inference time	Cross-check every `env.*` reference in the model config against the `secrets` block

Validation before installation

Connectivity testing to model endpoints

Authentication validation

TLS certificate validation

Model discovery validation

Common misconfiguration checks

On this page