Cerebras Model Allowlist Drift Sentinel

An inference provider's model catalog is not static: a preview model can become reachable on an account without anyone opting in, and a model your production flows depend on can be deprecated and removed with no warning beyond a changelog entry. Cerebras exposes the live list through its own Models API; this blueprint diffs that list against the allowlist you actually approved, in both directions, instead of assuming the catalog never changes.

This blueprint was created by Mohit Jeswani.

How it works

1. list_models (io.kestra.plugin.cerebras.ListModels) calls GET /models and returns every model id the API key can currently see. Read-only; nothing in the Cerebras account is changed. allowFailure: true covers an API or auth error without failing the flow outright.
2. evaluate (io.kestra.plugin.core.output.OutputValues) computes, with jq, the set of available-but-not-approved models (unapproved_models) and the set of approved-but-no-longer-available models (missing_models), plus a combined drift_count.
3. route (io.kestra.plugin.core.flow.If):
   • compliant: logs the live model list, matching the allowlist.
   • alert: posts both drift directions to Slack by name.
4. summary logs the drift count and severity, closing the governance cycle.
5. errors alerts Slack if the flow itself fails, for example an expired API key.

What you get

• A two-way diff against a real, live API response, not a changelog you have to read yourself: an unauthorized model becoming reachable and a depended-on model disappearing are both caught by the same check.
• The exact model ids involved in the Slack alert, not just a generic "something changed."
• A read-only check with zero risk of triggering a billed completion or touching account configuration.

Who it's for

• AI platform and ML ops teams who standardize on an approved model list across Cerebras consumers and want drift from that list surfaced automatically, not discovered when a flow using a removed model starts failing.
• Teams evaluating the Cerebras plugin who want a worked example of ListModels used as a standing compliance check rather than a one-off lookup before a ChatCompletion call.

Why orchestrate this with Kestra

Cerebras reports what is reachable right now; it does not know what your organization approved, compare the two lists, or notify anyone when they diverge. Kestra keeps approved_models as a flow input instead of a wiki page nobody reads, turns the diff into a Slack page naming the exact models involved, and keeps a full execution history of every run.

Prerequisites

• A Cerebras account with an API key that has access to the Models API.
• A written-down list of the exact model ids your production flows are authorized to call.
• A Slack incoming webhook URL.

This flow calls the Cerebras API directly over HTTPS; there is no official local Cerebras emulator, so list_models cannot be exercised against a local Docker container.

Secrets

• CEREBRAS_API_KEY: the Cerebras API key used by list_models. In Kestra OSS, provide it as the base64-encoded environment variable SECRET_CEREBRAS_API_KEY.
• SLACK_WEBHOOK_URL: used by alert and the errors block. In Kestra OSS, provide it as the base64-encoded environment variable SECRET_SLACK_WEBHOOK_URL.

Inputs

Input	Type	Default	Description
approved_models	ARRAY	["llama3.1-8b", "llama-3.3-70b", "qwen-3-32b"]	Model IDs your flows are authorized to call
alert_on_drift	BOOL	true	Whether allowlist drift triggers the Slack alert

Outputs

• {{ outputs.list_models.models }}: every model the API key can see (id, ownedBy, created).
• {{ outputs.evaluate.values.unapproved_models }} / .missing_models: semicolon-joined model ids present but not approved, and approved but no longer present.
• {{ outputs.evaluate.values.drift_count }} / .severity: OK, MODEL_DRIFT, or CRITICAL.

Pitfalls

• ListModels only reports what the API key is scoped to see; an organization-wide model rollout invisible to this particular key will not show up as drift until the key itself gains access.
• created is null for a model entry when the Cerebras API does not provide a meaningful timestamp; this blueprint does not depend on it, but a downstream extension that sorts by age should account for nulls.
• missing_models cannot distinguish "deprecated and removed" from "temporarily unavailable during a provider incident"; a model disappearing for one run and returning on the next still counts as drift on the run where it was absent.

Quick start

1. Add the CEREBRAS_API_KEY and SLACK_WEBHOOK_URL secrets.
2. Set approved_models to your actual production allowlist.
3. Run the flow manually and confirm compliant logs the live model list.
4. Temporarily remove a real model id from approved_models to confirm alert fires with it listed under unapproved, then restore it.
5. Enable the daily trigger once the allowlist reflects what your flows are actually approved to call.

How to extend

• Call io.kestra.plugin.cerebras.ChatCompletion against each missing_models entry before alerting, to distinguish a true removal from a transient listing glitch.
• Store each run's available_model_ids in a KV entry to diff consecutive runs and report exactly when a model first appeared or disappeared, not just that it currently differs.
• Route unapproved-model alerts to a security or platform-governance Slack channel separately from missing-model alerts, since the two have different owners.

Links

• Kestra Cerebras Plugin Documentation
• Cerebras Models API Reference
• Slack Incoming Webhooks Documentation