add oauth-proxy to rawdeployments if odh auth label is present #419

VedantMahabaleshwarkar · 2024-10-09T19:15:59Z

What this PR does / why we need it:

This PR adds the following :

If the isvc has label "security.opendatahub.io/enable-auth" = "true"
-- an oauth proxy container is added to the deployment
-- http port is replaced by https port in the service
-- "service.beta.openshift.io/serving-cert-secret-name" is added to the service to allow creation of the tls secret
Modified the kserve raw deployment spec to use the kserve-sa service account (previously no SA was specified, the default SA was used)
This is needed so that oauth proxy can use the kserve-sa service account to perform auth delegation.
The service account, CRB and Route are created in Add reconciliation for Kserve Raw odh-model-controller#274

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes # https://issues.redhat.com/browse/RHOAIENG-10291, https://issues.redhat.com/browse/RHOAIENG-13444
TEST WITH: opendatahub-io/odh-model-controller#274

Type of changes
Please delete options that are not relevant.

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
This change requires a documentation update

Feature/Issue validation/testing:

Deploy ODH/RHOAI:
Install the DSC (kserve spec below) :

    kserve:
      defaultDeploymentMode: RawDeployment
      devFlags:
        manifests:
          - contextDir: config
            sourcePath: overlays/odh
            uri: 'https://github.com/VedantMahabaleshwarkar/kserve/tarball/devflags'
          - contextDir: config
            sourcePath: ''
            uri: 'https://github.com/VedantMahabaleshwarkar/odh-model-controller/tarball/devflags'
      managementState: Managed
      serving:
        ingressGateway:
          certificate:
            type: OpenshiftDefaultIngress
        managementState: Managed
        name: knative-serving

To test enabling route for a particular ISVC
-- Create any kserve isvc+SR
-- isvc should have annotation : "serving.kserve.io/deploymentMode" : RawDeployment
-- isvc should have label : "networking.kserve.io/visibility": "enable-route"
To test route with auth:
-- Create any kserve isvc+SR
-- isvc should have annotation : "serving.kserve.io/deploymentMode" : RawDeployment
-- isvc should have label: "security.opendatahub.io/enable-auth" = "true"
-- isvc should have label: "networking.kserve.io/visibility": "enable-route"
To test Inference without auth:
-- remove isvc label "security.opendatahub.io/enable-auth" = "true"

Now inference should work without token

Please confirm that if this PR changes any image versions, then that's the sole change this PR makes.

Checklist:

Have you added unit/e2e tests that prove your fix is effective or that this feature works?
Has code been commented, particularly in hard-to-understand areas?
Have you made corresponding changes to the documentation?

Release note:

Added oauth-proxy authentication for Kserve RawDeployment Routes

Re-running failed tests

/rerun-all - rerun all failed workflows.
/rerun-workflow <workflow name> - rerun a specific failed workflow. Only one workflow name can be specified. Multiple /rerun-workflow commands are allowed per comment.

openshift-ci · 2024-10-09T19:16:03Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

openshift-ci · 2024-10-09T19:16:05Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: VedantMahabaleshwarkar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [VedantMahabaleshwarkar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

pkg/controller/v1beta1/inferenceservice/reconcilers/ingress/kube_ingress_reconciler.go

VedantMahabaleshwarkar · 2024-10-10T16:35:44Z

tests passing locally, the failures look like test infra failures

/retest-required

terrytangyuan · 2024-10-10T17:03:01Z

Makefile

+#	#TODO Remove this until new controller-tools is released
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	#remove the required property on framework as name field needs to be optional
+#	yq 'del(.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.*.properties.*.required)' -i config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	#remove ephemeralContainers properties for compress crd size https://github.com/kubeflow/kfserving/pull/1141#issuecomment-714170602
+#	yq 'del(.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.*.properties.ephemeralContainers)' -i config/crd/full/serving.kserve.io_inferenceservices.yaml


Is commenting these out intentional?

fixed in update

These are still commented out?

Yes, I'm still seeing comments here...

terrytangyuan · 2024-10-10T17:04:11Z

pkg/constants/constants.go

@@ -414,6 +416,16 @@ const (
 	SupportedModelMLFlow      = "mlflow"
 )

+// opendatahub rawDeployment Auth
+const (
+	OauthProxyImage                 = "registry.redhat.io/openshift4/ose-oauth-proxy@sha256:4bef31eb993feb6f1096b51b4876c65a6fb1f4401fee97fa4f4542b6b7c9bc46"


Do we need to expose this config? e.g. any updates in the image would require code change in KServe

we don't update this oauth proxy image very frequently at all, but do you think I should add it to the configmap and try to consume it from there?

It is better exposing the config, as it allow users quickly moving to another image in case this one becomes vulnerable.

Also, all the other Oauth related constants should be exposed. These should be defaults and users should be capable of customizing, since we don't know how much load there will be which would determine the amount of memory and CPU to be assigned.

Done, kept these constants as fallback values but PR includes changes to the kserve manifests where the oauth proxy params are defined

Thanks! LGTM

See my other comment: https://github.com/opendatahub-io/kserve/pull/419/files#r1805239200

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

VedantMahabaleshwarkar · 2024-10-11T17:53:46Z

/retest-required

VedantMahabaleshwarkar · 2024-10-11T18:35:16Z

not sure what's happening with the tests, they are passing locally :(

israel-hdez · 2024-10-11T23:47:45Z

pkg/apis/serving/v1beta1/openapi_generated.go

@@ -1333,7 +1333,6 @@ func schema_pkg_apis_serving_v1alpha1_SupportedModelFormat(ref common.ReferenceC
 						},
 					},
 				},
-


Please, revert this file.

israel-hdez · 2024-10-11T23:48:58Z

pkg/constants/constants.go

@@ -414,6 +416,16 @@ const (
 	SupportedModelMLFlow      = "mlflow"
 )

+// opendatahub rawDeployment Auth
+const (
+	OauthProxyImage                 = "registry.redhat.io/openshift4/ose-oauth-proxy@sha256:4bef31eb993feb6f1096b51b4876c65a6fb1f4401fee97fa4f4542b6b7c9bc46"


It is better exposing the config, as it allow users quickly moving to another image in case this one becomes vulnerable.

Also, all the other Oauth related constants should be exposed. These should be defaults and users should be capable of customizing, since we don't know how much load there will be which would determine the amount of memory and CPU to be assigned.

config/overlays/odh/inferenceservice-config-patch.yaml

pkg/constants/constants.go

pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

pkg/controller/v1beta1/inferenceservice/reconcilers/service/service_reconciler.go

pkg/controller/v1beta1/inferenceservice/reconcilers/ingress/kube_ingress_reconciler.go

pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

israel-hdez · 2024-10-12T18:41:54Z

pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

+		`--cookie-secret=SECRET`,
+		`--openshift-delegate-urls={"/": {"namespace": "$isvcNamespace", "resource": "services", "verb": "get"}}`,
+		`--openshift-sar={"namespace": "$isvcNamespace", "resource": "services", "verb": "get"}`,
+		`--skip-auth-regex="(^/metrics|^/apis/v1beta1/healthz)"`,


For the liveness and readiness probes, instead of being fixed, you should inspect the ISVC and extract the configured paths.

I didn't get why we should do this. For the modelmesh oauth proxy injection the oauth proxy probes are fixed. Even here the kserve container and the oauth proxy container will report statuses independently so I'm not seeing why we should change the probes here

pkg/controller/v1beta1/inferenceservice/reconcilers/ingress/kube_ingress_reconciler.go

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

VedantMahabaleshwarkar · 2024-10-17T00:34:02Z

the e2e raw test failure is because https://github.com/opendatahub-io/kserve/blob/master/test/scripts/openshift-ci/run-e2e-tests.sh needs to be updated with the new behavior. Imo it can be ignored now can will be fixed later in https://issues.redhat.com/browse/RHOAIENG-14604

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

terrytangyuan · 2024-10-17T18:16:13Z

Makefile

+#	#TODO Remove this until new controller-tools is released
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	#remove the required property on framework as name field needs to be optional
+#	yq 'del(.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.*.properties.*.required)' -i config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	#remove ephemeralContainers properties for compress crd size https://github.com/kubeflow/kfserving/pull/1141#issuecomment-714170602
+#	yq 'del(.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.*.properties.ephemeralContainers)' -i config/crd/full/serving.kserve.io_inferenceservices.yaml


These are still commented out?

terrytangyuan · 2024-10-17T18:16:58Z

pkg/constants/constants.go

@@ -414,6 +416,16 @@ const (
 	SupportedModelMLFlow      = "mlflow"
 )

+// opendatahub rawDeployment Auth
+const (
+	OauthProxyImage                 = "registry.redhat.io/openshift4/ose-oauth-proxy@sha256:4bef31eb993feb6f1096b51b4876c65a6fb1f4401fee97fa4f4542b6b7c9bc46"


Thanks! LGTM

terrytangyuan · 2024-10-17T18:17:40Z

pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

+	"encoding/json"
+	"k8s.io/client-go/kubernetes"
+	"strconv"
+
+	"k8s.io/apimachinery/pkg/api/resource"


Imports are not sorted and grouped

terrytangyuan · 2024-10-17T18:19:03Z

pkg/controller/v1beta1/inferenceservice/reconcilers/ingress/kube_ingress_reconciler.go

+	// Check if the route is admitted
+	for _, ingress := range route.Status.Ingress {
+		for _, condition := range ingress.Conditions {
+			if condition.Type == "Admitted" && condition.Status == "True" {


There might be a constant from netv1 for "Admitted"

openshift-ci · 2024-10-17T19:09:45Z

@VedantMahabaleshwarkar: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-raw	`693027b`	link	true	`/test e2e-raw`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

israel-hdez · 2024-10-17T18:19:59Z

Makefile

+#	#TODO Remove this until new controller-tools is released
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_trainedmodels.yaml
+#	perl -pi -e 's/storedVersions: null/storedVersions: []/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	perl -pi -e 's/conditions: null/conditions: []/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	perl -pi -e 's/Any/string/g' config/crd/full/serving.kserve.io_inferencegraphs.yaml
+#	#remove the required property on framework as name field needs to be optional
+#	yq 'del(.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.*.properties.*.required)' -i config/crd/full/serving.kserve.io_inferenceservices.yaml
+#	#remove ephemeralContainers properties for compress crd size https://github.com/kubeflow/kfserving/pull/1141#issuecomment-714170602
+#	yq 'del(.spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.*.properties.ephemeralContainers)' -i config/crd/full/serving.kserve.io_inferenceservices.yaml


Yes, I'm still seeing comments here...

israel-hdez · 2024-10-17T18:27:02Z

config/overlays/odh/params.env

@@ -2,3 +2,4 @@ kserve-controller=quay.io/opendatahub/kserve-controller:latest
 kserve-agent=quay.io/opendatahub/kserve-agent:latest
 kserve-router=quay.io/opendatahub/kserve-router:latest
 kserve-storage-initializer=quay.io/opendatahub/kserve-storage-initializer:latest
+oauth-proxy=registry.redhat.io/openshift4/ose-oauth-proxy@sha256:4bef31eb993feb6f1096b51b4876c65a6fb1f4401fee97fa4f4542b6b7c9bc46


This image is extremely old, and with F health: https://catalog.redhat.com/software/containers/openshift4/ose-oauth-proxy/5cdb2133bed8bd5717d5ae64?image=6306f12280cc9b3291272668&architecture=amd64

Please, use a newer one.

israel-hdez · 2024-10-17T18:29:15Z

pkg/apis/serving/v1beta1/openapi_generated.go

@@ -1333,7 +1333,6 @@ func schema_pkg_apis_serving_v1alpha1_SupportedModelFormat(ref common.ReferenceC
 						},
 					},
 				},
-


israel-hdez · 2024-10-17T19:02:14Z

pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

+			`--cookie-secret=SECRET`,
+			`--openshift-delegate-urls={"/": {"namespace": "` + namespace + `", "resource": "inferenceservices", "group": "serving.kserve.io", "name": "` + isvc + `", "verb": "get"}}`,
+			`--openshift-sar={"namespace": "` + namespace + `", "resource": "inferenceservices", "group": "serving.kserve.io", "name": "` + isvc + `", "verb": "get"}`,
+			`--skip-auth-regex="(^/metrics|^/apis/v1beta1/healthz)"`,


Following up #419 (comment).

These are not the probes, but paths that would be left unprotected.

Now... I'm thinking that you are right on your comment that Kubernetes is going to do the probing on the container. With that in mind, I'm not sure why we should have unprotected paths. So, maybe, remove the --skip-auth-regex argument?

israel-hdez · 2024-10-17T19:03:57Z

pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

+			`--upstream=http://localhost:` + upstreamPort,
+			`--tls-cert=/etc/tls/private/tls.crt`,
+			`--tls-key=/etc/tls/private/tls.key`,
+			`--cookie-secret=SECRET`,


Please, follow-up my comment of the previous review round: #419 (comment)

israel-hdez · 2024-10-17T19:34:58Z

pkg/controller/v1beta1/inferenceservice/reconcilers/ingress/kube_ingress_reconciler.go

+	routeReady := false
+	route := &routev1.Route{}
+	err := cli.Get(context.TODO(), types.NamespacedName{Name: isvc.Name, Namespace: isvc.Namespace}, route)
+	if err != nil {


Handle appropriately the not found error.

israel-hdez · 2024-10-17T19:42:19Z

pkg/controller/v1beta1/inferenceservice/reconcilers/ingress/kube_ingress_reconciler.go

+	// Construct the URL
+	host := route.Spec.Host
+	isSecure := false
+	if isSecure, err = strconv.ParseBool(isvc.Labels[constants.ODHKserveRawAuth]); err != nil {


Slightly better to check if route.Spec.tls.termination is populated

israel-hdez · 2024-10-17T19:50:07Z

pkg/controller/v1beta1/inferenceservice/reconcilers/service/service_reconciler.go

+		if val, ok := componentMeta.Labels[constants.InferenceServiceLabel]; ok {
+			isvcname = val
+		}
+		service.ObjectMeta.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = isvcname


This reconciler is used for predictors, explainers, transformers and also the inference graph. So, it is going to be neccesary to use the name as is in componentMeta.Name rather than the name of the inference service. Otherwise, you will have several Services generating different certificates, for different FQDN, and trying to store such certificate to the same Secret, leading to conflicts.

Additionally, I'd recommend, adding a suffix like -serving-cert .

israel-hdez · 2024-10-17T20:11:47Z

pkg/controller/v1beta1/inferenceservice/reconcilers/service/service_reconciler.go

+		ports := service.Spec.Ports
+		replaced := false
+		for i, port := range ports {
+			if port.Port == constants.CommonDefaultHttpPort {
+				ports[i] = httpsPort
+				replaced = true
+			}
+		}
+		if !replaced {
+			ports = append(ports, httpsPort)
+		}


From

kserve/pkg/controller/v1beta1/inferenceservice/reconcilers/service/service_reconciler.go

Lines 70 to 110 in 4add27b

if len(container.Ports) > 0 {

var servicePort corev1.ServicePort

servicePort = corev1.ServicePort{

Name: container.Ports[0].Name,

Port: constants.CommonDefaultHttpPort,

TargetPort: intstr.IntOrString{

Type: intstr.Int,

IntVal: container.Ports[0].ContainerPort,

},

Protocol: container.Ports[0].Protocol,

}

servicePorts = append(servicePorts, servicePort)

for i := 1; i < len(container.Ports); i++ {

port := container.Ports[i]

if port.Protocol == "" {

port.Protocol = corev1.ProtocolTCP

}

servicePort = corev1.ServicePort{

Name: port.Name,

Port: port.ContainerPort,

TargetPort: intstr.IntOrString{

Type: intstr.Int,

IntVal: port.ContainerPort,

},

Protocol: port.Protocol,

}

servicePorts = append(servicePorts, servicePort)

}

} else {

port, _ := strconv.Atoi(constants.InferenceServiceDefaultHttpPort)

servicePorts = append(servicePorts, corev1.ServicePort{

Name: componentMeta.Name,

Port: constants.CommonDefaultHttpPort,

TargetPort: intstr.IntOrString{

Type: intstr.Int,

IntVal: int32(port), // #nosec G109

},

Protocol: corev1.ProtocolTCP,

})

}

, looks like the CommonDefaultHttpPort entry should be present always, and it is going to be the first entry always. So, I think you can simply mutate service.Spec.Ports[0] and change the target port...

...sorry, I know that I said about being defensive in my previous comment.

israel-hdez · 2024-10-17T20:20:04Z

pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

+			`--provider=openshift`,
+			`--skip-provider-button`,
+			`--openshift-service-account=kserve-sa`,
+			`--upstream=http://localhost:` + upstreamPort,


Looks like the upstream is always configured to the predictor container (the runtime). But when observing here:

kserve/pkg/controller/v1beta1/inferenceservice/reconcilers/service/service_reconciler.go

Lines 112 to 123 in 4add27b

if componentExt != nil && componentExt.Batcher != nil {

servicePorts[0].TargetPort = intstr.IntOrString{

Type: intstr.Int,

IntVal: constants.InferenceServiceDefaultAgentPort,

}

}

if componentExt != nil && componentExt.Logger != nil {

servicePorts[0].TargetPort = intstr.IntOrString{

Type: intstr.Int,

IntVal: constants.InferenceServiceDefaultAgentPort,

}

}

I can see that the Service is choosing between the agent container and the predictor container. Since when auth is enabled, that Service will be moved to oauth-proxy, there should be an equivalent logic here, so that oauth-proxy chooses between the predictor and the agent container.

By setting it fixed to the predictor, the agent container can be bypassed, leading to batching and logging features to stop working when enabling auth. The logging feature is being used by TrustyAI team, so I think we should ensure logging still works.

israel-hdez · 2024-10-17T20:32:34Z

pkg/controller/v1beta1/inferenceservice/rawkube_controller_test.go

@@ -1264,6 +1270,109 @@ var _ = Describe("v1beta1 inference service controller", func() {
 			Eventually(func() error { return k8sClient.Get(context.TODO(), predictorHPAKey, actualHPA) }, timeout).
 				Should(HaveOccurred())
 		})
+		It("Should have no ingress created if labeled as cluster-local", func() {


Perhaps, contribute this one to upstream?

israel-hdez · 2024-10-17T20:36:05Z

pkg/controller/v1beta1/inferenceservice/rawkube_controller_test.go

@@ -272,6 +272,8 @@ var _ = Describe("v1beta1 inference service controller", func() {
 								FSGroupChangePolicy: nil,
 								SeccompProfile:      nil,
 							},
+							ServiceAccountName:       constants.KserveServiceAccountName,


I'm not seeing right to change the default service account. It could be considered backwards incompatible.

israel-hdez · 2024-10-17T20:38:13Z

pkg/controller/v1beta1/inferenceservice/rawkube_controller_test.go

+			expectedService := &v1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      predictorServiceKey.Name,
+					Namespace: predictorServiceKey.Namespace,


Add unit tests for the routes.

israel-hdez · 2024-10-17T20:55:27Z

pkg/controller/v1beta1/inferenceservice/reconcilers/service/service_reconciler.go

+		ports := service.Spec.Ports
+		replaced := false
+		for i, port := range ports {
+			if port.Port == constants.CommonDefaultHttpPort {


If the CommonDefaultHttpPort is going away, I think you should reflect in the Status of the ISVC the right port to reach.

openshift-ci bot added the do-not-merge/work-in-progress label Oct 9, 2024

openshift-ci bot added the approved label Oct 9, 2024

github-advanced-security bot found potential problems Oct 9, 2024

View reviewed changes

pkg/controller/v1beta1/inferenceservice/reconcilers/ingress/kube_ingress_reconciler.go Fixed Show fixed Hide fixed

This was referenced Oct 9, 2024

add ability to choose ingress creation for Kserve RawDeployment opendatahub-io/opendatahub-operator#1230

Open

Add reconciliation for Kserve Raw opendatahub-io/odh-model-controller#274

Open

VedantMahabaleshwarkar requested review from terrytangyuan and israel-hdez October 9, 2024 20:30

VedantMahabaleshwarkar force-pushed the j-10306 branch from 360560d to 67041cc Compare October 10, 2024 16:10

VedantMahabaleshwarkar marked this pull request as ready for review October 10, 2024 16:10

openshift-ci bot removed the do-not-merge/work-in-progress label Oct 10, 2024

openshift-ci bot requested a review from Jooho October 10, 2024 16:10

VedantMahabaleshwarkar force-pushed the j-10306 branch from 67041cc to 2cce5bc Compare October 10, 2024 16:47

terrytangyuan reviewed Oct 10, 2024

View reviewed changes

VedantMahabaleshwarkar force-pushed the j-10306 branch from 2cce5bc to 44ba660 Compare October 10, 2024 18:42

add oauth-proxy to rawdeployments if odh auth label is present

da8dc3a

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

VedantMahabaleshwarkar force-pushed the j-10306 branch from 44ba660 to da8dc3a Compare October 10, 2024 18:43

israel-hdez reviewed Oct 12, 2024

View reviewed changes

VedantMahabaleshwarkar added 6 commits October 15, 2024 19:35

remove ingress modifications

ae2a13a

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

bug fix

a89f2bd

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

consume oauth proxy params from configmap

05ef572

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

fix oauth proxy sar and minor bugs

a94bdb6

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

revert some unneeded changes

25fd6aa

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

minor fix for linter

363289e

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

add oauth proxy flag to prevent login page redirect on invalid request

693027b

Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>

terrytangyuan reviewed Oct 17, 2024

View reviewed changes

israel-hdez reviewed Oct 17, 2024

View reviewed changes

	if len(container.Ports) > 0 {
	var servicePort corev1.ServicePort
	servicePort = corev1.ServicePort{
	Name: container.Ports[0].Name,
	Port: constants.CommonDefaultHttpPort,
	TargetPort: intstr.IntOrString{
	Type: intstr.Int,
	IntVal: container.Ports[0].ContainerPort,
	},
	Protocol: container.Ports[0].Protocol,
	}
	servicePorts = append(servicePorts, servicePort)

	for i := 1; i < len(container.Ports); i++ {
	port := container.Ports[i]
	if port.Protocol == "" {
	port.Protocol = corev1.ProtocolTCP
	}
	servicePort = corev1.ServicePort{
	Name: port.Name,
	Port: port.ContainerPort,
	TargetPort: intstr.IntOrString{
	Type: intstr.Int,
	IntVal: port.ContainerPort,
	},
	Protocol: port.Protocol,
	}
	servicePorts = append(servicePorts, servicePort)
	}
	} else {
	port, _ := strconv.Atoi(constants.InferenceServiceDefaultHttpPort)
	servicePorts = append(servicePorts, corev1.ServicePort{
	Name: componentMeta.Name,
	Port: constants.CommonDefaultHttpPort,
	TargetPort: intstr.IntOrString{
	Type: intstr.Int,
	IntVal: int32(port), // #nosec G109
	},
	Protocol: corev1.ProtocolTCP,
	})
	}

	if componentExt != nil && componentExt.Batcher != nil {
	servicePorts[0].TargetPort = intstr.IntOrString{
	Type: intstr.Int,
	IntVal: constants.InferenceServiceDefaultAgentPort,
	}
	}
	if componentExt != nil && componentExt.Logger != nil {
	servicePorts[0].TargetPort = intstr.IntOrString{
	Type: intstr.Int,
	IntVal: constants.InferenceServiceDefaultAgentPort,
	}
	}

add oauth-proxy to rawdeployments if odh auth label is present #419

Are you sure you want to change the base?

add oauth-proxy to rawdeployments if odh auth label is present #419

Conversation

VedantMahabaleshwarkar commented Oct 9, 2024 • edited Loading

openshift-ci bot commented Oct 9, 2024

openshift-ci bot commented Oct 9, 2024

VedantMahabaleshwarkar commented Oct 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

israel-hdez Oct 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

VedantMahabaleshwarkar commented Oct 11, 2024

VedantMahabaleshwarkar commented Oct 11, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

israel-hdez Oct 11, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

VedantMahabaleshwarkar commented Oct 17, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci bot commented Oct 17, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

VedantMahabaleshwarkar commented Oct 9, 2024 •

edited

Loading

israel-hdez Oct 11, 2024 •

edited

Loading

israel-hdez Oct 11, 2024 •

edited

Loading

VedantMahabaleshwarkar commented Oct 17, 2024 •

edited

Loading