[RHOAIENG-13638] - Do not allow isvc creation in protected isvc

[spolti]

chore: Fixes [RHOAIENG-13638] - Kserve model is not Ready after a kserve model is created and deleted from istio-system namespace

Description

How Has This Been Tested?

Unit tests and test on cluster.

To test it use the following DSC:

spec:
  components:
    codeflare:
      managementState: Removed
    kserve:
      devFlags:
        manifests:
          - contextDir: config
            sourcePath: ''
            uri: 'https://github.com/spolti/odh-model-controller/tarball/RHOAIENG-13638-t'
      managementState: Managed
      serving:
        ingressGateway:
          certificate:
            secretName: knative-serving-cert
            type: SelfSigned
        managementState: Managed
        name: knative-serving
    modelregistry:
      registriesNamespace: odh-model-registries
    trustyai:
      managementState: Removed
    ray:
      managementState: Removed
    kueue:
      managementState: Removed
    workbenches:
      managementState: Removed
    dashboard:
      managementState: Removed
    modelmeshserving:
      managementState: Removed
    datasciencepipelines:
      managementState: Removed
    trainingoperator: {}

Try to create a new ISVC using one of the protected namespaces:

• knative-serving
• Application Namespace
• Mesh Namespace

ISVC:

apiVersion: serving.kserve.io/v1beta1
kind: InferenceService
metadata:
  name: example-onnx-mnist
  # annotations:
  #   serving.kserve.io/deploymentMode: ModelMesh
spec:
  predictor:
    model:
      modelFormat:
        name: onnx
      runtime: ovms-1.x
      storage:
        key: localMinIO
        path: onnx/mnist.onnx
        parameters: # Parameters to override the default values inside the common secret.
          bucket: modelmesh-example-models

You should receive a issue like this preventing the isvc to be created:

$ oc create -f mnist-isvc.yaml -n opendatahub
Error from server (Forbidden): error when creating "mnist-isvc.yaml": admission webhook "validating.isvc.odh-model-controller.opendatahub.io" denied the request: namespace opendatahub is protected, The InferenceService example-onnx-mnist will not be created

Merge criteria:

• The commits are squashed in a cohesive manner and have meaningful messages.
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has manually tested the changes and verified that the changes work

[spolti]

the failure is interesting, the 0.12.0 was already there:
https://github.com/opendatahub-io/odh-model-controller/blob/main/config/base/params.env#L1

Guess I would need to move the tags to fast, yes?

cc @Jooho @israel-hdez

#313

[israel-hdez]

Please, change the target branch to incubating.
The main branch is now a stable/downstream branch.

[spolti]

IIMHO, we should wait until the end of the sprint or the beginning of the next.

[mwaykole]

hi @spolti i tried to create model in redhat-ods-applications-auth-provider and i was able to create the model

servingruntime.serving.kserve.io/ovms-runtime created
inferenceservice.serving.kserve.io/test-mnist-serverless created

for redhat-ods-applications seems to be working fine

oc apply -f isvc_ovms_oci_serverless.yaml -n redhat-ods-applications
servingruntime.serving.kserve.io/ovms-runtime unchanged
Error from server (Forbidden): error when creating "isvc_ovms_oci_serverless.yaml": admission webhook "validating.isvc.odh-model-controller.opendatahub.io" denied the request: Namespace redhat-ods-applications is protected, the InferenceService test-mnist-serverless will not be created

[spolti]

Hi @mwaykole, thanks for testing it, I spoke with @Jooho about it and we decided to protect only the 3 mentioned namespaces for now, but I am happy to add more if needed.
cc @israel-hdez

[israel-hdez]

Quite good. Minor comments.

[spolti]

@israel-hdez updated.

@mwaykole I've also updated the test branch with the new changes.

[israel-hdez]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: israel-hdez, spolti

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [israel-hdez,spolti]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment