misc: updates

clusters/default/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
 - ../../components/configs/cluster/rbac/overlays/default
 - ../../components/operators/web-terminal/operator/overlays/fast
 - ../../components/configs/cluster/web-terminal/overlays/enhanced
+- ../../components/configs/cluster/console-samples

components/configs/cluster/console-samples/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- sample-build-config-dockerfile.yaml
+- sample-custom-s2i-quickstart.yaml

components/configs/cluster/rbac/base/kustomization.yaml

@@ -4,5 +4,7 @@ kind: Kustomization
 resources:
   - 99-master-ssh-machineconfig.yaml
   - 99-worker-ssh-machineconfig.yaml
+  - workshop-admins-group.yaml
+  - workshop-users-group.yaml
   # see components/configs/namespaces/base
   # - self-provisioner-clusterrolebinding.yaml

components/configs/cluster/rbac/base/workshop-admins-group.yaml

@@ -0,0 +1,5 @@
+kind: Group
+apiVersion: user.openshift.io/v1
+metadata:
+  name: workshop-admins
+users: []

components/configs/cluster/rbac/base/workshop-users-group.yaml

@@ -0,0 +1,5 @@
+kind: Group
+apiVersion: user.openshift.io/v1
+metadata:
+  name: workshop-users
+users: []

components/configs/cluster/rbac/overlays/rhdp/kustomization.yaml

@@ -7,17 +7,3 @@ resources:
   - cluster-admins-custom-rolebinding.yaml
   - cluster-readers-custom-group.yaml
   - cluster-readers-custom-rolebinding.yaml
-
-patches:
-  - target:
-      group: machineconfiguration.openshift.io
-      version: v1
-      kind: MachineConfig
-      name: 99-master-ssh
-    path: patch-ssh.yaml
-  - target:
-      group: machineconfiguration.openshift.io
-      version: v1
-      kind: MachineConfig
-      name: 99-worker-ssh
-    path: patch-ssh.yaml

components/configs/kustomized/custom-notebook-images/base/opencv/buildconfig.yaml

@@ -13,7 +13,7 @@ spec:
     dockerStrategy:
       from:
         kind: ImageStreamTag
-        name: tensorflow:2023.1-cuda-11.8
+        name: tensorflow:2023.1
         namespace: custom-notebooks
       dockerfilePath: Containerfile
   output:

components/configs/kustomized/minio/data-connector-rb.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: data-connector-setup-edit
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- kind: ServiceAccount
+  name: data-connector-setup
+  namespace: ds-group-project

components/configs/kustomized/minio/kustomization.yaml

@@ -11,10 +11,11 @@ commonLabels:
   # app.kubernetes.io/part-of: minio
 
 resources:
+- data-connector-rb.yaml
 - deployment.yaml
 - namespace.yaml
 - pvc.yaml
 - route.yaml
-- secret.yaml
+# - secret.yaml
 - service.yaml
-# - setup-job.yaml
+- setup-root-user-job.yaml

components/configs/kustomized/minio/namespace.yaml

@@ -6,5 +6,5 @@ metadata:
   labels:
     app: minio
   annotations:
-    openshift.io/display-name: "MinIO Object Storage"
+    openshift.io/display-name: "Minio Object Storage"
     argocd.argoproj.io/sync-wave: "0"

components/configs/kustomized/minio/setup-job.yaml → components/configs/kustomized/minio/setup-root-user-job.yaml

@@ -15,24 +15,33 @@ spec:
       - name: create-minio-root-user
         image: image-registry.openshift-image-registry.svc:5000/openshift/tools:latest
         imagePullPolicy: IfNotPresent
+        env:
+          - name: SECRET_NAME
+            value: minio-root-user
         command: ["/bin/bash"]
         args:
         - -ec
         - |-
-          if [ -n "$(oc get secret minio-root-user -oname 2>/dev/null)" ]; then
-            echo "Secret already exists. Skipping." >&2
-            exit 0
+          # FORCE=true
+
+          if [ -n "$(oc get secret minio-root-user -o name 2>/dev/null)" ]; then
+            echo "Secret already exists."
+            [ -z ${FORCE+x} ] && exit 0
+            echo "Forcing creation."
           fi
+
           genpass() {
               < /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c"${1:-32}"
           }
+
           id=$(genpass 16)
           secret=$(genpass)
+
           cat << EOF | oc apply -f-
           apiVersion: v1
           kind: Secret
           metadata:
-            name: minio-root-user
+            name: ${SECRET_NAME}
           type: Opqaue
           stringData:
             MINIO_ROOT_USER: ${id}

components/configs/kustomized/rhods-data-connector/create-data-connection-job.yaml

@@ -0,0 +1,88 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: create-data-connection
+spec:
+  backoffLimit: 4
+  template:
+    spec:
+      serviceAccount: data-connector-setup
+      serviceAccountName: data-connector-setup
+      containers:
+      - name: create-data-connection
+        image: image-registry.openshift-image-registry.svc:5000/openshift/tools:latest
+        imagePullPolicy: IfNotPresent
+        env:
+          - name: MINIO_SECRET_NAME
+            value: minio-root-user
+          - name: MINIO_NAMESPACE
+            value: minio
+          - name: DATA_CONNECTION_NAME
+            value: s3-connection-minio
+          - name: AWS_DEFAULT_REGION
+            value: us
+          - name: AWS_S3_ENDPOINT
+            value: http://minio.minio.svc:9000
+          - name: AWS_S3_BUCKET
+            value: serving-demo
+        command: ["/bin/bash"]
+        args:
+        - -ec
+        - |
+          echo "MINIO_NAMESPACE: ${MINIO_NAMESPACE}"
+          echo -n "Waiting for secret ${MINIO_SECRET_NAME}."
+
+          while [ -z "$(oc get secret -n minio ${MINIO_SECRET_NAME} -o name 2>/dev/null)" ]; do
+            echo -n '.'
+            sleep 1
+          done; echo
+
+          id=$(oc get secret -n minio ${MINIO_SECRET_NAME} -o go-template='{{.data.MINIO_ROOT_USER|base64decode}}')
+          secret=$(oc get secret -n minio ${MINIO_SECRET_NAME} -o go-template='{{.data.MINIO_ROOT_PASSWORD|base64decode}}')
+
+          echo "Creating secret ${DATA_CONNECTION_NAME}"
+          cat << EOF | oc apply -f-
+          apiVersion: v1
+          kind: Secret
+          metadata:
+            name: ${DATA_CONNECTION_NAME}
+            labels:
+              opendatahub.io/dashboard: "true"
+              opendatahub.io/managed: "true"
+            annotations:
+              opendatahub.io/connection-type: s3
+              openshift.io/display-name: Minio
+          type: Opaque
+          stringData:
+            AWS_ACCESS_KEY_ID: ${id}
+            AWS_SECRET_ACCESS_KEY: ${secret}
+            AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION}
+            AWS_S3_ENDPOINT: ${AWS_S3_ENDPOINT}
+            AWS_S3_BUCKET: ${AWS_S3_BUCKET}
+          EOF
+      restartPolicy: Never
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: data-connector-setup
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  name: data-connector-setup-edit
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- kind: ServiceAccount
+  name: data-connector-setup
+  namespace: ds-group-project

components/configs/kustomized/rhods-data-connector/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: ds-group-project
+
+resources:
+  - create-data-connection-job.yaml

components/configs/kustomized/rhods-model-instances/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: ds-group-project
+
+resources:
+- openvino
+- triton

components/configs/kustomized/model-server/inference.yaml → components/configs/kustomized/rhods-model-instances/openvino/inference.yaml

@@ -8,14 +8,14 @@ metadata:
   labels:
     name: stocks
     opendatahub.io/dashboard: "true"
-  name: stocks
+  name: openvino-stocks
 spec:
   predictor:
     model:
       modelFormat:
         name: onnx
         version: "1"
-      runtime: stocks
+      runtime: vino
       storage:
         key: minio-connection
         path: stocks.onnx

components/configs/kustomized/model-server/kustomization.yaml → components/configs/kustomized/rhods-model-instances/openvino/kustomization.yaml

@@ -1,6 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
+namespace: ds-group-project
+
 resources:
 - inference.yaml
 - runtime.yaml

components/configs/kustomized/model-server/runtime.yaml → components/configs/kustomized/rhods-model-instances/openvino/runtime.yaml

@@ -8,11 +8,11 @@ metadata:
     opendatahub.io/disable-gpu: "true"
     opendatahub.io/template-display-name: OpenVINO Model Server
     opendatahub.io/template-name: ovms
-    openshift.io/display-name: stocks
+    openshift.io/display-name: vino
   labels:
-    name: stocks
+    name: vino
     opendatahub.io/dashboard: "true"
-  name: stocks
+  name: vino
 spec:
   builtInAdapter:
     memBufferBytes: 134217728

components/configs/kustomized/rhods-model-instances/triton/inference.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: serving.kserve.io/v1beta1
+kind: InferenceService
+metadata:
+  annotations:
+    openshift.io/display-name: stocks
+    serving.kserve.io/deploymentMode: ModelMesh
+  labels:
+    name: stocks
+    opendatahub.io/dashboard: "true"
+  name: triton-stocks
+spec:
+  predictor:
+    model:
+      modelFormat:
+        name: tensorflow
+        version: "1"
+      runtime: triton
+      storage:
+        key: minio-connection
+        path: stocks.onnx

components/configs/kustomized/rhods-model-instances/triton/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: ds-group-project
+
+resources:
+- inference.yaml
+- runtime.yaml