Skip to content

Commit dfe02ca

Browse files
LogicalGuy77juliusvonkohout
LogicalGuy77
and
juliusvonkohout
authored
feat: GitHub Actions workflow to test the KServe Models Web Application (#3253)
* added inital models web app test Signed-off-by: Harshit Nayan <[email protected]> * fix2: added models web app test Signed-off-by: Harshit Nayan <[email protected]> * fix3: added models-web-app test Signed-off-by: Harshit Nayan <[email protected]> * fix4: added models-web-app test Signed-off-by: Harshit Nayan <[email protected]> * refactor: simplify KServe models web app test by removing XSRF token handling Signed-off-by: Harshit Nayan <[email protected]> * fixed linting and auth Signed-off-by: Harshit Nayan <[email protected]> * feat: enhance KServe models web app test with XSRF token handling Signed-off-by: Harshit Nayan <[email protected]> * Update full_kubeflow_integration_test.yaml Signed-off-by: Julius von Kohout <[email protected]> * Update and rename kserve_models_web_app_test.sh to kserve_models_web_application_test.sh Signed-off-by: Julius von Kohout <[email protected]> * Reduce the unnecessary overhead Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_application_test.sh Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_app_test.yaml Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_application_test.sh Signed-off-by: Julius von Kohout <[email protected]> * Apply suggestions from code review Signed-off-by: Julius von Kohout <[email protected]> * first install KServe then create profile Signed-off-by: Harshit Nayan <[email protected]> * added debugging to find issue Signed-off-by: Harshit Nayan <[email protected]> * added delay for sync Signed-off-by: Harshit Nayan <[email protected]> * Add debugging steps for JWT token and API call verification; update USERID_PREFIX in kustomization Signed-off-by: Harshit Nayan <[email protected]> * added todo comment Signed-off-by: Harshit Nayan <[email protected]> * removed debug steps Signed-off-by: Harshit Nayan <[email protected]> * Add checks for unauthorized access in inference service API calls Signed-off-by: Harshit Nayan <[email protected]> * Add checks for unauthorized access in inference service API calls Signed-off-by: Harshit Nayan <[email protected]> * Update kserve_models_web_application_test.sh Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_app_test.yaml Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_app_test.yaml Signed-off-by: Julius von Kohout <[email protected]> * Update sklearn-iris-private.yaml Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_application_test.sh Signed-off-by: Julius von Kohout <[email protected]> * Delete tests/kserve/sklearn-iris-private.yaml Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_app_test.yaml Signed-off-by: Julius von Kohout <[email protected]> * Rename kserve_models_web_app_test.yaml to kserve_models_web_application_test.yaml Signed-off-by: Julius von Kohout <[email protected]> * Update kserve_models_web_application_test.sh Signed-off-by: Julius von Kohout <[email protected]> --------- Signed-off-by: Harshit Nayan <[email protected]> Signed-off-by: Julius von Kohout <[email protected]> Co-authored-by: Julius von Kohout <[email protected]>
1 parent 66aa578 commit dfe02ca

File tree

4 files changed

+136
-1
lines changed

4 files changed

+136
-1
lines changed

‎.github/workflows/full_kubeflow_integration_test.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ jobs:
6363
- name: Install KServe
6464
run: ./tests/kserve_install.sh
6565

66-
#- name: Install Pipelines
66+
# - name: Install Pipelines
6767
# run: ./tests/pipelines_install.sh
6868

6969
- name: Install Pipelines with SeaweedFS
@@ -198,6 +198,9 @@ jobs:
198198
run: |
199199
./tests/kserve_test.sh ${KF_PROFILE}
200200
201+
- name: Test KServe Models Web Application API
202+
run: ./tests/kserve_models_web_application_test.sh "${KF_PROFILE}"
203+
201204
- name: Run Spark Test
202205
run: chmod u+x tests/*.sh && ./tests/spark_test.sh "${KF_PROFILE}"
203206

‎.github/workflows/kserve_models_web_application_test.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Test KServe Models Web Application
2+
on:
3+
pull_request:
4+
paths:
5+
- tests/install_KinD_create_KinD_cluster_install_kustomize.sh
6+
- .github/workflows/kserve_models_web_application_test.yaml
7+
- applications/kserve/**
8+
- tests/kserve*
9+
- tests/istio*
10+
- common/istio*/**
11+
- common/knative/**
12+
- common/oauth2-proxy/**
13+
14+
permissions:
15+
contents: read
16+
actions: read
17+
18+
env:
19+
KF_PROFILE: kubeflow-user-example-com
20+
21+
jobs:
22+
build:
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 25
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@v4
28+
29+
- name: Install KinD, Create KinD cluster and Install kustomize
30+
run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
31+
32+
- name: Install kubectl
33+
run: ./tests/kubectl_install.sh
34+
35+
- name: Create Kubeflow Namespace
36+
run: kustomize build common/kubeflow-namespace/base | kubectl apply -f -
37+
38+
- name: Install Certificate Manager
39+
run: ./tests/cert_manager_install.sh
40+
41+
- name: Install Istio CNI
42+
run: ./tests/istio-cni_install.sh
43+
44+
- name: Install OAuth2 Proxy
45+
run: ./tests/oauth2-proxy_install.sh
46+
47+
- name: Install Kubeflow Istio Resources
48+
run: kustomize build common/istio/kubeflow-istio-resources/base | kubectl apply -f -
49+
50+
- name: Install Multi-Tenancy
51+
run: ./tests/multi_tenancy_install.sh
52+
53+
- name: Install Knative
54+
run: ./tests/knative_install.sh
55+
56+
- name: Install KServe
57+
run: ./tests/kserve_install.sh
58+
59+
- name: Create KF Profile
60+
run: ./tests/kubeflow_profile_install.sh
61+
62+
- name: Wait for All Pods to be Ready
63+
run: |
64+
kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=300s --field-selector=status.phase!=Succeeded
65+
sleep 10
66+
kubectl get deployment kserve-models-web-app -n kubeflow
67+
kubectl wait --for=condition=Available deployment/kserve-models-web-app -n kubeflow --timeout=60s
68+
69+
- name: Port-forward the istio-ingress gateway
70+
run: ./tests/port_forward_gateway.sh
71+
72+
- name: Test KServe Models Web Application API
73+
run: ./tests/kserve_models_web_application_test.sh "${KF_PROFILE}"

‎applications/kserve/models-web-app/overlays/kubeflow/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ configMapGenerator:
1616
- behavior: replace
1717
literals:
1818
- USERID_HEADER=kubeflow-userid
19+
- USERID_PREFIX=""
1920
- APP_PREFIX=/kserve-endpoints
2021
- GRAFANA_PREFIX=/grafana
2122
- GRAFANA_CPU_MEMORY_DB=db/knative-serving-revision-cpu-and-memory-usage

‎tests/kserve_models_web_application_test.sh‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
#!/bin/bash
2+
set -euxo pipefail
3+
4+
5+
KF_PROFILE=${1:-kubeflow-user-example-com}
6+
TOKEN="$(kubectl -n $KF_PROFILE create token default-editor)"
7+
BASE_URL="localhost:8080/kserve-endpoints"
8+
9+
cat <<EOF | kubectl apply -f -
10+
apiVersion: "serving.kserve.io/v1beta1"
11+
kind: "InferenceService"
12+
metadata:
13+
name: "sklearn-iris"
14+
namespace: ${KF_PROFILE}
15+
spec:
16+
predictor:
17+
sklearn:
18+
storageUri: "gs://kfserving-examples/models/sklearn/1.0/model"
19+
resources:
20+
requests:
21+
cpu: "50m"
22+
memory: "128Mi"
23+
limits:
24+
cpu: "100m"
25+
memory: "256Mi"
26+
EOF
27+
28+
kubectl wait --for=condition=Ready inferenceservice/sklearn-iris -n ${KF_PROFILE} --timeout=120s
29+
kubectl get inferenceservice sklearn-iris -n ${KF_PROFILE}
30+
31+
# Get XSRF token for API calls
32+
curl -s "http://${BASE_URL}/" \
33+
-H "Authorization: Bearer ${TOKEN}" \
34+
-v -c /tmp/kserve_xcrf.txt 2>&1 | grep -i "set-cookie"
35+
XSRFTOKEN=$(grep XSRF-TOKEN /tmp/kserve_xcrf.txt | awk '{print $NF}')
36+
37+
RESPONSE=$(curl -s --fail-with-body \
38+
"${BASE_URL}/api/namespaces/${KF_PROFILE}/inferenceservices" \
39+
-H "Authorization: Bearer ${TOKEN}" \
40+
-H "X-XSRF-TOKEN: ${XSRFTOKEN}" \
41+
-H "Cookie: XSRF-TOKEN=${XSRFTOKEN}")
42+
43+
echo "$RESPONSE" | grep -q "sklearn-iris" || exit 1
44+
kubectl get inferenceservice sklearn-iris -n ${KF_PROFILE} || exit 1
45+
READY=$(kubectl get isvc sklearn-iris -n ${KF_PROFILE} -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}')
46+
[[ "$READY" == "True" ]] || {
47+
echo "FAILURE: InferenceService Ready status is: $READY"
48+
exit 1
49+
}
50+
51+
kubectl delete inferenceservice sklearn-iris -n ${KF_PROFILE} || exit 1
52+
53+
# Test unauthorized access
54+
TOKEN="$(kubectl -n default create token default)"
55+
BASE_URL="localhost:8080/kserve-endpoints"
56+
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${BASE_URL}/api/namespaces/${KF_PROFILE}/inferenceservices" -H "Authorization: Bearer ${TOKEN}")
57+
[[ "$HTTP_CODE" == "403" || "$HTTP_CODE" == "401" ]] || { echo "FAILURE: Expected 401/403, got $HTTP_CODE"; exit 1; }
58+
echo "Test succeeded. Token from unauthorized ServiceAccount cannot list InferenceServices in $KF_PROFILE namespace."

0 commit comments

Comments
 (0)