Skip to content

Commit 5155b94

Browse files
openshift-cherrypick-robotisrael-hdez
openshift-cherrypick-robot
and
israel-hdez
authored
[release-v0.15] Back-porting fixes for InferenceGraph (#648)
* Fix IG readiness probe KServe project has added readiness probes to raw IG. ODH fork needs the following adaptations: * The HTTP server has TLS. Thus, the readiness probe needs to be configured with HTTPS. * When auth is enabled, the /readyz endpoint should bypass auth check. Signed-off-by: Edgar Hernández <[email protected]> * Fix Raw InferenceGraph not connecting to ISVCs (#581) This is an ODH/OpenShift-specific fix. Since the InferenceServices can be protected under TLS, the InferenceGraph workload requires to trust OpenShift Serving certificates. This fixes kserve-contoller to properly configure the IG router workload to trust needed certificates so that connections succeed. Signed-off-by: Edgar Hernández <[email protected]> * Adapt unit tests for ODH Signed-off-by: Edgar Hernández <[email protected]> --------- Signed-off-by: Edgar Hernández <[email protected]> Co-authored-by: Edgar Hernández <[email protected]> Co-authored-by: Edgar Hernández <[email protected]>
1 parent c0c9b9d commit 5155b94

File tree

3 files changed

+128
-6
lines changed

3 files changed

+128
-6
lines changed

‎cmd/router/main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -609,8 +609,8 @@ func main() {
609609
log.Info("This Router has authorization enabled")
610610
}
611611

612-
http.Handle("/", entrypointHandler)
613612
http.HandleFunc(constants.RouterReadinessEndpoint, readyHandler)
613+
http.Handle("/", entrypointHandler)
614614

615615
server := &http.Server{
616616
Addr: ":8080", // specify the address and port

‎pkg/controller/v1alpha1/inferencegraph/raw_ig.go

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,30 @@ func createInferenceGraphPodSpec(graph *v1alpha1.InferenceGraph, config *RouterC
8383
Drop: []corev1.Capability{corev1.Capability("ALL")},
8484
},
8585
},
86+
VolumeMounts: []corev1.VolumeMount{
87+
{
88+
Name: "openshift-service-ca-bundle",
89+
MountPath: "/etc/odh/openshift-service-ca-bundle",
90+
},
91+
},
92+
Env: []corev1.EnvVar{
93+
{
94+
Name: "SSL_CERT_FILE",
95+
Value: "/etc/odh/openshift-service-ca-bundle/service-ca.crt",
96+
},
97+
},
98+
},
99+
},
100+
Volumes: []corev1.Volume{
101+
{
102+
Name: "openshift-service-ca-bundle",
103+
VolumeSource: corev1.VolumeSource{
104+
ConfigMap: &corev1.ConfigMapVolumeSource{
105+
LocalObjectReference: corev1.LocalObjectReference{
106+
Name: constants.OpenShiftServiceCaConfigMapName,
107+
},
108+
},
109+
},
86110
},
87111
},
88112
Affinity: graph.Spec.Affinity,
@@ -98,12 +122,12 @@ func createInferenceGraphPodSpec(graph *v1alpha1.InferenceGraph, config *RouterC
98122
// Only adding this env variable "PROPAGATE_HEADERS" if router's headers config has the key "propagate"
99123
value, exists := config.Headers["propagate"]
100124
if exists {
101-
podSpec.Containers[0].Env = []corev1.EnvVar{
102-
{
103-
Name: constants.RouterHeadersPropagateEnvVar,
104-
Value: strings.Join(value, ","),
105-
},
125+
propagateEnv := corev1.EnvVar{
126+
Name: constants.RouterHeadersPropagateEnvVar,
127+
Value: strings.Join(value, ","),
106128
}
129+
130+
podSpec.Containers[0].Env = append(podSpec.Containers[0].Env, propagateEnv)
107131
}
108132

109133
// If auth is enabled for the InferenceGraph:
@@ -128,6 +152,9 @@ func createInferenceGraphPodSpec(graph *v1alpha1.InferenceGraph, config *RouterC
128152
podSpec.ServiceAccountName = graph.GetName() + "-auth-verifier"
129153
}
130154

155+
// In ODH, the readiness probe is using HTTPS
156+
podSpec.Containers[0].ReadinessProbe.ProbeHandler.HTTPGet.Scheme = corev1.URISchemeHTTPS
157+
131158
return podSpec
132159
}
133160

‎pkg/controller/v1alpha1/inferencegraph/raw_ig_test.go

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ func TestCreateInferenceGraphPodSpec(t *testing.T) {
6363
}
6464

6565
expectedReadinessProbe := constants.GetRouterReadinessProbe()
66+
expectedReadinessProbe.ProbeHandler.HTTPGet.Scheme = corev1.URISchemeHTTPS
6667

6768
testIGSpecs := map[string]*InferenceGraph{
6869
"basic": {
@@ -220,6 +221,30 @@ func TestCreateInferenceGraphPodSpec(t *testing.T) {
220221
Drop: []corev1.Capability{corev1.Capability("ALL")},
221222
},
222223
},
224+
VolumeMounts: []corev1.VolumeMount{
225+
{
226+
Name: "openshift-service-ca-bundle",
227+
MountPath: "/etc/odh/openshift-service-ca-bundle",
228+
},
229+
},
230+
Env: []corev1.EnvVar{
231+
{
232+
Name: "SSL_CERT_FILE",
233+
Value: "/etc/odh/openshift-service-ca-bundle/service-ca.crt",
234+
},
235+
},
236+
},
237+
},
238+
Volumes: []corev1.Volume{
239+
{
240+
Name: "openshift-service-ca-bundle",
241+
VolumeSource: corev1.VolumeSource{
242+
ConfigMap: &corev1.ConfigMapVolumeSource{
243+
LocalObjectReference: corev1.LocalObjectReference{
244+
Name: constants.OpenShiftServiceCaConfigMapName,
245+
},
246+
},
247+
},
223248
},
224249
},
225250
AutomountServiceAccountToken: proto.Bool(false),
@@ -237,6 +262,10 @@ func TestCreateInferenceGraphPodSpec(t *testing.T) {
237262
"{\"nodes\":{\"root\":{\"routerType\":\"Sequence\",\"steps\":[{\"serviceUrl\":\"http://someservice.exmaple.com\"}]}},\"resources\":{}}",
238263
},
239264
Env: []corev1.EnvVar{
265+
{
266+
Name: "SSL_CERT_FILE",
267+
Value: "/etc/odh/openshift-service-ca-bundle/service-ca.crt",
268+
},
240269
{
241270
Name: "PROPAGATE_HEADERS",
242271
Value: "Authorization,Intuit_tid",
@@ -262,6 +291,24 @@ func TestCreateInferenceGraphPodSpec(t *testing.T) {
262291
Drop: []corev1.Capability{corev1.Capability("ALL")},
263292
},
264293
},
294+
VolumeMounts: []corev1.VolumeMount{
295+
{
296+
Name: "openshift-service-ca-bundle",
297+
MountPath: "/etc/odh/openshift-service-ca-bundle",
298+
},
299+
},
300+
},
301+
},
302+
Volumes: []corev1.Volume{
303+
{
304+
Name: "openshift-service-ca-bundle",
305+
VolumeSource: corev1.VolumeSource{
306+
ConfigMap: &corev1.ConfigMapVolumeSource{
307+
LocalObjectReference: corev1.LocalObjectReference{
308+
Name: constants.OpenShiftServiceCaConfigMapName,
309+
},
310+
},
311+
},
265312
},
266313
},
267314
AutomountServiceAccountToken: proto.Bool(false),
@@ -298,6 +345,30 @@ func TestCreateInferenceGraphPodSpec(t *testing.T) {
298345
Drop: []corev1.Capability{corev1.Capability("ALL")},
299346
},
300347
},
348+
VolumeMounts: []corev1.VolumeMount{
349+
{
350+
Name: "openshift-service-ca-bundle",
351+
MountPath: "/etc/odh/openshift-service-ca-bundle",
352+
},
353+
},
354+
Env: []corev1.EnvVar{
355+
{
356+
Name: "SSL_CERT_FILE",
357+
Value: "/etc/odh/openshift-service-ca-bundle/service-ca.crt",
358+
},
359+
},
360+
},
361+
},
362+
Volumes: []corev1.Volume{
363+
{
364+
Name: "openshift-service-ca-bundle",
365+
VolumeSource: corev1.VolumeSource{
366+
ConfigMap: &corev1.ConfigMapVolumeSource{
367+
LocalObjectReference: corev1.LocalObjectReference{
368+
Name: constants.OpenShiftServiceCaConfigMapName,
369+
},
370+
},
371+
},
301372
},
302373
},
303374
AutomountServiceAccountToken: proto.Bool(false),
@@ -334,6 +405,30 @@ func TestCreateInferenceGraphPodSpec(t *testing.T) {
334405
Drop: []corev1.Capability{corev1.Capability("ALL")},
335406
},
336407
},
408+
VolumeMounts: []corev1.VolumeMount{
409+
{
410+
Name: "openshift-service-ca-bundle",
411+
MountPath: "/etc/odh/openshift-service-ca-bundle",
412+
},
413+
},
414+
Env: []corev1.EnvVar{
415+
{
416+
Name: "SSL_CERT_FILE",
417+
Value: "/etc/odh/openshift-service-ca-bundle/service-ca.crt",
418+
},
419+
},
420+
},
421+
},
422+
Volumes: []corev1.Volume{
423+
{
424+
Name: "openshift-service-ca-bundle",
425+
VolumeSource: corev1.VolumeSource{
426+
ConfigMap: &corev1.ConfigMapVolumeSource{
427+
LocalObjectReference: corev1.LocalObjectReference{
428+
Name: constants.OpenShiftServiceCaConfigMapName,
429+
},
430+
},
431+
},
337432
},
338433
},
339434
AutomountServiceAccountToken: proto.Bool(false),

0 commit comments

Comments
 (0)