Skip to content

Commit dfae85f

Browse files
VedantMahabaleshwarkarVedantMahabaleshwarkar
authored
add tls to kserve-router and add certs to ig service and always mount serving cert secret to raw deployment (#531)
pr feedback modify callService to use TLS Revert "modify callService to use TLS" This reverts commit 1618bc8. edgar feedback fix lint errors bug fix Signed-off-by: Vedant Mahabaleshwarkar <[email protected]>
1 parent 2d9e0b2 commit dfae85f

File tree

11 files changed

+95
-39
lines changed

11 files changed

+95
-39
lines changed

‎cmd/router/main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -604,8 +604,8 @@ func main() {
604604
WriteTimeout: time.Minute, // set the maximum duration before timing out writes of the response
605605
IdleTimeout: 3 * time.Minute, // set the maximum amount of time to wait for the next request when keep-alives are enabled
606606
}
607-
err = server.ListenAndServe()
608607

608+
err = server.ListenAndServeTLS("/etc/tls/private/tls.crt", "/etc/tls/private/tls.key")
609609
if err != nil {
610610
log.Error(err, "failed to listen on 8080")
611611
os.Exit(1)

‎pkg/constants/constants.go

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -132,14 +132,15 @@ var (
132132

133133
// kserve networking constants
134134
const (
135-
NetworkVisibility = "networking.kserve.io/visibility"
136-
ClusterLocalVisibility = "cluster-local"
137-
ClusterLocalDomain = "svc.cluster.local"
138-
IsvcNameHeader = "KServe-Isvc-Name"
139-
IsvcNamespaceHeader = "KServe-Isvc-Namespace"
140-
ODHKserveRawAuth = "security.opendatahub.io/enable-auth"
141-
ODHRouteEnabled = "exposed"
142-
ServingCertSecretSuffix = "-serving-cert"
135+
NetworkVisibility = "networking.kserve.io/visibility"
136+
ClusterLocalVisibility = "cluster-local"
137+
ClusterLocalDomain = "svc.cluster.local"
138+
IsvcNameHeader = "KServe-Isvc-Name"
139+
IsvcNamespaceHeader = "KServe-Isvc-Namespace"
140+
ODHKserveRawAuth = "security.opendatahub.io/enable-auth"
141+
ODHRouteEnabled = "exposed"
142+
ServingCertSecretSuffix = "-serving-cert"
143+
OpenshiftServingCertAnnotation = "service.beta.openshift.io/serving-cert-secret-name"
143144
)
144145

145146
// StorageSpec Constants
@@ -519,6 +520,13 @@ const (
519520
OpenShiftServiceCaConfigMapName = "openshift-service-ca.crt"
520521
)
521522

523+
type ResourceType string
524+
525+
const (
526+
InferenceServiceResource ResourceType = "InferenceService"
527+
InferenceGraphResource ResourceType = "InferenceGraph"
528+
)
529+
522530
// GetRawServiceLabel generate native service label
523531
func GetRawServiceLabel(service string) string {
524532
return "isvc." + service

‎pkg/controller/v1alpha1/inferencegraph/raw_ig.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -176,7 +176,7 @@ func handleInferenceGraphRawDeployment(cl client.Client, clientset kubernetes.In
176176
objectMeta, componentExtSpec := constructForRawDeployment(graph)
177177

178178
// create the reconciler
179-
reconciler, err := raw.NewRawKubeReconciler(cl, clientset, scheme, objectMeta, metav1.ObjectMeta{}, &componentExtSpec, desiredSvc, nil)
179+
reconciler, err := raw.NewRawKubeReconciler(cl, clientset, scheme, constants.InferenceGraphResource, objectMeta, metav1.ObjectMeta{}, &componentExtSpec, desiredSvc, nil)
180180

181181
if err != nil {
182182
return nil, nil, errors.Wrapf(err, "fails to create NewRawKubeReconciler for inference graph")
@@ -189,6 +189,7 @@ func handleInferenceGraphRawDeployment(cl client.Client, clientset kubernetes.In
189189
}
190190
// set Service Controller
191191
for _, svc := range reconciler.Service.ServiceList {
192+
svc.ObjectMeta.Annotations[constants.OpenshiftServingCertAnnotation] = graph.Name + constants.ServingCertSecretSuffix
192193
if err := controllerutil.SetControllerReference(graph, svc, scheme); err != nil {
193194
return nil, reconciler.URL, errors.Wrapf(err, "fails to set service owner reference for inference graph")
194195
}

‎pkg/controller/v1beta1/inferenceservice/components/explainer.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ func (e *Explainer) Reconcile(isvc *v1beta1.InferenceService) (ctrl.Result, erro
160160

161161
// Here we allow switch between knative and vanilla deployment
162162
if e.deploymentMode == constants.RawDeployment {
163-
r, err := raw.NewRawKubeReconciler(e.client, e.clientset, e.scheme, objectMeta, metav1.ObjectMeta{},
163+
r, err := raw.NewRawKubeReconciler(e.client, e.clientset, e.scheme, constants.InferenceServiceResource, objectMeta, metav1.ObjectMeta{},
164164
&isvc.Spec.Explainer.ComponentExtensionSpec, &podSpec, nil)
165165
if err != nil {
166166
return ctrl.Result{}, errors.Wrapf(err, "fails to create NewRawKubeReconciler for explainer")

‎pkg/controller/v1beta1/inferenceservice/components/predictor.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,7 +365,7 @@ func (p *Predictor) Reconcile(isvc *v1beta1.InferenceService) (ctrl.Result, erro
365365
rawDeployment = true
366366
podLabelKey = constants.RawDeploymentAppLabel
367367
// This is main RawKubeReconciler to create objects (deployment, svc, scaler)
368-
r, err := raw.NewRawKubeReconciler(p.client, p.clientset, p.scheme, objectMeta, workerObjectMeta, &isvc.Spec.Predictor.ComponentExtensionSpec,
368+
r, err := raw.NewRawKubeReconciler(p.client, p.clientset, p.scheme, constants.InferenceServiceResource, objectMeta, workerObjectMeta, &isvc.Spec.Predictor.ComponentExtensionSpec,
369369
&podSpec, workerPodSpec)
370370
if err != nil {
371371
return ctrl.Result{}, errors.Wrapf(err, "fails to create NewRawKubeReconciler for predictor")

‎pkg/controller/v1beta1/inferenceservice/components/transformer.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ func (p *Transformer) Reconcile(isvc *v1beta1.InferenceService) (ctrl.Result, er
188188

189189
// Here we allow switch between knative and vanilla deployment
190190
if p.deploymentMode == constants.RawDeployment {
191-
r, err := raw.NewRawKubeReconciler(p.client, p.clientset, p.scheme, objectMeta, metav1.ObjectMeta{},
191+
r, err := raw.NewRawKubeReconciler(p.client, p.clientset, p.scheme, constants.InferenceServiceResource, objectMeta, metav1.ObjectMeta{},
192192
&isvc.Spec.Transformer.ComponentExtensionSpec, &podSpec, nil)
193193
if err != nil {
194194
return ctrl.Result{}, errors.Wrapf(err, "fails to create NewRawKubeReconciler for transformer")

‎pkg/controller/v1beta1/inferenceservice/rawkube_controller_test.go

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,7 @@ var _ = Describe("v1beta1 inference service controller", func() {
230230
"serving.kserve.io/autoscalerClass": "hpa",
231231
"serving.kserve.io/metrics": "cpu",
232232
"serving.kserve.io/targetUtilizationPercentage": "75",
233+
constants.OpenshiftServingCertAnnotation: predictorDeploymentKey.Name + constants.ServingCertSecretSuffix,
233234
},
234235
},
235236
Spec: v1.PodSpec{
@@ -649,6 +650,7 @@ var _ = Describe("v1beta1 inference service controller", func() {
649650
"serving.kserve.io/autoscalerClass": "hpa",
650651
"serving.kserve.io/metrics": "cpu",
651652
"serving.kserve.io/targetUtilizationPercentage": "75",
653+
constants.OpenshiftServingCertAnnotation: "raw-foo-customized-predictor-serving-cert",
652654
},
653655
},
654656
Spec: v1.PodSpec{
@@ -1053,6 +1055,7 @@ var _ = Describe("v1beta1 inference service controller", func() {
10531055
constants.StorageInitializerSourceUriInternalAnnotationKey: *isvc.Spec.Predictor.Model.StorageURI,
10541056
"serving.kserve.io/deploymentMode": "RawDeployment",
10551057
"serving.kserve.io/autoscalerClass": "external",
1058+
constants.OpenshiftServingCertAnnotation: predictorDeploymentKey.Name + constants.ServingCertSecretSuffix,
10561059
},
10571060
},
10581061
Spec: v1.PodSpec{
@@ -1724,6 +1727,7 @@ var _ = Describe("v1beta1 inference service controller", func() {
17241727
"serving.kserve.io/autoscalerClass": "hpa",
17251728
"serving.kserve.io/metrics": "cpu",
17261729
"serving.kserve.io/targetUtilizationPercentage": "75",
1730+
constants.OpenshiftServingCertAnnotation: predictorDeploymentKey.Name + constants.ServingCertSecretSuffix,
17271731
},
17281732
},
17291733
Spec: v1.PodSpec{
@@ -2158,6 +2162,7 @@ var _ = Describe("v1beta1 inference service controller", func() {
21582162
"serving.kserve.io/autoscalerClass": "hpa",
21592163
"serving.kserve.io/metrics": "cpu",
21602164
"serving.kserve.io/targetUtilizationPercentage": "75",
2165+
constants.OpenshiftServingCertAnnotation: predictorDeploymentKey.Name + constants.ServingCertSecretSuffix,
21612166
},
21622167
},
21632168
Spec: v1.PodSpec{
@@ -2598,6 +2603,12 @@ var _ = Describe("v1beta1 inference service controller", func() {
25982603
"--model_base_path=" + constants.DefaultModelLocalMountPath,
25992604
"--rest_api_timeout_in_ms=60000",
26002605
},
2606+
VolumeMounts: []v1.VolumeMount{
2607+
{
2608+
Name: "proxy-tls",
2609+
MountPath: "/etc/tls/private",
2610+
},
2611+
},
26012612
Resources: defaultResource,
26022613
ReadinessProbe: &v1.Probe{
26032614
ProbeHandler: v1.ProbeHandler{

‎pkg/controller/v1beta1/inferenceservice/reconcilers/deployment/deployment_reconciler.go

Lines changed: 44 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ import (
2626
"strings"
2727

2828
"k8s.io/apimachinery/pkg/api/resource"
29-
"k8s.io/apimachinery/pkg/util/strategicpatch"
3029
"k8s.io/client-go/kubernetes"
3130

3231
"github.com/google/go-cmp/cmp/cmpopts"
@@ -37,6 +36,7 @@ import (
3736
"k8s.io/apimachinery/pkg/runtime"
3837
"k8s.io/apimachinery/pkg/types"
3938
"k8s.io/apimachinery/pkg/util/intstr"
39+
"k8s.io/apimachinery/pkg/util/strategicpatch"
4040
"knative.dev/pkg/kmp"
4141
kclient "sigs.k8s.io/controller-runtime/pkg/client"
4242
logf "sigs.k8s.io/controller-runtime/pkg/log"
@@ -65,11 +65,12 @@ const (
6565
func NewDeploymentReconciler(client kclient.Client,
6666
clientset kubernetes.Interface,
6767
scheme *runtime.Scheme,
68+
resourceType constants.ResourceType,
6869
componentMeta metav1.ObjectMeta,
6970
workerComponentMeta metav1.ObjectMeta,
7071
componentExt *v1beta1.ComponentExtensionSpec,
7172
podSpec *corev1.PodSpec, workerPodSpec *corev1.PodSpec) (*DeploymentReconciler, error) {
72-
deploymentList, err := createRawDeploymentODH(clientset, componentMeta, workerComponentMeta, componentExt, podSpec, workerPodSpec)
73+
deploymentList, err := createRawDeploymentODH(clientset, resourceType, componentMeta, workerComponentMeta, componentExt, podSpec, workerPodSpec)
7374
if err != nil {
7475
return nil, err
7576
}
@@ -81,21 +82,26 @@ func NewDeploymentReconciler(client kclient.Client,
8182
}, nil
8283
}
8384

84-
func createRawDeploymentODH(clientset kubernetes.Interface, componentMeta metav1.ObjectMeta, workerComponentMeta metav1.ObjectMeta,
85+
func createRawDeploymentODH(clientset kubernetes.Interface, resourceType constants.ResourceType, componentMeta metav1.ObjectMeta, workerComponentMeta metav1.ObjectMeta,
8586
componentExt *v1beta1.ComponentExtensionSpec,
8687
podSpec *corev1.PodSpec, workerPodSpec *corev1.PodSpec) ([]*appsv1.Deployment, error) {
8788
deploymentList, err := createRawDeployment(componentMeta, workerComponentMeta, componentExt, podSpec, workerPodSpec)
8889
if err != nil {
8990
return nil, err
9091
}
92+
enableAuth := false
93+
// Deployment list is for multi-node, we only need to add oauth proxy and serving sercret certs to the head deployment
94+
headDeployment := deploymentList[0]
9195
if val, ok := componentMeta.Annotations[constants.ODHKserveRawAuth]; ok && strings.EqualFold(val, "true") {
92-
for _, deployment := range deploymentList {
93-
err := addOauthContainerToDeployment(clientset, deployment, componentMeta, componentExt, podSpec)
94-
if err != nil {
95-
return nil, err
96-
}
96+
enableAuth = true
97+
err := addOauthContainerToDeployment(clientset, headDeployment, componentMeta, componentExt, podSpec)
98+
if err != nil {
99+
return nil, err
97100
}
98101
}
102+
if (resourceType == constants.InferenceServiceResource && enableAuth) || resourceType == constants.InferenceGraphResource {
103+
mountServingSecretVolumeToDeployment(headDeployment, componentMeta, resourceType)
104+
}
99105
return deploymentList, nil
100106
}
101107

@@ -188,6 +194,36 @@ func createRawDefaultDeployment(componentMeta metav1.ObjectMeta,
188194
return deployment, nil
189195
}
190196

197+
func mountServingSecretVolumeToDeployment(deployment *appsv1.Deployment, componentMeta metav1.ObjectMeta, resourceType constants.ResourceType) {
198+
updatedPodSpec := deployment.Spec.Template.Spec.DeepCopy()
199+
tlsSecretVolume := corev1.Volume{
200+
Name: tlsVolumeName,
201+
VolumeSource: corev1.VolumeSource{
202+
Secret: &corev1.SecretVolumeSource{
203+
SecretName: componentMeta.Name + constants.ServingCertSecretSuffix,
204+
DefaultMode: func(i int32) *int32 { return &i }(420),
205+
},
206+
},
207+
}
208+
209+
updatedPodSpec.Volumes = append(updatedPodSpec.Volumes, tlsSecretVolume)
210+
211+
containerName := "kserve-container"
212+
if resourceType == constants.InferenceGraphResource {
213+
containerName = componentMeta.Name
214+
}
215+
for i, container := range updatedPodSpec.Containers {
216+
if container.Name == containerName {
217+
updatedPodSpec.Containers[i].VolumeMounts = append(updatedPodSpec.Containers[i].VolumeMounts, corev1.VolumeMount{
218+
Name: tlsVolumeName,
219+
MountPath: "/etc/tls/private",
220+
})
221+
}
222+
}
223+
224+
deployment.Spec.Template.Spec = *updatedPodSpec
225+
}
226+
191227
func addOauthContainerToDeployment(clientset kubernetes.Interface, deployment *appsv1.Deployment, componentMeta metav1.ObjectMeta, componentExt *v1beta1.ComponentExtensionSpec,
192228
podSpec *corev1.PodSpec) error {
193229
var isvcname string
@@ -224,16 +260,6 @@ func addOauthContainerToDeployment(clientset kubernetes.Interface, deployment *a
224260
updatedPodSpec := deployment.Spec.Template.Spec.DeepCopy()
225261
// updatedPodSpec := podSpec.DeepCopy()
226262
updatedPodSpec.Containers = append(updatedPodSpec.Containers, *oauthProxyContainer)
227-
tlsSecretVolume := corev1.Volume{
228-
Name: tlsVolumeName,
229-
VolumeSource: corev1.VolumeSource{
230-
Secret: &corev1.SecretVolumeSource{
231-
SecretName: componentMeta.Name + constants.ServingCertSecretSuffix,
232-
DefaultMode: func(i int32) *int32 { return &i }(420),
233-
},
234-
},
235-
}
236-
updatedPodSpec.Volumes = append(updatedPodSpec.Volumes, tlsSecretVolume)
237263
deployment.Spec.Template.Spec = *updatedPodSpec
238264
}
239265
return nil

‎pkg/controller/v1beta1/inferenceservice/reconcilers/raw/raw_kube_reconciler.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"fmt"
2121

2222
"github.com/kserve/kserve/pkg/apis/serving/v1beta1"
23+
"github.com/kserve/kserve/pkg/constants"
2324
autoscaler "github.com/kserve/kserve/pkg/controller/v1beta1/inferenceservice/reconcilers/autoscaler"
2425
deployment "github.com/kserve/kserve/pkg/controller/v1beta1/inferenceservice/reconcilers/deployment"
2526
"github.com/kserve/kserve/pkg/controller/v1beta1/inferenceservice/reconcilers/ingress"
@@ -51,6 +52,7 @@ type RawKubeReconciler struct {
5152
func NewRawKubeReconciler(client client.Client,
5253
clientset kubernetes.Interface,
5354
scheme *runtime.Scheme,
55+
resourceType constants.ResourceType,
5456
componentMeta metav1.ObjectMeta,
5557
workerComponentMeta metav1.ObjectMeta,
5658
componentExt *v1beta1.ComponentExtensionSpec,
@@ -75,7 +77,7 @@ func NewRawKubeReconciler(client client.Client,
7577
log.Error(err1, "failed to get service config")
7678
}
7779

78-
depl, err := deployment.NewDeploymentReconciler(client, clientset, scheme, componentMeta, workerComponentMeta, componentExt, podSpec, workerPodSpec)
80+
depl, err := deployment.NewDeploymentReconciler(client, clientset, scheme, resourceType, componentMeta, workerComponentMeta, componentExt, podSpec, workerPodSpec)
7981
if err != nil {
8082
return nil, err
8183
}

‎pkg/controller/v1beta1/inferenceservice/reconcilers/service/service_reconciler.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -170,11 +170,12 @@ func createDefaultSvc(componentMeta metav1.ObjectMeta, componentExt *v1beta1.Com
170170
},
171171
}
172172

173+
if service.ObjectMeta.Annotations == nil {
174+
service.ObjectMeta.Annotations = make(map[string]string)
175+
}
176+
service.ObjectMeta.Annotations[constants.OpenshiftServingCertAnnotation] = componentMeta.Name + constants.ServingCertSecretSuffix
177+
173178
if val, ok := componentMeta.Annotations[constants.ODHKserveRawAuth]; ok && strings.EqualFold(val, "true") {
174-
if service.ObjectMeta.Annotations == nil {
175-
service.ObjectMeta.Annotations = make(map[string]string)
176-
}
177-
service.ObjectMeta.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = componentMeta.Name + constants.ServingCertSecretSuffix
178179
httpsPort := corev1.ServicePort{
179180
Name: "https",
180181
Port: constants.OauthProxyPort,

0 commit comments

Comments
 (0)