Merge pull request #911 from opendatahub-io/main

sync: main to stable

Author: openshift-merge-bot[bot]

.github/workflows/build-image-pr.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Start Kind Cluster
         uses: helm/kind-action@v1.13.0
         with:
-          node_image: "kindest/node:v1.27.11"
+          node_image: "kindest/node:v1.33.7"
       - name: Load Local Registry Test Image
         env:
           IMG: "${{ env.IMG_REGISTRY }}/${{ env.IMG_ORG }}/${{ env.IMG_REPO }}:${{ steps.tags.outputs.tag }}"

.github/workflows/csi-test.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Start KinD cluster
         uses: helm/kind-action@v1.13.0
         with:
-          node_image: "kindest/node:v1.31.0"
+          node_image: "kindest/node:v1.33.7"
 
       - name: Install kustomize
         run: ./test/scripts/install_kustomize.sh

.github/workflows/go-mod-tidy-diff-check.yml

@@ -24,7 +24,7 @@ jobs:
                   go-version: "1.25.3"
 
             - name: Cache Go modules
-              uses: actions/cache@v4
+              uses: actions/cache@v5
               with:
                   path: ~/go/pkg/mod
                   key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}

.github/workflows/python-tests.yml

@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python: ["3.12"]
+        python: ["3.10"]
         session: [lint, mypy]
     env:
       NOXSESSION: ${{ matrix.session }}
@@ -120,24 +120,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python: ["3.12"] # see below for versions 3.9-3.11
+        python: ["3.12"] # see below for versions 3.10-3.11
         kubernetes-version:
-          ["v1.27.11", "v1.28.7", "v1.29.2", "v1.30.6", "v1.31.0"]
+          ["v1.33.7", "v1.34.3"]
         manifest-db: ["db", "postgres"] # subdirectory of manifests/kustomize/overlays to select which database: 'db' (MySQL) or 'postgres'
         exclude: # on main merges (not PRs), use also different K8s versions for E2E testing
-          - kubernetes-version: ${{ github.event_name != 'push' && 'v1.28.7' }}
-          - kubernetes-version: ${{ github.event_name != 'push' && 'v1.29.2' }}
-          - kubernetes-version: ${{ github.event_name != 'push' && 'v1.30.6' }}
-          - kubernetes-version: ${{ github.event_name != 'push' && 'v1.31.0' }}
-        include: # test Py versions only with a reference K8s version, designated currently to kubernetes-version: v1.27.11
+          - kubernetes-version: ${{ github.event_name != 'push' && 'v1.34.3' }}
+        include: # test Py versions only with a reference K8s version, designated currently to kubernetes-version: v1.33.7
           - python: "3.11"
-            kubernetes-version: "v1.27.11"
+            kubernetes-version: "v1.33.7"
             manifest-db: "db"
           - python: "3.10"
-            kubernetes-version: "v1.27.11"
-            manifest-db: "db"
-          - python: "3.9"
-            kubernetes-version: "v1.27.11"
+            kubernetes-version: "v1.33.7"
             manifest-db: "db"
     env:
       FORCE_COLOR: "1"
@@ -298,12 +292,12 @@ jobs:
           nox --python=${{ matrix.python }}
           poetry build
       - name: Upload dist
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6.0.0
         with:
           name: py-dist
           path: clients/python/dist
       - name: Upload documentation
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6.0.0
         with:
           name: py-docs
           path: clients/python/docs/_build

.github/workflows/scorecard.yml

@@ -58,7 +58,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif

.github/workflows/test-fuzz.yml

@@ -28,7 +28,7 @@ jobs:
       fail-fast: false
       matrix:
         manifest-db: ["db", "postgres"] # subdirectory of manifests/kustomize/overlays to select which database: 'db' (MySQL) or 'postgres'
-        kubernetes-version: ["v1.31.0"]
+        kubernetes-version: ["v1.33.7"]
     env:
       DEPLOY_MANIFEST_DB: "${{ matrix.manifest-db }}"
     steps:

Makefile

@@ -8,7 +8,7 @@ CSI_PATH := $(PROJECT_PATH)/cmd/csi
 CONTROLLER_PATH := $(PROJECT_PATH)/cmd/controller
 
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.29
+ENVTEST_K8S_VERSION = 1.33
 ENVTEST ?= $(PROJECT_BIN)/setup-envtest
 
 # add tools bin directory
@@ -169,7 +169,7 @@ clean/odh:
 	rm -Rf ./model-registry
 
 bin/envtest:
-	GOBIN=$(PROJECT_BIN) ${GO} install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20240320141353-395cfc7486e6
+	GOBIN=$(PROJECT_BIN) ${GO} install sigs.k8s.io/controller-runtime/tools/setup-envtest@release-0.21
 
 GOLANGCI_LINT ?= ${PROJECT_BIN}/golangci-lint
 bin/golangci-lint:
@@ -273,16 +273,16 @@ lint/csi: bin/golangci-lint
 	${GOLANGCI_LINT} run internal/csi/...
 
 .PHONY: test
-test: bin/envtest
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" ${GO} test ./internal/... ./pkg/...
+test:
+	${GO} test $$(${GO} list ./internal/... ./pkg/... | grep -v controller)
 
 .PHONY: test-nocache
-test-nocache: bin/envtest
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" ${GO} test ./internal/... ./pkg/... -count=1
+test-nocache:
+	${GO} test $$(${GO} list ./internal/... ./pkg/... | grep -v controller) -count=1
 
 .PHONY: test-cover
-test-cover: bin/envtest
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" ${GO} test ./internal/... ./pkg/... -coverprofile=coverage.txt
+test-cover:
+	${GO} test $$(${GO} list ./internal/... ./pkg/... | grep -v controller) -coverprofile=coverage.txt
 	${GO} tool cover -html=coverage.txt -o coverage.html
 
 .PHONY: run/proxy
@@ -364,7 +364,7 @@ controller/vet: ## Run go vet against code.
 
 .PHONY: controller/test
 controller/test: controller/manifests controller/generate controller/fmt controller/vet bin/envtest ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(PROJECT_BIN) -p path)" go test $$(go list ./internal/controller/... | grep -vF /e2e) -coverprofile cover.out
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(PROJECT_BIN) -p path)" go test $$(go list ./internal/controller/... ./pkg/inferenceservice-controller/... | grep -vF /e2e) -coverprofile cover.out
 
 ##@ Build
 

catalog/README.md

@@ -13,7 +13,7 @@ The catalog service operates as a **metadata aggregation layer** that:
 ### Supported Catalog Sources
 
 - **YAML Catalog** - Static YAML files containing model metadata
-- **HuggingFace Hub** - Discover models from HuggingFace's model repository
+- **Hugging Face Hub** - Discover models from Hugging Face's model repository
 
 ## REST API
 
@@ -274,20 +274,16 @@ catalogs:
       path: "./models"
 ```
 
-### HuggingFace Source Configuration
+### Hugging Face Source Configuration
 
-The HuggingFace catalog source allows you to discover and import models from the HuggingFace Hub. To configure a HuggingFace source:
+The Hugging Face catalog source allows you to discover and import models from the Hugging Face Hub. To configure a Hugging Face source:
 
 #### 1. Set Your API Key
 
 Setting a Hugging Face API key is optional. Hugging Face  requires an API key for authentication for full access to data of models that are private and/or gated. If an API key is NOT set, private models will be entirely unavailable and gated models will have limited metadata. By default, the service reads the API key from the `HF_API_KEY` environment variable:
 
-```bash
-export HF_API_KEY="your-huggingface-api-key-here"
-```
-
-**Getting a HuggingFace API Key:**
-1. Sign up or log in to [HuggingFace](https://huggingface.co)
+**Getting a Hugging Face API Key:**
+1. Sign up or log in to [Hugging Face](https://huggingface.co)
 2. Go to your [Settings > Access Tokens](https://huggingface.co/settings/tokens)
 3. Create a new token with "Read" permissions
 4. Copy the token and set it as an environment variable
@@ -297,52 +293,140 @@ export HF_API_KEY="your-huggingface-api-key-here"
 - Reference it in your deployment configuration
 - The catalog service will read it from the configured environment variable (defaults to `HF_API_KEY`)
 
+```bash
+kubectl create secret generic model-catalog-hf-api-key \
+  --from-literal=HF_API_KEY="your-api-key-here" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+kubectl rollout restart deployment model-catalog-server -n kubeflow
+```
+
 **Custom Environment Variable Name:**
 You can configure a custom environment variable name per source by setting the `apiKeyEnvVar` property in your source configuration (see below). This is useful when you need different API keys for different sources.
 
 **Important Notes:**
 - **Private Models**: For private models, the API key must belong to an account that has been granted access to the model. Without proper access, the catalog service will not be able to retrieve model information.
-- **Gated Models**: For gated models (models with usage restrictions), you must accept the model's terms of service on HuggingFace before the catalog service can access all available model information. Visit the model's page on HuggingFace and accept the terms to ensure full metadata is available.
+- **Gated Models**: For gated models (models with usage restrictions), you must accept the model's terms of service on Hugging Face before the catalog service can access all available model information. Visit the model's page on Hugging Face and accept the terms to ensure full metadata is available.
 
 #### 2. Configure the Source
 
-Add a HuggingFace source to your `catalog-sources.yaml`:
+Add a Hugging Face source to your `catalog-sources.yaml`:
 
 ```yaml
 catalogs:
-  - name: "HuggingFace Hub"
+  - name: "Hugging Face Hub"
     id: "huggingface"
     type: "hf"
     enabled: true
     # Required: List of model identifiers to include
     # Format: "organization/model-name" or "username/model-name"
+    # Supports wildcard patterns: "organization/*" or "organization/prefix*"
     includedModels:
       - "meta-llama/Llama-3.1-8B-Instruct"
-      - "ibm-granite/granite-4.0-h-small"
       - "microsoft/phi-2"
-    
+      - "microsoft/phi-3*"  # All models starting with "phi-3"
+
     # Optional: Exclude specific models or patterns
     # Supports exact matches or patterns ending with "*"
     excludedModels:
       - "some-org/unwanted-model"
       - "another-org/test-*"  # Excludes all models starting with "test-"
-    
+
     # Optional: Configure a custom environment variable name for the API key
     # Defaults to "HF_API_KEY" if not specified
     properties:
       apiKeyEnvVar: "MY_CUSTOM_API_KEY_VAR"
 ```
 
+#### Organization-Restricted Sources
+
+You can restrict a source to only fetch models from a specific organization using the `allowedOrganization` property. This automatically prefixes all model patterns with the organization name:
+
+```yaml
+catalogs:
+  - name: "Meta LLaMA Models"
+    id: "meta-llama-models"
+    type: "hf"
+    enabled: true
+    properties:
+      allowedOrganization: "meta-llama"
+      apiKeyEnvVar: "HF_API_KEY"
+    includedModels:
+      # These patterns are automatically prefixed with "meta-llama/"
+      - "*"           # Expands to: meta-llama/*
+      - "Llama-3*"    # Expands to: meta-llama/Llama-3*
+      - "CodeLlama-*" # Expands to: meta-llama/CodeLlama-*
+    excludedModels:
+      - "*-4bit"      # Excludes: meta-llama/*-4bit
+      - "*-GGUF"      # Excludes: meta-llama/*-GGUF
+```
+
+**Benefits of organization-restricted sources:**
+- **Simplified configuration**: No need to repeat organization name in every pattern
+- **Security**: Prevents accidental inclusion of models from other organizations
+- **Convenience**: Use `"*"` to get all models from an organization
+- **Performance**: Optimized API calls when fetching from a single organization
+
 #### Model Filtering
 
 Both `includedModels` and `excludedModels` are top-level properties (not nested under `properties`):
 
-- **`includedModels`** (required): List of model identifiers to fetch from HuggingFace. Format: `"organization/model-name"` or `"username/model-name"`
+- **`includedModels`** (required): List of model identifiers to fetch from Hugging Face
 - **`excludedModels`** (optional): List of models or patterns to exclude from the results
 
-The `excludedModels` property supports:
+#### Supported Pattern Types
+
+**Exact Model Names:**
+```yaml
+includedModels:
+  - "meta-llama/Llama-3.1-8B-Instruct"  # Specific model
+  - "microsoft/phi-2"                    # Specific model
+```
+
+**Wildcard Patterns:**
+
+In `includedModels`, wildcards can match model names by a prefix.
+
+```yaml
+includedModels:
+  - "microsoft/phi-*"      # All models starting with "phi-"
+  - "meta-llama/Llama-3*"  # All models starting with "Llama-3"
+  - "huggingface/*"        # All models from huggingface organization
+```
+
+**Organization-Only Patterns (with `allowedOrganization`):**
+```yaml
+properties:
+  allowedOrganization: "meta-llama"
+includedModels:
+  - "*"          # All models from meta-llama organization
+  - "Llama-3*"   # All meta-llama models starting with "Llama-3"
+  - "CodeLlama-*" # All meta-llama models starting with "CodeLlama-"
+```
+
+#### Pattern Validation
+
+**Valid patterns:**
+- `"org/model"` - Exact model name
+- `"org/prefix*"` - Models starting with prefix
+- `"org/*"` - All models from organization
+- `"*"` - All models (only when using `allowedOrganization`)
+
+**Invalid patterns (will be rejected):**
+- `"*"` - Global wildcard (without `allowedOrganization`)
+- `"*/*"` - Global organization wildcard
+- `"org*"` - Wildcard in organization name
+- `"org/"` - Empty model name
+- `"*prefix*"` - Multiple wildcards
+
+#### Exclusion Patterns
+
+The `excludedModels` property supports prefixes like `includedModels` and also suffixes and mid-name wildcards:
 - **Exact matches**: `"meta-llama/Llama-3.1-8B-Instruct"` - excludes this specific model
-- **Pattern matching**: `"test-*"` - excludes all models starting with "test-"
+- **Pattern matching**:
+    - `"*-draft"` - excludes all models ending with "-draft"
+    - `"Llama-3.*-Instruct"` - excludes all Llama 3.x models ending with "-Instruct"
+- **Organization patterns**: `"test-org/*"` - excludes all models from test-org
 
 ## Development
 

catalog/internal/catalog/db_catalog.go

@@ -252,6 +252,7 @@ func (d *dbCatalogImpl) GetFilterOptions(ctx context.Context) (*apimodels.Filter
 					Value:    filter.Value,
 				}
 			}
+			d.applyMinMax(apiFieldFilters, options)
 			apiNamedQueries[queryName] = apiFieldFilters
 		}
 
@@ -266,6 +267,37 @@ func (d *dbCatalogImpl) GetFilterOptions(ctx context.Context) (*apimodels.Filter
 	}, nil
 }
 
+func (d *dbCatalogImpl) applyMinMax(query map[string]apimodels.FieldFilter, options map[string]apimodels.FilterOption) {
+	// Find queries where the value is min or max and replace it with the
+	// actual min or max from the filter options.
+	for key, filter := range query {
+		// Find string values that are either min or max
+		value, ok := filter.Value.(string)
+		if !ok || (value != "min" && value != "max") {
+			continue
+		}
+
+		option, ok := options[key]
+		if !ok || option.Range == nil {
+			// Skip fields without a corresponding option or options without a range.
+			continue
+		}
+
+		switch value {
+		case "min":
+			if option.Range.Min != nil {
+				filter.Value = *option.Range.Min
+			}
+		case "max":
+			if option.Range.Max != nil {
+				filter.Value = *option.Range.Max
+			}
+		}
+
+		query[key] = filter
+	}
+}
+
 func (d *dbCatalogImpl) GetPerformanceArtifacts(ctx context.Context, modelName string, sourceID string, params ListPerformanceArtifactsParams) (apimodels.CatalogArtifactList, error) {
 	// Get the model to validate it exists and get its ID
 	modelsList, err := d.catalogModelRepository.List(dbmodels.CatalogModelListOptions{