OLS-1676: Create RAG BYOK tool image through konflux

Signed-off-by: Haoyu Sun <[email protected]>

Author: raptorsun

.tekton/lightspeed-rag-tool-pull-request.yaml

@@ -8,8 +8,10 @@ metadata:
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
     pipelinesascode.tekton.dev/cancel-in-progress: "true"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch
-      == "main"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      event == "pull_request" && 
+      target_branch == "main" &&
+      (".tekton/lightspeed-rag-tool-pull-request.yaml".pathChanged() || "artifacts.lock.yaml".pathChanged() || "rpms.lock.yaml".pathChanged() || "requirements*".pathChanged() || "byok/***".pathChanged() || "embeddings_model/***".pathChanged())
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: rag-tool
@@ -29,6 +31,11 @@ spec:
     value: 5d
   - name: dockerfile
     value: byok/Containerfile.tool
+  - name: hermetic
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "generic", "path": "."}, {"type": "rpm", "path": "."}, {"type":
+      "pip", "path": ".", "allow_binary": "true", "requirements_files": ["requirements.gpu.txt"]}]'
   pipelineSpec:
     description: |
       This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization.
@@ -181,6 +188,8 @@ spec:
         value: $(params.output-image).prefetch
       - name: ociArtifactExpiresAfter
         value: $(params.image-expires-after)
+      - name: dev-package-managers
+        value: "true"
       runAfter:
       - clone-repository
       taskRef:

.tekton/lightspeed-rag-tool-push.yaml

@@ -7,8 +7,10 @@ metadata:
     build.appstudio.redhat.com/target_branch: '{{target_branch}}'
     pipelinesascode.tekton.dev/cancel-in-progress: "false"
     pipelinesascode.tekton.dev/max-keep-runs: "3"
-    pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch
-      == "main"
+    pipelinesascode.tekton.dev/on-cel-expression: |
+      event == "push" &&
+      target_branch == "main" &&
+      (".tekton/lightspeed-rag-tool-on-push.yaml".pathChanged() || "artifacts.lock.yaml".pathChanged() || "rpms.lock.yaml".pathChanged() || "requirements*".pathChanged() || "byok/***".pathChanged() || "embeddings_model/***".pathChanged())
   creationTimestamp: null
   labels:
     appstudio.openshift.io/application: rag-tool
@@ -26,6 +28,11 @@ spec:
     value: quay.io/redhat-user-workloads/crt-nshift-lightspeed-tenant/lightspeed-rag-tool:{{revision}}
   - name: dockerfile
     value: byok/Containerfile.tool
+  - name: hermetic
+    value: "true"
+  - name: prefetch-input
+    value: '[{"type": "generic", "path": "."}, {"type": "rpm", "path": "."}, {"type":
+      "pip", "path": ".", "allow_binary": "true", "requirements_files": ["requirements.gpu.txt"]}]'
   pipelineSpec:
     description: |
       This pipeline is ideal for building container images from a Containerfile while maintaining trust after pipeline customization.
@@ -178,6 +185,8 @@ spec:
         value: $(params.output-image).prefetch
       - name: ociArtifactExpiresAfter
         value: $(params.image-expires-after)
+      - name: dev-package-managers
+        value: "true"
       runAfter:
       - clone-repository
       taskRef:

Makefile

@@ -60,3 +60,11 @@ help: ## Show this help screen
 	@grep -E '^[ a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | \
 		awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-25s\033[0m %s\n", $$1, $$2}'
 	@echo ''
+	
+model-safetensors: ## Download model.safetensors to embeddings_model
+	@if [ ! -f embeddings_model/model.safetensors ]; then \
+		echo "Downloading model.safetensors..."; \
+		wget "https://huggingface.co/sentence-transformers/all-mpnet-base-v2/resolve/9a3225965996d404b775526de6dbfe85d3368642/model.safetensors" -O embeddings_model/model.safetensors; \
+	else \
+		echo "model.safetensors already exists. Skipping download."; \
+	fi

byok/Containerfile.tool

@@ -1,24 +1,28 @@
 ARG BYOK_TOOL_IMAGE=quay.io/$USERNAME/tool:latest
 ARG UBI_BASE_IMAGE=registry.access.redhat.com/ubi9/ubi:latest
+ARG HERMETIC=false
 FROM ${UBI_BASE_IMAGE}
 ARG LOG_LEVEL=info
 ARG OUT_IMAGE_TAG=byok-image
 ARG VECTOR_DB_INDEX=vector_db_index
 ARG BYOK_TOOL_IMAGE
 ARG UBI_BASE_IMAGE
-RUN dnf install -y buildah python3.11 python3.11-pip wget
+ARG HERMETIC
+RUN dnf install -y buildah python3.11 python3.11-pip
 
 USER 0
 WORKDIR /workdir
 
-COPY requirements.cpu.txt .
-RUN pip3.11 install --upgrade pip && pip3.11 install --no-cache-dir -r requirements.cpu.txt
+COPY requirements.gpu.txt .
+RUN pip3.11 install --no-cache-dir --no-deps -r requirements.gpu.txt
 
 COPY embeddings_model ./embeddings_model
-RUN cd embeddings_model && if [ ! -f embeddings_model/model.safetensors ]; then \
-        wget -q https://huggingface.co/sentence-transformers/all-mpnet-base-v2/resolve/9a3225965996d404b775526de6dbfe85d3368642/model.safetensors; \
+RUN cd embeddings_model; if [ "$HERMETIC" == "true" ] && [ ! -f embeddings_model/model.safetensors ]; then \
+        cp /cachi2/output/deps/generic/model.safetensors model.safetensors; \
+    elif [ ! -f embeddings_model/model.safetensors ]; then \
+        curl -L -O https://huggingface.co/sentence-transformers/all-mpnet-base-v2/resolve/9a3225965996d404b775526de6dbfe85d3368642/model.safetensors; \
     fi
-COPY byok/generate_embeddings_tool.py byok/Containerfile.output .
+COPY byok/generate_embeddings_tool.py byok/Containerfile.output ./
 
 ENV _BUILDAH_STARTED_IN_USERNS=""
 ENV BUILDAH_ISOLATION=chroot