fix for redhat-ods-applications network policy in RHOAI 2.19 (#182)

dgrove-oss · web-flow · commit 0afab3a3b4f6 · 2025-05-15T13:45:27.000-04:00
* add mlbatch network policy for redhat-ods-applications
* reduce cpu request in samples for easier testing on small clusters
diff --git a/samples/job.yaml b/samples/job.yaml
@@ -20,4 +20,4 @@ spec:
               command: ["sh", "-c", "sleep 5"]
               resources:
                 requests:
-                  cpu: 1
+                  cpu: 100m
diff --git a/samples/pod.yaml b/samples/pod.yaml
@@ -18,4 +18,4 @@ spec:
           command: ["sh", "-c", "sleep 5"]
           resources:
             requests:
-              cpu: 1
+              cpu: 100m
diff --git a/samples/pytorchjob-in-appwrapper.yaml b/samples/pytorchjob-in-appwrapper.yaml
@@ -26,7 +26,7 @@ spec:
                   - "--epochs=1"
                   resources:
                     requests:
-                      cpu: 1
+                      cpu: 100m
           Worker:
             replicas: 1
             restartPolicy: OnFailure
@@ -41,4 +41,4 @@ spec:
                   - "--epochs=1"
                   resources:
                     requests:
-                      cpu: 1
+                      cpu: 100m
diff --git a/samples/pytorchjob.yaml b/samples/pytorchjob.yaml
@@ -20,7 +20,7 @@ spec:
             - "--epochs=1"
             resources:
               requests:
-                cpu: 1
+                cpu: 100m
     Worker:
       replicas: 1
       restartPolicy: OnFailure
@@ -35,4 +35,4 @@ spec:
             - "--epochs=1"
             resources:
               requests:
-                cpu: 1
+                cpu: 100m
diff --git a/setup.RHOAI-v2.16/CLUSTER-SETUP.md b/setup.RHOAI-v2.16/CLUSTER-SETUP.md
@@ -39,7 +39,7 @@ oc patch deployment -n scheduler-plugins --type=json --patch-file setup.RHOAI-v2
 Create the Red Hat OpenShift AI subscription:
 ```sh
 oc apply -f setup.RHOAI-v2.16/mlbatch-subscription.yaml
-````
+```
 Identify install plan:
 ```sh
 oc get ip -n redhat-ods-operator
diff --git a/setup.RHOAI-v2.19/CLUSTER-SETUP.md b/setup.RHOAI-v2.19/CLUSTER-SETUP.md
@@ -39,7 +39,11 @@ oc patch deployment -n scheduler-plugins --type=json --patch-file setup.RHOAI-v2
 Create the Red Hat OpenShift AI subscription:
 ```sh
 oc apply -f setup.RHOAI-v2.19/mlbatch-subscription.yaml
-````
+```
+Create the mlbatch NetworkPolicy in the redhat-ods-applications namespace.
+```sh
+oc apply -f setup.RHOAI-v2.19/mlbatch-network-policy.yaml
+```
 Identify install plan:
 ```sh
 oc get ip -n redhat-ods-operator
diff --git a/setup.RHOAI-v2.19/UPGRADE-FAST.md b/setup.RHOAI-v2.19/UPGRADE-FAST.md
@@ -34,8 +34,11 @@ kubectl delete crd multikueueconfigs.kueue.x-k8s.io
 
 Next, update the MLBatch modifications to the default RHOAI configuration maps and subscription.
 ```sh
+oc delete cm mlbatch-kuberay -n redhat-ods-operator
+oc delete cm mlbatch-codeflare -n redhat-ods-operator
 oc apply -f setup.RHOAI-v2.19/mlbatch-upgrade-configmaps.yaml
 oc apply -f setup.RHOAI-v2.19/mlbatch-upgrade-fast-subscription.yaml
+oc apply -f setup.RHOAI-v2.19/mlbatch-network-policy.yaml
 ```
 
 Finally, you can approve the install plan replacing the example plan name below
diff --git a/setup.RHOAI-v2.19/UPGRADE-STABLE.md b/setup.RHOAI-v2.19/UPGRADE-STABLE.md
@@ -37,8 +37,11 @@ kubectl delete crd multikueueconfigs.kueue.x-k8s.io
 
 Next, update the MLBatch modifications to the default RHOAI configuration maps and subscription.
 ```sh
+oc delete cm mlbatch-kuberay -n redhat-ods-operator
+oc delete cm mlbatch-codeflare -n redhat-ods-operator
 oc apply -f setup.RHOAI-v2.19/mlbatch-upgrade-configmaps.yaml
 oc apply -f setup.RHOAI-v2.19/mlbatch-upgrade-stable-subscription.yaml
+oc apply -f setup.RHOAI-v2.19/mlbatch-network-policy.yaml
 ```
 
 Finally, you can approve the install plan replacing the example plan name below
diff --git a/setup.RHOAI-v2.19/mlbatch-network-policy.yaml b/setup.RHOAI-v2.19/mlbatch-network-policy.yaml
@@ -0,0 +1,25 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: mlbatch-ods-applications
+  namespace: redhat-ods-applications
+spec:
+  podSelector: {}
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 8443
+        - protocol: TCP
+          port: 8080
+        - protocol: TCP
+          port: 8081
+        - protocol: TCP
+          port: 5432
+        - protocol: TCP
+          port: 8082
+        - protocol: TCP
+          port: 8099
+        - protocol: TCP
+          port: 8181
+        - protocol: TCP
+          port: 9443    # default webhook of components
diff --git a/setup.RHOAI-v2.19/mlbatch-subscription.yaml b/setup.RHOAI-v2.19/mlbatch-subscription.yaml
@@ -175,19 +175,13 @@ spec:
     env:
     - name: "DISABLE_DSC_CONFIG"
     volumeMounts:
-    - name: mlbatch-codeflare
-      mountPath: /opt/manifests/codeflare/manager/manager.yaml
-      subPath: manager.yaml
     - name: mlbatch-kueue
       mountPath: /opt/manifests/kueue/components/manager/controller_manager_config.yaml
       subPath: controller_manager_config.yaml
     - name: mlbatch-training-operator
       mountPath: /opt/manifests/trainingoperator/rhoai/manager_config_patch.yaml
       subPath: manager_config_patch.yaml
     volumes:
-    - name: mlbatch-codeflare
-      configMap:
-        name: mlbatch-codeflare
     - name: mlbatch-kueue
       configMap:
         name: mlbatch-kueue
diff --git a/setup.RHOAI-v2.19/mlbatch-upgrade-fast-subscription.yaml b/setup.RHOAI-v2.19/mlbatch-upgrade-fast-subscription.yaml
@@ -13,19 +13,13 @@ spec:
     env:
     - name: "DISABLE_DSC_CONFIG"
     volumeMounts:
-    - name: mlbatch-codeflare
-      mountPath: /opt/manifests/codeflare/manager/manager.yaml
-      subPath: manager.yaml
     - name: mlbatch-kueue
       mountPath: /opt/manifests/kueue/components/manager/controller_manager_config.yaml
       subPath: controller_manager_config.yaml
     - name: mlbatch-training-operator
       mountPath: /opt/manifests/trainingoperator/rhoai/manager_config_patch.yaml
       subPath: manager_config_patch.yaml
     volumes:
-    - name: mlbatch-codeflare
-      configMap:
-        name: mlbatch-codeflare
     - name: mlbatch-kueue
       configMap:
         name: mlbatch-kueue
diff --git a/setup.RHOAI-v2.19/mlbatch-upgrade-stable-subscription.yaml b/setup.RHOAI-v2.19/mlbatch-upgrade-stable-subscription.yaml
@@ -13,19 +13,13 @@ spec:
     env:
     - name: "DISABLE_DSC_CONFIG"
     volumeMounts:
-    - name: mlbatch-codeflare
-      mountPath: /opt/manifests/codeflare/manager/manager.yaml
-      subPath: manager.yaml
     - name: mlbatch-kueue
       mountPath: /opt/manifests/kueue/components/manager/controller_manager_config.yaml
       subPath: controller_manager_config.yaml
     - name: mlbatch-training-operator
       mountPath: /opt/manifests/trainingoperator/rhoai/manager_config_patch.yaml
       subPath: manager_config_patch.yaml
     volumes:
-    - name: mlbatch-codeflare
-      configMap:
-        name: mlbatch-codeflare
     - name: mlbatch-kueue
       configMap:
         name: mlbatch-kueue
diff --git a/setup.tmpl/CLUSTER-SETUP.md.tmpl b/setup.tmpl/CLUSTER-SETUP.md.tmpl
@@ -71,7 +71,13 @@ Optionally, create a config map capturing your cluster's topology as described i
 Create the Red Hat OpenShift AI subscription:
 ```sh
 {{ .KUBECTL }} apply -f setup.{{ .VERSION }}/mlbatch-subscription.yaml
-````
+```
+{{- if not (eq .VERSION "RHOAI-v2.16") }}
+Create the mlbatch NetworkPolicy in the redhat-ods-applications namespace.
+```sh
+{{ .KUBECTL }} apply -f setup.{{ .VERSION }}/mlbatch-network-policy.yaml
+```
+{{- end }}
 Identify install plan:
 ```sh
 {{ .KUBECTL }} get ip -n redhat-ods-operator
diff --git a/setup.tmpl/StepsToUpgrade.txt b/setup.tmpl/StepsToUpgrade.txt
@@ -0,0 +1,9 @@
+Things to remember/do when updating RHOAI versions.
+
+1. Clone setup directory from previous RHOAI release.
+2. Inspect all files we are overlaying in mlbatch-subscription's
+   overlay of ODH and merge any upstream changes.
+3. Replicate all subscription deltas in upgrade files and note in
+   UPGRADE steps.
+4. Be sure to verify ready status of RHOAI operator, DSC and DSCI
+   in console to make sure the overlays were successfully applied.
