Merge remote-tracking branch 'upstream/main'

Author: CFSNM

tests/odh/mnist_ray_test.go

@@ -68,6 +68,9 @@ func mnistRay(t *testing.T, numGpus int, gpuResourceName string, rayImage string
 	// Create a namespace
 	namespace := test.NewTestNamespace()
 
+	// Ensure Notebook ServiceAccount exists (no extra RBAC)
+	ensureNotebookServiceAccount(test, namespace.Name)
+
 	// Create Kueue resources
 	resourceFlavor := CreateKueueResourceFlavor(test, v1beta1.ResourceFlavorSpec{})
 	defer test.Client().Kueue().KueueV1beta1().ResourceFlavors().Delete(test.Ctx(), resourceFlavor.Name, metav1.DeleteOptions{})

tests/odh/mnist_raytune_hpo_test.go

@@ -48,6 +48,9 @@ func mnistRayTuneHpo(t *testing.T, numGpus int) {
 	// Creating a namespace
 	namespace := test.NewTestNamespace()
 
+	// Ensure Notebook ServiceAccount exists (no extra RBAC)
+	ensureNotebookServiceAccount(test, namespace.Name)
+
 	// Create Kueue resources
 	resourceFlavor := CreateKueueResourceFlavor(test, v1beta1.ResourceFlavorSpec{})
 	defer test.Client().Kueue().KueueV1beta1().ResourceFlavors().Delete(test.Ctx(), resourceFlavor.Name, metav1.DeleteOptions{})

tests/odh/ray_finetune_llm_deepspeed_test.go

@@ -48,6 +48,9 @@ func rayFinetuneLlmDeepspeed(t *testing.T, numGpus int, modelName string, modelC
 	var workingDirectory, err = os.Getwd()
 	test.Expect(err).ToNot(HaveOccurred())
 
+	// Ensure Notebook ServiceAccount exists (no extra RBAC)
+	ensureNotebookServiceAccount(test, namespace.Name)
+
 	// Define the regular(non-admin) user
 	userName := GetNotebookUserName(test)
 	userToken := GetNotebookUserToken(test)

tests/odh/raytune_oai_mr_grpc_test.go

@@ -48,6 +48,9 @@ func raytuneHpo(t *testing.T, numGpus int) {
 	// Create a namespace
 	namespace := test.NewTestNamespace()
 
+	// Ensure Notebook ServiceAccount exists (no extra RBAC)
+	ensureNotebookServiceAccount(test, namespace.Name)
+
 	// Get current working directory
 	workingDirectory, err := os.Getwd()
 	test.Expect(err).ToNot(HaveOccurred())

tests/odh/support.go

@@ -25,7 +25,9 @@ import (
 	gomega "github.com/onsi/gomega"
 	rayv1 "github.com/ray-project/kuberay/ray-operator/apis/ray/v1"
 
-	v1 "k8s.io/api/core/v1"
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/opendatahub-io/distributed-workloads/tests/common/support"
 )
@@ -58,7 +60,7 @@ func getNotebookCommand(rayImage string) []string {
 	}
 }
 
-func GetDashboardUrl(test support.Test, namespace *v1.Namespace, rayCluster *rayv1.RayCluster) string {
+func GetDashboardUrl(test support.Test, namespace *corev1.Namespace, rayCluster *rayv1.RayCluster) string {
 	dashboardName := "ray-dashboard-" + rayCluster.Name
 	route := support.GetRoute(test, namespace.Name, dashboardName)
 	hostname := route.Status.Ingress[0].Host
@@ -79,6 +81,18 @@ func GetTestJobId(test support.Test, rayClient support.RayClusterClient) string
 	return jobID
 }
 
+// EnsureNotebookServiceAccount ensures the Notebook ServiceAccount exists in the target namespace.
+// This avoids webhook/controller failures when creating the Notebook CR.
+func ensureNotebookServiceAccount(test support.Test, namespace string) {
+	test.T().Helper()
+	saName := "jupyter-nb-kube-3aadmin"
+	sa := &corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: saName, Namespace: namespace}}
+	_, err := test.Client().Core().CoreV1().ServiceAccounts(namespace).Create(test.Ctx(), sa, metav1.CreateOptions{})
+	if err != nil && !apierrors.IsAlreadyExists(err) {
+		test.T().Fatalf("Failed to create ServiceAccount %s/%s: %v", namespace, saName, err)
+	}
+}
+
 // Adds a unique suffix to the provided string
 func uniqueSuffix(prefix string) string {
 	suffix := gonanoid.MustGenerate("1234567890abcdef", 4)