Skip to content

Commit 0714eb8

Browse files
pabel-rhpabel-rh
committed
Incorporated Gabe's comments
1 parent 9155e44 commit 0714eb8

File tree

2 files changed

+130
-5
lines changed

2 files changed

+130
-5
lines changed

‎modules/openshift-ai-connector-for-rhdh/proc-setting-up-openshift-ai-connector-for-rhdh-with-rhoai.adoc‎

Lines changed: 129 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ The installation of the {openshift-ai-connector-name} requires manual updates to
77

88
.{rhoai-short} Prerequisites
99

10-
* To import model cards from the model catalog into TechDocs, you need to use {rhoai-short} 2.25.
10+
* To import model cards from the model catalog into TechDocs, you must use {rhoai-short} 2.25.
1111
+
1212
[NOTE]
1313
====
@@ -25,11 +25,136 @@ For more details, see link:https://docs.redhat.com/en/documentation/red_hat_open
2525

2626
. Configure {rhoai-short}-related RBAC and credentials.
2727
A Kubernetes `ServiceAccount` and a `service-account-token` Secret are required for the connector to retrieve data from {rhoai-short}. The following resources must be created, replacing namespace names (`ai-rhdh` for {product-very-short}, `rhoai-model-registries` for {rhoai-short}) as needed:
28-
** `ServiceAccount` (`rhdh-rhoai-bridge`)
29-
** `ClusterRole` and `ClusterRoleBinding` (`rhdh-rhoai-bridge`) to allow access to OCP resources like `routes`, `services`, and `inferenceservices`.
30-
** `Role` and `RoleBinding` to allow ConfigMap updates within the {product-very-short} namespace.
28+
** `ServiceAccount` (`rhdh-rhoai-bridge`). For example:
29+
+
30+
[source,yaml]
31+
----
32+
apiVersion: v1
33+
kind: ServiceAccount
34+
metadata:
35+
name: rhdh-rhoai-bridge
36+
namespace: ai-rhdh
37+
----
38+
** `ClusterRole` and `ClusterRoleBinding` (`rhdh-rhoai-bridge`) to allow access to OCP resources like `routes`, `services`, and `inferenceservices`. For example:
39+
+
40+
[source,yaml]
41+
----
42+
# Example for `ClusterRole`
43+
apiVersion: rbac.authorization.k8s.io/v1
44+
kind: ClusterRole
45+
metadata:
46+
name: rhdh-rhoai-bridge
47+
annotations:
48+
argocd.argoproj.io/sync-wave: "0"
49+
rules:
50+
- apiGroups:
51+
- apiextensions.k8s.sio
52+
resources:
53+
- customresourcedefinitions
54+
verbs:
55+
- get
56+
- apiGroups:
57+
- route.openshift.io
58+
resources:
59+
- routes
60+
verbs:
61+
- get
62+
- list
63+
- watch
64+
- apiGroups: [""]
65+
resources:
66+
- serviceaccounts
67+
- services
68+
verbs:
69+
- get
70+
- list
71+
- watch
72+
73+
- apiGroups: ["serving.kserve.io"]
74+
resources: ["inferenceservices"]
75+
verbs: ["get", "list", "watch"]
76+
----
77+
+
78+
[source,yaml]
79+
----
80+
# Example for `ClusterRoleBinding`
81+
apiVersion: rbac.authorization.k8s.io/v1
82+
kind: ClusterRoleBinding
83+
metadata:
84+
name: rhdh-rhoai-bridge
85+
roleRef:
86+
apiGroup: rbac.authorization.k8s.io
87+
kind: ClusterRole
88+
name: rhdh-rhoai-bridge
89+
subjects:
90+
- kind: ServiceAccount
91+
name: rhdh-rhoai-bridge
92+
namespace: ai-rhdh
93+
----
94+
** `Role` and `RoleBinding` to allow ConfigMap updates within the {product-very-short} namespace. For example:
95+
+
96+
[source,yaml]
97+
----
98+
# Example for `Role`
99+
apiVersion: rbac.authorization.k8s.io/v1
100+
kind: Role
101+
metadata:
102+
name: rhdh-rhoai-bridge
103+
namespace: ai-rhdh
104+
rules:
105+
- apiGroups: [""]
106+
resources: ["configmaps"]
107+
verbs: ["get", "list", "watch", "create", "update", "patch"]
108+
----
109+
+
110+
[source,yaml]
111+
----
112+
# Example for `RoleBinding`
113+
apiVersion: rbac.authorization.k8s.io/v1
114+
kind: RoleBinding
115+
metadata:
116+
name: rhdh-rhoai-dashboard-permissions
117+
namespace: rhoai-model-registries
118+
roleRef:
119+
apiGroup: rbac.authorization.k8s.io
120+
kind: Role
121+
name: registry-user-modelregistry-public
122+
subjects:
123+
- apiGroup: rbac.authorization.k8s.io
124+
kind: Group
125+
name: system:serviceaccounts:ai-rhdh
126+
----
31127
** `RoleBinding` in the {rhoai-short} namespace to grant the {product-very-short} `ServiceAccount` read permissions to the Model Registry data (binding to `registry-user-modelregistry-public`).
128+
+
129+
[source,yaml]
130+
----
131+
apiVersion: rbac.authorization.k8s.io/v1
132+
kind: RoleBinding
133+
metadata:
134+
name: rhdh-rhoai-bridge
135+
namespace: ai-rhdh
136+
roleRef:
137+
apiGroup: rbac.authorization.k8s.io
138+
kind: Role
139+
name: rhdh-rhoai-bridge
140+
subjects:
141+
- kind: ServiceAccount
142+
name: rhdh-rhoai-bridge
143+
namespace: ai-rhdh
144+
----
32145
** Secret (`rhdh-rhoai-bridge-token`) of type `kubernetes.io/service-account-token` that goes along with the `rhdh-rhoai-bridge` `ServiceAccount`.
146+
+
147+
[source,yaml]
148+
----
149+
apiVersion: v1
150+
kind: Secret
151+
metadata:
152+
name: rhdh-rhoai-bridge-token
153+
namespace: ai-rhdh
154+
annotations:
155+
kubernetes.io/service-account.name: rhdh-rhoai-bridge
156+
type: kubernetes.io/service-account-token
157+
----
33158

34159
. Update your {product-very-short} dynamic plugin configuration.
35160
The {product-very-short} Pod requires two dynamic plugins.

‎modules/openshift-ai-connector-for-rhdh/ref-enrich-ai-model-metadata.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
[id="ref-enrich-ai-model-metadata_{context}"]
44
= Enrich AI model metadata for enhanced {product} experience
55

6-
While {rhoai-short} provides essential data, an AI platform engineer can enrich the {backstage} experience by adding custom properties to the `ModelVersion` or `RegisteredModel` (or annotations to the `KServe InferenceService` if the Model Registry is not used) so that the {openshift-ai-connector-name} can add the information to the {product-very-short} entities it creates.
6+
While {rhoai-short} provides essential data, an AI platform engineer using {rhoai-short} can enrich the {backstage}/{product-very-short} experience by adding custom properties to the `ModelVersion` or `RegisteredModel` (or annotations to the `KServe InferenceService` if the model registry is not used) so that the {openshift-ai-connector-name} can add the information to the {product-very-short} entities it creates. For more details, see https://docs.redhat.com/en/documentation/red_hat_openshift_ai_self-managed/2.25/html/working_with_model_registries/working-with-model-registries_model-registry#editing-model-version-metadata-in-a-model-registry_model-registry[Editing model version metadata in a model registry].
77

88
|===
99
|Property Key |Entity Field Populated |Description

0 commit comments

Comments
 (0)