models-as-a-service/deployment/overlays/odh/kustomization.yaml at a4733e7124bb72d8b18cd6ad84edbe26840c2228 · opendatahub-io/models-as-a-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

metadata:
  name: maas-odh-overlay

# ODH overlay: maas-api with TLS + maas-controller (per-route auth/rate limits)
# For full deployment including rate limits, use openshift overlay

namespace: opendatahub
resources:
  - ../../base/maas-api/overlays/tls  # maas-api with TLS (includes DestinationRule + NetworkPolicy)
  - ../../base/maas-controller/default
  - ../../base/maas-controller/policies  # gateway-default-auth, gateway-default-deny

configMapGenerator:
- envs:
  - params.env
  name: maas-parameters
generatorOptions:
  disableNameSuffixHash: true

patches:
- patch: |-
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: maas-api
    spec:
      template:
        spec:
          containers:
          - name: maas-api
            env:
            - name: GATEWAY_NAMESPACE
              valueFrom:
                configMapKeyRef:
                  key: gateway-namespace
                  name: maas-parameters
            - name: GATEWAY_NAME
              valueFrom:
                configMapKeyRef:
                  key: gateway-name
                  name: maas-parameters
            - name: API_KEY_MAX_EXPIRATION_DAYS
              valueFrom:
                configMapKeyRef:
                  key: api-key-max-expiration-days
                  name: maas-parameters
                  optional: true
  target:
    kind: Deployment
    name: maas-api
- path: maas-api-auth-policy-oidc-patch.yaml
  target:
    kind: AuthPolicy
    name: maas-api-auth-policy

replacements:
# Gateway policies must be in openshift-ingress to target maas-default-gateway
- source:
    kind: ConfigMap
    version: v1
    name: maas-parameters
    fieldPath: data.gateway-namespace
  targets:
  - select:
      kind: AuthPolicy
      name: gateway-default-auth
    fieldPaths:
    - metadata.namespace
  - select:
      kind: TokenRateLimitPolicy
      name: gateway-default-deny
    fieldPaths:
    - metadata.namespace
- source:
    kind: ConfigMap
    version: v1
    name: maas-parameters
    fieldPath: data.maas-api-image
  targets:
  - select:
      kind: Deployment
      name: maas-api
    fieldPaths:
    - spec.template.spec.containers.[name=maas-api].image
- source:
    kind: ConfigMap
    version: v1
    name: maas-parameters
    fieldPath: data.maas-controller-image
  targets:
  - select:
      kind: Deployment
      name: maas-controller
    fieldPaths:
    - spec.template.spec.containers.[name=manager].image
- source:
    kind: ConfigMap
    version: v1
    name: maas-parameters
    fieldPath: data.gateway-namespace
  targets:
  - select:
      kind: HTTPRoute
      name: maas-api-route
    fieldPaths:
    - spec.parentRefs.0.namespace
  - select:
      kind: DestinationRule
      name: maas-api-backend-tls
    fieldPaths:
    - metadata.namespace
- source:
    kind: ConfigMap
    version: v1
    name: maas-parameters
    fieldPath: data.gateway-name
  targets:
  - select:
      kind: HTTPRoute
      name: maas-api-route
    fieldPaths:
    - spec.parentRefs.0.name
- source:
    kind: ConfigMap
    version: v1
    name: maas-parameters
    fieldPath: data.app-namespace
  targets:
  - select:
      kind: AuthPolicy
      name: maas-api-auth-policy
    fieldPaths:
    - spec.rules.metadata.apiKeyValidation.http.url
    options:
      delimiter: "."
      index: 1
  - select:
      kind: DestinationRule
      name: maas-api-backend-tls
    fieldPaths:
    - spec.host
    options:
      delimiter: "."
      index: 1
- source:
    kind: ConfigMap
    version: v1
    name: maas-parameters
    fieldPath: data.oidc-issuer-url
  targets:
  - select:
      kind: AuthPolicy
      name: maas-api-auth-policy
    fieldPaths:
    - spec.rules.authentication.oidc-identities.jwt.issuerUrl