Skip to content

Commit 531b5f9

Browse files
bartoszmajsakisrael-hdez
bartoszmajsak
and
israel-hdez
authored
chore: simplifies manifest structure (#98)
* chore: simplifies manifest structure This PR simplifies maas-api manifests and promote re-use. It also provides clear, documented overlays for common install paths (ODH operator, dev, secrets). ## Detailed Changeset ### RBAC Trimmed RBAC definitions by moving secret-specific rules to dedicated overlay. ### Policies Separate Gateway-level policies from MaaS API access. ### Overlays `odh`: operator-specific install with ConfigMap-driven image replacement. `secret`: Secret-provider variant (adds ADMIN_API_KEY and provider patch + RBAC). `dev`: tidied, keeps debug patch and local infra wiring. ### Other changes * Uses SA Token provider as default deployment mode, to use Secret-based one build dedicated overlay * Makefile: introduce deploy helper and deploy-dev/deploy targets; image set via kustomize. Signed-off-by: Bartosz Majsak <bartosz.majsak@gmail.com> * fix: corrects image repository for odh overlay Co-authored-by: Edgar Hernández <ehernand@redhat.com> * chore(make): no need to check REPO variable (#99) It is always defaulted and if explictly set to blank the push will fail regardless. Signed-off-by: Bartosz Majsak <bartosz.majsak@gmail.com> * chore: simplifies manifest structure This PR simplifies maas-api manifests and promote re-use. It also provides clear, documented overlays for common install paths (ODH operator, dev, secrets). ## Detailed Changeset ### RBAC Trimmed RBAC definitions by moving secret-specific rules to dedicated overlay. ### Policies Separate Gateway-level policies from MaaS API access. ### Overlays `odh`: operator-specific install with ConfigMap-driven image replacement. `secret`: Secret-provider variant (adds ADMIN_API_KEY and provider patch + RBAC). `dev`: tidied, keeps debug patch and local infra wiring. ### Other changes * Uses SA Token provider as default deployment mode, to use Secret-based one build dedicated overlay * Makefile: introduce deploy helper and deploy-dev/deploy targets; image set via kustomize. Signed-off-by: Bartosz Majsak <bartosz.majsak@gmail.com> ; Conflicts: ; maas-api/DEV.md ; maas-api/deploy/overlays/odh/params.env Signed-off-by: Bartosz Majsak <bartosz.majsak@gmail.com> --------- Signed-off-by: Bartosz Majsak <bartosz.majsak@gmail.com> Co-authored-by: Edgar Hernández <ehernand@redhat.com>
1 parent 100fbdf commit 531b5f9

27 files changed

+203
-92
lines changed

‎maas-api/DEV.md‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55
- kubectl
66
- jq
7-
- kustomize
7+
- kustomize 5.7
88
- OCP 4.19.9+ (for GW API)
99
- [jwt](https://github.com/mike-engel/jwt-cli) CLI tool (for inspecting tokens)
1010

@@ -48,10 +48,7 @@ kustomize build ${PROJECT_DIR}/maas-api/deploy/infra/odh | kubectl apply --serve
4848
### Deploying MaaS API for development
4949

5050
```shell
51-
make deploy-dev \
52-
-e REPO=quay.io/bmajsak/maas-api \
53-
-e TAG=latest \
54-
-e PRE_DEPLOY_STEP='kustomize edit add patch --group apps --kind Deployment --path patches/sa-token-provider.yaml'
51+
make deploy-dev
5552
```
5653

5754
This will:
@@ -99,12 +96,12 @@ AUD="$(kubectl create token default --duration=10m \
9996

10097
echo "Patching AuthPolicy with audience: $AUD"
10198

102-
kubectl patch --local -f ${PROJECT_DIR}/maas-api/deploy/policies/auth-policy.yaml \
99+
kubectl patch --local -f ${PROJECT_DIR}/maas-api/deploy/policies/maas-api/auth-policy.yaml \
103100
--type='json' \
104101
-p "$(jq -nc --arg aud "$AUD" '[{
105102
op:"replace",
106-
path:"/spec/rules/authentication/openshift-identities/kubernetesTokenReview/audiences",
107-
value:[$aud]
103+
path:"/spec/rules/authentication/openshift-identities/kubernetesTokenReview/audiences/0",
104+
value:$aud
108105
}]')" \
109106
-o yaml | kubectl apply -f -
110107
```

‎maas-api/Makefile‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,17 +108,27 @@ push-image: ## Push container image (use REPO= and TAG= to specify image)
108108
.PHONY: build-push-image
109109
build-push-image: build-image push-image ## Build and push container image
110110

111+
## Deployment
112+
111113
PRE_DEPLOY_STEP ?=
112-
.PHONY: deploy-dev
113-
deploy-dev: ## Deploy to development
114+
define deploy
114115
kubectl create namespace maas-api || true
115-
cd $(PROJECT_DIR)/deploy/overlays/dev && \
116+
cd $(PROJECT_DIR)/deploy/$(1) && \
116117
set -eu; \
117118
cp kustomization.yaml kustomization.yaml.backup && \
118119
trap 'mv kustomization.yaml.backup kustomization.yaml 2>/dev/null || true' EXIT INT TERM && \
119120
kustomize edit set image maas-api=$(FULL_IMAGE) && \
120121
$(if $(PRE_DEPLOY_STEP),$(PRE_DEPLOY_STEP) &&) \
121122
kustomize build . | kubectl apply -f -
123+
endef
124+
125+
.PHONY: deploy-dev
126+
deploy-dev: ## Deploy development version
127+
$(call deploy,overlays/dev)
128+
129+
.PHONY: deploy
130+
deploy: ## Deploy base component
131+
$(call deploy,base)
122132

123133
default_run_flags := --debug
124134
RUN_FLAGS ?=

‎maas-api/deploy/README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
## Overview
2+
3+
```shell
4+
├── base <1>
5+
├── infra <2>
6+
│ ├── kuadrant
7+
│ ├── odh <*>
8+
│ └── openshift-gateway-api
9+
├── models <3>
10+
├── overlays <4>
11+
│ ├── dev
12+
│ ├── odh
13+
│ └── secret
14+
├── policies <5>
15+
└── rbac <6>
16+
```
17+
18+
**<1> base** - Core MaaS API deployment manifests (service, deployment) with common labels and RBAC
19+
20+
**<2> infra** - Infrastructure dependencies for Gateway API, Kuadrant, and OpenDataHub integration
21+
* `<*>` - ODH minimal deployment to support models (`LLMInferenceService` machinery)
22+
23+
**<3> models** - Model simulation resources for testing and development environments
24+
25+
**<4> overlays** - Environment-specific configurations:
26+
- `dev` - Development overlay with debug mode and local infrastructure
27+
- `odh` - OpenDataHub operator overlay for core MaaS API component deployment (no policies/infra)
28+
- `secret` - Secret provider-based deployment configuration
29+
30+
**<5> policies** - Kuadrant policies for authentication, rate limiting, and token management
31+
32+
**<6> rbac** - Role-based access control manifests (ServiceAccount, ClusterRole, ClusterRoleBinding)

‎maas-api/deploy/base/deployment.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ spec:
1111
runAsNonRoot: true
1212
containers:
1313
- name: maas-api
14-
image: maas-api:latest
14+
image: maas-api
1515
imagePullPolicy: Always
1616
ports:
1717
- containerPort: 8080
@@ -22,11 +22,6 @@ spec:
2222
valueFrom:
2323
fieldRef:
2424
fieldPath: metadata.namespace
25-
- name: ADMIN_API_KEY
26-
valueFrom:
27-
secretKeyRef:
28-
name: maas-api-admin-secret
29-
key: admin-api-key
3025
resources:
3126
requests:
3227
memory: "64Mi"

‎maas-api/deploy/base/kustomization.yaml‎

Lines changed: 3 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -12,31 +12,8 @@ resources:
1212
namespace: maas-api
1313

1414
labels:
15-
- pairs:
16-
app.kubernetes.io/name: maas-api
15+
- includeSelectors: true
16+
pairs:
1717
app.kubernetes.io/component: api
18-
includeSelectors: true
19-
20-
# See https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kustomize/
21-
secretGenerator:
22-
- name: maas-api-admin-secret
23-
envs:
24-
- admin.secret.env # secret for the admin API key, e.g. `admin-api-key=letmein`
25-
26-
# This approach is used across odh components to set the image through GitOps
27-
configMapGenerator:
28-
- name: maas-api-config
29-
envs:
30-
- params.env
18+
app.kubernetes.io/name: maas-api
3119

32-
replacements:
33-
- source:
34-
kind: ConfigMap
35-
name: maas-api-config
36-
fieldPath: data.maas-api-image
37-
targets:
38-
- select:
39-
kind: Deployment
40-
name: maas-api
41-
fieldPaths:
42-
- spec.template.spec.containers.[name=maas-api].image

‎maas-api/deploy/infra/odh/kustomization.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ kind: Kustomization
33

44
metadata:
55
name: odh-infra
6-
6+
7+
# Set of Kustomize manifests with OpenDataHub components required for MaaS.
78
# For now, install only Model Serving pieces
89
resources:
910
- github.com/opendatahub-io/kserve/config/overlays/odh?ref=release-v0.15

‎maas-api/deploy/overlays/dev/infra/networking/httproute.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
apiVersion: gateway.networking.k8s.io/v1
22
kind: HTTPRoute
33
metadata:
4-
name: maas-api-dev-route
4+
name: maas-api-route
5+
namespace: maas-api
56
spec:
67
parentRefs:
78
- name: openshift-ai-inference

‎maas-api/deploy/overlays/dev/infra/networking/kustomization.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33

44
metadata:
5-
name: maas-api-networking-infra
5+
name: maas-api-gw-api-routing-infra
66

77
resources:
88
- gateway.yaml

‎maas-api/deploy/overlays/dev/kustomization.yaml‎

Lines changed: 2 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,9 @@ transformers:
1616
- transformers/namespace.yaml
1717

1818
patches:
19-
- path: patches/debug-mode-patch.yaml
19+
- path: patches/debug-mode.yaml
2020

21-
# Overwrite the image to use the local image set through kustomize edit set image
22-
# This is needed because the image is set in the base/deployment.yaml using params.env "injection"
2321
images:
2422
- name: maas-api
25-
newName: quay.io/opendatahub/maas-api:latest
23+
newName: quay.io/opendatahub/maas-api
2624
newTag: latest
27-
28-
secretGenerator:
29-
- name: maas-api-admin-secret
30-
behavior: replace
31-
literals:
32-
- admin-api-key=letmein

maas-api/deploy/overlays/dev/patches/debug-mode-patch.yaml renamed to maas-api/deploy/overlays/dev/patches/debug-mode.yaml

File renamed without changes.

0 commit comments

Comments
 (0)