Merge branch 'main' into jr_55467

Author: jrhyness

.github/hack/cleanup-odh.sh

@@ -9,6 +9,7 @@
 # - ODH operator namespace (odh-operator)
 # - OpenDataHub application namespace (opendatahub)
 # - MaaS subscription namespace (models-as-a-service)
+# - Keycloak identity provider (if deployed)
 # - ODH CRDs (optional)
 #
 # Usage: ./cleanup-odh.sh [--include-crds]
@@ -123,33 +124,52 @@ for policy_ns in kuadrant-system rh-connectivity-link; do
     "authorinos.operator.authorino.kuadrant.io" "kuadrants.kuadrant.io" "limitadors.limitador.kuadrant.io"
 done
 
-# 11. Delete llm namespace and model resources
-echo "11. Deleting LLM models and namespace..."
+# 11. Delete Keycloak identity provider (if installed)
+echo "11. Deleting Keycloak namespace (if installed)..."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && cd ../.. && pwd)"
+if [[ -f "${SCRIPT_DIR}/scripts/cleanup-keycloak.sh" ]]; then
+    # Pass --delete-crds if --include-crds was specified for this script
+    if $INCLUDE_CRDS; then
+        "${SCRIPT_DIR}/scripts/cleanup-keycloak.sh" --force --delete-crds 2>/dev/null || true
+    else
+        "${SCRIPT_DIR}/scripts/cleanup-keycloak.sh" --force 2>/dev/null || true
+    fi
+else
+    # Fallback if cleanup script not found - direct cleanup
+    force_delete_namespace "keycloak-system" "keycloaks.k8s.keycloak.org"
+    if $INCLUDE_CRDS; then
+        kubectl delete crd keycloaks.k8s.keycloak.org --ignore-not-found 2>/dev/null || true
+        kubectl delete crd keycloakrealmimports.k8s.keycloak.org --ignore-not-found 2>/dev/null || true
+    fi
+fi
+
+# 12. Delete llm namespace and model resources
+echo "12. Deleting LLM models and namespace..."
 force_delete_namespace "llm" "llminferenceservice" "inferenceservice" "maasmodelrefs.maas.opendatahub.io"
 
-# 12. Delete gateway resources in openshift-ingress
-echo "12. Deleting gateway resources..."
+# 13. Delete gateway resources in openshift-ingress
+echo "13. Deleting gateway resources..."
 kubectl delete gateway maas-default-gateway -n openshift-ingress --ignore-not-found 2>/dev/null || true
 kubectl delete envoyfilter -n openshift-ingress -l kuadrant.io/managed=true --ignore-not-found 2>/dev/null || true
 kubectl delete envoyfilter kuadrant-auth-tls-fix -n openshift-ingress --ignore-not-found 2>/dev/null || true
 kubectl delete authpolicy -n openshift-ingress --all --ignore-not-found 2>/dev/null || true
 kubectl delete ratelimitpolicy -n openshift-ingress --all --ignore-not-found 2>/dev/null || true
 kubectl delete tokenratelimitpolicy -n openshift-ingress --all --ignore-not-found 2>/dev/null || true
 
-# 13. Delete MaaS RBAC (ClusterRoles, ClusterRoleBindings - can conflict with other managers)
-echo "13. Deleting MaaS RBAC..."
+# 14. Delete MaaS RBAC (ClusterRoles, ClusterRoleBindings - can conflict with other managers)
+echo "14. Deleting MaaS RBAC..."
 kubectl delete clusterrolebinding maas-api maas-controller-rolebinding --ignore-not-found 2>/dev/null || true
 kubectl delete clusterrole maas-api maas-controller-role --ignore-not-found 2>/dev/null || true
 
-# 14. Optionally delete CRDs
+# 15. Optionally delete CRDs
 if $INCLUDE_CRDS; then
-    echo "14. Deleting ODH CRDs..."
+    echo "15. Deleting ODH CRDs..."
     kubectl delete crd datascienceclusters.datasciencecluster.opendatahub.io --ignore-not-found 2>/dev/null || true
     kubectl delete crd dscinitializations.dscinitialization.opendatahub.io --ignore-not-found 2>/dev/null || true
     kubectl delete crd datasciencepipelinesapplications.datasciencepipelinesapplications.opendatahub.io --ignore-not-found 2>/dev/null || true
     # Add more CRDs as needed
 else
-    echo "14. Skipping CRD deletion (use --include-crds to remove CRDs)"
+    echo "15. Skipping CRD deletion (use --include-crds to remove CRDs)"
 fi
 
 echo ""
@@ -158,4 +178,4 @@ echo ""
 echo "Verify cleanup with:"
 echo "  kubectl get subscription -A | grep -i odh"
 echo "  kubectl get csv -A | grep -i odh"
-echo "  kubectl get ns | grep -E 'odh|opendatahub|models-as-a-service|kuadrant|rh-connectivity-link|llm'"
+echo "  kubectl get ns | grep -E 'odh|opendatahub|models-as-a-service|kuadrant|rh-connectivity-link|keycloak-system|llm'"

CONTRIBUTING.md

@@ -57,7 +57,8 @@ This project follows a **Stream-Lake-Ocean** release model. Code flows from acti
 |------|--------|
 | `scripts/` | Deployment and install scripts (e.g. `deploy.sh`, `deployment-helpers.sh`, `install-dependencies.sh`) |
 | `deployment/` | Kustomize manifests (base, overlays, networking, components) |
-| `maas-api/` | Go API service (keys, tokens, tiers); see [maas-api/README.md](maas-api/README.md) |
+| `maas-api/` | Go API service (keys, tokens, subscriptions); see [maas-api/README.md](maas-api/README.md) |
+| `maas-controller/` | Kubernetes controller for MaaS CRDs; see [maas-controller/README.md](maas-controller/README.md) |
 | `docs/` | User and admin documentation (MkDocs); [online docs](https://opendatahub-io.github.io/models-as-a-service/) |
 | `test/` | E2E and billing/smoke tests |
 | `.github/workflows/` | CI (build, PR title validation, MaaS API lint/build) |

OWNERS

@@ -34,3 +34,4 @@ reviewers:
   - somya-bhatnagar
   - liangwen12year
   - ryancham715
+  - EgorLu

README.md

@@ -120,7 +120,7 @@ MAAS_API_IMAGE=quay.io/myuser/maas-api:pr-123 \
 #### Minimal Deployments
 
 ```bash
-# Deploy without TLS backend (HTTP tier lookup)
+# Deploy without TLS backend (HTTP for Authorino to maas-api)
 ./scripts/deploy.sh --disable-tls-backend
 ```
 

deployment/base/maas-api/core/cronjob-cleanup.yaml

@@ -0,0 +1,44 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: maas-api-key-cleanup
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      activeDeadlineSeconds: 60
+      backoffLimit: 2
+      template:
+        metadata:
+          labels:
+            app: maas-api-cleanup
+        spec:
+          serviceAccountName: maas-api
+          restartPolicy: OnFailure
+          securityContext:
+            runAsNonRoot: true
+          containers:
+          - name: cleanup
+            image: curlimages/curl:8.19.0
+            command:
+            - /bin/sh
+            - -c
+            - |
+              curl -sf -X POST http://maas-api:8080/internal/v1/api-keys/cleanup
+            resources:
+              requests:
+                memory: "16Mi"
+                cpu: "10m"
+              limits:
+                memory: "32Mi"
+                cpu: "50m"
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              readOnlyRootFilesystem: true
+              runAsNonRoot: true

deployment/base/maas-api/core/kustomization.yaml

@@ -4,6 +4,8 @@ kind: Kustomization
 resources:
   - deployment.yaml
   - service.yaml
+  - cronjob-cleanup.yaml
+  - networkpolicy-cleanup.yaml
 
 images:
   - name: maas-api

deployment/base/maas-api/core/networkpolicy-cleanup.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: maas-api-cleanup-restrict
+spec:
+  # Restrict CronJob cleanup pods: they can only communicate with maas-api on port 8080.
+  # This prevents the cleanup pods from being used as a pivot to access other services.
+  # Note: L4 NetworkPolicy cannot restrict by URL path; the /internal/ endpoint is
+  # additionally protected by not being exposed via the external Service/Route.
+  podSelector:
+    matchLabels:
+      app: maas-api-cleanup
+  policyTypes:
+  - Egress
+  - Ingress
+  ingress: []
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          app.kubernetes.io/name: maas-api
+    ports:
+    - protocol: TCP
+      port: 8080
+  # Allow DNS resolution
+  - to:
+    ports:
+    - protocol: UDP
+      port: 53
+    - protocol: TCP
+      port: 53

deployment/base/maas-api/default/kustomization.yaml

@@ -8,7 +8,6 @@ resources:
   - ../rbac
   - ../networking
   - ../policies
-  - ../resources
 
 labels:
   - includeSelectors: true

deployment/base/maas-api/rbac/clusterrole.yaml

@@ -3,10 +3,6 @@ kind: ClusterRole
 metadata:
   name: maas-api
 rules:
-- apiGroups: [""]
-  resources: ["configmaps"]
-  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-
 # Database configuration secret
 - apiGroups: [""]
   resources: ["secrets"]
@@ -35,6 +31,7 @@ rules:
   resources: ["subjectaccessreviews"]
   verbs: ["create"]
 
+
 # MaaS CRs for the models endpoint and subscription selector (cached via informer)
 - apiGroups: ["maas.opendatahub.io"]
   resources: ["maasmodelrefs", "maassubscriptions"]