opendatahub-io
diff --git a/‎.cve-fix/examples.md‎
Lines changed: 1552 additions & 0 deletions b/‎.cve-fix/examples.md‎
Lines changed: 1552 additions & 0 deletions
diff --git a/‎.github/hack/cleanup-odh.sh‎
Lines changed: 87 additions & 12 deletions b/‎.github/hack/cleanup-odh.sh‎
Lines changed: 87 additions & 12 deletions
diff --git a/‎.github/hack/install-odh.sh‎
Lines changed: 5 additions & 2 deletions b/‎.github/hack/install-odh.sh‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎.github/workflows/build-test.yml‎
Lines changed: 3 additions & 1 deletion b/‎.github/workflows/build-test.yml‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎.github/workflows/create-release.yml‎
Lines changed: 56 additions & 21 deletions b/‎.github/workflows/create-release.yml‎
Lines changed: 56 additions & 21 deletions
@@ -9,6 +9,7 @@
 # - ODH operator namespace (odh-operator)
 # - OpenDataHub application namespace (opendatahub)
 # - MaaS subscription namespace (models-as-a-service)
+# - Keycloak identity provider (if deployed)
 # - ODH CRDs (optional)
 #
 # Usage: ./cleanup-odh.sh [--include-crds]
@@ -116,40 +117,114 @@ echo "9. Deleting models-as-a-service namespace..."
 force_delete_namespace "models-as-a-service" \
     "maasauthpolicies.maas.opendatahub.io" "maassubscriptions.maas.opendatahub.io"
 
-# 10. Delete policy engine namespaces (Kuadrant or RHCL)
+# 10. Delete policy engine workload CRs (before operator cleanup)
+# This allows operators to cleanly delete Deployments/ReplicaSets before we delete the operators themselves
+echo "10. Deleting policy engine workload CRs..."
 for policy_ns in kuadrant-system rh-connectivity-link; do
-    echo "10. Deleting $policy_ns namespace (if installed)..."
+    if kubectl get namespace "$policy_ns" &>/dev/null; then
+        echo "   Deleting workload CRs in $policy_ns..."
+        # Delete high-level CRs to trigger operator cleanup of owned resources
+        kubectl delete kuadrant --all -n "$policy_ns" --ignore-not-found --timeout=60s 2>/dev/null || true
+        kubectl delete limitador --all -n "$policy_ns" --ignore-not-found --timeout=60s 2>/dev/null || true
+        kubectl delete authorino --all -n "$policy_ns" --ignore-not-found --timeout=60s 2>/dev/null || true
+
+        # Wait for CRs to be fully deleted (finalizers processed) before removing operators
+        # This prevents orphaned resources if we delete operators while finalizers are still running
+        echo "   Waiting for CR finalizers to complete in $policy_ns..."
+        timeout=60
+        deadline=$((SECONDS + timeout))
+        remaining=1
+        while [[ $SECONDS -lt $deadline ]]; do
+            # Count remaining CRs (wc -l counts all lines, subtract 1 for header if present)
+            count=$(kubectl get kuadrant,limitador,authorino -n "$policy_ns" --ignore-not-found 2>/dev/null | wc -l)
+            remaining=$((count > 0 ? count - 1 : 0))
+            if [[ $remaining -eq 0 ]]; then
+                echo "   ✅ All workload CRs deleted from $policy_ns"
+                break
+            fi
+            sleep 2
+        done
+        if [[ $remaining -gt 0 ]]; then
+            echo "   ⚠️  Warning: $remaining CR(s) still exist in $policy_ns after ${timeout}s (finalizers may be stuck)"
+        fi
+    fi
+done
+
+# 11. Delete policy engine OLM resources (before namespace deletion)
+echo "11. Cleaning up policy engine OLM resources..."
+# Kuadrant cleanup
+if kubectl get namespace kuadrant-system &>/dev/null; then
+    echo "   Cleaning up Kuadrant OLM resources..."
+    # Delete Subscriptions (triggers CSV cleanup by OLM)
+    kubectl delete subscription --all -n kuadrant-system --ignore-not-found --timeout=60s 2>/dev/null || true
+    # Delete CSVs explicitly (includes dependent operators: authorino, limitador, dns-operator)
+    kubectl delete csv -n kuadrant-system --all --ignore-not-found --timeout=60s 2>/dev/null || true
+    # Delete CatalogSource (created in kuadrant-system namespace, not marketplace)
+    kubectl delete catalogsource kuadrant-operator-catalog -n kuadrant-system --ignore-not-found 2>/dev/null || true
+    echo "   ✅ Kuadrant OLM resources cleaned"
+fi
+# RHCL cleanup
+if kubectl get namespace rh-connectivity-link &>/dev/null; then
+    echo "   Cleaning up RHCL OLM resources..."
+    kubectl delete subscription --all -n rh-connectivity-link --ignore-not-found --timeout=60s 2>/dev/null || true
+    kubectl delete csv -n rh-connectivity-link --all --ignore-not-found --timeout=60s 2>/dev/null || true
+    # Note: RHCL uses redhat-operators catalog (not a custom catalog), so no catalog deletion needed
+    echo "   ✅ RHCL OLM resources cleaned"
+fi
+
+# 12. Delete policy engine namespaces (Kuadrant or RHCL)
+for policy_ns in kuadrant-system rh-connectivity-link; do
+    echo "12. Deleting $policy_ns namespace (if installed)..."
     force_delete_namespace "$policy_ns" \
     "authorinos.operator.authorino.kuadrant.io" "kuadrants.kuadrant.io" "limitadors.limitador.kuadrant.io"
 done
 
-# 11. Delete llm namespace and model resources
-echo "11. Deleting LLM models and namespace..."
+# 13. Delete Keycloak identity provider (if installed)
+echo "13. Deleting Keycloak namespace (if installed)..."
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && cd ../.. && pwd)"
+if [[ -f "${SCRIPT_DIR}/scripts/cleanup-keycloak.sh" ]]; then
+    # Pass --delete-crds if --include-crds was specified for this script
+    if $INCLUDE_CRDS; then
+        "${SCRIPT_DIR}/scripts/cleanup-keycloak.sh" --force --delete-crds 2>/dev/null || true
+    else
+        "${SCRIPT_DIR}/scripts/cleanup-keycloak.sh" --force 2>/dev/null || true
+    fi
+else
+    # Fallback if cleanup script not found - direct cleanup
+    force_delete_namespace "keycloak-system" "keycloaks.k8s.keycloak.org"
+    if $INCLUDE_CRDS; then
+        kubectl delete crd keycloaks.k8s.keycloak.org --ignore-not-found 2>/dev/null || true
+        kubectl delete crd keycloakrealmimports.k8s.keycloak.org --ignore-not-found 2>/dev/null || true
+    fi
+fi
+
+# 14. Delete llm namespace and model resources
+echo "14. Deleting LLM models and namespace..."
 force_delete_namespace "llm" "llminferenceservice" "inferenceservice" "maasmodelrefs.maas.opendatahub.io"
 
-# 12. Delete gateway resources in openshift-ingress
-echo "12. Deleting gateway resources..."
+# 15. Delete gateway resources in openshift-ingress
+echo "15. Deleting gateway resources..."
 kubectl delete gateway maas-default-gateway -n openshift-ingress --ignore-not-found 2>/dev/null || true
 kubectl delete envoyfilter -n openshift-ingress -l kuadrant.io/managed=true --ignore-not-found 2>/dev/null || true
 kubectl delete envoyfilter kuadrant-auth-tls-fix -n openshift-ingress --ignore-not-found 2>/dev/null || true
 kubectl delete authpolicy -n openshift-ingress --all --ignore-not-found 2>/dev/null || true
 kubectl delete ratelimitpolicy -n openshift-ingress --all --ignore-not-found 2>/dev/null || true
 kubectl delete tokenratelimitpolicy -n openshift-ingress --all --ignore-not-found 2>/dev/null || true
 
-# 13. Delete MaaS RBAC (ClusterRoles, ClusterRoleBindings - can conflict with other managers)
-echo "13. Deleting MaaS RBAC..."
+# 16. Delete MaaS RBAC (ClusterRoles, ClusterRoleBindings - can conflict with other managers)
+echo "16. Deleting MaaS RBAC..."
 kubectl delete clusterrolebinding maas-api maas-controller-rolebinding --ignore-not-found 2>/dev/null || true
 kubectl delete clusterrole maas-api maas-controller-role --ignore-not-found 2>/dev/null || true
 
-# 14. Optionally delete CRDs
+# 17. Optionally delete CRDs
 if $INCLUDE_CRDS; then
-    echo "14. Deleting ODH CRDs..."
+    echo "17. Deleting ODH CRDs..."
     kubectl delete crd datascienceclusters.datasciencecluster.opendatahub.io --ignore-not-found 2>/dev/null || true
     kubectl delete crd dscinitializations.dscinitialization.opendatahub.io --ignore-not-found 2>/dev/null || true
     kubectl delete crd datasciencepipelinesapplications.datasciencepipelinesapplications.opendatahub.io --ignore-not-found 2>/dev/null || true
     # Add more CRDs as needed
 else
-    echo "14. Skipping CRD deletion (use --include-crds to remove CRDs)"
+    echo "17. Skipping CRD deletion (use --include-crds to remove CRDs)"
 fi
 
 echo ""
@@ -158,4 +233,4 @@ echo ""
 echo "Verify cleanup with:"
 echo "  kubectl get subscription -A | grep -i odh"
 echo "  kubectl get csv -A | grep -i odh"
-echo "  kubectl get ns | grep -E 'odh|opendatahub|models-as-a-service|kuadrant|rh-connectivity-link|llm'"
+echo "  kubectl get ns | grep -E 'odh|opendatahub|models-as-a-service|kuadrant|rh-connectivity-link|keycloak-system|llm'"
@@ -87,15 +87,18 @@ plan_approval="${OPERATOR_INSTALL_PLAN_APPROVAL:-Manual}"
 
 # 2. Install ODH operator via OLM
 echo "2. Installing ODH operator..."
-install_olm_operator \
+if ! install_olm_operator \
   "opendatahub-operator" \
   "$NAMESPACE" \
   "$catalog_source" \
   "$channel" \
   "$starting_csv" \
   "AllNamespaces" \
   "openshift-marketplace" \
-  "$plan_approval"
+  "$plan_approval"; then
+  log_error "ODH operator installation failed"
+  exit 1
+fi
 
 # 3. Patch CSV with custom image if specified
 if [[ -n "$OPERATOR_IMAGE" ]]; then
 
@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - 'maas-controller/api/**'
+      - 'maas-controller/cmd/**'
+      - 'maas-controller/pkg/**'
       - 'maas-controller/Makefile'
       - 'deployment/base/maas-controller/crd/**'
       - 'deployment/**'
@@ -39,7 +41,7 @@ jobs:
         ./scripts/ci/validate-manifests.sh
 
   verify-codegen:
-    name: Verify generated CRDs and deepcopy
+    name: Verify generated CRDs, RBAC, and deepcopy
     timeout-minutes: 10
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-verify-codegen
 
@@ -10,8 +10,9 @@
 # Usage:
 #   1. Go to Actions > Create Release > Run workflow
 #   2. Enter the tag (e.g., v1.0.0)
-#   3. Optionally enable "Allow overwriting existing tag" (only for pre-release iterations)
-#   4. Optionally enable "Create GitHub release"
+#   3. Optionally enable "Pre-release" to skip updating the docs 'latest' alias
+#   4. Optionally enable "Allow overwriting existing tag" (only for pre-release iterations)
+#   5. Optionally enable "Create GitHub release"
 #
 # The workflow will:
 #   - Extract minor version (e.g., v1.0.0 -> v1.x)
@@ -30,6 +31,11 @@ on:
         description: 'Release tag (e.g., v1.0.0)'
         required: true
         type: string
+      prerelease:
+        description: 'Pre-release (will not update the docs "latest" alias)'
+        required: false
+        type: boolean
+        default: false
       allow_tag_overwrite:
         description: 'Allow overwriting existing tag (use only for pre-release iterations)'
         required: false
@@ -58,7 +64,8 @@ jobs:
       version_tag: ${{ steps.set_vars.outputs.version_tag }}
       minor_release_branch: ${{ steps.set_vars.outputs.minor_release_branch }}
       minor_version: ${{ steps.set_vars.outputs.minor_version }}
-    
+      is_prerelease: ${{ steps.prerelease.outputs.is_prerelease }}
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -95,6 +102,11 @@ jobs:
           echo "Minor version: $MINOR_VERSION"
           echo "Release branch: $MINOR_BRANCH"
 
+      - name: Set unified prerelease flag
+        id: prerelease
+        run: |
+          echo "is_prerelease=${{ inputs.prerelease || contains(inputs.tag, '-') || contains(inputs.tag, 'alpha') || contains(inputs.tag, 'beta') || contains(inputs.tag, 'rc') }}" >> "$GITHUB_OUTPUT"
+
       - name: Validate tag format
         run: |
           TAG="${{ inputs.tag }}"
@@ -110,6 +122,7 @@ jobs:
     outputs:
       version_tag: ${{ needs.prepare-release.outputs.version_tag }}
       minor_release_branch: ${{ needs.prepare-release.outputs.minor_release_branch }}
+      is_prerelease: ${{ needs.prepare-release.outputs.is_prerelease }}
 
     steps:
       - name: Checkout code
@@ -176,6 +189,7 @@ jobs:
     needs: create-release-branch
     outputs:
       version_tag: ${{ needs.create-release-branch.outputs.version_tag }}
+      is_prerelease: ${{ needs.create-release-branch.outputs.is_prerelease }}
 
     steps:
       - name: Checkout release branch
@@ -191,13 +205,15 @@ jobs:
           git config user.email "${{ env.GH_USER_EMAIL }}"
 
       - name: Create and push git tag
+        env:
+          ALLOW_TAG_OVERWRITE: ${{ inputs.allow_tag_overwrite }}
         run: |
           TAG="${{ needs.create-release-branch.outputs.version_tag }}"
           BRANCH="${{ needs.create-release-branch.outputs.minor_release_branch }}"
           
           # Check if tag already exists
           if git rev-parse "$TAG" >/dev/null 2>&1; then
-            if [ "${{ inputs.allow_tag_overwrite }}" != "true" ]; then
+            if [ "$ALLOW_TAG_OVERWRITE" != "true" ]; then
               echo "❌ Error: Tag $TAG already exists!"
               echo ""
               echo "Tags should be immutable once released. To overwrite an existing tag:"
@@ -241,7 +257,7 @@ jobs:
             
             > Note: Release notes can be edited after creation.
           draft: false
-          prerelease: ${{ contains(inputs.tag, '-') || contains(inputs.tag, 'alpha') || contains(inputs.tag, 'beta') || contains(inputs.tag, 'rc') }}
+          prerelease: ${{ needs.create-release-branch.outputs.is_prerelease == 'true' }}
 
   build-and-push-image:
     name: Build and Push Image
@@ -278,22 +294,26 @@ jobs:
         id: build_image
         env:
           QUAY_REPO: ${{ secrets.APP_QUAY_REPO }}
+          VERSION_TAG: ${{ needs.create-tag.outputs.version_tag }}
         run: |
           if [ -n "$QUAY_REPO" ]; then
             echo "Using custom repository from secret: $QUAY_REPO"
             echo "repo=$QUAY_REPO" >> $GITHUB_OUTPUT
-            make build-push-image REPO="$QUAY_REPO" TAG=${{ needs.create-tag.outputs.version_tag }} CONTAINER_ENGINE=docker
+            make build-push-image REPO="$QUAY_REPO" TAG="$VERSION_TAG" CONTAINER_ENGINE=docker
           else
             echo "Using Makefile default repository: quay.io/opendatahub/maas-api"
             echo "repo=quay.io/opendatahub/maas-api" >> $GITHUB_OUTPUT
-            make build-push-image TAG=${{ needs.create-tag.outputs.version_tag }} CONTAINER_ENGINE=docker
+            make build-push-image TAG="$VERSION_TAG" CONTAINER_ENGINE=docker
           fi
 
   deploy-documentation:
     name: Deploy Documentation
     runs-on: ubuntu-latest
     needs: create-tag
-    
+    concurrency:
+      group: pages
+      cancel-in-progress: false
+
     steps:
       - name: Checkout version tag
         uses: actions/checkout@v6
@@ -326,13 +346,18 @@ jobs:
           git config --global user.email "${{ env.GH_USER_EMAIL }}"
 
       - name: Deploy versioned docs with mike
+        env:
+          PRERELEASE: ${{ needs.create-tag.outputs.is_prerelease }}
+          VERSION_TAG: ${{ needs.create-tag.outputs.version_tag }}
         run: |
           cd docs
-          # Deploy the new version and update latest
-          # Note: mike will automatically create the gh-pages branch if it doesn't exist
-          mike deploy --push --update-aliases ${{ needs.create-tag.outputs.version_tag }} latest
-          # Set latest as the default version
-          mike set-default --push latest
+          if [ "$PRERELEASE" = "true" ]; then
+            echo "Pre-release: deploying docs version without updating 'latest' alias"
+            mike deploy --push "$VERSION_TAG"
+          else
+            mike deploy --push --update-aliases "$VERSION_TAG" latest
+            mike set-default --push latest
+          fi
 
   summary:
     name: Release Summary
@@ -342,27 +367,37 @@ jobs:
 
     steps:
       - name: Summary
+        env:
+          VERSION_TAG: ${{ needs.create-tag.outputs.version_tag }}
+          MINOR_BRANCH: ${{ needs.create-release-branch.outputs.minor_release_branch }}
+          IMAGE_REPO: ${{ needs.build-and-push-image.outputs.image_repo }}
+          IS_PRERELEASE: ${{ needs.prepare-release.outputs.is_prerelease }}
+          CREATE_RELEASE: ${{ inputs.create_release }}
         run: |
           {
             echo "## Release Summary"
             echo ""
-            echo "✅ **Tag**: \`${{ needs.create-tag.outputs.version_tag }}\`"
-            echo "✅ **Release Branch**: \`${{ needs.create-release-branch.outputs.minor_release_branch }}\`"
+            echo "✅ **Tag**: \`$VERSION_TAG\`"
+            echo "✅ **Release Branch**: \`$MINOR_BRANCH\`"
             echo "✅ **Git Tag**: Created and pushed from release branch"
-            echo "✅ **Image Built & Pushed**: \`${{ needs.build-and-push-image.outputs.image_repo }}:${{ needs.create-tag.outputs.version_tag }}\`"
-            echo "✅ **Documentation Deployed**: \`${{ needs.create-tag.outputs.version_tag }}\`"
-            if [ "${{ inputs.create_release }}" == "true" ]; then
+            echo "✅ **Image Built & Pushed**: \`$IMAGE_REPO:$VERSION_TAG\`"
+            echo "✅ **Documentation Deployed**: \`$VERSION_TAG\`"
+            if [ "$CREATE_RELEASE" = "true" ]; then
               echo "✅ **GitHub Release**: Created"
             fi
             echo ""
             echo "### Updated Files"
             echo "- \`deployment/base/maas-api/kustomization.yaml\`"
             echo "- \`maas-api/deploy/overlays/dev/kustomization.yaml\`"
             echo "- \`maas-api/deploy/overlays/odh/params.env\`"
-            echo "- MAAS_REF references updated to use \`${{ needs.create-tag.outputs.version_tag }}\`"
+            echo "- MAAS_REF references updated to use \`$VERSION_TAG\`"
             echo ""
             echo "### Documentation"
-            echo "- Docs Version: \`${{ needs.create-tag.outputs.version_tag }}\`"
-            echo "- Docs Alias: \`latest\`"
+            echo "- Docs Version: \`$VERSION_TAG\`"
+            if [ "$IS_PRERELEASE" = "true" ]; then
+              echo "- Docs Alias: _(not updated — pre-release)_"
+            else
+              echo "- Docs Alias: \`latest\`"
+            fi
             echo "- Docs URL: https://opendatahub-io.github.io/models-as-a-service/"
           } >> "$GITHUB_STEP_SUMMARY"