Merge branch 'main' into feature/user-creation-tests

mwaykole · web-flow · commit 38b897311c3d · 2025-11-18T22:12:27.000+05:30
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -36,7 +36,7 @@ repos:
         exclude: .*/__snapshots__/.*|.*-input\.json$
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.4
+    rev: v0.14.5
     hooks:
       - id: ruff
       - id: ruff-format
diff --git a/tests/conftest.py b/tests/conftest.py
@@ -61,6 +61,7 @@
 from utilities.minio import create_minio_data_connection_secret
 from utilities.operator_utils import get_csv_related_images, get_cluster_service_version
 from ocp_resources.authentication_config_openshift_io import Authentication
+from utilities.user_utils import get_unprivileged_context
 
 LOGGER = get_logger(name=__name__)
 
@@ -409,8 +410,14 @@ def unprivileged_client(
 
     elif is_byoidc:
         # this requires a pre-existing context in $KUBECONFIG with a unprivileged user
-        current_context = run_command(command=["oc", "config", "current-context"])[1].strip()
-        unprivileged_context = current_context + "-unprivileged"
+        try:
+            unprivileged_context, _ = get_unprivileged_context()
+        except ValueError as e:
+            raise ValueError(
+                f"Failed to get unprivileged context for BYOIDC mode. "
+                f"Ensure the context naming follows the convention: <context>-unprivileged. "
+                f"Error: {e}"
+            ) from e
 
         unprivileged_client = get_client(config_file=kubconfig_filepath, context=unprivileged_context)
 
diff --git a/tests/fixtures/vector_io.py b/tests/fixtures/vector_io.py
@@ -66,6 +66,12 @@ def _factory(provider_name: str) -> list[Dict[str, str]]:
             env_vars.append({"name": "MILVUS_ENDPOINT", "value": "http://vector-io-milvus-service:19530"})
             env_vars.append({"name": "MILVUS_TOKEN", "value": MILVUS_TOKEN})
             env_vars.append({"name": "MILVUS_CONSISTENCY_LEVEL", "value": "Bounded"})
+        elif provider_name == "faiss":
+            env_vars.append({"name": "ENABLE_FAISS", "value": "faiss"})
+            env_vars.append({
+                "name": "FAISS_KVSTORE_DB_PATH",
+                "value": "/opt/app-root/src/.llama/distributions/rh/sqlite_vec.db",
+            })
 
         return env_vars
 
diff --git a/tests/llama_stack/vector_io/test_vector_stores.py b/tests/llama_stack/vector_io/test_vector_stores.py
@@ -24,6 +24,15 @@
             {"vector_io_provider": "milvus"},
             id="vector_io_provider_milvus",
         ),
+        pytest.param(
+            {"name": "test-llamastack-vector-stores", "randomize_name": True},
+            {
+                "llama_stack_storage_size": "2Gi",
+                "vector_io_provider": "faiss",
+            },
+            {"vector_io_provider": "faiss"},
+            id="vector_io_provider_faiss",
+        ),
         pytest.param(
             {"name": "test-llamastack-vector-stores", "randomize_name": True},
             {
diff --git a/tests/model_registry/conftest.py b/tests/model_registry/conftest.py
@@ -24,6 +24,7 @@
 from ocp_resources.data_science_cluster import DataScienceCluster
 from ocp_resources.deployment import Deployment
 
+
 from ocp_resources.model_registry_modelregistry_opendatahub_io import ModelRegistry
 from ocp_resources.resource import ResourceEditor
 
@@ -481,7 +482,10 @@ def mr_access_role_binding(
 
 @pytest.fixture(scope="module")
 def test_idp_user(
-    request: pytest.FixtureRequest, original_user: str, api_server_url: str, is_byoidc: bool
+    request: pytest.FixtureRequest,
+    original_user: str,
+    api_server_url: str,
+    is_byoidc: bool,
 ) -> Generator[UserTestSession, None, None]:
     """
     Session-scoped fixture that creates a test IDP user and cleans it up after all tests.
diff --git a/tests/model_registry/model_catalog/conftest.py b/tests/model_registry/model_catalog/conftest.py
@@ -26,7 +26,7 @@
     execute_get_command,
     get_model_str,
 )
-from utilities.infra import get_openshift_token, login_with_user_password, create_inference_token
+from utilities.infra import get_openshift_token, create_inference_token
 from utilities.user_utils import UserTestSession
 
 
@@ -106,17 +106,8 @@ def user_token_for_api_calls(
         LOGGER.info("Logging in as admin user")
         yield get_openshift_token()
     elif user == "test":
-        login_with_user_password(
-            api_address=api_server_url,
-            user=test_idp_user.username,
-            password=test_idp_user.password,
-        )
+        # TODO: implement byoidc check in get_openshift_token
         yield get_openshift_token()
-        LOGGER.info(f"Logging in as {original_user}")
-        login_with_user_password(
-            api_address=api_server_url,
-            user=original_user,
-        )
     elif user == "sa_user":
         yield create_inference_token(service_account)
     else:
diff --git a/tests/model_registry/rbac/conftest.py b/tests/model_registry/rbac/conftest.py
@@ -19,8 +19,8 @@
 from kubernetes.dynamic import DynamicClient
 
 from tests.model_registry.rbac.utils import create_role_binding
-from utilities.infra import login_with_user_password
 from utilities.user_utils import UserTestSession
+from utilities.infra import login_with_user_password
 from tests.model_registry.rbac.group_utils import create_group
 from tests.model_registry.constants import (
     MR_INSTANCE_NAME,
diff --git a/tests/model_registry/rbac/test_mr_rbac.py b/tests/model_registry/rbac/test_mr_rbac.py
@@ -23,7 +23,12 @@
 from ocp_resources.service import Service
 from ocp_resources.deployment import Deployment
 from tests.model_registry.rbac.multiple_instance_utils import MR_MULTIPROJECT_TEST_SCENARIO_PARAMS
-from tests.model_registry.rbac.utils import build_mr_client_args, assert_positive_mr_registry, assert_forbidden_access
+from tests.model_registry.rbac.utils import (
+    build_mr_client_args,
+    assert_positive_mr_registry,
+    assert_forbidden_access,
+    should_skip_rbac_tests,
+)
 from tests.model_registry.constants import NUM_MR_INSTANCES
 from utilities.infra import get_openshift_token
 from mr_openapi.exceptions import ForbiddenException
@@ -34,8 +39,15 @@
 from tests.model_registry.rbac.utils import grant_mr_access, revoke_mr_access
 from utilities.constants import Protocols
 
+
 LOGGER = get_logger(name=__name__)
-pytestmark = [pytest.mark.usefixtures("original_user", "test_idp_user")]
+pytestmark = [
+    pytest.mark.usefixtures("original_user", "test_idp_user"),
+    pytest.mark.skipif(
+        should_skip_rbac_tests(),
+        reason="RBAC tests are not supported in OpenShift 4.20 and later with OIDC authentication",
+    ),
+]
 
 
 @pytest.mark.usefixtures(
diff --git a/tests/model_registry/rbac/test_mr_rbac_sa.py b/tests/model_registry/rbac/test_mr_rbac_sa.py
@@ -7,8 +7,15 @@
 from utilities.infra import create_inference_token
 from mr_openapi.exceptions import ForbiddenException
 from ocp_resources.service_account import ServiceAccount
+from tests.model_registry.rbac.utils import should_skip_rbac_tests
 
 LOGGER = get_logger(name=__name__)
+pytestmark = [
+    pytest.mark.skipif(
+        should_skip_rbac_tests(),
+        reason="RBAC tests are not supported in OpenShift 4.20 and later with OIDC authentication",
+    ),
+]
 
 
 @pytest.mark.usefixtures(
diff --git a/tests/model_registry/rbac/utils.py b/tests/model_registry/rbac/utils.py
@@ -1,11 +1,14 @@
 from typing import Any, Dict, Generator, List
 
 from kubernetes.dynamic import DynamicClient
+from semver.version import Version
 from timeout_sampler import TimeoutSampler
 
+from ocp_resources.authentication_config_openshift_io import Authentication
 from ocp_resources.deployment import Deployment
 from ocp_resources.role import Role
 from ocp_resources.role_binding import RoleBinding
+from ocp_utilities.cluster_versions import get_cluster_version
 from utilities.constants import Protocols
 import logging
 from model_registry import ModelRegistry as ModelRegistryClient
@@ -178,3 +181,20 @@ def assert_forbidden_access(endpoint: str, token: str) -> None:
     except ForbiddenException:
         # This is what we want - access is properly forbidden
         pass
+
+
+def should_skip_rbac_tests() -> bool:
+    """Check if RBAC tests should be skipped"""
+    # Need to get these details here to use this in the skipif statement.
+    # Skip RBAC tests on OpenShift 4.20+ with OIDC authentication
+    # Check BYOIDC
+    try:
+        auth = Authentication(name="cluster")
+        if not auth.exists:
+            return False
+        is_byoidc = auth.instance.spec.type == "OIDC"
+    except Exception:
+        return False
+    if not is_byoidc:
+        return False
+    return get_cluster_version() >= Version.parse("4.20.0")
diff --git a/tests/model_serving/model_server/kserve/model_car/test_oci_image.py b/tests/model_serving/model_server/kserve/model_car/test_oci_image.py
@@ -66,3 +66,15 @@ def test_model_car_using_rest(self, model_car_inference_service):
             protocol=Protocols.HTTPS,
             use_default_query=True,
         )
+
+    @pytest.mark.smoke
+    @pytest.mark.ocp_interop
+    @pytest.mark.jira("RHOAIENG-38674")
+    def test_model_status_loaded(self, model_car_inference_service):
+        """Verify model status on the InferenceService resource is in a valid state."""
+        model_status = model_car_inference_service.instance.status.modelStatus
+
+        # After deployment the model should be fully loaded and up to date.
+        assert model_status.states.activeModelState == "Loaded"
+        assert model_status.states.targetModelState == "Loaded"
+        assert model_status.transitionStatus == "UpToDate"
diff --git a/utilities/llmd_constants.py b/utilities/llmd_constants.py
@@ -1,7 +1,6 @@
 """LLMD-specific constants that extend the shared constants."""
 
 from utilities.constants import (
-    Timeout,
     ModelName,
     ContainerImages as SharedContainerImages,
     ModelStorage as SharedModelStorage,
@@ -25,7 +24,7 @@ class LLMEndpoint:
     CHAT_COMPLETIONS: str = "/v1/chat/completions"
     DEFAULT_MAX_TOKENS: int = 50
     DEFAULT_TEMPERATURE: float = 0.0
-    DEFAULT_TIMEOUT: int = Timeout.TIMEOUT_30SEC
+    DEFAULT_TIMEOUT: int = 60
 
 
 class ModelStorage:
diff --git a/utilities/user_utils.py b/utilities/user_utils.py
@@ -12,7 +12,6 @@
 import base64
 from pathlib import Path
 
-
 LOGGER = logging.getLogger(__name__)
 SLEEP_TIME = 5
 
@@ -28,6 +27,7 @@ class UserTestSession:
     password: str
     original_user: str
     api_server_url: str
+    is_byoidc: bool = False
 
     def __post_init__(self) -> None:
         """Validate the session data after initialization."""
@@ -85,9 +85,28 @@ def wait_for_user_creation(username: str, password: str, cluster_url: str) -> bo
     Returns:
         True if login is successful
     """
+    # not executed in byoidc mode
     LOGGER.info(f"Attempting to login as {username}")
     res = login_with_user_password(api_address=cluster_url, user=username, password=password)
 
     if res:
         return True
     raise ExceptionUserLogin(f"Could not login as user {username}.")
+
+
+def get_unprivileged_context() -> tuple[str, str]:
+    """
+    Get the unprivileged context from the current context.
+    This only works in BYOIDC mode, and it assumes that the unprivileged context is already created
+    with a precise naming convention: <current_context>-unprivileged.
+
+    Returns:
+        Tuple of (unprivileged context, current context).
+    """
+    status, current_context, _ = run_command(command=["oc", "config", "current-context"])
+    current_context = current_context.strip()
+    if not status or not current_context:
+        raise ValueError("Could not get current context from oc config current-context")
+    if current_context.endswith("-unprivileged"):
+        raise ValueError("Current context is already called [...]-unprivileged")
+    return current_context + "-unprivileged", current_context
diff --git a/uv.lock b/uv.lock
