Merge remote-tracking branch 'upstream/main' into add_ossm

Author: dbasunag

.pre-commit-config.yaml

@@ -19,7 +19,7 @@ repos:
       - id: check-toml
 
   - repo: https://github.com/PyCQA/flake8
-    rev: "7.2.0"
+    rev: "7.3.0"
     hooks:
       - id: flake8
         args: [--config=.flake8]
@@ -35,7 +35,7 @@ repos:
       - id: detect-secrets
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.13
+    rev: v0.12.0
     hooks:
       - id: ruff
       - id: ruff-format
@@ -54,7 +54,7 @@ repos:
       - id: gitleaks
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.16.0
+    rev: v1.16.1
     hooks:
       - id: mypy
         additional_dependencies: ["types-PyYAML", "types-requests"]

conftest.py

@@ -32,11 +32,11 @@
     collect_rhoai_must_gather,
     get_base_dir,
 )
-
 from kubernetes.dynamic import DynamicClient
 from utilities.infra import get_operator_distribution, get_dsci_applications_namespace, get_data_science_cluster
 from ocp_resources.resource import get_client
 
+
 LOGGER = logging.getLogger(name=__name__)
 BASIC_LOGGER = logging.getLogger(name="basic")
 

tests/conftest.py

@@ -44,6 +44,7 @@
     Protocols,
 )
 from utilities.infra import update_configmap_data
+from utilities.logger import RedactedString
 from utilities.minio import create_minio_data_connection_secret
 from utilities.operator_utils import get_csv_related_images
 
@@ -68,7 +69,7 @@ def tests_tmp_dir(request: FixtureRequest, tmp_path_factory: TempPathFactory) ->
 
 @pytest.fixture(scope="session")
 def current_client_token(admin_client: DynamicClient) -> str:
-    return get_openshift_token()
+    return RedactedString(value=get_openshift_token())
 
 
 @pytest.fixture(scope="session")

tests/model_explainability/guardrails/test_guardrails.py

@@ -23,10 +23,12 @@
 
 
 @pytest.mark.parametrize(
-    "model_namespace",
+    "model_namespace, minio_pod, minio_data_connection",
     [
         pytest.param(
             {"name": "test-guardrails-image"},
+            MinIo.PodConfig.QWEN_MINIO_CONFIG,
+            {"bucket": "llms"},
         )
     ],
     indirect=True,

tests/model_explainability/guardrails/utils.py

@@ -18,7 +18,6 @@ def get_chat_payload(content: str) -> Dict[str, Any]:
         "messages": [
             {"role": "user", "content": content},
         ],
-        "temperature": "0.0",
     }
 
 

tests/model_explainability/trustyai_service/conftest.py

@@ -50,6 +50,7 @@
     create_isvc_getter_service_account,
     create_isvc_getter_token_secret,
 )
+from utilities.logger import RedactedString
 from utilities.operator_utils import get_cluster_service_version
 
 from utilities.constants import Timeout, KServeDeploymentType, Labels
@@ -369,4 +370,4 @@ def isvc_getter_token_secret(
 
 @pytest.fixture(scope="class")
 def isvc_getter_token(isvc_getter_service_account: ServiceAccount, isvc_getter_token_secret: Secret) -> str:
-    return create_inference_token(model_service_account=isvc_getter_service_account)
+    return RedactedString(value=create_inference_token(model_service_account=isvc_getter_service_account))

tests/model_registry/conftest.py

@@ -47,8 +47,6 @@
 from utilities.constants import Protocols, DscComponents
 from model_registry import ModelRegistry as ModelRegistryClient
 from semver import Version
-from utilities.infra import get_product_version
-from utilities.operator_utils import get_cluster_service_version, validate_operator_subscription_channel
 from utilities.general import wait_for_pods_by_labels
 
 LOGGER = get_logger(name=__name__)
@@ -182,16 +180,36 @@ def model_registry_instance(
 
 @pytest.fixture(scope="class")
 def model_registry_mysql_config(
-    model_registry_db_deployment: Deployment, model_registry_db_secret: Secret
+    request: FixtureRequest,
+    model_registry_db_deployment: Deployment,
+    model_registry_db_secret: Secret,
 ) -> dict[str, Any]:
-    return {
+    """
+    Fixture to build the MySQL config dictionary for Model Registry.
+    Expects request.param to be a dict. If 'sslRootCertificateConfigMap' is not present, it defaults to None.
+    If 'sslRootCertificateConfigMap' is present, it will be used to configure the MySQL connection.
+
+    Args:
+        request: The pytest request object
+        model_registry_db_deployment: The model registry db deployment
+        model_registry_db_secret: The model registry db secret
+
+    Returns:
+        dict[str, Any]: The MySQL config dictionary
+    """
+    param = request.param if hasattr(request, "param") else {}
+    config = {
         "host": f"{model_registry_db_deployment.name}.{model_registry_db_deployment.namespace}.svc.cluster.local",
         "database": model_registry_db_secret.string_data["database-name"],
         "passwordSecret": {"key": "database-password", "name": model_registry_db_deployment.name},
-        "port": 3306,
+        "port": param.get("port", 3306),
         "skipDBCreation": False,
         "username": model_registry_db_secret.string_data["database-user"],
     }
+    if "sslRootCertificateConfigMap" in param:
+        config["sslRootCertificateConfigMap"] = param["sslRootCertificateConfigMap"]
+
+    return config
 
 
 @pytest.fixture(scope="class")
@@ -362,47 +380,6 @@ def model_registry_instance_pod(admin_client: DynamicClient) -> Generator[Pod, A
     )[0]
 
 
-@pytest.fixture(scope="package", autouse=True)
-def validate_authorino_operator_version_channel(admin_client: DynamicClient) -> None:
-    """Check if Authorino operator is installed with required version and channel.
-
-    This fixture is automatically used for all tests in the model_registry directory.
-    It verifies that:
-    1. For OpenShift AI: The product version is >= 2.20
-    2. The Authorino operator is installed
-    3. The Authorino operator is using the required channel (stable)
-    4. The Authorino operator is at least version 1.2.1
-    """
-    distribution = py_config["distribution"]
-    if distribution == "upstream":
-        # TODO: figure out minimum version for ODH
-        LOGGER.info(f"Skipping Authorino operator check for {distribution} distribution")
-        return
-    # Only check product version for OpenShift AI
-    if distribution == "downstream":
-        product_version = get_product_version(admin_client=admin_client)
-        if product_version < MIN_MR_VERSION:
-            LOGGER.info(
-                "Skipping Authorino operator check - product version "
-                f"{product_version} is below required {MIN_MR_VERSION}"
-            )
-            return
-        operator_name = "authorino-operator"
-        # Find the CSV for the operator
-        authorino_csv = get_cluster_service_version(
-            client=admin_client, prefix=operator_name, namespace=py_config["applications_namespace"]
-        )
-        current_authorino_version = authorino_csv.instance.spec.version
-        if Version.parse(version="1.2.1") > Version.parse(version=current_authorino_version):
-            pytest.exit(
-                f"Authorino operator is not at least version 1.2.1. Current version: {current_authorino_version}"
-            )
-
-        validate_operator_subscription_channel(
-            client=admin_client, namespace="openshift-operators", operator_name=operator_name, channel_name="stable"
-        )
-
-
 @pytest.fixture(scope="class")
 def is_model_registry_oauth(request: FixtureRequest) -> bool:
     return getattr(request, "param", {}).get("use_oauth_proxy", True)

tests/model_registry/constants.py

@@ -26,6 +26,7 @@ class ModelRegistryEndpoints:
     },
 }
 MR_INSTANCE_NAME: str = "model-registry"
+SECURE_MR_NAME: str = "secure-db-mr"
 ISTIO_CONFIG_DICT: dict[str, Any] = {
     "gateway": {"grpc": {"tls": {}}, "rest": {"tls": {}}},
 }
@@ -48,6 +49,11 @@ class ModelRegistryEndpoints:
     f"{Resource.ApiGroup.TEMPLATE_OPENSHIFT_IO}/expose-password": "'{.data[''database-password'']}'",
     f"{Resource.ApiGroup.TEMPLATE_OPENSHIFT_IO}/expose-username": "'{.data[''database-user'']}'",
 }
+
+CA_CONFIGMAP_NAME = "odh-trusted-ca-bundle"
+CA_MOUNT_PATH = "/etc/pki/ca-trust/extracted/pem"
+CA_FILE_PATH = f"{CA_MOUNT_PATH}/ca-bundle.crt"
+
 MODEL_REGISTRY_STANDARD_LABELS = {
     Annotations.KubernetesIo.NAME: MR_INSTANCE_NAME,
     Annotations.KubernetesIo.INSTANCE: MR_INSTANCE_NAME,