Use exitStack to support multiple resource creations

Author: dbasunag

tests/model_registry/conftest.py

@@ -1,6 +1,6 @@
 from typing import Any
 from ocp_resources.resource import Resource
-from utilities.constants import ModelFormat, Annotations
+from utilities.constants import ModelFormat
 
 
 class ModelRegistryEndpoints:
@@ -25,7 +25,8 @@ class ModelRegistryEndpoints:
         "str_key": "str_value",
     },
 }
-MR_INSTANCE_NAME: str = "model-registry"
+MR_INSTANCE_BASE_NAME: str = "model-registry"
+MR_INSTANCE_NAME: str = f"{MR_INSTANCE_BASE_NAME}0"
 SECURE_MR_NAME: str = "secure-db-mr"
 ISTIO_CONFIG_DICT: dict[str, Any] = {
     "gateway": {"grpc": {"tls": {}}, "rest": {"tls": {}}},
@@ -35,7 +36,8 @@ class ModelRegistryEndpoints:
     "routePort": 443,
     "serviceRoute": "enabled",
 }
-DB_RESOURCES_NAME: str = "db-model-registry"
+DB_BASE_RESOURCES_NAME: str = "db-model-registry"
+DB_RESOURCE_NAME: str = f"{DB_BASE_RESOURCES_NAME}0"
 MR_DB_IMAGE_DIGEST: str = (
     "public.ecr.aws/docker/library/mysql@sha256:9de9d54fecee6253130e65154b930978b1fcc336bcc86dfd06e89b72a2588ebe"
 )
@@ -53,10 +55,3 @@ class ModelRegistryEndpoints:
 CA_CONFIGMAP_NAME = "odh-trusted-ca-bundle"
 CA_MOUNT_PATH = "/etc/pki/ca-trust/extracted/pem"
 CA_FILE_PATH = f"{CA_MOUNT_PATH}/ca-bundle.crt"
-
-MODEL_REGISTRY_STANDARD_LABELS = {
-    Annotations.KubernetesIo.NAME: MR_INSTANCE_NAME,
-    Annotations.KubernetesIo.INSTANCE: MR_INSTANCE_NAME,
-    Annotations.KubernetesIo.PART_OF: MR_OPERATOR_NAME,
-    Annotations.KubernetesIo.CREATED_BY: MR_OPERATOR_NAME,
-}

tests/model_registry/constants.py

@@ -8,7 +8,6 @@
 from utilities.general import (
     validate_container_images,
 )
-from ocp_resources.model_registry_modelregistry_opendatahub_io import ModelRegistry
 from ocp_resources.pod import Pod
 
 LOGGER = get_logger(name=__name__)
@@ -48,7 +47,6 @@ class TestModelRegistryImages:
     def test_verify_model_registry_images(
         self: Self,
         admin_client: DynamicClient,
-        model_registry_instance_mysql: ModelRegistry,
         model_registry_operator_pod: Pod,
         model_registry_instance_pod: Pod,
         related_images_refs: Set[str],

tests/model_registry/image_validation/test_verify_rhoai_images.py

@@ -12,7 +12,7 @@
 from tests.model_registry.constants import (
     MR_OPERATOR_NAME,
     MR_INSTANCE_NAME,
-    DB_RESOURCES_NAME,
+    DB_RESOURCE_NAME,
     OAUTH_PROXY_CONFIG_DICT,
 )
 from kubernetes.dynamic.exceptions import ForbiddenError
@@ -71,7 +71,7 @@ def test_registering_model_negative(
             "host": f"{model_registry_db_deployment_negative_test.name}."
             f"{model_registry_db_deployment_negative_test.namespace}.svc.cluster.local",
             "database": model_registry_db_secret_negative_test.string_data["database-name"],
-            "passwordSecret": {"key": "database-password", "name": DB_RESOURCES_NAME},
+            "passwordSecret": {"key": "database-password", "name": DB_RESOURCE_NAME},
             "port": 3306,
             "skipDBCreation": False,
             "username": model_registry_db_secret_negative_test.string_data["database-user"],

tests/model_registry/negative_tests/test_model_registry_creation_negative.py

@@ -62,10 +62,10 @@ class TestModelRegistryCreation:
     @pytest.mark.smoke
     def test_registering_model(
         self: Self,
-        model_registry_client: ModelRegistryClient,
+        model_registry_client: list[ModelRegistryClient],
         registered_model: RegisteredModel,
     ):
-        model = model_registry_client.get_registered_model(name=MODEL_NAME)
+        model = model_registry_client[0].get_registered_model(name=MODEL_NAME)
         expected_attrs = {
             "id": registered_model.id,
             "name": registered_model.name,
@@ -130,7 +130,7 @@ def test_model_registry_pod_log_mlmd_removal(
         ],
     )
     def test_model_registry_endpoint_response(
-        self, model_registry_rest_url: str, model_registry_rest_headers: dict[str, str], endpoint: str
+        self, model_registry_rest_url: list[str], model_registry_rest_headers: dict[str, str], endpoint: str
     ):
         """
         RHOAIENG-26239: Test to ensure model registry endpoints are responsive
@@ -140,6 +140,6 @@ def test_model_registry_endpoint_response(
             Ensure endpoint is responsive via get call
         """
         output = execute_model_registry_get_command(
-            url=f"{model_registry_rest_url}/{endpoint}", headers=model_registry_rest_headers, json_output=False
+            url=f"{model_registry_rest_url[0]}/{endpoint}", headers=model_registry_rest_headers, json_output=False
         )
         assert output["raw_output"].lower() == "OK".lower()

tests/model_registry/python_client/test_model_registry_creation.py

@@ -53,14 +53,14 @@ class TestUserPermission:
     def test_user_permission_non_admin_user(
         self: Self,
         test_idp_user,
-        model_registry_instance_rest_endpoint: str,
+        model_registry_instance_rest_endpoint: list[str],
         login_as_test_user: None,
     ):
         """
         This test verifies that non-admin users cannot access the Model Registry (403 Forbidden)
         """
         client_args = build_mr_client_args(
-            rest_endpoint=model_registry_instance_rest_endpoint, token=get_openshift_token()
+            rest_endpoint=model_registry_instance_rest_endpoint[0], token=get_openshift_token()
         )
         with pytest.raises(ForbiddenException) as exc_info:
             ModelRegistryClient(**client_args)
@@ -70,7 +70,7 @@ def test_user_permission_non_admin_user(
     @pytest.mark.sanity
     def test_user_added_to_group(
         self: Self,
-        model_registry_instance_rest_endpoint: str,
+        model_registry_instance_rest_endpoint: list[str],
         test_idp_user: UserTestSession,
         model_registry_group_with_user: Group,
         login_as_test_user: Generator[UserTestSession, None, None],
@@ -84,7 +84,7 @@ def test_user_added_to_group(
             wait_timeout=240,
             sleep=5,
             func=assert_positive_mr_registry,
-            model_registry_instance_rest_endpoint=model_registry_instance_rest_endpoint,
+            model_registry_instance_rest_endpoint=model_registry_instance_rest_endpoint[0],
             token=get_openshift_token(),
         )
         for _ in sampler:
@@ -95,7 +95,7 @@ def test_user_added_to_group(
     def test_create_group(
         self: Self,
         test_idp_user: UserTestSession,
-        model_registry_instance_rest_endpoint: str,
+        model_registry_instance_rest_endpoint: list[str],
         created_role_binding_group: RoleBinding,
         login_as_test_user: None,
     ):
@@ -108,14 +108,14 @@ def test_create_group(
         3. Users in the group can access the Model Registry
         """
         assert_positive_mr_registry(
-            model_registry_instance_rest_endpoint=model_registry_instance_rest_endpoint,
+            model_registry_instance_rest_endpoint=model_registry_instance_rest_endpoint[0],
         )
 
     @pytest.mark.sanity
     def test_add_single_user_role_binding(
         self: Self,
         test_idp_user: UserTestSession,
-        model_registry_instance_rest_endpoint: str,
+        model_registry_instance_rest_endpoint: list[str],
         created_role_binding_user: RoleBinding,
         login_as_test_user: None,
     ):
@@ -127,5 +127,5 @@ def test_add_single_user_role_binding(
         2. The user can access the Model Registry after being granted access
         """
         assert_positive_mr_registry(
-            model_registry_instance_rest_endpoint=model_registry_instance_rest_endpoint,
+            model_registry_instance_rest_endpoint=model_registry_instance_rest_endpoint[0],
         )

tests/model_registry/rbac/test_mr_rbac.py

@@ -42,7 +42,7 @@ class TestModelRegistryRBAC:
     @pytest.mark.usefixtures("sa_namespace", "service_account")
     def test_service_account_access_denied(
         self: Self,
-        model_registry_instance_rest_endpoint: str,
+        model_registry_instance_rest_endpoint: list[str],
         sa_token: str,
     ):
         """
@@ -54,7 +54,7 @@ def test_service_account_access_denied(
         LOGGER.info("Expecting initial access DENIAL (403 Forbidden)")
 
         client_args = build_mr_client_args(
-            rest_endpoint=model_registry_instance_rest_endpoint, token=sa_token, author="rbac-test-denied"
+            rest_endpoint=model_registry_instance_rest_endpoint[0], token=sa_token, author="rbac-test-denied"
         )
         LOGGER.debug(f"Attempting client connection with args: {client_args}")
 
@@ -74,18 +74,18 @@ def test_service_account_access_denied(
     def test_service_account_access_granted(
         self: Self,
         sa_token: str,
-        model_registry_instance_rest_endpoint: str,
+        model_registry_instance_rest_endpoint: list[str],
     ):
         """
         Verifies SA access is GRANTED via REST after applying Role and RoleBinding fixtures.
         """
         LOGGER.info("--- Starting RBAC Test: Access Granted ---")
-        LOGGER.info(f"Targeting Model Registry REST endpoint: {model_registry_instance_rest_endpoint}")
+        LOGGER.info(f"Targeting Model Registry REST endpoint: {model_registry_instance_rest_endpoint[0]}")
         LOGGER.info("Applied RBAC Role/Binding via fixtures. Expecting access GRANT.")
 
         try:
             client_args = build_mr_client_args(
-                rest_endpoint=model_registry_instance_rest_endpoint, token=sa_token, author="rbac-test-granted"
+                rest_endpoint=model_registry_instance_rest_endpoint[0], token=sa_token, author="rbac-test-granted"
             )
             LOGGER.debug(f"Attempting client connection with args: {client_args}")
             mr_client_success = ModelRegistryClient(**client_args)

tests/model_registry/rbac/test_mr_rbac_sa.py

@@ -16,15 +16,16 @@
     apply_mysql_args_and_volume_mounts,
     add_mysql_certs_volumes_to_deployment,
     wait_for_pods_running,
+    get_mr_standard_labels,
+    get_mysql_config,
 )
 
 from tests.model_registry.constants import (
-    DB_RESOURCES_NAME,
+    DB_RESOURCE_NAME,
     CA_MOUNT_PATH,
     CA_FILE_PATH,
     CA_CONFIGMAP_NAME,
     OAUTH_PROXY_CONFIG_DICT,
-    MODEL_REGISTRY_STANDARD_LABELS,
     SECURE_MR_NAME,
 )
 from ocp_resources.resource import ResourceEditor
@@ -45,11 +46,11 @@
 def registered_model_rest_api(
     request: pytest.FixtureRequest,
     is_model_registry_oauth: bool,
-    model_registry_rest_url: str,
+    model_registry_rest_url: list[str],
     model_registry_rest_headers: dict[str, str],
 ) -> dict[str, Any]:
     return register_model_rest_api(
-        model_registry_rest_url=model_registry_rest_url,
+        model_registry_rest_url=model_registry_rest_url[0],
         model_registry_rest_headers=model_registry_rest_headers,
         data_dict=request.param,
     )
@@ -58,7 +59,7 @@ def registered_model_rest_api(
 @pytest.fixture()
 def updated_model_registry_resource(
     request: pytest.FixtureRequest,
-    model_registry_rest_url: str,
+    model_registry_rest_url: list[str],
     model_registry_rest_headers: dict[str, str],
     registered_model_rest_api: dict[str, Any],
 ) -> dict[str, Any]:
@@ -80,7 +81,7 @@ def updated_model_registry_resource(
     resource_id = registered_model_rest_api[resource_name]["id"]
     assert resource_id, f"Resource id not found: {registered_model_rest_api[resource_name]}"
     return execute_model_registry_patch_command(
-        url=f"{model_registry_rest_url}{MODEL_REGISTRY_BASE_URI}{api_name}/{resource_id}",
+        url=f"{model_registry_rest_url[0]}{MODEL_REGISTRY_BASE_URI}{api_name}/{resource_id}",
         headers=model_registry_rest_headers,
         data_json=request.param["data"],
     )
@@ -119,7 +120,7 @@ def patch_invalid_ca(
 
 
 @pytest.fixture(scope="class")
-def mysql_template_with_ca(model_registry_db_secret: Secret) -> dict[str, Any]:
+def mysql_template_with_ca(model_registry_db_secret: list[Secret]) -> dict[str, Any]:
     """
     Patches the MySQL template with the CA file path and volume mount.
 
@@ -130,8 +131,8 @@ def mysql_template_with_ca(model_registry_db_secret: Secret) -> dict[str, Any]:
         dict[str, Any]: The patched MySQL template
     """
     mysql_template = get_model_registry_deployment_template_dict(
-        secret_name=model_registry_db_secret.name,
-        resource_name=DB_RESOURCES_NAME,
+        secret_name=model_registry_db_secret[0].name,
+        resource_name=DB_RESOURCE_NAME,
     )
     mysql_template["spec"]["containers"][0]["args"].append(f"--ssl-ca={CA_FILE_PATH}")
     mysql_template["spec"]["containers"][0]["volumeMounts"].append({
@@ -145,33 +146,29 @@ def mysql_template_with_ca(model_registry_db_secret: Secret) -> dict[str, Any]:
 
 @pytest.fixture(scope="class")
 def deploy_secure_mysql_and_mr(
+    request: pytest.FixtureRequest,
     admin_client: DynamicClient,
     model_registry_namespace: str,
-    model_registry_mysql_metadata_db: Deployment,
-    model_registry_mysql_config: dict[str, Any],
+    model_registry_mysql_metadata_db: list[Deployment],
     mysql_template_with_ca: dict[str, Any],
     patch_mysql_deployment_with_ssl_ca: Deployment,
 ) -> Generator[ModelRegistry, None, None]:
     """
     Deploy a secure MySQL and Model Registry instance.
-
-    Args:
-        model_registry_namespace: The namespace of the model registry
-        model_registry_db_secret: The secret for the model registry's MySQL database
-        model_registry_db_deployment: The deployment for the model registry's MySQL database
-        model_registry_mysql_config: The MySQL config dictionary
-        mysql_template_with_ca: The MySQL template with the CA file path and volume mount
-        patch_mysql_deployment_with_ssl_ca: The MySQL deployment with the CA file path and volume mount
     """
+    param = getattr(request, "param", {})
+    mysql = get_mysql_config(base_name=DB_RESOURCE_NAME, namespace=model_registry_namespace)
+    if "sslRootCertificateConfigMap" in param:
+        mysql["sslRootCertificateConfigMap"] = param["sslRootCertificateConfigMap"]
     with ModelRegistry(
         name=SECURE_MR_NAME,
         namespace=model_registry_namespace,
-        label=MODEL_REGISTRY_STANDARD_LABELS,
+        label=get_mr_standard_labels(resource_name=SECURE_MR_NAME),
         grpc={},
         rest={},
         istio=None,
         oauth_proxy=OAUTH_PROXY_CONFIG_DICT,
-        mysql=model_registry_mysql_config,
+        mysql=mysql,
         wait_for_resource=True,
     ) as mr:
         mr.wait_for_condition(condition="Available", status="True")
@@ -216,7 +213,7 @@ def ca_configmap_for_test(
     Args:
         admin_client: The admin client to create the ConfigMap
         model_registry_namespace: The namespace of the model registry
-        mysql_ssl_secrets: The artifacts and secrets for the MySQL SSL connection
+        mysql_ssl_artifact_paths: The artifacts and secrets for the MySQL SSL connection
 
     Returns:
         Generator[ConfigMap, None, None]: A generator that yields the ConfigMap instance.
@@ -241,7 +238,7 @@ def patch_mysql_deployment_with_ssl_ca(
     request: pytest.FixtureRequest,
     admin_client: DynamicClient,
     model_registry_namespace: str,
-    model_registry_db_deployment: Deployment,
+    model_registry_db_deployment: list[Deployment],
     mysql_ssl_secrets: dict[str, Any],
 ) -> Generator[Deployment, Any, Any]:
     """
@@ -251,11 +248,11 @@ def patch_mysql_deployment_with_ssl_ca(
 
     if request.param.get("ca_configmap_for_test"):
         LOGGER.info("Invoking ca_configmap_for_test fixture")
-        request.getfixturevalue("ca_configmap_for_test")  # noqa: FCN001
+        request.getfixturevalue(argname="ca_configmap_for_test")
     CA_CONFIGMAP_NAME = request.param.get("ca_configmap_name", "mysql-ca-configmap")
     CA_MOUNT_PATH = request.param.get("ca_mount_path", "/etc/mysql/ssl")
 
-    deployment = model_registry_db_deployment.instance.to_dict()
+    deployment = model_registry_db_deployment[0].instance.to_dict()
     spec = deployment["spec"]["template"]["spec"]
     my_sql_container = next(container for container in spec["containers"] if container["name"] == "mysql")
     assert my_sql_container is not None, "Mysql container not found"
@@ -266,9 +263,9 @@ def patch_mysql_deployment_with_ssl_ca(
     volumes = add_mysql_certs_volumes_to_deployment(spec=spec, ca_configmap_name=CA_CONFIGMAP_NAME)
 
     patch = {"spec": {"template": {"spec": {"volumes": volumes, "containers": [my_sql_container]}}}}
-    with ResourceEditor(patches={model_registry_db_deployment: patch}):
-        model_registry_db_deployment.wait_for_condition(condition="Available", status="True")
-        yield model_registry_db_deployment
+    with ResourceEditor(patches={model_registry_db_deployment[0]: patch}):
+        model_registry_db_deployment[0].wait_for_condition(condition="Available", status="True")
+        yield model_registry_db_deployment[0]
 
 
 @pytest.fixture(scope="class")

tests/model_registry/rest_api/conftest.py

@@ -5,13 +5,12 @@
 from ocp_resources.maria_db import MariaDB
 from ocp_resources.mariadb_operator import MariadbOperator
 from tests.model_registry.rest_api.mariadb.utils import get_mariadb_dict
-from tests.model_registry.utils import wait_for_pods_running
+from tests.model_registry.utils import wait_for_pods_running, get_mr_standard_labels
 from utilities.constants import OPENSHIFT_OPERATORS, MARIADB
 from utilities.general import generate_random_name
 
 from tests.model_registry.constants import (
     OAUTH_PROXY_CONFIG_DICT,
-    MODEL_REGISTRY_STANDARD_LABELS,
     MR_INSTANCE_NAME,
 )
 from ocp_resources.secret import Secret
@@ -68,7 +67,7 @@ def model_registry_with_mariadb(
     with ModelRegistry(
         name=MR_INSTANCE_NAME,
         namespace=model_registry_namespace,
-        label=MODEL_REGISTRY_STANDARD_LABELS,
+        label=get_mr_standard_labels(resource_name=MR_INSTANCE_NAME),
         grpc={},
         rest={},
         oauth_proxy=OAUTH_PROXY_CONFIG_DICT,