Merge branch 'opendatahub-io:main' into main

Author: dbasunag

.pre-commit-config.yaml

@@ -35,7 +35,7 @@ repos:
       - id: detect-secrets
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.11
+    rev: v0.11.13
     hooks:
       - id: ruff
       - id: ruff-format
@@ -49,12 +49,12 @@ repos:
   #     - id: renovate-config-validator
 
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.26.0
+    rev: v8.27.2
     hooks:
       - id: gitleaks
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.15.0
+    rev: v1.16.0
     hooks:
       - id: mypy
         additional_dependencies: ["types-PyYAML", "types-requests"]

conftest.py

@@ -33,6 +33,10 @@
     get_base_dir,
 )
 
+from kubernetes.dynamic import DynamicClient
+from utilities.infra import get_operator_distribution, get_dsci_applications_namespace, get_data_science_cluster
+from ocp_resources.resource import get_client
+
 LOGGER = logging.getLogger(name=__name__)
 BASIC_LOGGER = logging.getLogger(name="basic")
 
@@ -233,6 +237,36 @@ def pytest_sessionstart(session: Session) -> None:
         path=must_gather_dict["must_gather_base_directory"],
         ignore_errors=True,
     )
+    config = session.config
+    if config.getoption("--collect-only") or config.getoption("--setup-plan"):
+        LOGGER.info("Skipping global config update for collect-only or setup-plan")
+        return
+    updated_global_config(admin_client=get_client())
+
+
+def updated_global_config(admin_client: DynamicClient) -> None:
+    """
+    Updates the global config with the distribution, applications namespace, and model registry namespace.
+    Args:
+        admin_client: The admin client to use to get resources.
+    Returns:
+        None
+    """
+    distribution = get_operator_distribution(client=admin_client)
+    if distribution == "Open Data Hub":
+        py_config["distribution"] = "upstream"
+
+    elif distribution.startswith("OpenShift AI"):
+        py_config["distribution"] = "downstream"
+    else:
+        import pytest
+
+        pytest.exit(f"Unknown distribution: {distribution}")
+
+    py_config["applications_namespace"] = get_dsci_applications_namespace(client=admin_client)
+    py_config["model_registry_namespace"] = get_data_science_cluster(
+        client=admin_client
+    ).instance.spec.components.modelregistry.registriesNamespace
 
 
 def pytest_fixture_setup(fixturedef: FixtureDef[Any], request: FixtureRequest) -> None:
@@ -276,9 +310,6 @@ def pytest_runtest_setup(item: Item) -> None:
     elif KServeDeploymentType.MODEL_MESH.lower() in item.keywords:
         item.fixturenames.insert(0, "enabled_modelmesh_in_dsc")
 
-    # The above fixtures require the global config to be updated before being called
-    item.fixturenames.insert(0, "updated_global_config")
-
 
 def pytest_runtest_call(item: Item) -> None:
     BASIC_LOGGER.info(f"{separator(symbol_='-', val='CALL')}")

pyproject.toml

@@ -63,7 +63,7 @@ dependencies = [
     "timeout-sampler>=1.0.6",
     "shortuuid>=1.0.13",
     "jira>=3.8.0",
-    "openshift-python-wrapper>=11.0.50",
+    "openshift-python-wrapper>=11.0.57",
     "semver>=3.0.4",
     "sqlalchemy>=2.0.40",
     "pytest-order>=1.3.0",

pytest.ini

@@ -17,6 +17,7 @@ markers =
     post_upgrade: Mark tests which should be run after upgrading the product.
     fuzzer: Mark tests that use fuzzing and are probably going to generate unanticipated failures.
     ocp_interop: Interop testing with Openshift.
+    downstream_only: Tests that are specific to downstream
 
     # Model server
     modelmesh: Mark tests which are model mesh tests
@@ -25,6 +26,7 @@ markers =
     minio: Mark tests which are using MinIO storage
     tls: Mark tests which are testing TLS
     metrics: Mark tests which are testing metrics
+    kueue: Mark tests which are testing Kueue
 
 addopts =
     -s

schemathesis.toml

@@ -0,0 +1 @@
+base-url = "https://${API_HOST}"

tests/conftest.py

@@ -30,11 +30,8 @@
 from utilities.infra import (
     verify_cluster_sanity,
     create_ns,
-    get_dsci_applications_namespace,
-    get_operator_distribution,
     login_with_user_password,
     get_openshift_token,
-    get_data_science_cluster,
 )
 from utilities.constants import (
     AcceleratorType,
@@ -65,23 +62,6 @@ def tests_tmp_dir(request: FixtureRequest, tmp_path_factory: TempPathFactory) ->
     shutil.rmtree(path=str(tests_tmp_path), ignore_errors=True)
 
 
-@pytest.fixture(scope="session")
-def updated_global_config(request: FixtureRequest, admin_client: DynamicClient) -> None:
-    distribution = get_operator_distribution(client=admin_client)
-    if distribution == "Open Data Hub":
-        py_config["distribution"] = "upstream"
-
-    elif distribution.startswith("OpenShift AI"):
-        py_config["distribution"] = "downstream"
-    else:
-        pytest.exit(f"Unknown distribution: {distribution}")
-
-    py_config["applications_namespace"] = get_dsci_applications_namespace(client=admin_client)
-    py_config["model_registry_namespace"] = get_data_science_cluster(
-        client=admin_client
-    ).instance.spec.components.modelregistry.registriesNamespace
-
-
 @pytest.fixture(scope="session")
 def current_client_token(admin_client: DynamicClient) -> str:
     return get_openshift_token()

tests/model_registry/conftest.py

@@ -1,4 +1,6 @@
+import os
 import pytest
+from pytest import Config
 import schemathesis
 from typing import Generator, Any
 from ocp_resources.pod import Pod
@@ -9,7 +11,7 @@
 from ocp_resources.data_science_cluster import DataScienceCluster
 from ocp_resources.deployment import Deployment
 
-from ocp_resources.model_registry import ModelRegistry
+from ocp_resources.model_registry_modelregistry_opendatahub_io import ModelRegistry
 from schemathesis.specs.openapi.schemas import BaseOpenAPISchema
 from schemathesis.generation.stateful.state_machine import APIStateMachine
 from schemathesis.core.transport import Response
@@ -29,6 +31,8 @@
     DB_RESOURCES_NAME,
     MODEL_REGISTRY_DB_SECRET_STR_DATA,
     MODEL_REGISTRY_DB_SECRET_ANNOTATIONS,
+    OAUTH_PROXY_CONFIG_DICT,
+    MODEL_REGISTRY_STANDARD_LABELS,
 )
 from utilities.constants import Labels
 from tests.model_registry.utils import (
@@ -38,7 +42,7 @@
     get_model_registry_db_label_dict,
     wait_for_pods_running,
 )
-from utilities.constants import Annotations, Protocols, DscComponents
+from utilities.constants import Protocols, DscComponents
 from model_registry import ModelRegistry as ModelRegistryClient
 from semver import Version
 from utilities.infra import get_product_version
@@ -145,66 +149,94 @@ def model_registry_db_deployment(
 
 @pytest.fixture(scope="class")
 def model_registry_instance(
-    admin_client: DynamicClient,
-    model_registry_namespace: str,
-    model_registry_db_deployment: Deployment,
-    model_registry_db_secret: Secret,
-    model_registry_db_service: Service,
+    model_registry_namespace: str, model_registry_mysql_config: dict[str, Any], is_model_registry_oauth: bool
 ) -> Generator[ModelRegistry, Any, Any]:
+    istio_config = None
+    oauth_config = None
+    if is_model_registry_oauth:
+        LOGGER.warning("Requested Ouath Proxy configuration:")
+        oauth_config = OAUTH_PROXY_CONFIG_DICT
+    else:
+        LOGGER.warning("Requested OSSM configuration:")
+        istio_config = ISTIO_CONFIG_DICT
+    """Creates a model registry instance with oauth proxy/service mesh configuration."""
     with ModelRegistry(
         name=MR_INSTANCE_NAME,
         namespace=model_registry_namespace,
-        label={
-            Annotations.KubernetesIo.NAME: MR_INSTANCE_NAME,
-            Annotations.KubernetesIo.INSTANCE: MR_INSTANCE_NAME,
-            Annotations.KubernetesIo.PART_OF: MR_OPERATOR_NAME,
-            Annotations.KubernetesIo.CREATED_BY: MR_OPERATOR_NAME,
-        },
+        label=MODEL_REGISTRY_STANDARD_LABELS,
         grpc={},
         rest={},
-        istio=ISTIO_CONFIG_DICT,
-        mysql={
-            "host": f"{model_registry_db_deployment.name}.{model_registry_db_deployment.namespace}.svc.cluster.local",
-            "database": model_registry_db_secret.string_data["database-name"],
-            "passwordSecret": {"key": "database-password", "name": DB_RESOURCES_NAME},
-            "port": 3306,
-            "skipDBCreation": False,
-            "username": model_registry_db_secret.string_data["database-user"],
-        },
+        istio=istio_config,
+        oauth_proxy=oauth_config,
+        mysql=model_registry_mysql_config,
         wait_for_resource=True,
     ) as mr:
         mr.wait_for_condition(condition="Available", status="True")
         yield mr
 
 
+@pytest.fixture(scope="class")
+def model_registry_mysql_config(
+    model_registry_db_deployment: Deployment, model_registry_db_secret: Secret
+) -> dict[str, Any]:
+    return {
+        "host": f"{model_registry_db_deployment.name}.{model_registry_db_deployment.namespace}.svc.cluster.local",
+        "database": model_registry_db_secret.string_data["database-name"],
+        "passwordSecret": {"key": "database-password", "name": model_registry_db_deployment.name},
+        "port": 3306,
+        "skipDBCreation": False,
+        "username": model_registry_db_secret.string_data["database-user"],
+    }
+
+
 @pytest.fixture(scope="class")
 def model_registry_instance_service(
     admin_client: DynamicClient,
     model_registry_namespace: str,
     model_registry_instance: ModelRegistry,
 ) -> Service:
+    """
+    Get the service for the regular model registry instance.
+    Args:
+        admin_client: The admin client
+        model_registry_namespace: The namespace where the model registry is deployed
+        model_registry_instance: The model registry instance to get the service for
+    Returns:
+        Service: The service for the model registry instance
+    """
     return get_mr_service_by_label(
-        client=admin_client, ns=Namespace(name=model_registry_namespace), mr_instance=model_registry_instance
+        client=admin_client,
+        ns=Namespace(name=model_registry_namespace),
+        mr_instance=model_registry_instance,
     )
 
 
 @pytest.fixture(scope="class")
 def model_registry_instance_rest_endpoint(
     model_registry_instance_service: Service,
 ) -> str:
+    """
+    Get the REST endpoint for the model registry instance.
+    Args:
+        model_registry_instance_service: The service for the model registry instance
+    Returns:
+        str: The REST endpoint for the model registry instance
+    """
     return get_endpoint_from_mr_service(svc=model_registry_instance_service, protocol=Protocols.REST)
 
 
 @pytest.fixture(scope="class")
-def generated_schema(model_registry_instance_rest_endpoint: str) -> BaseOpenAPISchema:
+def generated_schema(pytestconfig: Config, model_registry_instance_rest_endpoint: str) -> BaseOpenAPISchema:
+    os.environ["API_HOST"] = model_registry_instance_rest_endpoint
+    config = schemathesis.config.SchemathesisConfig.from_path(f"{pytestconfig.rootpath}/schemathesis.toml")
     schema = schemathesis.openapi.from_url(
-        url="https://raw.githubusercontent.com/kubeflow/model-registry/main/api/openapi/model-registry.yaml"
+        url="https://raw.githubusercontent.com/kubeflow/model-registry/main/api/openapi/model-registry.yaml",
+        config=config,
     )
-    schema.configure(base_url=f"https://{model_registry_instance_rest_endpoint}/")
     return schema
 
 
-@pytest.fixture
+@pytest.fixture()
 def state_machine(generated_schema: BaseOpenAPISchema, current_client_token: str) -> APIStateMachine:
     BaseAPIWorkflow = generated_schema.as_state_machine()
 
@@ -214,12 +246,18 @@ class APIWorkflow(BaseAPIWorkflow):  # type: ignore
         def setup(self) -> None:
             self.headers = {"Authorization": f"Bearer {current_client_token}", "Content-Type": "application/json"}
 
+        def before_call(self, case: Case) -> None:
+            LOGGER.info(f"Checking: {case.method} {case.path}")
+
         # these kwargs are passed to requests.request()
         def get_call_kwargs(self, case: Case) -> dict[str, Any]:
             return {"verify": False, "headers": self.headers}
 
         def after_call(self, response: Response, case: Case) -> None:
-            LOGGER.info(f"{case.method} {case.path} -> {response.status_code}")
+            LOGGER.info(
+                f"Method tested: {case.method}, API: {case.path}, response code:{response.status_code},"
+                f" Full Response:{response.text}"
+            )
 
     return APIWorkflow
 
@@ -263,11 +301,18 @@ def updated_dsc_component_state_scope_class(
 
 @pytest.fixture(scope="class")
 def model_registry_client(current_client_token: str, model_registry_instance_rest_endpoint: str) -> ModelRegistryClient:
-    # address and port need to be split in the client instantiation
+    """
+    Get a client for the model registry instance.
+    Args:
+        request: The pytest request object
+        current_client_token: The current client token
+    Returns:
+        ModelRegistryClient: A client for the model registry instance
+    """
     server, port = model_registry_instance_rest_endpoint.split(":")
     return ModelRegistryClient(
         server_address=f"{Protocols.HTTPS}://{server}",
-        port=port,
+        port=int(port),
         author="opendatahub-test",
         user_token=current_client_token,
         is_secure=False,
@@ -350,3 +395,8 @@ def validate_authorino_operator_version_channel(admin_client: DynamicClient) ->
         validate_operator_subscription_channel(
             client=admin_client, namespace="openshift-operators", operator_name=operator_name, channel_name="stable"
         )
+
+
+@pytest.fixture(scope="class")
+def is_model_registry_oauth(request: FixtureRequest) -> bool:
+    return getattr(request, "param", {}).get("use_oauth_proxy", False)

tests/model_registry/constants.py

@@ -1,6 +1,6 @@
 from typing import Any
 from ocp_resources.resource import Resource
-from utilities.constants import ModelFormat
+from utilities.constants import ModelFormat, Annotations
 
 
 class ModelRegistryEndpoints:
@@ -29,6 +29,11 @@ class ModelRegistryEndpoints:
 ISTIO_CONFIG_DICT: dict[str, Any] = {
     "gateway": {"grpc": {"tls": {}}, "rest": {"tls": {}}},
 }
+OAUTH_PROXY_CONFIG_DICT: dict[str, Any] = {
+    "port": 8443,
+    "routePort": 443,
+    "serviceRoute": "enabled",
+}
 DB_RESOURCES_NAME: str = "db-model-registry"
 MR_DB_IMAGE_DIGEST: str = (
     "public.ecr.aws/docker/library/mysql@sha256:9de9d54fecee6253130e65154b930978b1fcc336bcc86dfd06e89b72a2588ebe"
@@ -43,3 +48,9 @@ class ModelRegistryEndpoints:
     f"{Resource.ApiGroup.TEMPLATE_OPENSHIFT_IO}/expose-password": "'{.data[''database-password'']}'",
     f"{Resource.ApiGroup.TEMPLATE_OPENSHIFT_IO}/expose-username": "'{.data[''database-user'']}'",
 }
+MODEL_REGISTRY_STANDARD_LABELS = {
+    Annotations.KubernetesIo.NAME: MR_INSTANCE_NAME,
+    Annotations.KubernetesIo.INSTANCE: MR_INSTANCE_NAME,
+    Annotations.KubernetesIo.PART_OF: MR_OPERATOR_NAME,
+    Annotations.KubernetesIo.CREATED_BY: MR_OPERATOR_NAME,
+}

tests/model_registry/image_validation/test_verify_rhoai_images.py

@@ -8,7 +8,7 @@
 from utilities.general import (
     validate_container_images,
 )
-from ocp_resources.model_registry import ModelRegistry
+from ocp_resources.model_registry_modelregistry_opendatahub_io import ModelRegistry
 from ocp_resources.pod import Pod
 
 LOGGER = get_logger(name=__name__)
@@ -29,6 +29,7 @@
     indirect=True,
 )
 @pytest.mark.usefixtures("updated_dsc_component_state_scope_class")
+@pytest.mark.downstream_only
 class TestModelRegistryImages:
     """
     Tests to verify that all Model Registry component images (operator and instance container images)