Aibroker kmodels

instance-applications/113-ibm-kmodels/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: ibm-kmodels
+description: IBM KMODELS
+type: application
+version: 1.0.0
+
+dependencies:
+- name: junitreporter
+  version: 1.0.0
+  repository: "file://../../sub-charts/junitreporter/"
+  condition: junitreporter.devops_mongo_uri != ""

instance-applications/113-ibm-kmodels/README.md

@@ -0,0 +1,3 @@
+IBM Kmodels
+===============================================================================
+Deploy and configure kmodels storage with configurable version

instance-applications/113-ibm-kmodels/templates/01-kmodel-namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: "{{ .Values.aibroker_namespace }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "137"

instance-applications/113-ibm-kmodels/templates/02-kmodel-secret.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: km-s3-secret
+  namespace: "{{ .Values.aibroker_namespace }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "138"
+    {{- if eq .Values.mas_aibroker_storage_provider "aws" }}
+    serving.kserve.io/s3-endpoint: "{{ .Values.mas_aibroker_storage_host }}"
+    {{- else if eq .Values.mas_aibroker_storage_provider "minio" }}
+    serving.kserve.io/s3-endpoint: "{{ .Values.mas_aibroker_storage_host }}:{{ .Values.mas_aibroker_storage_port }}"
+    {{- end }}
+    {{- if eq .Values.mas_aibroker_storage_ssl "false" }}
+    serving.kserve.io/s3-usehttps: "0"
+    {{- else }}
+    serving.kserve.io/s3-usehttps: "1"
+    {{- end }}
+    {{- if and (eq .Values.mas_aibroker_storage_provider "minio") (not .Values.mas_aibroker_storage_region | empty) }}
+    serving.kserve.io/s3-region: "{{ .Values.mas_aibroker_storage_region }}"
+    {{- end }}
+stringData:
+  AWS_ACCESS_KEY_ID: "{{ .Values.mas_aibroker_storage_accesskey}}"
+  AWS_SECRET_ACCESS_KEY: "{{ .Values.mas_aibroker_storage_secretkey}}"
+  S3_ACCESS_KEY: "{{ .Values.mas_aibroker_storage_accesskey}}"
+  S3_SECRET_KEY: "{{ .Values.mas_aibroker_storage_secretkey}}"
+  S3_HOST: "{{ .Values.mas_aibroker_storage_host}}"
+  S3_PORT: "{{ .Values.mas_aibroker_storage_port}}"
+  S3_REGION: "{{ .Values.mas_aibroker_storage_region}}"
+  S3_SSL: "{{ .Values.mas_aibroker_storage_ssl}}"

instance-applications/113-ibm-kmodels/templates/03-kmodel-istio.yaml

@@ -0,0 +1,47 @@
+---
+apiVersion: security.istio.io/v1beta1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: opendatahub
+  annotations:
+    argocd.argoproj.io/sync-wave: "139"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+spec:
+  mtls:
+    mode: PERMISSIVE
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: ds-pipeline-instance
+  namespace: opendatahub
+  annotations:
+    argocd.argoproj.io/sync-wave: "140"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  host: ds-pipeline-instance.opendatahub.svc.cluster.local
+  trafficPolicy:
+    portLevelSettings:
+      - port:
+          number: 8888
+        tls:
+          mode: DISABLE
+---
+apiVersion: networking.istio.io/v1beta1
+kind: DestinationRule
+metadata:
+  name: minio-instance
+  namespace: opendatahub
+  annotations:
+    argocd.argoproj.io/sync-wave: "141"
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  host: minio-instance.opendatahub.svc.cluster.local
+  trafficPolicy:
+    portLevelSettings:
+      - port:
+          number: 9000
+        tls:
+          mode: DISABLE

instance-applications/113-ibm-kmodels/templates/04-kmodel-networkpolicies.yaml

@@ -0,0 +1,43 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: km-instance
+  namespace: "{{ .Values.aibroker_namespace }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "142"
+spec:
+  podSelector:
+    matchLabels:
+      kmodels: instance
+      part-of: kmodels
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - port: 3000
+        - port: 8443
+
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: ds-pipelines-km-instance
+  namespace: "{{ .Values.aibroker_namespace }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "143"
+spec:
+  podSelector:
+    matchLabels:
+      app: ds-pipeline-instance
+      component: data-science-pipelines
+  ingress:
+    - ports:
+        - protocol: TCP
+          port: 8888
+      from:
+        - podSelector:
+            matchLabels:
+              app: km-controller
+  policyTypes:
+    - Ingress

instance-applications/113-ibm-kmodels/templates/05-kmodel-store.yaml

@@ -0,0 +1,125 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: km-store
+  namespace: "{{ .Values.aibroker_namespace }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "144"
+  labels:
+    app: km-store
+data:
+  STORE_BUCKET: "{{ .Values.mas_aibroker_storage_templates_bucket }}"
+  # Certificate files folder (default: /etc/ssl/certs)
+  CERTS_PATH: "/etc/ssl/certs"
+  # Private key (default: tls.key)
+  CERT_PRIVATE_KEY: "tls.key"
+  # Public certificate (default: tls.crt)
+  CERT_PUBLIC_CERTIFICATE: "tls.crt"
+  # Set to true to enable https server (default: true)
+  SUPPORT_HTTPS: "true"
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: km-store
+  namespace: "{{ .Values.aibroker_namespace }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "145"
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: http
+    - name: https
+      port: 8443
+      targetPort: https
+  selector:
+    app: km-store
+  type: ClusterIP
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: km-store
+  namespace: "{{ .Values.aibroker_namespace }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "146"
+  labels:
+    app: km-store
+    component: store
+    kmodels: instance
+    part-of: kmodels
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: km-store
+      kmodels: instance
+      part-of: kmodels
+  template:
+    metadata:
+      labels:
+        app: km-store
+        component: store
+        kmodels: instance
+        part-of: kmodels
+    spec:
+      restartPolicy: Always
+      volumes:
+        - name: ssh-key
+          secret:
+            secretName: "{{ .Values.ssh_secret_name }}"
+      imagePullSecrets:
+        - name: "{{ .Values.pullSecretName }}"
+      containers:
+        - name: store
+          image: "{{ .Values.image_store }}"
+          imagePullPolicy: Always
+          securityContext:
+            readOnlyRootFilesystem: false
+            allowPrivilegeEscalation: false
+            privileged: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - name: http
+              containerPort: 3000
+            - name: https
+              containerPort: 8443
+          envFrom:
+            - configMapRef:
+                name: km-store
+            - secretRef:
+                name: km-s3-secret
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+              ephemeral-storage: "1Gi"
+            limits:
+              memory: "256Mi"
+              cpu: "100m"
+              ephemeral-storage: "2Gi"
+          livenessProbe:
+            httpGet:
+              path: /version
+              port: 8443
+              scheme: HTTPS
+            initialDelaySeconds: 15
+            periodSeconds: 500
+          readinessProbe:
+            httpGet:
+              path: /version
+              port: 8443
+              scheme: HTTPS
+            initialDelaySeconds: 5
+            periodSeconds: 500
+          volumeMounts:
+            - mountPath: "/etc/ssl/certs"
+              name: ssh-key
+              readOnly: true