Add OPA and Openshift AI
This commit is contained in:
49
playbooks/deploy_opa.yml
Normal file
49
playbooks/deploy_opa.yml
Normal file
@@ -0,0 +1,49 @@
|
||||
---
|
||||
# Deploy an Open Policy Agent server on OpenShift and wire it into AAP's
|
||||
# policy enforcement (policy as code).
|
||||
#
|
||||
# Authenticates via the aap-deployer ServiceAccount token used by deploy_aap.yml
|
||||
# (same cluster). The token is stored in 1Password as vault_aap_deployer_token.
|
||||
#
|
||||
# Prerequisites:
|
||||
# - AAP deployed (deploy_aap.yml) and aap_gateway_url set for the aap host
|
||||
# - aap-deployer ServiceAccount RBAC current (re-run after RBAC changes):
|
||||
# ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
||||
#
|
||||
# Policies live in roles/opa_server/files/policies; test them with:
|
||||
# podman run --rm -v ./roles/opa_server/files:/files:Z docker.io/openpolicyagent/opa:1.21.1-static \
|
||||
# test /files/policies /files/tests -v
|
||||
#
|
||||
# Attaching a policy (AAP fails closed — start with aap/smoke/allow_all):
|
||||
# -e '{"opa_server_aap_query_paths": [{"type": "job_templates", "name": "Demo Job Template",
|
||||
# "query_path": "aap/policy/decision"}]}'
|
||||
#
|
||||
# Usage:
|
||||
# ansible-navigator run playbooks/deploy_opa.yml --mode stdout
|
||||
|
||||
- name: Deploy OPA server for AAP policy enforcement
|
||||
hosts: aap
|
||||
gather_facts: false
|
||||
connection: local
|
||||
|
||||
environment:
|
||||
K8S_AUTH_HOST: "{{ aap_k8s_api_url }}"
|
||||
K8S_AUTH_API_KEY: "{{ vault_aap_deployer_token }}"
|
||||
|
||||
pre_tasks:
|
||||
- name: Verify aap-deployer token and AAP URL are available
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- vault_aap_deployer_token is defined
|
||||
- vault_aap_deployer_token | length > 0
|
||||
- aap_gateway_url is defined
|
||||
fail_msg: >-
|
||||
vault_aap_deployer_token or aap_gateway_url is not set. Provision the ServiceAccount with:
|
||||
ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
||||
|
||||
roles:
|
||||
- role: opa_server
|
||||
vars:
|
||||
opa_server_aap_namespace: "{{ aap_operator_namespace | default('aap') }}"
|
||||
opa_server_aap_admin_secret: "{{ aap_operator_platform_name | default('aap') }}-admin-password"
|
||||
opa_server_aap_username: "{{ aap_operator_admin_user | default('admin') }}"
|
||||
@@ -400,10 +400,15 @@
|
||||
- apiGroups: [""]
|
||||
resources: ["serviceaccounts"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# OPA server (deploy_opa.yml): policy ConfigMap, Service, service CA bundle
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "services"]
|
||||
verbs: ["get", "list", "watch", "create", "patch"]
|
||||
# patch: Automation Orchestrator backend env (APP_OIDC_ALLOW_PRIVATE_NETWORKS)
|
||||
# create: OPA server Deployment
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "patch"]
|
||||
verbs: ["get", "list", "watch", "create", "patch"]
|
||||
- apiGroups: ["route.openshift.io"]
|
||||
resources: ["routes"]
|
||||
verbs: ["get", "list"]
|
||||
@@ -443,6 +448,90 @@
|
||||
token: "{{ __ocp_service_account_token }}"
|
||||
no_log: true
|
||||
|
||||
# ---- rhoai-deployer (deploy_rhoai_maas.yml) ----
|
||||
- name: Provision rhoai-deployer ServiceAccount
|
||||
ansible.builtin.include_role:
|
||||
name: ocp_service_account
|
||||
vars:
|
||||
ocp_service_account_name: rhoai-deployer
|
||||
ocp_service_account_namespace: redhat-ods-operator
|
||||
ocp_service_account_cluster_role_rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get", "list", "create", "patch"]
|
||||
# configmaps: cluster-monitoring-config (UWM), gateway options
|
||||
# services: Authorino serving-cert annotation
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets", "configmaps", "services"]
|
||||
verbs: ["get", "list", "watch", "create", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["serviceaccounts", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# delete: restart the Kuadrant operator after Istio is installed
|
||||
- apiGroups: [""]
|
||||
resources: ["pods"]
|
||||
verbs: ["get", "list", "watch", "delete"]
|
||||
# patch: Authorino service-CA trust env
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "patch"]
|
||||
- apiGroups: ["route.openshift.io"]
|
||||
resources: ["routes", "routes/custom-host"]
|
||||
verbs: ["get", "list", "create", "patch"]
|
||||
- apiGroups: ["config.openshift.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: ["operators.coreos.com"]
|
||||
resources: ["operatorgroups", "subscriptions", "clusterserviceversions",
|
||||
"catalogsources"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["operators.coreos.com"]
|
||||
resources: ["installplans"]
|
||||
verbs: ["get", "list", "patch", "watch"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# CloudNativePG Cluster/Database CRs backing the MaaS database
|
||||
- apiGroups: ["postgresql.cnpg.io"]
|
||||
resources: ["clusters", "databases"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources: ["gatewayclasses", "gateways"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
# Dedicated MaaS gateway certificate (avoids HTTP/2 coalescing on the wildcard)
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["kuadrant.io"]
|
||||
resources: ["kuadrants"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["operator.authorino.kuadrant.io"]
|
||||
resources: ["authorinos"]
|
||||
verbs: ["get", "list", "patch", "watch"]
|
||||
- apiGroups: ["dscinitialization.opendatahub.io"]
|
||||
resources: ["dscinitializations"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["datasciencecluster.opendatahub.io"]
|
||||
resources: ["datascienceclusters"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["opendatahub.io"]
|
||||
resources: ["odhdashboardconfigs"]
|
||||
verbs: ["get", "list", "patch"]
|
||||
- apiGroups: ["inference.opendatahub.io"]
|
||||
resources: ["externalproviders", "externalmodels"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
- apiGroups: ["maas.opendatahub.io"]
|
||||
resources: ["maasmodelrefs", "maasauthpolicies", "maassubscriptions"]
|
||||
verbs: ["get", "list", "create", "patch", "watch"]
|
||||
|
||||
- name: Store rhoai-deployer token in Vault
|
||||
community.hashi_vault.vault_kv2_write:
|
||||
path: toallab/rhoai-deployer
|
||||
engine_mount_point: kv
|
||||
data:
|
||||
token: "{{ __ocp_service_account_token }}"
|
||||
no_log: true
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Play 10: Drop platform alerts that are false positives on a single
|
||||
# control-plane cluster (AlertRelabelConfig in openshift-monitoring)
|
||||
|
||||
55
playbooks/deploy_rhoai_maas.yml
Normal file
55
playbooks/deploy_rhoai_maas.yml
Normal file
@@ -0,0 +1,55 @@
|
||||
---
|
||||
# Deploy Red Hat OpenShift AI 3.5 Models-as-a-Service and publish the existing
|
||||
# llama-coder (llama.cpp) server through it as an ExternalModel.
|
||||
#
|
||||
# WARNING: the MaaS database is a single-instance CloudNativePG cluster intended
|
||||
# for demo/dev use — not production.
|
||||
#
|
||||
# Technology Preview: MaaS is GA in 3.5, but ExternalModel (used here to front
|
||||
# llama.cpp instead of a KServe LLMInferenceService) is Technology Preview.
|
||||
#
|
||||
# Prerequisites:
|
||||
# - OpenShift cluster deployed (deploy_openshift.yml) with cert-manager
|
||||
# - rhoai-deployer ServiceAccount provisioned (re-run after RBAC changes):
|
||||
# ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
||||
# - vault_rhoai_deployer_token set in host_vars (see hashivault_secrets.yml)
|
||||
# - llama-coder running in llm-coding-assistant with secret llama-coder-api-key
|
||||
#
|
||||
# Usage:
|
||||
# ansible-navigator run playbooks/deploy_rhoai_maas.yml --mode stdout
|
||||
|
||||
- name: Deploy OpenShift AI Models-as-a-Service
|
||||
hosts: sno.openshift.toal.ca
|
||||
gather_facts: false
|
||||
connection: local
|
||||
|
||||
environment:
|
||||
K8S_AUTH_HOST: "{{ rhoai_maas_k8s_api_url | default('https://api.' ~ ocp_cluster_name ~ '.' ~ ocp_base_domain ~ ':6443') }}"
|
||||
K8S_AUTH_API_KEY: "{{ vault_rhoai_deployer_token }}"
|
||||
|
||||
pre_tasks:
|
||||
- name: Verify rhoai-deployer token is available
|
||||
ansible.builtin.assert:
|
||||
that:
|
||||
- vault_rhoai_deployer_token is defined
|
||||
- vault_rhoai_deployer_token | length > 0
|
||||
fail_msg: >-
|
||||
vault_rhoai_deployer_token is not set. Provision the ServiceAccount with:
|
||||
ansible-navigator run playbooks/deploy_openshift.yml --tags sno_deploy_service_accounts
|
||||
Then reference kv/data/toallab/rhoai-deployer:token as vault_rhoai_deployer_token.
|
||||
|
||||
roles:
|
||||
- role: cloudnativepg_operator
|
||||
vars:
|
||||
cloudnativepg_operator_cluster_namespace: rhoai-maas-db
|
||||
cloudnativepg_operator_cluster_name: maas-postgres
|
||||
cloudnativepg_operator_owner_user: maas
|
||||
cloudnativepg_operator_max_connections: 100
|
||||
cloudnativepg_operator_databases:
|
||||
- name: maas
|
||||
dbname: maas
|
||||
cloudnativepg_operator_secrets:
|
||||
- name: maas-postgres-secret
|
||||
database: maas
|
||||
cloudnativepg_operator_vault_path: cloudnativepg/maas-postgres
|
||||
- role: rhoai_maas
|
||||
Reference in New Issue
Block a user