Add OPA and Openshift AI

roles/rhoai_maas/defaults/main.yml

@@ -0,0 +1,111 @@
+---
+# --- OLM operators ---
+# Installed in order. RHOAI is pinned to stable-3.5: the MaaS DSC layout
+# (aigateway.modelsAsAService) changed between 3.4 and 3.5, so don't float on stable-3.x.
+# RHCL must be 1.4.x (Kuadrant >= 1.4.2 for AuthPolicy spec.defaults.rules).
+# cert-manager is a prerequisite but already installed by deploy_openshift.yml.
+rhoai_maas_operators:
+  - name: rhcl-operator
+    namespace: openshift-operators
+    channel: stable-1.4
+  - name: leader-worker-set
+    namespace: openshift-lws-operator
+    channel: stable-v1.0
+    operator_group_target_namespaces:
+      - openshift-lws-operator
+  - name: rhods-operator
+    namespace: redhat-ods-operator
+    channel: stable-3.5
+    namespace_labels:
+      openshift.io/cluster-monitoring: "true"
+rhoai_maas_wait_timeout: 900
+
+# --- Gateway ---
+# Empty = maas.<cluster ingress domain>.
+rhoai_maas_hostname: ""
+# The gateway gets its own single-host certificate. Don't use the *.apps wildcard:
+# browsers would reuse the MaaS HTTP/2 connection for every other *.apps host
+# (console, dashboards), and the MaaS gateway answers those with 404.
+rhoai_maas_gateway_cert_secret: maas-gateway-tls
+# cert-manager ClusterIssuer for the gateway certificate. Empty = use the existing
+# rhoai_maas_gateway_cert_secret as-is and don't create a Certificate.
+rhoai_maas_gateway_cert_issuer: letsencrypt-production
+# No cloud LB on this cluster: run the gateway Service as ClusterIP and expose it
+# through a passthrough Route on the default router. Set to LoadBalancer with MetalLB.
+rhoai_maas_gateway_service_type: ClusterIP
+rhoai_maas_gateway_create_route: true
+
+# --- MaaS database ---
+# PostgreSQL is provisioned by the cloudnativepg_operator role (see the playbook);
+# this secret holds its credentials (type kubernetes.io/basic-auth).
+rhoai_maas_db_secret_name: maas-postgres-secret
+rhoai_maas_db_secret_namespace: rhoai-maas-db
+rhoai_maas_db_sslmode: require
+rhoai_maas_infra_namespace: redhat-ai-gateway-infra
+
+# --- DataScienceCluster ---
+# Minimal component set for MaaS. Anything not listed here is set to Removed.
+rhoai_maas_dsc_name: default-dsc
+rhoai_maas_dsc_managed_components:
+  - dashboard
+  - kserve
+  - aigateway
+  - ogx
+rhoai_maas_dsc_removed_components:
+  - aipipelines
+  - feastoperator
+  - kueue
+  - mlflowoperator
+  - modelregistry
+  - ray
+  - trainer
+  - trainingoperator
+  - trustyai
+  - workbenches
+
+# --- Models (ExternalModel fronting in-cluster OpenAI-compatible servers) ---
+# The api_key_secret must already exist in the model namespace with key `api-key`;
+# the role only labels it for MaaS. Names must not collide with existing Services
+# in the namespace (the controller creates a Service per provider/model).
+rhoai_maas_external_models:
+  - name: qwen35-9b-coder
+    namespace: llm-coding-assistant
+    display_name: Qwen3.5 9B Coder (llama.cpp)
+    description: Qwen3.5-9B Q5_K_M served by llama.cpp on the desktop GPU node
+    provider_name: llama-coder-provider
+    provider_type: openai
+    endpoint: llama-coder.llm-coding-assistant.svc.cluster.local
+    port: 8080
+    tls: false
+    api_key_secret: llama-coder-api-key
+    # llama-server serves a single model and ignores the request's model field.
+    target_model: Qwen3.5-9B-Q5_K_M.gguf
+    api_format: openai-chat
+    path: /v1/chat/completions
+
+# --- Access policy and quota (CR spec shapes, models-as-a-service namespace) ---
+rhoai_maas_auth_policies:
+  - name: llama-coder-access
+    display_name: llama-coder access
+    description: All authenticated users can call the llama-coder model
+    groups:
+      - system:authenticated
+    users: []
+    model_refs:
+      - name: qwen35-9b-coder
+        namespace: llm-coding-assistant
+
+rhoai_maas_subscriptions:
+  - name: llama-coder-default
+    display_name: llama-coder default
+    description: 200k tokens/hour per user for all authenticated users
+    priority: 10
+    groups:
+      - system:authenticated
+    users: []
+    model_refs:
+      - name: qwen35-9b-coder
+        namespace: llm-coding-assistant
+        tokenRateLimits:
+          - limit: 200000
+            window: 1h