ptoal/toallab-automation
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add OPA and Openshift AI

Browse Source
This commit is contained in:
Patrick Toal
2026-10-20 14:08:57 -04:00
parent 7df35b9dd4
commit 5b46ba7c74
27 changed files with 2634 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

361
roles/rhoai_maas/tasks/platform.yml Normal file
View File

@@ -0,0 +1,361 @@
---
# ------------------------------------------------------------------
# User Workload Monitoring (MaaS reports Degraded without it)
# ------------------------------------------------------------------
- name: Read cluster monitoring config
kubernetes.core.k8s_info:
api_version: v1
kind: ConfigMap
namespace: openshift-monitoring
name: cluster-monitoring-config
register: __rhoai_maas_cmo
- name: Resolve cluster monitoring config
ansible.builtin.set_fact:
__rhoai_maas_cmo_config: >-
{{ ((__rhoai_maas_cmo.resources[0].data['config.yaml'] | default('{}')) if __rhoai_maas_cmo.resources else '{}')
| from_yaml | default({}, true) }}
- name: Enable User Workload Monitoring
kubernetes.core.k8s:
state: present
definition:
apiVersion: v1
kind: ConfigMap
metadata:
name: cluster-monitoring-config
namespace: openshift-monitoring
data:
config.yaml: "{{ __rhoai_maas_cmo_config | combine({'enableUserWorkload': true}) | to_nice_yaml }}"
when: not (__rhoai_maas_cmo_config.enableUserWorkload | default(false) | bool)
# ------------------------------------------------------------------
# Gateway API: GatewayClass, Gateway, passthrough Route
# ------------------------------------------------------------------
- name: Read cluster ingress domain
kubernetes.core.k8s_info:
api_version: config.openshift.io/v1
kind: Ingress
name: cluster
register: __rhoai_maas_ingress
when: rhoai_maas_hostname | length == 0
- name: Resolve MaaS hostname
ansible.builtin.set_fact:
__rhoai_maas_hostname: >-
{{ rhoai_maas_hostname if rhoai_maas_hostname | length > 0
else 'maas.' ~ __rhoai_maas_ingress.resources[0].spec.domain }}
- name: Create MaaS gateway certificate
kubernetes.core.k8s:
state: present
definition:
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: "{{ __rhoai_maas_gateway_name }}-cert"
namespace: "{{ __rhoai_maas_gateway_namespace }}"
spec:
secretName: "{{ rhoai_maas_gateway_cert_secret }}"
issuerRef:
name: "{{ rhoai_maas_gateway_cert_issuer }}"
kind: ClusterIssuer
dnsNames:
- "{{ __rhoai_maas_hostname }}"
duration: 2160h
renewBefore: 720h
when: rhoai_maas_gateway_cert_issuer | length > 0
- name: Wait for MaaS gateway certificate to be issued
kubernetes.core.k8s_info:
api_version: cert-manager.io/v1
kind: Certificate
namespace: "{{ __rhoai_maas_gateway_namespace }}"
name: "{{ __rhoai_maas_gateway_name }}-cert"
register: __rhoai_maas_gw_cert
until: >-
(__rhoai_maas_gw_cert.resources[0].status.conditions | default([])
| selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length) > 0
retries: 30
delay: 10
when: rhoai_maas_gateway_cert_issuer | length > 0
# Creating the GatewayClass makes the ingress operator install Service Mesh 3 (Istio)
- name: Create openshift-default GatewayClass
kubernetes.core.k8s:
state: present
definition:
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: openshift-default
spec:
controllerName: openshift.io/gateway-controller/v1
- name: Wait for GatewayClass to be accepted
kubernetes.core.k8s_info:
api_version: gateway.networking.k8s.io/v1
kind: GatewayClass
name: openshift-default
register: __rhoai_maas_gwc
until: >-
__rhoai_maas_gwc.resources | length > 0 and
(__rhoai_maas_gwc.resources[0].status.conditions | default([])
| selectattr('type', 'equalto', 'Accepted') | selectattr('status', 'equalto', 'True') | list | length) > 0
retries: "{{ __rhoai_maas_wait_retries }}"
delay: 10
- name: Create Gateway deployment options
kubernetes.core.k8s:
state: present
definition:
apiVersion: v1
kind: ConfigMap
metadata:
name: maas-gateway-options
namespace: "{{ __rhoai_maas_gateway_namespace }}"
data:
deployment: |
spec:
template:
spec:
containers:
- name: istio-proxy
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: "2"
memory: 2Gi
- name: Create MaaS Gateway
kubernetes.core.k8s:
state: present
definition:
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: "{{ __rhoai_maas_gateway_name }}"
namespace: "{{ __rhoai_maas_gateway_namespace }}"
annotations:
opendatahub.io/managed: "false"
security.opendatahub.io/authorino-tls-bootstrap: "true"
networking.istio.io/service-type: "{{ rhoai_maas_gateway_service_type }}"
spec:
gatewayClassName: openshift-default
infrastructure:
parametersRef:
group: ""
kind: ConfigMap
name: maas-gateway-options
listeners:
- name: http
hostname: "{{ __rhoai_maas_hostname }}"
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
maas.opendatahub.io/gateway-access: "true"
- name: https
hostname: "{{ __rhoai_maas_hostname }}"
port: 443
protocol: HTTPS
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
maas.opendatahub.io/gateway-access: "true"
tls:
mode: Terminate
certificateRefs:
- group: ""
kind: Secret
name: "{{ rhoai_maas_gateway_cert_secret }}"
- name: Wait for MaaS Gateway to be programmed
kubernetes.core.k8s_info:
api_version: gateway.networking.k8s.io/v1
kind: Gateway
namespace: "{{ __rhoai_maas_gateway_namespace }}"
name: "{{ __rhoai_maas_gateway_name }}"
register: __rhoai_maas_gw
until: >-
(__rhoai_maas_gw.resources[0].status.conditions | default([])
| selectattr('type', 'equalto', 'Programmed') | selectattr('status', 'equalto', 'True') | list | length) > 0
retries: "{{ __rhoai_maas_wait_retries }}"
delay: 10
- name: Expose MaaS Gateway through the default router
kubernetes.core.k8s:
state: present
definition:
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: "{{ __rhoai_maas_gateway_name }}-https"
namespace: "{{ __rhoai_maas_gateway_namespace }}"
spec:
host: "{{ __rhoai_maas_hostname }}"
port:
targetPort: https
tls:
termination: passthrough
insecureEdgeTerminationPolicy: Redirect
to:
kind: Service
name: "{{ __rhoai_maas_gateway_service }}"
weight: 100
when: rhoai_maas_gateway_create_route | bool
# ------------------------------------------------------------------
# Kuadrant (Authorino + Limitador) and Authorino TLS
# ------------------------------------------------------------------
- name: Create kuadrant-system namespace
kubernetes.core.k8s:
state: present
definition:
apiVersion: v1
kind: Namespace
metadata:
name: kuadrant-system
- name: Create Kuadrant instance
kubernetes.core.k8s:
state: present
definition:
apiVersion: kuadrant.io/v1beta1
kind: Kuadrant
metadata:
name: kuadrant
namespace: kuadrant-system
spec:
observability:
enable: true
# The Kuadrant operator only detects the Gateway API provider (Istio) at startup.
# RHCL is installed before the GatewayClass provisions Istio, so on a fresh
# install Kuadrant reports MissingDependency until the operator pod restarts.
- name: Read Kuadrant status
kubernetes.core.k8s_info:
api_version: kuadrant.io/v1beta1
kind: Kuadrant
namespace: kuadrant-system
name: kuadrant
register: __rhoai_maas_kuadrant
until: >-
(__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
| selectattr('type', 'equalto', 'Ready') | list | length) > 0
retries: 12
delay: 5
failed_when: false
- name: Restart the Kuadrant operator to detect Istio
kubernetes.core.k8s:
state: absent
api_version: v1
kind: Pod
namespace: openshift-operators
label_selectors:
- app=kuadrant
- control-plane=controller-manager
when: >-
(__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
| selectattr('type', 'equalto', 'Ready') | map(attribute='reason') | first | default(''))
== 'MissingDependency'
- name: Wait for Kuadrant to be ready
kubernetes.core.k8s_info:
api_version: kuadrant.io/v1beta1
kind: Kuadrant
namespace: kuadrant-system
name: kuadrant
register: __rhoai_maas_kuadrant
until: >-
(__rhoai_maas_kuadrant.resources[0].status.conditions | default([])
| selectattr('type', 'equalto', 'Ready') | selectattr('status', 'equalto', 'True') | list | length) > 0
retries: "{{ __rhoai_maas_wait_retries }}"
delay: 10
- name: Wait for Authorino service
kubernetes.core.k8s_info:
api_version: v1
kind: Service
namespace: kuadrant-system
name: authorino-authorino-authorization
register: __rhoai_maas_authorino_svc
until: __rhoai_maas_authorino_svc.resources | length > 0
retries: "{{ __rhoai_maas_wait_retries }}"
delay: 10
- name: Request a service-ca serving certificate for Authorino
kubernetes.core.k8s:
state: patched
api_version: v1
kind: Service
namespace: kuadrant-system
name: authorino-authorino-authorization
definition:
metadata:
annotations:
service.beta.openshift.io/serving-cert-secret-name: authorino-server-cert
- name: Wait for Authorino serving certificate
kubernetes.core.k8s_info:
api_version: v1
kind: Secret
namespace: kuadrant-system
name: authorino-server-cert
register: __rhoai_maas_authorino_cert
until: __rhoai_maas_authorino_cert.resources | length > 0
retries: 30
delay: 10
no_log: true
- name: Enable Authorino TLS listener
kubernetes.core.k8s:
state: patched
api_version: operator.authorino.kuadrant.io/v1beta1
kind: Authorino
namespace: kuadrant-system
name: authorino
merge_type: merge
definition:
spec:
listener:
tls:
enabled: true
certSecretRef:
name: authorino-server-cert
- name: Read Authorino deployment
kubernetes.core.k8s_info:
api_version: apps/v1
kind: Deployment
namespace: kuadrant-system
name: authorino
register: __rhoai_maas_authorino_deploy
- name: Trust the service CA in Authorino
kubernetes.core.k8s:
state: patched
api_version: apps/v1
kind: Deployment
namespace: kuadrant-system
name: authorino
merge_type: strategic-merge
definition:
spec:
template:
spec:
containers:
- name: "{{ __rhoai_maas_authorino_deploy.resources[0].spec.template.spec.containers[0].name }}"
env:
- name: SSL_CERT_FILE
value: /etc/ssl/certs/openshift-service-ca/service-ca-bundle.crt
- name: REQUESTS_CA_BUNDLE
value: /etc/ssl/certs/openshift-service-ca/service-ca-bundle.crt