Skip to content

feat: add podantiaffinity and nodeaffinity#2079

Merged
ugiordan merged 1 commit into
opendatahub-io:mainfrom
zdtsw-forking:jira_23172
Jun 25, 2025
Merged

feat: add podantiaffinity and nodeaffinity#2079
ugiordan merged 1 commit into
opendatahub-io:mainfrom
zdtsw-forking:jira_23172

Conversation

@zdtsw

@zdtsw zdtsw commented Jun 24, 2025

Copy link
Copy Markdown
Member
  • operator pod must run on Linux node
  • preferrable operator pods with label name:opendatahub-operator should not run on the same node

Description

ref: https://issues.redhat.com/browse/RHOAIENG-28127

How Has This Been Tested?

Screenshot or short clip

Merge criteria

  • You have read the contributors guide.
  • Commit messages are meaningful - have a clear and concise summary and detailed explanation of what was changed and why.
  • Pull Request contains a description of the solution, a link to the JIRA issue, and to any dependent or related Pull Request.
  • Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
  • The developer has manually tested the changes and verified that the changes work

Summary by CodeRabbit

  • Refactor
    • Updated pod scheduling rules to ensure operator pods are scheduled only on Linux nodes and to prefer distributing pods across different nodes for improved reliability.

@coderabbitai

coderabbitai Bot commented Jun 24, 2025

Copy link
Copy Markdown
Contributor
## Walkthrough

Affinity and anti-affinity scheduling rules were added to the Open Data Hub operator's controller manager pod deployment specifications in both the ClusterServiceVersion manifest and the manager deployment YAML. These changes ensure pods are scheduled only on Linux nodes and prefer to run on separate nodes from other operator pods.

## Changes

| File(s)                                                                 | Change Summary                                                                                          |
|-------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| bundle/manifests/opendatahub-operator.clusterserviceversion.yaml,       | Added node affinity (Linux-only) and preferred pod anti-affinity (spread across nodes) to pod spec.     |
| config/manager/manager.yaml                                             | Enhanced pod spec with node affinity (Linux-only) and preferred pod anti-affinity (spread across nodes). |

## Suggested labels

`lgtm`

## Suggested reviewers

- pierDipi
- bartoszmajsak

## Poem

> 🐇  
> Pods now hop from node to node,  
> Preferring not to share their abode.  
> Only on Linux fields they graze,  
> Spreading wide in Kubernetes' maze.  
> With affinity rules, they leap anew—  
> Operator bunnies, strong and true!  
>

📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8050648 and ff5e124.

📒 Files selected for processing (2)
  • bundle/manifests/opendatahub-operator.clusterserviceversion.yaml (2 hunks)
  • config/manager/manager.yaml (1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
  • bundle/manifests/opendatahub-operator.clusterserviceversion.yaml
  • config/manager/manager.yaml

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@zdtsw zdtsw requested review from ugiordan and removed request for asanzgom and valdar June 24, 2025 11:48
@zdtsw

zdtsw commented Jun 24, 2025

Copy link
Copy Markdown
Member Author

cc @bdattoma who is not in this org

- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (2)
config/manager/manager.yaml (1)

30-49: Optional: add zone-level spreading for greater resilience
To further minimise blast radius on multi-zone clusters you could append a second preferredDuringSchedulingIgnoredDuringExecution entry that uses topologyKey: topology.kubernetes.io/zone. This keeps the rule soft while nudging the scheduler to spread replicas across zones when they exist.

bundle/manifests/opendatahub-operator.clusterserviceversion.yaml (1)

1301-1320: Minor consistency nit: align key ordering with kustomize manifest
Here the list item has podAffinityTerm before weight, whereas the kustomize file places weight first. Functionally identical, but keeping the ordering consistent across files reduces noise in future diffs.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 439ff3a and 8050648.

📒 Files selected for processing (2)
  • bundle/manifests/opendatahub-operator.clusterserviceversion.yaml (2 hunks)
  • config/manager/manager.yaml (1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
  • GitHub Check: Build/push catalog image
  • GitHub Check: Run tests and collect coverage
  • GitHub Check: golangci-lint
🔇 Additional comments (2)
config/manager/manager.yaml (1)

30-49: Affinity block correctly enforces Linux-only scheduling and soft anti-collocation
The node-affinity uses the canonical kubernetes.io/os=linux selector and the pod anti-affinity (weight 100) discourages multiple opendatahub-operator pods on the same node. YAML structure matches the Kubernetes schema.

bundle/manifests/opendatahub-operator.clusterserviceversion.yaml (1)

1301-1320: CSV manifest faithfully mirrors the new affinity rules – nice catch
Propagating the same node- and pod-affinity into the CSV ensures the OLM-managed deployment behaves exactly like the kustomize manifest.

@openshift-ci

openshift-ci Bot commented Jun 24, 2025

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ugiordan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@zdtsw zdtsw requested a review from lburgazzoli June 24, 2025 12:22
@codecov

codecov Bot commented Jun 24, 2025

Copy link
Copy Markdown

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 36.29%. Comparing base (439ff3a) to head (ff5e124).
Report is 33 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #2079   +/-   ##
=======================================
  Coverage   36.29%   36.29%           
=======================================
  Files          85       85           
  Lines        7754     7754           
=======================================
  Hits         2814     2814           
  Misses       4680     4680           
  Partials      260      260           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ugiordan ugiordan merged commit ab22f8f into opendatahub-io:main Jun 25, 2025
12 of 15 checks passed
@github-project-automation github-project-automation Bot moved this from Todo to Done in ODH Platform Planning Jun 25, 2025
ugiordan pushed a commit to ugiordan/opendatahub-operator that referenced this pull request Jun 27, 2025
- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

(cherry picked from commit ab22f8f)
ugiordan pushed a commit to ugiordan/opendatahub-operator that referenced this pull request Jun 27, 2025
- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

(cherry picked from commit ab22f8f)
ugiordan pushed a commit to ugiordan/opendatahub-operator that referenced this pull request Jun 28, 2025
- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

(cherry picked from commit ab22f8f)
openshift-merge-bot Bot pushed a commit that referenced this pull request Jul 3, 2025
* fix: CodeFlare Operator Probe Success 5m and 1h Burn Rate high has wrong triage URL (#2011)

* docs: update DESIGN.md document to capture reconciliation refactor (#1900)

* RHOAI-452 | feat: modified code to only use wait.ExponentialBackoffWithContext (#1960)

Co-authored-by: den-rgb <den02_m@yahoo.com>

* update: Cleanup Auth creation logic (#2005)

- remove admin_group pass from operator to dashboard
- create Auth CR only when it does not exist, otherwise do nothing

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* fix(main): import webhook package to resolve RegisterAllWebhooks for nowebhook builds (#2016)

- Import internal/webhook package in main.go
- Use webhook.RegisterAllWebhooks(mgr) to ensure correct function resolution
- Fixes unresolved reference error when building with the nowebhook tag

* (feat): Add FBC processor workflow (#1997)

* (feat): Add FBC processor workflow
- Add the process-fbc-fragment.yaml
 - Do some cleanup in update-version.sh
 - Change the catalog name operator.yaml -> catalog.yaml
 - Add an icon in the template.
 - Add platform for bundle and catalog build

* revert $NEW_VERSION

* minor improvements

* replace sed with perl(for compatibility)

* no cleanup of labels/annotations
remove bundle_meta_opts

* Add llama-stack-k8s-operator controller to ODH operator (#2007)

* Add llama-stack-k8s-operator controller to ODH operator
Signed-off-by: Christopher Sams <csams@redhat.com>

* update: llamastack

- revert manifests change

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* test: swtich to new branch with latest changes

- should update this before final PR merge

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* fix: CSV

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: set to official llama-stack operator repo

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Co-authored-by: Wen Zhou <wenzhou@redhat.com>

* update: add workbenchNamespace into DSC and Workbnech status (#2033)

- in DSC: .status.components.workbenches.workbenchNamespace
- in Workbench: .status.workbenchNamespace

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* Update version to 2.30.0 (#2030)

Co-authored-by: AjayJagan <36824134+AjayJagan@users.noreply.github.com>

* chore: add unit test for HasCRD and HasCRDWithVersion (#2035)

* Update: add check in Kserve before create resources (#2045)

* Update: add check in Kserve before create resources

- extra check in preConditions: if DSIC does not have servicmesh condition ready
  do not create resources knative-serving need istio-proxy injected that requires
  smcp ready

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: use function IsStatusConditionPresentAndEqual()

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: move check on DSCI.status.condition after check of operators

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: use IsStatusConditionTrue directly

- cover both False and Unknown
- add observedgeneration

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* feat: add GH action for running integration tests - image building part (#2046)

* (feat): Rework release automation to support new konflux changes (#2036)

* (feat): Rework release automation to support new konflux changes

* make changes based on comments

* remove composite action and use the same logic in release-staging

* use an action for branch creation

* Update: add predicate on DSCI.status.condition.CapabilityServiceMeshchange (#2047)

* Update: add predicate on DSCI.status.condition.CapabilityServiceMesh change

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* test: run in parallel

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* RHOAIENG-26152-knative-enable-podspec-schedulername by default (#2044)

Signed-off-by: Andres Llausas <allausas@redhat.com>

* chore: change integration tests trigger action to use pull_request_target with PR author verification (#2065)

* RHOAIENG-26313-enable-multi-container-probing (#2061)

Signed-off-by: Andres Llausas <allausas@redhat.com>

* RHOAIENG-26410: Set controller deployment replicas to 3 for webhook HA (#2066)

RHOAIENG-26410: Update e2e test to expect 3 replicas for controller deployment

* chore: improve security of integration tests trigger action (#2070)

* feat: enable rendering cache by default (#2067)

The rendering cache has been running for a while now without any issue,
in order make the code simpler, the rendering cache is now enabled by
default.

Caching can be turned off by using:
- kustomize.WithCache(false)
- template.WithCache(false)

Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com>

* feat: add podantiaffinity and nodeaffinity (#2079)

- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* disable temporaty the custom catalog gh action (#2081)

* Implement Auth validating webhook to reject invalid groups (#2085)

* feat: add validating webhook for Auth resources to block invalid groups (RHOAIENG-21972)

Add validating webhook to prevent invalid AdminGroups and AllowedGroups:
- Block 'system:authenticated' and empty string values
- Add comprehensive unit and integration tests
- Fix decoder injection issue in webhook setup
- Update webhook manifests for registration

All tests passing: 9 unit tests + 8 integration tests

# Conflicts:
#	bundle/manifests/opendatahub-operator.clusterserviceversion.yaml

* feat: add E2E webhook validation framework for Auth resources

- Add EnsureWebhookBlocksResourceUpdate function to test webhook validation
- Implement ValidateWebhookBlocksInvalidGroups test for Auth resource validation
- Add webhook validation test cases for AdminGroups and AllowedGroups
- Extend E2E test framework to support admission webhook testing

* Add a management option for Argo Workflows (#2064)

This will allow the user to opt out of Argo Workflows being managed by
the DSP operator to enable BYO Argo Workflows.

Relates:
https://issues.redhat.com/browse/RHOAIENG-25499

Signed-off-by: mprahl <mprahl@users.noreply.github.com>

* deploy monitoringstack if metrics stanza in monitoring CR (#2014)

* deploy monitoringstack if metrics stanza in monitoring CR

* get namespace from monitoirng CR so we dont need the DSCI

* (fix): Remove cleanup in release automation (#2120)

* update: env variable name pass from build for lls-o (#2115)

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* enable back the gha to build the bundle (#2125)

* feat: move HardwareProfile CRD to odh-operator

# Conflicts:
#	bundle/manifests/opendatahub-operator.clusterserviceversion.yaml
#	config/crd/kustomization.yaml
#	internal/controller/datasciencecluster/kubebuilder_rbac.go

* feat: added localQueueName to HardwareProfile

* feat: added integration test for HardwareProfile

* feat: Relocate kueue manifests to odh-operator

https://issues.redhat.com/browse/RHOAIENG-24289

This applies the configs we expect to be necessary on top of the
external kueue manifests, maintained in config/kueue-configs.

This also changes the way that the batch-user label is applied, since it
will not be managed by the odh-operator when the user installs the kueue
operator outside of odh-operator.

An additional watch on ClusterRole monitors the clusterqueue-viewer-role
since it is externally managed, triggering a reconcile of the
default-kueue if the ClusterRole changes, so that we can keep the
necessary labels appropriately set.

Adds some tests for the new batch-user label management logic.

* fix: Patch proper role name in batch-user-rolebinding

* fix: Add kueue prefix to clusterqueue-viewer-role

* fix: Address review feedback

* chore: Manage symlinks in get_all_manifests.sh instead of Makefile

* chore: Change kueue branch to kueue-migration

* fix: remove legacy extra manifests path

* fix: remove legacy extra manifests path

* feat: add priorityClass field to HardwareProfile CRD

* fix: removed unneeded fields from HardwareProfile

* RHOAIENG-25258: Implement Validating Webhook for Kueue label Enforcement (#1998)

1. Ensures the Kueue component is installed.
2. Verifies the namespace has the label "kueue.openshift.io/managed=true".
3. Validates that the workload has the "kueue.x-k8s.io/queue-name" label set.

Added two new edge case to ensure label validation
1. When the workload has a valid queue label but the namespace isn't labeled — validation fails
2. When the namespace and workload object(Job, etc..) is labeled but Kueue isn't installed — validation fails.

Uncached client change using "mgr.GetAPIReader()"

Signed-off-by: Gowtham Shanmugasundaram <gshanmug@redhat.com>

* RHOAIENG-25252: [ODH Operator] Support "Unmanaged" Kueue in OpenShift AI (#2062)

* Fix symlink problem in docker image generation.

* Refactored helper test function UpdateComponentStateInDataScienceCluster signature for better clarity

* Refactored tests helper functions to accomodate consistently.
Moved CRD mock creation function to test utilities from e2e tests.

* RHOAIENG-25252: Support "Unmanaged" Kueue in OpenShift AI
Add Unmanaged state to kueue component
Managed state check for ocp kueue operator to not be installed
Unmanaged state check for ocp kueue operator to be installed
Transition to unmanaged removes everything but rhoai specific bits

* Add IsEnabled to ComponentHandler to support additional management state values

* Add basic unit tests for component handlers

* Fix kueue e2e tests

* update: update bundle with new CRD fields

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Co-authored-by: Luca Burgazzoli <lburgazzoli@gmail.com>
Co-authored-by: Wen Zhou <wenzhou@redhat.com>

* Add llama-stack-k8s-operator controller to ODH operator (#2007) (#2086)

* Add llama-stack-k8s-operator controller to ODH operator (#2007)

* Add llama-stack-k8s-operator controller to ODH operator
Signed-off-by: Christopher Sams <csams@redhat.com>

* update: llamastack

- revert manifests change

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* test: swtich to new branch with latest changes

- should update this before final PR merge

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* fix: CSV

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: set to official llama-stack operator repo

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Co-authored-by: Wen Zhou <wenzhou@redhat.com>

* Fix llama stack operator controller handler

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Co-authored-by: Chris Sams <csams@users.noreply.github.com>
Co-authored-by: Wen Zhou <wenzhou@redhat.com>

* feat: Implement dynamic kueue admin role binding based on Auth CR (#2096)

- Move kueue admin role binding logic from auth controller to kueue controller
- Create dynamic ClusterRoleBinding that syncs with Auth CR admin groups
- Remove static binding_admin_roles.yaml configuration
- Add Auth CR watch to kueue controller for reactive updates
- Filter out invalid groups (system:authenticated and empty strings)
- Ensure proper architectural separation where each component manages its own RBAC

Resolves: RHOAIENG-26336

* Remove unused template code from kueue admin role binding (#2100)

- Remove template registration in initialize() function
- Remove unused KueueAdminRoleBindingTemplate constant
- Remove unused kueue-admin-rolebinding.tmpl.yaml template file
- Remove embed directive and resourcesFS variable

The template approach was unnecessary since we create the ClusterRoleBinding
programmatically in the manageKueueAdminRoleBinding function using Go structs.
This makes the code cleaner and more consistent.

* Cherry-pick: Auth validating webhook, PodAntiAffinity, and NodeAffinity support (#2099)

* Cherrypick  45943e4 a290515 (#2122)

* Add a management option for Argo Workflows (#2064)

This will allow the user to opt out of Argo Workflows being managed by
the DSP operator to enable BYO Argo Workflows.

Relates:
https://issues.redhat.com/browse/RHOAIENG-25499

Signed-off-by: mprahl <mprahl@users.noreply.github.com>
(cherry picked from commit 45943e4)

* deploy monitoringstack if metrics stanza in monitoring CR (#2014)

* deploy monitoringstack if metrics stanza in monitoring CR

* get namespace from monitoirng CR so we dont need the DSCI

(cherry picked from commit a290515)

* Fix tests

---------

Signed-off-by: mprahl <mprahl@users.noreply.github.com>
Co-authored-by: Matt Prahl <mprahl@users.noreply.github.com>
Co-authored-by: Steven Tobin <stobin@redhat.com>

* Cherrypick 763d0a6 cfd6643 (#2126)

* (feat): Add FBC processor workflow (#1997)

* (feat): Add FBC processor workflow
- Add the process-fbc-fragment.yaml
 - Do some cleanup in update-version.sh
 - Change the catalog name operator.yaml -> catalog.yaml
 - Add an icon in the template.
 - Add platform for bundle and catalog build

* revert $NEW_VERSION

* minor improvements

* replace sed with perl(for compatibility)

* no cleanup of labels/annotations
remove bundle_meta_opts

(cherry picked from commit 763d0a6)

* Update version to 2.30.0 (#2030)

Co-authored-by: AjayJagan <36824134+AjayJagan@users.noreply.github.com>
(cherry picked from commit cfd6643)

---------

Co-authored-by: Ajay Jaganathan <36824134+AjayJagan@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* Remove VAP manifests from Kueue configuration (#2113)

* Remove Validation Admission Policy (VAP) manifests and related code
from Kueue configuration since VAP functionality is now handled by
a dedicated webhook implementation. Add cleanup for deprecated
ValidatingAdmissionPolicyBinding resources during upgrades.

Changes:
- Remove entire config/kueue-configs/ocp-4.17-addons directory containing:
  * validating_admission_policy.yaml
  * validating_admission_policy_binding.yaml
  * kustomization.yaml
- Remove VAP ownership and watching from kueue controller
- Remove customizeResources function (was only handling VAPB)
- Remove VAP GVK definitions from pkg/cluster/gvk/gvk.go
- Remove VAP RBAC permissions from:
  * internal/controller/datasciencecluster/kubebuilder_rbac.go
  * config/rbac/role.yaml
  * bundle/manifests/opendatahub-operator.clusterserviceversion.yaml
- Remove ValidateKueueVAPReady test function and related test case
- Fix typo: ValidateKueueUnmanagedWhitoutOcpKueueOperator → ValidateKueueUnmanagedWithoutOcpKueueOperator
- Add cleanupDeprecatedKueueVAPB function in upgrade package to remove orphaned ValidatingAdmissionPolicyBinding
- Integrate cleanup into CleanupExistingResource for automatic execution during upgrades
- Add comprehensive tests for the cleanup functionality in pkg/upgrade/upgrade_test.go

* Remove empty ocp-4.17-addons directory and unused code

Following VAP manifest removal, clean up remaining empty directory
and unused functions that were only serving the removed VAP resources.

Changes:
- Remove empty config/kueue-configs/ocp-4.17-addons/ directory
- Remove kueueConfigExtraManifestsPath() function
- Remove extraInitialize() function and its reference
- Remove empty OCP 4.17 version check block
- Remove unused getClusterVersion() function from e2e tests
- Clean up unused imports (semver, cluster)

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Signed-off-by: Andres Llausas <allausas@redhat.com>
Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com>
Signed-off-by: mprahl <mprahl@users.noreply.github.com>
Signed-off-by: Gowtham Shanmugasundaram <gshanmug@redhat.com>
Co-authored-by: Marián Macik <macik.marian@gmail.com>
Co-authored-by: Marek Laššák <73712209+mlassak@users.noreply.github.com>
Co-authored-by: Denis Moskalenko <59964862+den-rgb@users.noreply.github.com>
Co-authored-by: den-rgb <den02_m@yahoo.com>
Co-authored-by: Wen Zhou <wenzhou@redhat.com>
Co-authored-by: Ugo Giordano <ugiordan@redhat.com>
Co-authored-by: Ajay Jaganathan <36824134+AjayJagan@users.noreply.github.com>
Co-authored-by: Chris Sams <csams@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Luca Burgazzoli <lburgazzoli@users.noreply.github.com>
Co-authored-by: Andres Llausas <allausas@redhat.com>
Co-authored-by: Matt Prahl <mprahl@users.noreply.github.com>
Co-authored-by: Steven Tobin <stobin@redhat.com>
Co-authored-by: Carl Kyrillos <ckyrillo@redhat.com>
Co-authored-by: Kevin Howell <khowell@redhat.com>
Co-authored-by: Luca Burgazzoli <lburgazzoli@gmail.com>
Co-authored-by: Gowtham Shanmugasundaram <gshanmug@redhat.com>
Co-authored-by: Andrea Tarocchi <andrea.tarocchi@gmail.com>
openshift-merge-bot Bot pushed a commit that referenced this pull request Jul 7, 2025
* fix: CodeFlare Operator Probe Success 5m and 1h Burn Rate high has wrong triage URL (#2011)

* docs: update DESIGN.md document to capture reconciliation refactor (#1900)

* RHOAI-452 | feat: modified code to only use wait.ExponentialBackoffWithContext (#1960)

Co-authored-by: den-rgb <den02_m@yahoo.com>

* update: Cleanup Auth creation logic (#2005)

- remove admin_group pass from operator to dashboard
- create Auth CR only when it does not exist, otherwise do nothing

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* fix(main): import webhook package to resolve RegisterAllWebhooks for nowebhook builds (#2016)

- Import internal/webhook package in main.go
- Use webhook.RegisterAllWebhooks(mgr) to ensure correct function resolution
- Fixes unresolved reference error when building with the nowebhook tag

* (feat): Add FBC processor workflow (#1997)

* (feat): Add FBC processor workflow
- Add the process-fbc-fragment.yaml
 - Do some cleanup in update-version.sh
 - Change the catalog name operator.yaml -> catalog.yaml
 - Add an icon in the template.
 - Add platform for bundle and catalog build

* revert $NEW_VERSION

* minor improvements

* replace sed with perl(for compatibility)

* no cleanup of labels/annotations
remove bundle_meta_opts

* Add llama-stack-k8s-operator controller to ODH operator (#2007)

* Add llama-stack-k8s-operator controller to ODH operator
Signed-off-by: Christopher Sams <csams@redhat.com>

* update: llamastack

- revert manifests change

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* test: swtich to new branch with latest changes

- should update this before final PR merge

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* fix: CSV

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: set to official llama-stack operator repo

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Co-authored-by: Wen Zhou <wenzhou@redhat.com>

* update: add workbenchNamespace into DSC and Workbnech status (#2033)

- in DSC: .status.components.workbenches.workbenchNamespace
- in Workbench: .status.workbenchNamespace

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* Update version to 2.30.0 (#2030)

Co-authored-by: AjayJagan <36824134+AjayJagan@users.noreply.github.com>

* chore: add unit test for HasCRD and HasCRDWithVersion (#2035)

* Update: add check in Kserve before create resources (#2045)

* Update: add check in Kserve before create resources

- extra check in preConditions: if DSIC does not have servicmesh condition ready
  do not create resources knative-serving need istio-proxy injected that requires
  smcp ready

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: use function IsStatusConditionPresentAndEqual()

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: move check on DSCI.status.condition after check of operators

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* update: use IsStatusConditionTrue directly

- cover both False and Unknown
- add observedgeneration

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* feat: add GH action for running integration tests - image building part (#2046)

* (feat): Rework release automation to support new konflux changes (#2036)

* (feat): Rework release automation to support new konflux changes

* make changes based on comments

* remove composite action and use the same logic in release-staging

* use an action for branch creation

* Update: add predicate on DSCI.status.condition.CapabilityServiceMeshchange (#2047)

* Update: add predicate on DSCI.status.condition.CapabilityServiceMesh change

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* test: run in parallel

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* RHOAIENG-26152-knative-enable-podspec-schedulername by default (#2044)

Signed-off-by: Andres Llausas <allausas@redhat.com>

* chore: change integration tests trigger action to use pull_request_target with PR author verification (#2065)

* RHOAIENG-26313-enable-multi-container-probing (#2061)

Signed-off-by: Andres Llausas <allausas@redhat.com>

* RHOAIENG-26410: Set controller deployment replicas to 3 for webhook HA (#2066)

RHOAIENG-26410: Update e2e test to expect 3 replicas for controller deployment

* chore: improve security of integration tests trigger action (#2070)

* feat: enable rendering cache by default (#2067)

The rendering cache has been running for a while now without any issue,
in order make the code simpler, the rendering cache is now enabled by
default.

Caching can be turned off by using:
- kustomize.WithCache(false)
- template.WithCache(false)

Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com>

* feat: add podantiaffinity and nodeaffinity (#2079)

- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* disable temporaty the custom catalog gh action (#2081)

* Implement Auth validating webhook to reject invalid groups (#2085)

* feat: add validating webhook for Auth resources to block invalid groups (RHOAIENG-21972)

Add validating webhook to prevent invalid AdminGroups and AllowedGroups:
- Block 'system:authenticated' and empty string values
- Add comprehensive unit and integration tests
- Fix decoder injection issue in webhook setup
- Update webhook manifests for registration

All tests passing: 9 unit tests + 8 integration tests

# Conflicts:
#	bundle/manifests/opendatahub-operator.clusterserviceversion.yaml

* feat: add E2E webhook validation framework for Auth resources

- Add EnsureWebhookBlocksResourceUpdate function to test webhook validation
- Implement ValidateWebhookBlocksInvalidGroups test for Auth resource validation
- Add webhook validation test cases for AdminGroups and AllowedGroups
- Extend E2E test framework to support admission webhook testing

* Add a management option for Argo Workflows (#2064)

This will allow the user to opt out of Argo Workflows being managed by
the DSP operator to enable BYO Argo Workflows.

Relates:
https://issues.redhat.com/browse/RHOAIENG-25499

Signed-off-by: mprahl <mprahl@users.noreply.github.com>

* deploy monitoringstack if metrics stanza in monitoring CR (#2014)

* deploy monitoringstack if metrics stanza in monitoring CR

* get namespace from monitoirng CR so we dont need the DSCI

* (fix): Remove cleanup in release automation (#2120)

* update: env variable name pass from build for lls-o (#2115)

Signed-off-by: Wen Zhou <wenzhou@redhat.com>

* enable back the gha to build the bundle (#2125)

---------

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Signed-off-by: Andres Llausas <allausas@redhat.com>
Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com>
Signed-off-by: mprahl <mprahl@users.noreply.github.com>
Co-authored-by: Marián Macik <macik.marian@gmail.com>
Co-authored-by: Marek Laššák <73712209+mlassak@users.noreply.github.com>
Co-authored-by: Denis Moskalenko <59964862+den-rgb@users.noreply.github.com>
Co-authored-by: den-rgb <den02_m@yahoo.com>
Co-authored-by: Wen Zhou <wenzhou@redhat.com>
Co-authored-by: Ugo Giordano <ugiordan@redhat.com>
Co-authored-by: Ajay Jaganathan <36824134+AjayJagan@users.noreply.github.com>
Co-authored-by: Chris Sams <csams@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Luca Burgazzoli <lburgazzoli@users.noreply.github.com>
Co-authored-by: Andres Llausas <allausas@redhat.com>
Co-authored-by: Matt Prahl <mprahl@users.noreply.github.com>
Co-authored-by: Steven Tobin <stobin@redhat.com>
@zdtsw

zdtsw commented Jul 21, 2025

Copy link
Copy Markdown
Member Author

/cherry-pick rhoai

@openshift-cherrypick-robot

Copy link
Copy Markdown

@zdtsw: #2079 failed to apply on top of branch "rhoai":

Applying: feat: add podantiaffinity and nodeaffinity
Using index info to reconstruct a base tree...
A	bundle/manifests/opendatahub-operator.clusterserviceversion.yaml
M	config/manager/manager.yaml
Falling back to patching base and 3-way merge...
Auto-merging config/manager/manager.yaml
Auto-merging bundle/manifests/rhods-operator.clusterserviceversion.yaml
CONFLICT (content): Merge conflict in bundle/manifests/rhods-operator.clusterserviceversion.yaml
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 feat: add podantiaffinity and nodeaffinity

Details

In response to this:

/cherry-pick rhoai

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

zdtsw added a commit to zdtsw-forking/opendatahub-operator that referenced this pull request Jul 22, 2025
- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
(cherry picked from commit ab22f8f)
Signed-off-by: Wen Zhou <wenzhou@redhat.com>
zdtsw added a commit to zdtsw-forking/opendatahub-operator that referenced this pull request Jul 22, 2025
- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
(cherry picked from commit ab22f8f)
Signed-off-by: Wen Zhou <wenzhou@redhat.com>
zdtsw added a commit to zdtsw-forking/opendatahub-operator that referenced this pull request Jul 25, 2025
- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
(cherry picked from commit ab22f8f)
Signed-off-by: Wen Zhou <wenzhou@redhat.com>
zdtsw added a commit that referenced this pull request Jul 29, 2025
- operator pod must run on Linux node
- preferrable operator pods with label name:opendatahub-operator should not run on the same node


(cherry picked from commit ab22f8f)

Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants