feat: add podantiaffinity and nodeaffinity#2079
Conversation
## Walkthrough
Affinity and anti-affinity scheduling rules were added to the Open Data Hub operator's controller manager pod deployment specifications in both the ClusterServiceVersion manifest and the manager deployment YAML. These changes ensure pods are scheduled only on Linux nodes and prefer to run on separate nodes from other operator pods.
## Changes
| File(s) | Change Summary |
|-------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
| bundle/manifests/opendatahub-operator.clusterserviceversion.yaml, | Added node affinity (Linux-only) and preferred pod anti-affinity (spread across nodes) to pod spec. |
| config/manager/manager.yaml | Enhanced pod spec with node affinity (Linux-only) and preferred pod anti-affinity (spread across nodes). |
## Suggested labels
`lgtm`
## Suggested reviewers
- pierDipi
- bartoszmajsak
## Poem
> 🐇
> Pods now hop from node to node,
> Preferring not to share their abode.
> Only on Linux fields they graze,
> Spreading wide in Kubernetes' maze.
> With affinity rules, they leap anew—
> Operator bunnies, strong and true!
>📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
cc @bdattoma who is not in this org |
- operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
config/manager/manager.yaml (1)
30-49: Optional: add zone-level spreading for greater resilience
To further minimise blast radius on multi-zone clusters you could append a secondpreferredDuringSchedulingIgnoredDuringExecutionentry that usestopologyKey: topology.kubernetes.io/zone. This keeps the rule soft while nudging the scheduler to spread replicas across zones when they exist.bundle/manifests/opendatahub-operator.clusterserviceversion.yaml (1)
1301-1320: Minor consistency nit: align key ordering with kustomize manifest
Here the list item haspodAffinityTermbeforeweight, whereas the kustomize file placesweightfirst. Functionally identical, but keeping the ordering consistent across files reduces noise in future diffs.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
bundle/manifests/opendatahub-operator.clusterserviceversion.yaml(2 hunks)config/manager/manager.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: Build/push catalog image
- GitHub Check: Run tests and collect coverage
- GitHub Check: golangci-lint
🔇 Additional comments (2)
config/manager/manager.yaml (1)
30-49: Affinity block correctly enforces Linux-only scheduling and soft anti-collocation
The node-affinity uses the canonicalkubernetes.io/os=linuxselector and the pod anti-affinity (weight 100) discourages multipleopendatahub-operatorpods on the same node. YAML structure matches the Kubernetes schema.bundle/manifests/opendatahub-operator.clusterserviceversion.yaml (1)
1301-1320: CSV manifest faithfully mirrors the new affinity rules – nice catch
Propagating the same node- and pod-affinity into the CSV ensures the OLM-managed deployment behaves exactly like the kustomize manifest.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ugiordan The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2079 +/- ##
=======================================
Coverage 36.29% 36.29%
=======================================
Files 85 85
Lines 7754 7754
=======================================
Hits 2814 2814
Misses 4680 4680
Partials 260 260 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
- operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> (cherry picked from commit ab22f8f)
- operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> (cherry picked from commit ab22f8f)
- operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> (cherry picked from commit ab22f8f)
* fix: CodeFlare Operator Probe Success 5m and 1h Burn Rate high has wrong triage URL (#2011) * docs: update DESIGN.md document to capture reconciliation refactor (#1900) * RHOAI-452 | feat: modified code to only use wait.ExponentialBackoffWithContext (#1960) Co-authored-by: den-rgb <den02_m@yahoo.com> * update: Cleanup Auth creation logic (#2005) - remove admin_group pass from operator to dashboard - create Auth CR only when it does not exist, otherwise do nothing Signed-off-by: Wen Zhou <wenzhou@redhat.com> * fix(main): import webhook package to resolve RegisterAllWebhooks for nowebhook builds (#2016) - Import internal/webhook package in main.go - Use webhook.RegisterAllWebhooks(mgr) to ensure correct function resolution - Fixes unresolved reference error when building with the nowebhook tag * (feat): Add FBC processor workflow (#1997) * (feat): Add FBC processor workflow - Add the process-fbc-fragment.yaml - Do some cleanup in update-version.sh - Change the catalog name operator.yaml -> catalog.yaml - Add an icon in the template. - Add platform for bundle and catalog build * revert $NEW_VERSION * minor improvements * replace sed with perl(for compatibility) * no cleanup of labels/annotations remove bundle_meta_opts * Add llama-stack-k8s-operator controller to ODH operator (#2007) * Add llama-stack-k8s-operator controller to ODH operator Signed-off-by: Christopher Sams <csams@redhat.com> * update: llamastack - revert manifests change Signed-off-by: Wen Zhou <wenzhou@redhat.com> * test: swtich to new branch with latest changes - should update this before final PR merge Signed-off-by: Wen Zhou <wenzhou@redhat.com> * fix: CSV Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: set to official llama-stack operator repo Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: Wen Zhou <wenzhou@redhat.com> * update: add workbenchNamespace into DSC and Workbnech status (#2033) - in DSC: .status.components.workbenches.workbenchNamespace - in Workbench: .status.workbenchNamespace Signed-off-by: Wen Zhou <wenzhou@redhat.com> * Update version to 2.30.0 (#2030) Co-authored-by: AjayJagan <36824134+AjayJagan@users.noreply.github.com> * chore: add unit test for HasCRD and HasCRDWithVersion (#2035) * Update: add check in Kserve before create resources (#2045) * Update: add check in Kserve before create resources - extra check in preConditions: if DSIC does not have servicmesh condition ready do not create resources knative-serving need istio-proxy injected that requires smcp ready Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: use function IsStatusConditionPresentAndEqual() Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: move check on DSCI.status.condition after check of operators Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: use IsStatusConditionTrue directly - cover both False and Unknown - add observedgeneration Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> * feat: add GH action for running integration tests - image building part (#2046) * (feat): Rework release automation to support new konflux changes (#2036) * (feat): Rework release automation to support new konflux changes * make changes based on comments * remove composite action and use the same logic in release-staging * use an action for branch creation * Update: add predicate on DSCI.status.condition.CapabilityServiceMeshchange (#2047) * Update: add predicate on DSCI.status.condition.CapabilityServiceMesh change Signed-off-by: Wen Zhou <wenzhou@redhat.com> * test: run in parallel Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> * RHOAIENG-26152-knative-enable-podspec-schedulername by default (#2044) Signed-off-by: Andres Llausas <allausas@redhat.com> * chore: change integration tests trigger action to use pull_request_target with PR author verification (#2065) * RHOAIENG-26313-enable-multi-container-probing (#2061) Signed-off-by: Andres Llausas <allausas@redhat.com> * RHOAIENG-26410: Set controller deployment replicas to 3 for webhook HA (#2066) RHOAIENG-26410: Update e2e test to expect 3 replicas for controller deployment * chore: improve security of integration tests trigger action (#2070) * feat: enable rendering cache by default (#2067) The rendering cache has been running for a while now without any issue, in order make the code simpler, the rendering cache is now enabled by default. Caching can be turned off by using: - kustomize.WithCache(false) - template.WithCache(false) Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com> * feat: add podantiaffinity and nodeaffinity (#2079) - operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> * disable temporaty the custom catalog gh action (#2081) * Implement Auth validating webhook to reject invalid groups (#2085) * feat: add validating webhook for Auth resources to block invalid groups (RHOAIENG-21972) Add validating webhook to prevent invalid AdminGroups and AllowedGroups: - Block 'system:authenticated' and empty string values - Add comprehensive unit and integration tests - Fix decoder injection issue in webhook setup - Update webhook manifests for registration All tests passing: 9 unit tests + 8 integration tests # Conflicts: # bundle/manifests/opendatahub-operator.clusterserviceversion.yaml * feat: add E2E webhook validation framework for Auth resources - Add EnsureWebhookBlocksResourceUpdate function to test webhook validation - Implement ValidateWebhookBlocksInvalidGroups test for Auth resource validation - Add webhook validation test cases for AdminGroups and AllowedGroups - Extend E2E test framework to support admission webhook testing * Add a management option for Argo Workflows (#2064) This will allow the user to opt out of Argo Workflows being managed by the DSP operator to enable BYO Argo Workflows. Relates: https://issues.redhat.com/browse/RHOAIENG-25499 Signed-off-by: mprahl <mprahl@users.noreply.github.com> * deploy monitoringstack if metrics stanza in monitoring CR (#2014) * deploy monitoringstack if metrics stanza in monitoring CR * get namespace from monitoirng CR so we dont need the DSCI * (fix): Remove cleanup in release automation (#2120) * update: env variable name pass from build for lls-o (#2115) Signed-off-by: Wen Zhou <wenzhou@redhat.com> * enable back the gha to build the bundle (#2125) * feat: move HardwareProfile CRD to odh-operator # Conflicts: # bundle/manifests/opendatahub-operator.clusterserviceversion.yaml # config/crd/kustomization.yaml # internal/controller/datasciencecluster/kubebuilder_rbac.go * feat: added localQueueName to HardwareProfile * feat: added integration test for HardwareProfile * feat: Relocate kueue manifests to odh-operator https://issues.redhat.com/browse/RHOAIENG-24289 This applies the configs we expect to be necessary on top of the external kueue manifests, maintained in config/kueue-configs. This also changes the way that the batch-user label is applied, since it will not be managed by the odh-operator when the user installs the kueue operator outside of odh-operator. An additional watch on ClusterRole monitors the clusterqueue-viewer-role since it is externally managed, triggering a reconcile of the default-kueue if the ClusterRole changes, so that we can keep the necessary labels appropriately set. Adds some tests for the new batch-user label management logic. * fix: Patch proper role name in batch-user-rolebinding * fix: Add kueue prefix to clusterqueue-viewer-role * fix: Address review feedback * chore: Manage symlinks in get_all_manifests.sh instead of Makefile * chore: Change kueue branch to kueue-migration * fix: remove legacy extra manifests path * fix: remove legacy extra manifests path * feat: add priorityClass field to HardwareProfile CRD * fix: removed unneeded fields from HardwareProfile * RHOAIENG-25258: Implement Validating Webhook for Kueue label Enforcement (#1998) 1. Ensures the Kueue component is installed. 2. Verifies the namespace has the label "kueue.openshift.io/managed=true". 3. Validates that the workload has the "kueue.x-k8s.io/queue-name" label set. Added two new edge case to ensure label validation 1. When the workload has a valid queue label but the namespace isn't labeled — validation fails 2. When the namespace and workload object(Job, etc..) is labeled but Kueue isn't installed — validation fails. Uncached client change using "mgr.GetAPIReader()" Signed-off-by: Gowtham Shanmugasundaram <gshanmug@redhat.com> * RHOAIENG-25252: [ODH Operator] Support "Unmanaged" Kueue in OpenShift AI (#2062) * Fix symlink problem in docker image generation. * Refactored helper test function UpdateComponentStateInDataScienceCluster signature for better clarity * Refactored tests helper functions to accomodate consistently. Moved CRD mock creation function to test utilities from e2e tests. * RHOAIENG-25252: Support "Unmanaged" Kueue in OpenShift AI Add Unmanaged state to kueue component Managed state check for ocp kueue operator to not be installed Unmanaged state check for ocp kueue operator to be installed Transition to unmanaged removes everything but rhoai specific bits * Add IsEnabled to ComponentHandler to support additional management state values * Add basic unit tests for component handlers * Fix kueue e2e tests * update: update bundle with new CRD fields Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: Luca Burgazzoli <lburgazzoli@gmail.com> Co-authored-by: Wen Zhou <wenzhou@redhat.com> * Add llama-stack-k8s-operator controller to ODH operator (#2007) (#2086) * Add llama-stack-k8s-operator controller to ODH operator (#2007) * Add llama-stack-k8s-operator controller to ODH operator Signed-off-by: Christopher Sams <csams@redhat.com> * update: llamastack - revert manifests change Signed-off-by: Wen Zhou <wenzhou@redhat.com> * test: swtich to new branch with latest changes - should update this before final PR merge Signed-off-by: Wen Zhou <wenzhou@redhat.com> * fix: CSV Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: set to official llama-stack operator repo Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: Wen Zhou <wenzhou@redhat.com> * Fix llama stack operator controller handler --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: Chris Sams <csams@users.noreply.github.com> Co-authored-by: Wen Zhou <wenzhou@redhat.com> * feat: Implement dynamic kueue admin role binding based on Auth CR (#2096) - Move kueue admin role binding logic from auth controller to kueue controller - Create dynamic ClusterRoleBinding that syncs with Auth CR admin groups - Remove static binding_admin_roles.yaml configuration - Add Auth CR watch to kueue controller for reactive updates - Filter out invalid groups (system:authenticated and empty strings) - Ensure proper architectural separation where each component manages its own RBAC Resolves: RHOAIENG-26336 * Remove unused template code from kueue admin role binding (#2100) - Remove template registration in initialize() function - Remove unused KueueAdminRoleBindingTemplate constant - Remove unused kueue-admin-rolebinding.tmpl.yaml template file - Remove embed directive and resourcesFS variable The template approach was unnecessary since we create the ClusterRoleBinding programmatically in the manageKueueAdminRoleBinding function using Go structs. This makes the code cleaner and more consistent. * Cherry-pick: Auth validating webhook, PodAntiAffinity, and NodeAffinity support (#2099) * Cherrypick 45943e4 a290515 (#2122) * Add a management option for Argo Workflows (#2064) This will allow the user to opt out of Argo Workflows being managed by the DSP operator to enable BYO Argo Workflows. Relates: https://issues.redhat.com/browse/RHOAIENG-25499 Signed-off-by: mprahl <mprahl@users.noreply.github.com> (cherry picked from commit 45943e4) * deploy monitoringstack if metrics stanza in monitoring CR (#2014) * deploy monitoringstack if metrics stanza in monitoring CR * get namespace from monitoirng CR so we dont need the DSCI (cherry picked from commit a290515) * Fix tests --------- Signed-off-by: mprahl <mprahl@users.noreply.github.com> Co-authored-by: Matt Prahl <mprahl@users.noreply.github.com> Co-authored-by: Steven Tobin <stobin@redhat.com> * Cherrypick 763d0a6 cfd6643 (#2126) * (feat): Add FBC processor workflow (#1997) * (feat): Add FBC processor workflow - Add the process-fbc-fragment.yaml - Do some cleanup in update-version.sh - Change the catalog name operator.yaml -> catalog.yaml - Add an icon in the template. - Add platform for bundle and catalog build * revert $NEW_VERSION * minor improvements * replace sed with perl(for compatibility) * no cleanup of labels/annotations remove bundle_meta_opts (cherry picked from commit 763d0a6) * Update version to 2.30.0 (#2030) Co-authored-by: AjayJagan <36824134+AjayJagan@users.noreply.github.com> (cherry picked from commit cfd6643) --------- Co-authored-by: Ajay Jaganathan <36824134+AjayJagan@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Remove VAP manifests from Kueue configuration (#2113) * Remove Validation Admission Policy (VAP) manifests and related code from Kueue configuration since VAP functionality is now handled by a dedicated webhook implementation. Add cleanup for deprecated ValidatingAdmissionPolicyBinding resources during upgrades. Changes: - Remove entire config/kueue-configs/ocp-4.17-addons directory containing: * validating_admission_policy.yaml * validating_admission_policy_binding.yaml * kustomization.yaml - Remove VAP ownership and watching from kueue controller - Remove customizeResources function (was only handling VAPB) - Remove VAP GVK definitions from pkg/cluster/gvk/gvk.go - Remove VAP RBAC permissions from: * internal/controller/datasciencecluster/kubebuilder_rbac.go * config/rbac/role.yaml * bundle/manifests/opendatahub-operator.clusterserviceversion.yaml - Remove ValidateKueueVAPReady test function and related test case - Fix typo: ValidateKueueUnmanagedWhitoutOcpKueueOperator → ValidateKueueUnmanagedWithoutOcpKueueOperator - Add cleanupDeprecatedKueueVAPB function in upgrade package to remove orphaned ValidatingAdmissionPolicyBinding - Integrate cleanup into CleanupExistingResource for automatic execution during upgrades - Add comprehensive tests for the cleanup functionality in pkg/upgrade/upgrade_test.go * Remove empty ocp-4.17-addons directory and unused code Following VAP manifest removal, clean up remaining empty directory and unused functions that were only serving the removed VAP resources. Changes: - Remove empty config/kueue-configs/ocp-4.17-addons/ directory - Remove kueueConfigExtraManifestsPath() function - Remove extraInitialize() function and its reference - Remove empty OCP 4.17 version check block - Remove unused getClusterVersion() function from e2e tests - Clean up unused imports (semver, cluster) --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> Signed-off-by: Andres Llausas <allausas@redhat.com> Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com> Signed-off-by: mprahl <mprahl@users.noreply.github.com> Signed-off-by: Gowtham Shanmugasundaram <gshanmug@redhat.com> Co-authored-by: Marián Macik <macik.marian@gmail.com> Co-authored-by: Marek Laššák <73712209+mlassak@users.noreply.github.com> Co-authored-by: Denis Moskalenko <59964862+den-rgb@users.noreply.github.com> Co-authored-by: den-rgb <den02_m@yahoo.com> Co-authored-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: Ugo Giordano <ugiordan@redhat.com> Co-authored-by: Ajay Jaganathan <36824134+AjayJagan@users.noreply.github.com> Co-authored-by: Chris Sams <csams@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Luca Burgazzoli <lburgazzoli@users.noreply.github.com> Co-authored-by: Andres Llausas <allausas@redhat.com> Co-authored-by: Matt Prahl <mprahl@users.noreply.github.com> Co-authored-by: Steven Tobin <stobin@redhat.com> Co-authored-by: Carl Kyrillos <ckyrillo@redhat.com> Co-authored-by: Kevin Howell <khowell@redhat.com> Co-authored-by: Luca Burgazzoli <lburgazzoli@gmail.com> Co-authored-by: Gowtham Shanmugasundaram <gshanmug@redhat.com> Co-authored-by: Andrea Tarocchi <andrea.tarocchi@gmail.com>
* fix: CodeFlare Operator Probe Success 5m and 1h Burn Rate high has wrong triage URL (#2011) * docs: update DESIGN.md document to capture reconciliation refactor (#1900) * RHOAI-452 | feat: modified code to only use wait.ExponentialBackoffWithContext (#1960) Co-authored-by: den-rgb <den02_m@yahoo.com> * update: Cleanup Auth creation logic (#2005) - remove admin_group pass from operator to dashboard - create Auth CR only when it does not exist, otherwise do nothing Signed-off-by: Wen Zhou <wenzhou@redhat.com> * fix(main): import webhook package to resolve RegisterAllWebhooks for nowebhook builds (#2016) - Import internal/webhook package in main.go - Use webhook.RegisterAllWebhooks(mgr) to ensure correct function resolution - Fixes unresolved reference error when building with the nowebhook tag * (feat): Add FBC processor workflow (#1997) * (feat): Add FBC processor workflow - Add the process-fbc-fragment.yaml - Do some cleanup in update-version.sh - Change the catalog name operator.yaml -> catalog.yaml - Add an icon in the template. - Add platform for bundle and catalog build * revert $NEW_VERSION * minor improvements * replace sed with perl(for compatibility) * no cleanup of labels/annotations remove bundle_meta_opts * Add llama-stack-k8s-operator controller to ODH operator (#2007) * Add llama-stack-k8s-operator controller to ODH operator Signed-off-by: Christopher Sams <csams@redhat.com> * update: llamastack - revert manifests change Signed-off-by: Wen Zhou <wenzhou@redhat.com> * test: swtich to new branch with latest changes - should update this before final PR merge Signed-off-by: Wen Zhou <wenzhou@redhat.com> * fix: CSV Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: set to official llama-stack operator repo Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: Wen Zhou <wenzhou@redhat.com> * update: add workbenchNamespace into DSC and Workbnech status (#2033) - in DSC: .status.components.workbenches.workbenchNamespace - in Workbench: .status.workbenchNamespace Signed-off-by: Wen Zhou <wenzhou@redhat.com> * Update version to 2.30.0 (#2030) Co-authored-by: AjayJagan <36824134+AjayJagan@users.noreply.github.com> * chore: add unit test for HasCRD and HasCRDWithVersion (#2035) * Update: add check in Kserve before create resources (#2045) * Update: add check in Kserve before create resources - extra check in preConditions: if DSIC does not have servicmesh condition ready do not create resources knative-serving need istio-proxy injected that requires smcp ready Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: use function IsStatusConditionPresentAndEqual() Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: move check on DSCI.status.condition after check of operators Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: use IsStatusConditionTrue directly - cover both False and Unknown - add observedgeneration Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> * feat: add GH action for running integration tests - image building part (#2046) * (feat): Rework release automation to support new konflux changes (#2036) * (feat): Rework release automation to support new konflux changes * make changes based on comments * remove composite action and use the same logic in release-staging * use an action for branch creation * Update: add predicate on DSCI.status.condition.CapabilityServiceMeshchange (#2047) * Update: add predicate on DSCI.status.condition.CapabilityServiceMesh change Signed-off-by: Wen Zhou <wenzhou@redhat.com> * test: run in parallel Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> * RHOAIENG-26152-knative-enable-podspec-schedulername by default (#2044) Signed-off-by: Andres Llausas <allausas@redhat.com> * chore: change integration tests trigger action to use pull_request_target with PR author verification (#2065) * RHOAIENG-26313-enable-multi-container-probing (#2061) Signed-off-by: Andres Llausas <allausas@redhat.com> * RHOAIENG-26410: Set controller deployment replicas to 3 for webhook HA (#2066) RHOAIENG-26410: Update e2e test to expect 3 replicas for controller deployment * chore: improve security of integration tests trigger action (#2070) * feat: enable rendering cache by default (#2067) The rendering cache has been running for a while now without any issue, in order make the code simpler, the rendering cache is now enabled by default. Caching can be turned off by using: - kustomize.WithCache(false) - template.WithCache(false) Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com> * feat: add podantiaffinity and nodeaffinity (#2079) - operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> * disable temporaty the custom catalog gh action (#2081) * Implement Auth validating webhook to reject invalid groups (#2085) * feat: add validating webhook for Auth resources to block invalid groups (RHOAIENG-21972) Add validating webhook to prevent invalid AdminGroups and AllowedGroups: - Block 'system:authenticated' and empty string values - Add comprehensive unit and integration tests - Fix decoder injection issue in webhook setup - Update webhook manifests for registration All tests passing: 9 unit tests + 8 integration tests # Conflicts: # bundle/manifests/opendatahub-operator.clusterserviceversion.yaml * feat: add E2E webhook validation framework for Auth resources - Add EnsureWebhookBlocksResourceUpdate function to test webhook validation - Implement ValidateWebhookBlocksInvalidGroups test for Auth resource validation - Add webhook validation test cases for AdminGroups and AllowedGroups - Extend E2E test framework to support admission webhook testing * Add a management option for Argo Workflows (#2064) This will allow the user to opt out of Argo Workflows being managed by the DSP operator to enable BYO Argo Workflows. Relates: https://issues.redhat.com/browse/RHOAIENG-25499 Signed-off-by: mprahl <mprahl@users.noreply.github.com> * deploy monitoringstack if metrics stanza in monitoring CR (#2014) * deploy monitoringstack if metrics stanza in monitoring CR * get namespace from monitoirng CR so we dont need the DSCI * (fix): Remove cleanup in release automation (#2120) * update: env variable name pass from build for lls-o (#2115) Signed-off-by: Wen Zhou <wenzhou@redhat.com> * enable back the gha to build the bundle (#2125) --------- Signed-off-by: Wen Zhou <wenzhou@redhat.com> Signed-off-by: Andres Llausas <allausas@redhat.com> Signed-off-by: Luca Burgazzoli <lburgazzoli@gmail.com> Signed-off-by: mprahl <mprahl@users.noreply.github.com> Co-authored-by: Marián Macik <macik.marian@gmail.com> Co-authored-by: Marek Laššák <73712209+mlassak@users.noreply.github.com> Co-authored-by: Denis Moskalenko <59964862+den-rgb@users.noreply.github.com> Co-authored-by: den-rgb <den02_m@yahoo.com> Co-authored-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: Ugo Giordano <ugiordan@redhat.com> Co-authored-by: Ajay Jaganathan <36824134+AjayJagan@users.noreply.github.com> Co-authored-by: Chris Sams <csams@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Luca Burgazzoli <lburgazzoli@users.noreply.github.com> Co-authored-by: Andres Llausas <allausas@redhat.com> Co-authored-by: Matt Prahl <mprahl@users.noreply.github.com> Co-authored-by: Steven Tobin <stobin@redhat.com>
|
/cherry-pick rhoai |
|
@zdtsw: #2079 failed to apply on top of branch "rhoai": DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
- operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> (cherry picked from commit ab22f8f) Signed-off-by: Wen Zhou <wenzhou@redhat.com>
- operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> (cherry picked from commit ab22f8f) Signed-off-by: Wen Zhou <wenzhou@redhat.com>
- operator pod must run on Linux node - preferrable operator pods with label name:opendatahub-operator should not run on the same node Signed-off-by: Wen Zhou <wenzhou@redhat.com> (cherry picked from commit ab22f8f) Signed-off-by: Wen Zhou <wenzhou@redhat.com>
Description
ref: https://issues.redhat.com/browse/RHOAIENG-28127
How Has This Been Tested?
Screenshot or short clip
Merge criteria
Summary by CodeRabbit