Add Istio overlay for UI integration with Central Dashboard

Signed-off-by: Griffin-Sullivan <[email protected]>

clients/ui/manifests/base/kustomization.yaml → clients/ui/manifests/bff/base/kustomization.yaml

@@ -5,14 +5,9 @@ resources:
 - model-registry-bff-role.yaml
 - model-registry-bff-service.yaml
 - model-registry-bff-deployment.yaml
-- model-registry-ui-service.yaml
-- model-registry-ui-deployment.yaml
 - model-registry-service-account.yaml
 
 images:
 - name: model-registry-bff-image
-  newName: kubeflow/model-registry-bff
-  newTag: latest
-- name: model-registry-ui-image
-  newName: kubeflow/model-registry-ui
-  newTag: latest
+  newName: docker.io/kubeflow/model-registry-bff
+  newTag: main-648c8fe

clients/ui/manifests/base/model-registry-bff-deployment.yaml → clients/ui/manifests/bff/base/model-registry-bff-deployment.yaml

@@ -18,6 +18,7 @@ spec:
       containers:
       - name: model-registry-bff
         image: model-registry-bff-image
+        imagePullPolicy: Never
         resources:
           limits:
             cpu: 500m

clients/ui/manifests/base/model-registry-bff-service.yaml → clients/ui/manifests/bff/base/model-registry-bff-service.yaml

@@ -8,4 +8,5 @@ spec:
   ports:
     - protocol: TCP
       port: 4000
-      targetPort: 4000
+      targetPort: 4000
+      name: http

clients/ui/manifests/bff/base/model-registry-service-account.yaml

@@ -0,0 +1,5 @@
+---
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  name: model-registry-bff

clients/ui/manifests/bff/overlays/istio/auth-pol-bff.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: model-registry-bff
+  namespace: kubeflow
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
+  selector:
+    matchLabels:
+      app: model-registry-bff

clients/ui/manifests/bff/overlays/istio/dest-rule-bff.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: model-registry-bff
+  namespace: kubeflow
+spec:
+  host: model-registry-bff-service.kubeflow.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

clients/ui/manifests/bff/overlays/istio/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../base
+- auth-pol-bff.yaml
+- dest-rule-bff.yaml
+namespace: kubeflow
+commonLabels:
+  app: model-registry-bff
+  kustomize.component: model-registry-bff

clients/ui/manifests/frontend/base/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- model-registry-ui-service.yaml
+- model-registry-ui-deployment.yaml
+- model-registry-service-account.yaml
+
+images:
+- name: model-registry-ui-image
+  newName: docker.io/kubeflow/model-registry-ui
+  newTag: latest

clients/ui/manifests/base/model-registry-service-account.yaml → clients/ui/manifests/frontend/base/model-registry-service-account.yaml

@@ -1,4 +1,5 @@
+---
 kind: ServiceAccount
 apiVersion: v1
 metadata:
-  name: model-registry-bff
+  name: model-registry-ui

clients/ui/manifests/base/model-registry-ui-deployment.yaml → clients/ui/manifests/frontend/base/model-registry-ui-deployment.yaml

@@ -14,6 +14,7 @@ spec:
       labels:
         app: model-registry-ui
     spec:
+      serviceAccountName: model-registry-ui 
       containers:
       - name: model-registry-ui
         image: model-registry-ui-image
@@ -27,5 +28,13 @@ spec:
         ports:
           - containerPort: 8080
         env:
+        # TODO: Add env variables
           - name: API_URL
-            value: "http://model-registry-bff-service:4000"
+            value: "http://model-registry-bff-service.kubeflow.svc.cluster.local:4000"
+          - name: APP_PREFIX
+            value: /model-registry
+          - name: USERID_HEADER
+            value: kubeflow-userid
+          # TODO: Come back to this before committing
+          # - name: USERID_PREFIX
+          #   value: ""

clients/ui/manifests/base/model-registry-ui-service.yaml → clients/ui/manifests/frontend/base/model-registry-ui-service.yaml

@@ -7,6 +7,6 @@ spec:
     app: model-registry-ui
   ports:
     - protocol: TCP
-      port: 8080
+      port: 80
       targetPort: 8080
       name: http

clients/ui/manifests/frontend/overlays/istio/authorization-policy.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: model-registry-ui
+  namespace: kubeflow
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
+  selector:
+    matchLabels:
+      app: model-registry-ui

clients/ui/manifests/frontend/overlays/istio/destination-rule.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: DestinationRule
+metadata:
+  name: model-registry-ui
+  namespace: kubeflow
+spec:
+  host: model-registry-ui-service.kubeflow.svc.cluster.local
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL

clients/ui/manifests/frontend/overlays/istio/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../base
+- virtual-service.yaml
+- authorization-policy.yaml
+- destination-rule.yaml
+namespace: kubeflow
+commonLabels:
+  app: model-registry-ui
+  kustomize.component: model-registry-ui

clients/ui/manifests/frontend/overlays/istio/virtual-service.yaml

@@ -0,0 +1,25 @@
+
+apiVersion: networking.istio.io/v1alpha3
+kind: VirtualService
+metadata:
+  name: model-registry-ui
+spec:
+  gateways:
+  - kubeflow-gateway
+  hosts:
+  - '*'
+  http:
+  - headers:
+      request:
+        add:
+          x-forwarded-prefix: /model-registry
+    match:
+    - uri:
+        prefix: /model-registry/
+    rewrite:
+      uri: /
+    route:
+    - destination:
+        host: model-registry-ui-service.kubeflow.svc.cluster.local
+        port:
+          number: 80

clients/ui/manifests/user-rbac/kubeflow-dashboard-rbac.yaml

@@ -0,0 +1,22 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: service-access-cluster-role
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: service-access-cluster-binding
+  namespace: kubeflow
+subjects:
+  - kind: User
+    name: [email protected]
+    apiGroup: rbac.authorization.k8s.io
+roleRef:
+  kind: ClusterRole
+  name: service-access-cluster-role
+  apiGroup: rbac.authorization.k8s.io

clients/ui/manifests/user-rbac/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - admin-rbac.yaml
+  - admin-rbac.yaml
+  - kubeflow-dashboard-rbac.yaml