wip: support kserve with authorino

* Activate extauth for grpc traffic
* Set host on requests from activator to trigger authconfig
* Temp Authorization header fix to workaround https://issues.redhat.com/browse/OSSM-4873

components/kserve/kserve.go

@@ -3,6 +3,9 @@ package kserve
 
 import (
  "fmt"
+ "github.com/opendatahub-io/opendatahub-operator/v2/pkg/servicemesh"
+ "github.com/opendatahub-io/opendatahub-operator/v2/pkg/servicemesh/feature"
+ "path"
  "path/filepath"
  "strings"
 
@@ -129,21 +132,74 @@ func (k *Kserve) ReconcileComponent(cli client.Client, owner metav1.Object, dsci
  if err := cluster.UpdatePodSecurityRolebinding(cli, dscispec.ApplicationsNamespace, "odh-model-controller"); err != nil {
  return err
  }
- // Update image parameters for odh-maodel-controller
+ // Update image parameters for odh-model-controller
  if dscispec.DevFlags.ManifestsUri == "" && len(k.DevFlags.Manifests) == 0 {
  if err := deploy.ApplyImageParams(DependentPath, dependentImageParamMap); err != nil {
  return err
  }
  }
  }
+
  if err := deploy.DeployManifestsFromPath(cli, owner, DependentPath, dscispec.ApplicationsNamespace, k.GetComponentName(), enabled); err != nil {
  return err
  }
 
+ if enabled {
+ if err := k.configureServiceMesh(cli, dscispec); err != nil {
+ return err
+ }
+ }
+
  return nil
 }
 
 func (k *Kserve) DeepCopyInto(target *Kserve) {
  *target = *k
  target.Component = k.Component
 }
+
+func (k *Kserve) configureServiceMesh(cli client.Client, dscispec *dsci.DSCInitializationSpec) error {
+ shouldConfigureServiceMesh, err := deploy.ShouldConfigureServiceMesh(cli, dscispec)
+ if err != nil {
+ return err
+ }
+
+ if shouldConfigureServiceMesh {
+ serviceMeshInitializer := servicemesh.NewServiceMeshInitializer(dscispec, k.defineServiceMeshFeatures(dscispec))
+
+ if err := serviceMeshInitializer.Prepare(); err != nil {
+ return err
+ }
+
+ if err := serviceMeshInitializer.Apply(); err != nil {
+ return err
+ }
+ }
+
+ return nil
+}
+
+func (k *Kserve) defineServiceMeshFeatures(dscispec *dsci.DSCInitializationSpec) servicemesh.DefineFeatures {
+ return func(s *servicemesh.ServiceMeshInitializer) error {
+ var rootDir = filepath.Join(feature.BaseOutputDir, dscispec.ApplicationsNamespace)
+ if err := servicemesh.CopyEmbeddedFiles("templates", rootDir); err != nil {
+ return err
+ }
+
+ kserve, err := feature.CreateFeature("configure-kserve-for-external-authz").
+ For(dscispec).
+ Manifests(
+ path.Join(rootDir, feature.ControlPlaneDir, "components", k.GetComponentName()),
+ ).
+ WithData(feature.ClusterDetails).
+ Load()
+
+ if err != nil {
+ return err
+ }
+
+ s.Features = append(s.Features, kserve)
+
+ return nil
+ }
+}

pkg/servicemesh/feature/manifest.go

@@ -2,11 +2,12 @@ package feature
 
 import (
  "fmt"
- "github.com/pkg/errors"
  "html/template"
  "os"
  "path/filepath"
  "strings"
+
+ "github.com/pkg/errors"
 )
 
 const (

pkg/servicemesh/templates/kserve/activator-envoyfilter.tmpl.yaml

@@ -0,0 +1,42 @@
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+ labels:
+ app: odh
+ name: activator-host-header
+ namespace: {{ .Mesh.Namespace }}
+spec:
+ priority: 20
+ workloadSelector:
+ labels:
+ component: predictor
+ configPatches:
+ - applyTo: HTTP_FILTER
+ match:
+ listener:
+ filterChain:
+ filter:
+ name: envoy.filters.network.http_connection_manager
+ patch:
+ operation: INSERT_BEFORE
+ value:
+ name: envoy.filters.http.lua
+ typed_config:
+ '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
+ inlineCode: |
+ function envoy_on_request(request_handle)
+ local headers = request_handle:headers()
+ if not headers then
+ return
+ end
+
+ local original_host = headers:get("k-original-host")
+ if original_host then
+
+ port_seperator = string.find(original_host, ":", 7)
+ if port_seperator then
+ original_host = string.sub(original_host, 0, port_seperator-1)
+ end
+ headers:replace('host', original_host)
+ end
+ end

pkg/servicemesh/templates/kserve/envoy-oauth-temp-fix.tmpl.yaml

@@ -0,0 +1,79 @@
+# https://issues.redhat.com/browse/OSSM-4873
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+ name: envoy-oauth-temp-fix-before
+ namespace: {{ .Mesh.Namespace }}
+ labels:
+ app: odh
+ temp: hack
+spec:
+ workloadSelector:
+ labels:
+ istio: ingressgateway
+ priority: 20
+ configPatches:
+ - applyTo: HTTP_FILTER
+ match:
+ listener:
+ filterChain:
+ filter:
+ name: envoy.filters.network.http_connection_manager
+ patch:
+ operation: INSERT_BEFORE
+ value:
+ name: envoy.filters.http.lua
+ typed_config:
+ "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
+ inlineCode: |
+ function envoy_on_request(request_handle)
+ local headers = request_handle:headers()
+ if not headers then
+ return
+ end
+
+ local auth = headers:get("authorization")
+ if auth then
+ headers:replace("x-authorization", auth)
+ end
+ end
+---
+apiVersion: networking.istio.io/v1alpha3
+kind: EnvoyFilter
+metadata:
+ name: envoy-oauth-temp-fix-after
+ namespace: {{ .Mesh.Namespace }}
+ labels:
+ app: odh
+ temp: hack
+spec:
+ workloadSelector:
+ labels:
+ istio: ingressgateway
+ priority: 5
+ configPatches:
+ - applyTo: HTTP_FILTER
+ match:
+ listener:
+ filterChain:
+ filter:
+ name: envoy.filters.network.http_connection_manager
+ patch:
+ operation: INSERT_BEFORE
+ value:
+ name: envoy.filters.http.lua
+ typed_config:
+ "@type": type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
+ inlineCode: |
+ function envoy_on_request(request_handle)
+ local headers = request_handle:headers()
+ if not headers then
+ return
+ end
+
+ local xauth = headers:get("x-authorization")
+ if xauth then
+ headers:replace("authorization", xauth)
+ headers.remove("x-authorization")
+ end
+ end

pkg/servicemesh/templates/kserve/grpc-authorizationpolicy.tmpl.yaml

@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+ name: kserve-predicator
+ namespace: {{ .Mesh.Namespace }}
+spec:
+ action: CUSTOM
+ provider:
+ name: opendatahub-odh-auth-provider
+ rules:
+ - to:
+ - operation:
+ notPaths:
+ - /healthz*
+ ports:
+ - "8013"
+ selector:
+ matchLabels:
+ component: predictor