Sync kubeflow model registry manifests v0.2.1-alpha

.github/workflows/model_registry_test.yaml

@@ -23,15 +23,24 @@ jobs:
     - name: Create KinD Cluster
       run: kind create cluster --config tests/gh-actions/kind-cluster.yaml
 
+    - name: Install kubectl
+      run: ./tests/gh-actions/install_kubectl.sh
+
     - name: Install kustomize
       run: ./tests/gh-actions/install_kustomize.sh
 
-    - name: Install Istio
-      run: ./tests/gh-actions/install_istio.sh
-
     - name: Create kubeflow namespace
       run: kustomize build common/kubeflow-namespace/base | kubectl apply -f -
 
+    - name: Install Istio with ext auth
+      run: ./tests/gh-actions/install_istio_with_ext_auth.sh*
+
+    - name: Install cert-manager
+      run: ./tests/gh-actions/install_cert_manager.sh
+
+    - name: Install knative
+      run: ./tests/gh-actions/install_knative.sh
+
     - name: Build & Apply KF Model Registry manifests
       run: |
         kustomize build apps/model-registry/upstream/overlays/db | kubectl apply -f -
@@ -42,3 +51,25 @@ jobs:
         echo "Waiting for all Model Registry Pods to become ready..."
         kubectl wait --for=condition=available -n kubeflow deployment/model-registry-db --timeout=600s
         kubectl wait --for=condition=available -n kubeflow deployment/model-registry-deployment --timeout=600s
+
+    - name: Dry-run KF Model Registry API directly
+      run: |
+        echo "Dry-run KF Model Registry API directly..."
+        nohup kubectl port-forward svc/model-registry-service -n kubeflow 8081:8080 &
+        while ! curl localhost:8081; do echo "waiting for port-forwarding 8081"; sleep 1; done; echo "port-forwarding 8181 ready"
+        curl -v -X 'GET' \
+          'http://localhost:8081/api/model_registry/v1alpha3/registered_models?pageSize=100&orderBy=ID&sortOrder=DESC' \
+          -H 'accept: application/json'
+
+    # for these steps below ensure same steps as kserve (ie: Istio with ext auth, cert0manager, knative) so to achieve same setup 
+    - name: Port forward Istio gateway
+      run: |
+        INGRESS_GATEWAY_SERVICE=$(kubectl get svc --namespace istio-system --selector="app=istio-ingressgateway" --output jsonpath='{.items[0].metadata.name}')
+        nohup kubectl port-forward --namespace istio-system svc/${INGRESS_GATEWAY_SERVICE} 8080:80 &
+        while ! curl localhost:8080; do echo waiting for port-forwarding; sleep 1; done; echo port-forwarding ready
+
+    - name: Dry-run KF Model Registry REST API
+      run: |
+        echo "Dry-run KF Model Registry REST API..."
+        export KF_TOKEN="$(kubectl -n default create token default)"
+        curl -v -H "Authorization: Bearer "$KF_TOKEN http://localhost:8080/api/model_registry/v1alpha3/registered_models

README.md

@@ -57,7 +57,7 @@ This repo periodically syncs all official Kubeflow components from their respect
 | KServe Models Web App | contrib/kserve/models-web-app | [v0.10.0](https://github.com/kserve/models-web-app/tree/v0.10.0/config) |
 | Kubeflow Pipelines | apps/pipeline/upstream | [2.2.0](https://github.com/kubeflow/pipelines/tree/2.2.0/manifests/kustomize) |
 | Kubeflow Tekton Pipelines | apps/kfp-tekton/upstream | [2.0.5](https://github.com/kubeflow/kfp-tekton/tree/2.0.5/manifests/kustomize) |
-| Kubeflow Model Registry | apps/model-registry/upstream | [v0.2.0-alpha](https://github.com/kubeflow/model-registry/tree/v0.2.0-alpha/manifests/kustomize) |
+| Kubeflow Model Registry | apps/model-registry/upstream | [v0.2.1-alpha](https://github.com/kubeflow/model-registry/tree/v0.2.1-alpha/manifests/kustomize) |
 
 The following is also a matrix with versions from common components that are
 used from the different projects of Kubeflow:

apps/model-registry/upstream/OWNERS

@@ -5,4 +5,4 @@ approvers:
 reviewers:
   - tarilabs
   - rareddy
-  - Tomcli
+  - Tomcli

apps/model-registry/upstream/base/model-registry-deployment.yaml

@@ -11,6 +11,8 @@ spec:
       component: model-registry-server
   template:
     metadata:
+      annotations:
+        sidecar.istio.io/inject: "true"
       labels:
         component: model-registry-server
     spec:

apps/model-registry/upstream/base/model-registry-service.yaml

@@ -11,7 +11,9 @@ spec:
   ports:
   - port: 8080
     protocol: TCP
+    appProtocol: http
     name: http-api
   - port: 9090
     protocol: TCP
+    appProtocol: grpc
     name: grpc-api

apps/model-registry/upstream/options/istio/virtual-service.yaml

@@ -7,18 +7,23 @@ spec:
   - kubeflow-gateway
   hosts:
   - '*'
-  tcp:
+  http:
   - match:
-    - port: 8080
+    - uri:
+        prefix: /api/model_registry/
     route:
     - destination:
         host: model-registry-service.kubeflow.svc.cluster.local
         port:
           number: 8080
   - match:
-      - port: 9090
+    - port: 9090
+    - authority:
+        regex: model-registry-service(\..+)?(:9090)?
+    - uri:
+        prefix: /ml_metadata.MetadataStoreService/
     route:
-      - destination:
-          host: model-registry-service.kubeflow.svc.cluster.local
-          port:
-            number: 9090
+    - destination:
+        host: model-registry-service.kubeflow.svc.cluster.local
+        port:
+          number: 9090

apps/model-registry/upstream/overlays/db/kustomization.yaml

@@ -36,3 +36,10 @@ vars:
     apiVersion: v1
     kind: Service
     name: model-registry-db
+- name: MYSQL_PORT
+  objref:
+    kind: ConfigMap
+    name: model-registry-db-parameters
+    apiVersion: v1
+  fieldref:
+    fieldpath: data.MYSQL_PORT

apps/model-registry/upstream/overlays/db/patches/model-registry-deployment.yaml

@@ -4,6 +4,10 @@ metadata:
   name: model-registry-deployment
 spec:
   template:
+    metadata:
+      annotations:
+        # db doesn't use istio
+        traffic.sidecar.istio.io/excludeOutboundPorts: $(MYSQL_PORT)
     spec:
       containers:
         - name: rest-container

apps/model-registry/upstream/overlays/postgres/kustomization.yaml

@@ -36,3 +36,10 @@ vars:
     apiVersion: v1
   fieldref:
     fieldpath: metadata.name
+- name: POSTGRES_PORT
+  objref:
+    kind: ConfigMap
+    name: model-registry-db-parameters
+    apiVersion: v1
+  fieldref:
+    fieldpath: data.POSTGRES_PORT

apps/model-registry/upstream/overlays/postgres/patches/model-registry-deployment.yaml

@@ -4,6 +4,10 @@ metadata:
   name: model-registry-deployment
 spec:
   template:
+    metadata:
+      annotations:
+        # db doesn't use istio
+        traffic.sidecar.istio.io/excludeOutboundPorts: $(POSTGRES_PORT)
     spec:
       containers:
         - name: grpc-container

hack/sync-model-registry-manifests.sh

@@ -15,7 +15,7 @@
 set -euxo pipefail
 IFS=$'\n\t'
 
-COMMIT="v0.2.0-alpha" # You can use tags as well
+COMMIT="v0.2.1-alpha" # You can use tags as well
 DEV_MODE=${DEV_MODE:=false}
 SRC_DIR=${SRC_DIR:=/tmp/kubeflow-model-registry}
 BRANCH=${BRANCH:=sync-kubeflow-model-registry-manifests-${COMMIT?}}
@@ -64,7 +64,8 @@ DST_DIR=$MANIFESTS_DIR/apps/model-registry/upstream
 if [ -d "$DST_DIR" ]; then
     rm -r "$DST_DIR"
 fi
-cp $SRC_DIR/manifests/kustomize/* $DST_DIR -r
+mkdir -p $DST_DIR
+cp $SRC_DIR/model-registry/manifests/kustomize/* $DST_DIR -r
 
 echo "Successfully copied all manifests."