feat: typed ExternalModel reconciler with cross-watch and legacy support

Updates the model-provider-resolver plugin to watch both CRD API groups:
- inference.opendatahub.io ExternalModel (typed client, cross-watches
  ExternalProvider for credential/config propagation)
- maas.opendatahub.io ExternalModel (legacy unstructured, backward compat)

Adds config field to model store and ModelConfigKey for CycleState.
Registers scheme in factory for typed reconciler support.

Author: yossiovadia

pkg/plugins/common/state/state-keys.go

@@ -22,4 +22,5 @@ const (
 	ModelKey          = "model"
 	CredsRefName      = "credential-ref-name"
 	CredsRefNamespace = "credential-ref-namespace"
+	ModelConfigKey    = "model-config"
 )

pkg/plugins/model-provider-resolver/external_model_reconciler.go

@@ -19,39 +19,88 @@ package model_provider_resolver
 import (
 	"context"
 	"fmt"
+	"time"
 
 	"k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	logutil "sigs.k8s.io/gateway-api-inference-extension/pkg/common/observability/logging"
+
+	inferencev1alpha1 "github.com/opendatahub-io/ai-gateway-payload-processing/api/inference/v1alpha1"
 )
 
-// externalModelGVK is the GroupVersionKind for ExternalModel CRD.
-var externalModelGVK = schema.GroupVersionKind{
+// legacyExternalModelGVK is the old MaaS ExternalModel CRD (maas.opendatahub.io).
+var legacyExternalModelGVK = schema.GroupVersionKind{
 	Group:   "maas.opendatahub.io",
 	Version: "v1alpha1",
 	Kind:    "ExternalModel",
 }
 
-// externalModelReconciler watches ExternalModel CRDs (via unstructured client)
-// and updates the model store with provider and credential information.
+// externalModelReconciler watches inference.opendatahub.io ExternalModel CRDs
+// and resolves provider info from the provider store.
 type externalModelReconciler struct {
 	client.Reader
-	store *modelInfoStore
+	modelStore    *modelInfoStore
+	providerStore *providerInfoStore
 }
 
-// Reconcile handles create/update/delete events for ExternalModel resources.
-// The ExternalModel CR name is used as the model key in the store, matching
-// the model name in inference request bodies.
 func (r *externalModelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
 	logger := log.FromContext(ctx).V(logutil.DEFAULT)
 	logger.Info("reconciling ExternalModel", "name", req.Name, "namespace", req.Namespace)
 
+	model := &inferencev1alpha1.ExternalModel{}
+	err := r.Get(ctx, req.NamespacedName, model)
+	if err != nil && !errors.IsNotFound(err) {
+		return ctrl.Result{}, fmt.Errorf("unable to get ExternalModel: %w", err)
+	}
+
+	if errors.IsNotFound(err) || !model.GetDeletionTimestamp().IsZero() {
+		r.modelStore.deleteExternalModel(req.NamespacedName)
+		logger.Info("ExternalModel removed from store", "name", req.Name, "namespace", req.Namespace)
+		return ctrl.Result{}, nil
+	}
+
+	// CRD validation ensures at least one ref (MinItems=1)
+	ref := model.Spec.ExternalProviderRefs[0]
+
+	providerKey := types.NamespacedName{Namespace: req.Namespace, Name: ref.Ref.Name}
+	providerInfo, found := r.providerStore.get(providerKey)
+	if !found {
+		logger.Info("ExternalProvider not yet available, requeuing", "provider", ref.Ref.Name)
+		return ctrl.Result{RequeueAfter: 5 * time.Second}, nil
+	}
+
+	info := &externalModelInfo{
+		provider:        providerInfo.provider,
+		targetModel:     ref.TargetModel,
+		secretName:      providerInfo.secretName,
+		secretNamespace: providerInfo.secretNamespace,
+		config:          providerInfo.config,
+	}
+	r.modelStore.addOrUpdateExternalModel(req.NamespacedName, info)
+
+	logger.Info("updated model store", "provider", providerInfo.provider, "targetModel", ref.TargetModel)
+	return ctrl.Result{}, nil
+}
+
+// legacyExternalModelReconciler handles the flat maas.opendatahub.io ExternalModel
+// CRD structure (spec.provider, spec.targetModel, spec.credentialRef).
+// Uses unstructured client because the types are in a different repo.
+type legacyExternalModelReconciler struct {
+	client.Reader
+	store *modelInfoStore
+}
+
+func (r *legacyExternalModelReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	logger := log.FromContext(ctx).V(logutil.DEFAULT)
+	logger.Info("reconciling legacy ExternalModel", "name", req.Name, "namespace", req.Namespace)
+
 	obj := &unstructured.Unstructured{}
-	obj.SetGroupVersionKind(externalModelGVK)
+	obj.SetGroupVersionKind(legacyExternalModelGVK)
 
 	err := r.Get(ctx, req.NamespacedName, obj)
 	if err != nil && !errors.IsNotFound(err) {
@@ -68,12 +117,11 @@ func (r *externalModelReconciler) Reconcile(ctx context.Context, req ctrl.Reques
 	targetModel, _, _ := unstructured.NestedString(obj.Object, "spec", "targetModel")
 	credsName, _, _ := unstructured.NestedString(obj.Object, "spec", "credentialRef", "name")
 
-	// targetModel is the model that will be used in the request body when getting inference requests.
 	info := &externalModelInfo{
 		provider:        provider,
 		targetModel:     targetModel,
 		secretName:      credsName,
-		secretNamespace: req.Namespace, // secret namespace is always the namespace of the ExternalModel
+		secretNamespace: req.Namespace,
 	}
 	r.store.addOrUpdateExternalModel(req.NamespacedName, info)
 

pkg/plugins/model-provider-resolver/plugin.go

@@ -24,14 +24,18 @@ import (
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/types"
+	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"sigs.k8s.io/gateway-api-inference-extension/pkg/bbr/framework"
 	errcommon "sigs.k8s.io/gateway-api-inference-extension/pkg/common/error"
 	logutil "sigs.k8s.io/gateway-api-inference-extension/pkg/common/observability/logging"
 	"sigs.k8s.io/gateway-api-inference-extension/pkg/epp/framework/interface/plugin"
 
+	inferencev1alpha1 "github.com/opendatahub-io/ai-gateway-payload-processing/api/inference/v1alpha1"
 	"github.com/opendatahub-io/ai-gateway-payload-processing/pkg/plugins/common/state"
 )
 
@@ -44,6 +48,8 @@ var _ framework.RequestProcessor = &ModelProviderResolverPlugin{}
 
 // ModelProviderResolverFactory defines the factory function for ModelProviderResolverPlugin
 func ModelProviderResolverFactory(name string, _ json.RawMessage, handle framework.Handle) (framework.BBRPlugin, error) {
+	utilruntime.Must(inferencev1alpha1.AddToScheme(handle.Client().Scheme()))
+
 	plugin, err := NewModelProviderResolver(handle.ReconcilerBuilder, handle.Client())
 	if err != nil {
 		return nil, fmt.Errorf("failed to create plugin '%s' - %w", ModelProviderResolverPluginType, err)
@@ -52,55 +58,78 @@ func ModelProviderResolverFactory(name string, _ json.RawMessage, handle framewo
 	return plugin.WithName(name), nil
 }
 
-func NewModelProviderResolver(reconcilerBuilder func() *builder.Builder, clientReader client.Reader) (*ModelProviderResolverPlugin, error) {
-	modelInfoStore := newModelInfoStore()
-	reconciler := &externalModelReconciler{
-		Reader: clientReader,
-		store:  modelInfoStore,
-	}
+func NewModelProviderResolver(reconcilerBuilder func() *builder.Builder, k8sClient client.Client) (*ModelProviderResolverPlugin, error) {
+	providerStore := newProviderInfoStore()
+	modelStore := newModelInfoStore()
 
-	// Watch ExternalModel CRDs directly (no MaaS dependency)
-	obj := &unstructured.Unstructured{}
-	obj.SetGroupVersionKind(externalModelGVK)
+	// Watch ExternalProvider CRDs (inference.opendatahub.io/v1alpha1) using typed client
+	providerReconciler := &externalProviderReconciler{Reader: k8sClient, store: providerStore}
+	if err := reconcilerBuilder().For(&inferencev1alpha1.ExternalProvider{}).Complete(providerReconciler); err != nil {
+		return nil, fmt.Errorf("failed to register ExternalProvider reconciler for plugin '%s' - %w", ModelProviderResolverPluginType, err)
+	}
 
-	if err := reconcilerBuilder().For(obj).Complete(reconciler); err != nil {
+	// Watch ExternalModel CRDs (inference.opendatahub.io/v1alpha1) using typed client.
+	// Cross-watch ExternalProviders so credential/endpoint changes propagate to modelStore.
+	modelReconciler := &externalModelReconciler{Reader: k8sClient, modelStore: modelStore, providerStore: providerStore}
+	mapProviderToModels := func(ctx context.Context, obj client.Object) []reconcile.Request {
+		provider := obj.(*inferencev1alpha1.ExternalProvider)
+		modelList := &inferencev1alpha1.ExternalModelList{}
+		if err := k8sClient.List(ctx, modelList, client.InNamespace(provider.Namespace)); err != nil {
+			log.FromContext(ctx).Error(err, "failed to list ExternalModels for provider mapping",
+				"provider", provider.Name, "namespace", provider.Namespace)
+			return nil
+		}
+		var requests []reconcile.Request
+		for i := range modelList.Items {
+			for _, ref := range modelList.Items[i].Spec.ExternalProviderRefs {
+				if ref.Ref.Name == provider.Name {
+					requests = append(requests, reconcile.Request{
+						NamespacedName: types.NamespacedName{Name: modelList.Items[i].Name, Namespace: modelList.Items[i].Namespace},
+					})
+				}
+			}
+		}
+		return requests
+	}
+	if err := reconcilerBuilder().
+		For(&inferencev1alpha1.ExternalModel{}).
+		Named("inference-externalmodel").
+		Watches(&inferencev1alpha1.ExternalProvider{}, handler.EnqueueRequestsFromMapFunc(mapProviderToModels)).
+		Complete(modelReconciler); err != nil {
 		return nil, fmt.Errorf("failed to register ExternalModel reconciler for plugin '%s' - %w", ModelProviderResolverPluginType, err)
 	}
 
+	// Legacy: watch maas.opendatahub.io ExternalModels for backward compatibility
+	legacyObj := &unstructured.Unstructured{}
+	legacyObj.SetGroupVersionKind(legacyExternalModelGVK)
+	legacyReconciler := &legacyExternalModelReconciler{Reader: k8sClient, store: modelStore}
+	if err := reconcilerBuilder().For(legacyObj).Named("legacy-externalmodel").Complete(legacyReconciler); err != nil {
+		return nil, fmt.Errorf("failed to register legacy ExternalModel reconciler for plugin '%s' - %w", ModelProviderResolverPluginType, err)
+	}
+
 	return &ModelProviderResolverPlugin{
 		typedName:      plugin.TypedName{Type: ModelProviderResolverPluginType, Name: ModelProviderResolverPluginType},
-		modelInfoStore: modelInfoStore,
+		modelInfoStore: modelStore,
 	}, nil
 }
 
 // ModelProviderResolverPlugin resolves model names to provider info by watching ExternalModel CRDs.
-// It writes the model, provider and credential reference to CycleState for downstream plugins
-// (api-translation, api-key-injection).
 type ModelProviderResolverPlugin struct {
 	typedName      plugin.TypedName
 	modelInfoStore *modelInfoStore
 }
 
-// TypedName returns the type and name tuple of this plugin instance.
-func (p *ModelProviderResolverPlugin) TypedName() plugin.TypedName {
-	return p.typedName
-}
+func (p *ModelProviderResolverPlugin) TypedName() plugin.TypedName { return p.typedName }
 
-// WithName sets the name of the plugin instance.
 func (p *ModelProviderResolverPlugin) WithName(name string) *ModelProviderResolverPlugin {
 	p.typedName.Name = name
 	return p
 }
 
-// ProcessRequest reads the model name from the request body, resolves the provider
-// from the modelInfoStore (populated by ExternalModel reconciler), and writes model, provider
-// and credential reference info to CycleState.
 func (p *ModelProviderResolverPlugin) ProcessRequest(ctx context.Context, cycleState *framework.CycleState, request *framework.InferenceRequest) error {
-	logger := log.FromContext(ctx).V(logutil.DEFAULT)
-
 	model, ok := request.Body["model"].(string)
 	if !ok || model == "" {
-		return nil // not an inference request (e.g. API key management, model listing)
+		return nil
 	}
 
 	log.FromContext(ctx).V(logutil.VERBOSE).Info("received incoming request", "path", request.Headers[":path"])
@@ -116,37 +145,33 @@ func (p *ModelProviderResolverPlugin) ProcessRequest(ctx context.Context, cycleS
 	log.FromContext(ctx).V(logutil.VERBOSE).Info("exported namespaced name from path", "key", modelKey)
 
 	externalModelInfo, found := p.modelInfoStore.getModelInfo(modelKey)
-	if !found { // info is stored only for external models
-		return nil // this is not considered an error, we just need to skip if it's internal model
+	if !found {
+		return nil
 	}
 
-	if !strings.HasSuffix(relativePath, "chat/completions") { // no support for other input types
-		logger.Error(nil, "unsupported route for external model", "model", modelKey.String(), "path", relativePath)
+	if !strings.HasSuffix(relativePath, "chat/completions") {
 		return errcommon.Error{Code: errcommon.BadRequest, Msg: "only /chat/completions input type is supported"}
 	}
 
-	// if there's a mismatch it's an error, we don't want to proceed
 	if externalModelInfo.targetModel != model {
-		logger.Error(nil, "model mismatch between request body and ExternalModel", "requestModel", model, "externalModel", externalModelInfo.targetModel)
 		return errcommon.Error{Code: errcommon.NotFound, Msg: fmt.Sprintf("model in request body '%s' doesn't match ExternalModel", model)}
 	}
 
-	// info of external model written to cycle state for next plugins
 	cycleState.Write(state.ProviderKey, externalModelInfo.provider)
 	cycleState.Write(state.ModelKey, externalModelInfo.targetModel)
 	cycleState.Write(state.CredsRefName, externalModelInfo.secretName)
 	cycleState.Write(state.CredsRefNamespace, externalModelInfo.secretNamespace)
+	if len(externalModelInfo.config) > 0 {
+		cycleState.Write(state.ModelConfigKey, externalModelInfo.config)
+	}
 
-	logger.Info("external model resolved", "model", modelKey.String(), "provider", externalModelInfo.provider)
 	return nil
 }
 
 func sanitizePath(relativeUrlPath string) string {
 	relativeUrlPath = strings.TrimSpace(relativeUrlPath)
-
 	if index := strings.IndexByte(relativeUrlPath, '?'); index >= 0 {
-		relativeUrlPath = relativeUrlPath[:index] // remove query params
+		relativeUrlPath = relativeUrlPath[:index]
 	}
-
 	return strings.Trim(relativeUrlPath, "/")
 }