Skip to content

Commit 2611647

Browse files
zdtswjira-autofix-botclaude
authored
feat: add support for limit allowedRoute in GW (opendatahub-io#108)
* fix(INFERENG-7126): make gateway allowedRoutes configurable in rhai-on-xks chart The rhai-on-xks chart hardcoded allowedRoutes.namespaces.from to "All" in the post-install gateway Job, allowing any namespace to attach HTTPRoutes to the inference Gateway. This creates a security risk in multi-tenant clusters where unauthorized services could hijack traffic or expose services through the Gateway's load balancer. This change adds allowedRoutes configuration to values.yaml under components.kserve.gateway, supporting All, Same, and Selector modes with an optional label selector. The default remains "All" for backward compatibility. The JSON schema is updated to validate the new fields, and all snapshot tests are regenerated. Closes INFERENG-7126 Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aneesh Puttur <aputtur@redhat.com> * fix(INFERENG-7126): regenerate xks chart snapshots for Helm v4 compatibility CI uses Helm v4 (latest) which adds blank lines between YAML document separators. The previous snapshots were generated with Helm v3 and lacked these blank lines, causing snapshot test failures. Closes INFERENG-7126 Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aneesh Puttur <aputtur@redhat.com> * fix(INFERENG-7126): regenerate xks chart api-docs.md for allowedRoutes Run helm-docs to include the new components.kserve.gateway.allowedRoutes.namespaces.from value in the generated api-docs.md, fixing the CI lint check that validates documentation is up to date. Closes INFERENG-7126 Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Aneesh Puttur <aputtur@redhat.com> * feat: add support for limit allowedRoute in GW - add https - limit alowedRoutes to selector and same as skip set and all Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: code review Signed-off-by: Wen Zhou <wenzhou@redhat.com> * update: code review - to keep upgrade work for those already on "All" keep default values.yaml with "all" Signed-off-by: Wen Zhou <wenzhou@redhat.com> --------- Signed-off-by: Aneesh Puttur <aputtur@redhat.com> Signed-off-by: Wen Zhou <wenzhou@redhat.com> Co-authored-by: jira-autofix-bot <jira-autofix-bot@redhat.com> Co-authored-by: Claude <noreply@anthropic.com>
1 parent 80812f1 commit 2611647

15 files changed

Lines changed: 9416 additions & 3 deletions

‎charts/rhai-on-xks-chart/api-docs.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ RHAI on XKS Helm chart for non-OLM installation on non-OpenShift Kubernetes serv
4545
| azure.kubernetesEngine.spec.dependencies.sailOperator.configuration.namespace | string | `"istio-system"` | |
4646
| azure.kubernetesEngine.spec.dependencies.sailOperator.managementPolicy | string | `"Managed"` | |
4747
| components.kserve.enabled | bool | `true` | |
48+
| components.kserve.gateway.allowedRoutes.namespaces.from | string | `"All"` | |
4849
| components.kserve.gateway.create | bool | `true` | |
4950
| components.kserve.spec | object | `{}` | |
5051
| coreweave.cloudManager.image | string | `"quay.io/opendatahub/opendatahub-operator:latest"` | |

‎charts/rhai-on-xks-chart/templates/hooks/post-install-gateway-job.yaml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,9 +144,33 @@ spec:
144144
- name: http
145145
port: 80
146146
protocol: HTTP
147+
{{- if .Values.components.kserve.gateway.allowedRoutes.namespaces.from }}
148+
{{- if and (eq .Values.components.kserve.gateway.allowedRoutes.namespaces.from "Selector") (not .Values.components.kserve.gateway.allowedRoutes.namespaces.selector) }}
149+
{{- fail "allowedRoutes.namespaces.selector is required when from is set to Selector" }}
150+
{{- end }}
151+
allowedRoutes:
152+
namespaces:
153+
from: {{ .Values.components.kserve.gateway.allowedRoutes.namespaces.from }}
154+
{{- if and (eq .Values.components.kserve.gateway.allowedRoutes.namespaces.from "Selector") .Values.components.kserve.gateway.allowedRoutes.namespaces.selector }}
155+
selector:
156+
{{- toYaml .Values.components.kserve.gateway.allowedRoutes.namespaces.selector | nindent 26 }}
157+
{{- end }}
158+
{{- end }}
159+
- name: https
160+
port: 443
161+
protocol: HTTPS
162+
{{- if .Values.components.kserve.gateway.allowedRoutes.namespaces.from }}
163+
{{- if and (eq .Values.components.kserve.gateway.allowedRoutes.namespaces.from "Selector") (not .Values.components.kserve.gateway.allowedRoutes.namespaces.selector) }}
164+
{{- fail "allowedRoutes.namespaces.selector is required when from is set to Selector" }}
165+
{{- end }}
147166
allowedRoutes:
148167
namespaces:
149-
from: All
168+
from: {{ .Values.components.kserve.gateway.allowedRoutes.namespaces.from }}
169+
{{- if and (eq .Values.components.kserve.gateway.allowedRoutes.namespaces.from "Selector") .Values.components.kserve.gateway.allowedRoutes.namespaces.selector }}
170+
selector:
171+
{{- toYaml .Values.components.kserve.gateway.allowedRoutes.namespaces.selector | nindent 26 }}
172+
{{- end }}
173+
{{- end }}
150174
infrastructure:
151175
labels:
152176
serving.kserve.io/gateway: kserve-ingress-gateway

‎charts/rhai-on-xks-chart/test/snapshots/aws-with-allowed-routes-all.snap.yaml‎

Lines changed: 3093 additions & 0 deletions
Large diffs are not rendered by default.

‎charts/rhai-on-xks-chart/test/snapshots/aws-with-allowed-routes-same.snap.yaml‎

Lines changed: 3093 additions & 0 deletions
Large diffs are not rendered by default.

‎charts/rhai-on-xks-chart/test/snapshots/aws-with-pull-secret.snap.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3214,6 +3214,12 @@ spec:
32143214
allowedRoutes:
32153215
namespaces:
32163216
from: All
3217+
- name: https
3218+
port: 443
3219+
protocol: HTTPS
3220+
allowedRoutes:
3221+
namespaces:
3222+
from: All
32173223
infrastructure:
32183224
labels:
32193225
serving.kserve.io/gateway: kserve-ingress-gateway

‎charts/rhai-on-xks-chart/test/snapshots/aws.snap.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3075,6 +3075,12 @@ spec:
30753075
allowedRoutes:
30763076
namespaces:
30773077
from: All
3078+
- name: https
3079+
port: 443
3080+
protocol: HTTPS
3081+
allowedRoutes:
3082+
namespaces:
3083+
from: All
30783084
infrastructure:
30793085
labels:
30803086
serving.kserve.io/gateway: kserve-ingress-gateway

‎charts/rhai-on-xks-chart/test/snapshots/azure-with-pull-secret.snap.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3199,6 +3199,12 @@ spec:
31993199
allowedRoutes:
32003200
namespaces:
32013201
from: All
3202+
- name: https
3203+
port: 443
3204+
protocol: HTTPS
3205+
allowedRoutes:
3206+
namespaces:
3207+
from: All
32023208
infrastructure:
32033209
labels:
32043210
serving.kserve.io/gateway: kserve-ingress-gateway

‎charts/rhai-on-xks-chart/test/snapshots/azure-with-related-images.snap.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3081,6 +3081,12 @@ spec:
30813081
allowedRoutes:
30823082
namespaces:
30833083
from: All
3084+
- name: https
3085+
port: 443
3086+
protocol: HTTPS
3087+
allowedRoutes:
3088+
namespaces:
3089+
from: All
30843090
infrastructure:
30853091
labels:
30863092
serving.kserve.io/gateway: kserve-ingress-gateway

0 commit comments

Comments
 (0)