From 6891fd68e931586c8356d56f8da7f5f04776a0d3 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 11:54:38 +0300 Subject: [PATCH 01/16] chore: wire GitOps and Makefile to unified charts Update gitops.basePath to charts/ and add gitops.cloud (aro|rosa) parameter in both Terraform bootstraps. Update Makefile CHARTS_DIR. --- Makefile | 2 +- PCA_Deployment_ARO/terraform/gitops-bootstrap.tf | 4 +++- PCA_Deployment_ROSA/terraform/gitops-bootstrap.tf | 4 +++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 34a42a6..d6e754a 100644 --- a/Makefile +++ b/Makefile @@ -8,7 +8,7 @@ PROJECT_DIR := $(shell pwd) AI_NAMESPACE ?= private-assistant-ai-serving HF_TOKEN ?= $(HUGGINGFACE_TOKEN) MCP_ENABLED ?= false -CHARTS_DIR := PCA_Deployment_ROSA/charts +CHARTS_DIR := charts SCRIPTS_DIR := PCA_Deployment_ROSA/scripts DEPLOY_VALUES_DIR := deploy_existing_openshift diff --git a/PCA_Deployment_ARO/terraform/gitops-bootstrap.tf b/PCA_Deployment_ARO/terraform/gitops-bootstrap.tf index 562ac82..1323478 100644 --- a/PCA_Deployment_ARO/terraform/gitops-bootstrap.tf +++ b/PCA_Deployment_ARO/terraform/gitops-bootstrap.tf @@ -104,7 +104,9 @@ resource "null_resource" "argocd_app_of_apps" { - name: gitops.targetRevision value: ${var.gitops_repo_revision} - name: gitops.basePath - value: ${var.gitops_charts_path} + value: charts + - name: gitops.cloud + value: aro - name: hfToken.raw value: ${var.huggingface_token} destination: diff --git a/PCA_Deployment_ROSA/terraform/gitops-bootstrap.tf b/PCA_Deployment_ROSA/terraform/gitops-bootstrap.tf index 15e7b88..803e624 100644 --- a/PCA_Deployment_ROSA/terraform/gitops-bootstrap.tf +++ b/PCA_Deployment_ROSA/terraform/gitops-bootstrap.tf @@ -111,7 +111,9 @@ resource "null_resource" "argocd_app_of_apps" { - name: gitops.targetRevision value: ${var.gitops_repo_revision} - name: gitops.basePath - value: ${var.gitops_charts_path} + value: charts + - name: gitops.cloud + value: rosa - name: hfToken.raw value: ${var.huggingface_token} destination: From b66a8cabac181d38d472370d840469ac82c195be Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 11:56:00 +0300 Subject: [PATCH 02/16] docs: update directory structure and deployment docs for unified charts AGENTS.md reflects the new charts/ layout and six-wave structure. deploy_existing_openshift/README.md drops stale PCA_Deployment_ROSA/charts path references. Add unify-aro-rosa-plan.md to local-docs. --- AGENTS.md | 47 +++++++++++++++-------------- deploy_existing_openshift/README.md | 6 ++-- 2 files changed, 27 insertions(+), 26 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index de3ebdb..c96807f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -32,17 +32,17 @@ ArgoCD syncs these Helm charts in order (via `pca-app-of-apps`): | `pca-platform-config` | 2 | Namespaces, HF token, DSC/DSCI, NFD, NVIDIA ClusterPolicy, CheCluster, OAuth HTPasswd, Maas gateway, LWS CR; optional `pca-guardrails` / `pca-mcp` | AI ns (default `ai-serving`); optional per-dev namespaces | | `pca-ai-serving` | 3 | PVC, HardwareProfile, LLMInferenceService (llm-d/vLLM), llm-d gateway + HTTPRoute, RHCL AI Gateway (`pca-ai-gateway`) + AuthPolicy; `pca-observability` (Grafana; optional Langfuse/OTel) | AI ns | | `pca-devspaces` | 4 | DevWorkspace, Roo/Continue/Cline ConfigMaps, per-ns API keys, RBAC; global DevSpaces ConfigMaps | Per-dev ns; globals in `openshift-devspaces` | +| `pca-benchmarks` | 5 | GuideLLM sweep Job (one-shot; enabled per-cloud); disabled on ROSA by default | AI ns | ## Where each target deploys -| Target | Charts | -|--------|--------| -| **ROSA / ARO** | All five via ArgoCD | -| **Existing OpenShift** | `pca-platform-config`, `pca-ai-serving`, `pca-devspaces` only (Helm) | +| Target | Charts | Cloud-specific config | +|--------|--------|-----------------------| +| **ROSA** | All six via ArgoCD (`charts/`) | `values-rosa.yaml` per chart | +| **ARO** | All six via ArgoCD (`charts/`) | `values-aro.yaml` per chart | +| **Existing OpenShift** | `pca-platform-config`, `pca-ai-serving`, `pca-devspaces` only (Helm) | `deploy_existing_openshift/values-*.yaml` | -Existing OpenShift uses the charts under `PCA_Deployment_ROSA/charts` with overrides in `deploy_existing_openshift/`. - -ARO charts lag behind ROSA for most features; RHCL gateway pieces were mirrored for parity where practical. Full ARO migration to ROSA charts is still planned. +Both ROSA and ARO use the same unified `charts/` directory at the repo root. Cloud-specific values (hardware, storage class, model, enabled features) are in `values-aro.yaml` / `values-rosa.yaml` within each chart. Terraform injects `gitops.cloud: aro|rosa` to select the right overlay via ArgoCD `valueFiles`. ## ROSA / ARO — full from-scratch @@ -53,7 +53,7 @@ Terraform provisions the cluster; GitOps (`pca-app-of-apps`) syncs the five char ## Existing OpenShift — Helm-only -No infrastructure provisioning. Deploys onto a cluster that already has RHOAI, GPU operator, and DevSpaces installed. Uses ROSA charts via `make ai-serving-deploy-existing-openshift` (once) and `make devspace-deploy-existing-openshift` (one or more developers). +No infrastructure provisioning. Deploys onto a cluster that already has RHOAI, GPU operator, and DevSpaces installed. Uses the unified `charts/` via `make ai-serving-deploy-existing-openshift` (once) and `make devspace-deploy-existing-openshift` (one or more developers). Deploy AI serving first, then each DevSpace into its own `DEV_NAMESPACE` (or the AI ns for a single-dev setup). The first DevSpace release owns the global ConfigMaps in `openshift-devspaces`; later ones must pass `HELM_ARGS='--set devspacesGlobalConfig.enabled=false'` or Helm conflicts. @@ -75,21 +75,22 @@ Package lives in `tests/cluster-smoke/` (see its README). Optional Langfuse / OT ## Directory Structure ``` -PCA_Deployment_ROSA/ # Full ROSA (AWS) deployment — source of truth for charts -├── terraform/ # Cluster provisioning (VPC, ROSA, GPU node pool) -└── charts/ - ├── pca-app-of-apps/ # Root ArgoCD AppProject + child Applications - ├── pca-operators/ # Operator Subscriptions (RHOAI, GPU, DevSpaces, NFD, RHCL, …) - ├── pca-platform-config/ # Namespace, RBAC, secrets, DSC (+ optional guardrails, pca-mcp) - ├── pca-ai-serving/ # LLMInferenceService, llm-d + pca-ai-gateway, pca-observability - │ └── charts/pca-observability/ # Grafana + optional Langfuse/OTel Collector - └── pca-devspaces/ # Per-developer DevWorkspaces + Roo/Continue/Cline + API keys - -PCA_Deployment_ARO/ # Full ARO (Azure) — charts lag; will migrate to ROSA charts -├── terraform/ -└── charts/ - -deploy_existing_openshift/ # Helm value overrides (reuses ROSA charts) +charts/ # Unified Helm charts — single set for ROSA and ARO +├── pca-app-of-apps/ # Root ArgoCD AppProject + child Applications +├── pca-operators/ # Operator Subscriptions (RHOAI, GPU, DevSpaces, NFD, RHCL, …) +├── pca-platform-config/ # Namespace, RBAC, secrets, DSC (+ optional guardrails, pca-mcp) +├── pca-ai-serving/ # LLMInferenceService, llm-d + pca-ai-gateway; optional EPP, TLS job +│ └── charts/pca-observability/ # Grafana + optional Langfuse/OTel Collector +├── pca-devspaces/ # Per-developer DevWorkspaces + Roo/Continue/Cline + API keys +└── pca-benchmarks/ # GuideLLM sweep (optional; enabled in values-aro.yaml) + +PCA_Deployment_ROSA/ # ROSA (AWS) — Terraform only +└── terraform/ # Cluster provisioning (VPC, ROSA HCP, GPU node pool) + +PCA_Deployment_ARO/ # ARO (Azure) — Terraform only +└── terraform/ # Cluster provisioning (VNet, ARO cluster, GPU MachineSet) + +deploy_existing_openshift/ # Helm value overrides for existing OpenShift (no Terraform) ├── README.md # Deploy steps + parameters (incl. RHCL prerequisite) ├── values-platform-config.yaml ├── values-ai-serving.yaml diff --git a/deploy_existing_openshift/README.md b/deploy_existing_openshift/README.md index 71f190e..a30203e 100644 --- a/deploy_existing_openshift/README.md +++ b/deploy_existing_openshift/README.md @@ -1,6 +1,6 @@ # Deploying on an Existing OpenShift Cluster -Helm value overrides for deploying onto an existing OpenShift cluster (RHOAI, GPU operator, and DevSpaces already installed). Uses charts from `PCA_Deployment_ROSA/charts`. +Helm value overrides for deploying onto an existing OpenShift cluster (RHOAI, GPU operator, and DevSpaces already installed). Uses charts from `charts`. | Target | What it deploys | |--------|-----------------| @@ -146,7 +146,7 @@ oc get secret pca-langfuse-credentials -n $AI_NAMESPACE -o jsonpath='{.data.init **GPU $/hr PLACEHOLDER:** `cost.gpuHourlyUsd: 1.86` is illustrative L40S on-demand — **not** billing truth. Override per cluster and set `cost.gpuHourlyUsdIsPlaceholder: false`. -**Attribution:** Roo + Continue + Cline send `X-PCA-User` / `X-PCA-DevSpace` / optional `X-PCA-Team` (from `devspaces[].team`). Full prompt/completion bodies go to Langfuse when `ioCapture=full`. See `PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/README.md`. +**Attribution:** Roo + Continue + Cline send `X-PCA-User` / `X-PCA-DevSpace` / optional `X-PCA-Team` (from `devspaces[].team`). Full prompt/completion bodies go to Langfuse when `ioCapture=full`. See `charts/pca-ai-serving/charts/pca-observability/README.md`. ### Combined: Langfuse + MCP @@ -193,7 +193,7 @@ make mcp-disable AI_NAMESPACE= DEV_NAMESPACE= ### Adding more data sources -See `PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/README.md` for how to add further MCP servers (MariaDB, Confluence, Jira, GitLab) by enabling the disabled-by-default templates. +See `charts/pca-platform-config/charts/pca-mcp/README.md` for how to add further MCP servers (MariaDB, Confluence, Jira, GitLab) by enabling the disabled-by-default templates. --- From 2721d4ccacd03a8c4b03c1f06e77207dfeb56610 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 11:56:49 +0300 Subject: [PATCH 03/16] feat: unify ARO and ROSA Helm charts under charts Single chart set replaces the two parallel chart trees. ROSA charts serve as the base; cloud-specific config lives in values-aro.yaml values-rosa.yaml per chart. ARO gains observability, guardrails, MCP, and full IDE coverage (Roo Code + Continue + Cline). ROSA gains EPP, TLS cert job, benchmarks, and DevSpaces dashboard samples. --- .../charts/pca-ai-serving/Chart.yaml | 4 - .../templates/llm-d-gateway.yaml | 79 ------ .../templates/llminferenceservice.yaml | 224 ------------------ .../templates/pca-ai-gateway.yaml | 92 ------- .../charts/pca-ai-serving/templates/pvcs.yaml | 17 -- .../charts/pca-ai-serving/values.yaml | 21 -- .../charts/pca-app-of-apps/values.yaml | 6 - .../charts/pca-devspaces/Chart.yaml | 4 - .../pca-devspaces/templates/_helpers.tpl | 78 ------ .../templates/devworkspaces.yaml | 143 ----------- .../templates/opencode-image-build.yaml | 100 -------- .../pca-ai-gateway-apikey-secrets.yaml | 48 ---- .../templates/roo-code-configmaps.yaml | 41 ---- .../charts/pca-devspaces/values.yaml | 17 -- .../pca-operators/templates/cert-manager.yaml | 22 -- .../templates/leader-worker-set.yaml | 21 -- .../templates/lws-operator-cr.yaml | 11 - .../templates/nvidia-cluster-policy.yaml | 36 --- .../charts/pca-platform-config/Chart.yaml | 4 - .../templates/checluster.yaml | 52 ---- .../templates/datasciencecluster.yaml | 29 --- .../templates/hf-token-placeholder.yaml | 12 - .../templates/namespaces.yaml | 22 -- .../pca-platform-config/templates/rbac.yaml | 28 --- .../charts/pca-platform-config/values.yaml | 2 - .../charts/pca-app-of-apps/Chart.yaml | 4 - .../templates/00-app-of-apps.yaml | 155 ------------ .../charts/pca-operators/Chart.yaml | 4 - .../templates/subscriptions.yaml | 181 -------------- .../charts/pca-operators/values.yaml | 9 - .../pca-ai-serving/Chart.lock | 0 .../pca-ai-serving/Chart.yaml | 0 .../charts/pca-observability/Chart.lock | 0 .../charts/pca-observability/Chart.yaml | 0 .../charts/pca-observability/README.md | 0 .../charts/langfuse-1.5.38.tgz | Bin .../pca-observability/templates/_helpers.tpl | 0 .../templates/dashboards/board-a.yaml | 0 .../templates/dashboards/board-b.yaml | 0 .../templates/dashboards/board-c.yaml | 0 .../templates/dashboards/board-d.yaml | 0 .../grafana-dashboards-provider.yaml | 0 .../templates/grafana-datasources.yaml | 0 .../templates/grafana-rbac.yaml | 0 .../templates/grafana-secret.yaml | 0 .../pca-observability/templates/grafana.yaml | 0 .../templates/langfuse-model-prices.yaml | 0 .../templates/langfuse-route.yaml | 0 .../templates/langfuse-secret.yaml | 0 .../templates/otel-collector.yaml | 0 .../charts/pca-observability/values.yaml | 0 .../pca-ai-serving/files/pca_langfuse_io.py | 0 .../pca-ai-serving/templates/_helpers.tpl | 0 .../templates/hardware-profiles.yaml | 22 +- .../templates/inference-routing.yaml | 18 +- .../langfuse-io-middleware-configmap.yaml | 0 .../pca-ai-serving/templates/llm-d-epp.yaml | 22 +- .../templates/llm-d-gateway-httproute.yaml | 8 +- .../templates/llm-d-gateway.yaml | 2 +- .../templates/llminferenceservice.yaml | 35 +-- .../templates/pca-ai-gateway-authpolicy.yaml | 0 .../templates/pca-ai-gateway-httproute.yaml | 0 .../templates/pca-ai-gateway-kuadrant.yaml | 0 .../templates/pca-ai-gateway.yaml | 0 .../pca-ai-serving/templates/pvcs.yaml | 4 +- .../templates/tls-secret-job.yaml | 18 +- .../vllm-neuron-runtime-template.yaml | 0 charts/pca-ai-serving/values-aro.yaml | 42 ++++ charts/pca-ai-serving/values-rosa.yaml | 30 +++ .../pca-ai-serving/values.yaml | 26 ++ .../pca-app-of-apps/Chart.yaml | 0 .../templates/00-app-of-apps.yaml | 28 ++- .../pca-app-of-apps/values.yaml | 1 + .../pca-benchmarks/Chart.yaml | 0 .../templates/guidellm-sweep.yaml | 10 +- charts/pca-benchmarks/values-aro.yaml | 3 + charts/pca-benchmarks/values-rosa.yaml | 1 + charts/pca-benchmarks/values.yaml | 4 + .../pca-devspaces/Chart.yaml | 0 .../pca-devspaces/templates/_helpers.tpl | 0 .../templates/cline-configmaps.yaml | 0 .../templates/continue-configmaps.yaml | 0 .../devspaces-dashboard-samples.yaml | 6 +- .../templates/devspaces-global-config.yaml | 0 .../templates/devworkspaces.yaml | 0 .../templates/opencode-image-build.yaml | 0 .../opencode-web-password-secret.yaml | 0 .../pca-ai-gateway-apikey-secrets.yaml | 0 .../pca-devspaces/templates/rbac.yaml | 0 .../templates/roo-code-configmaps.yaml | 0 .../templates/vscode-extensions-config.yaml | 0 charts/pca-devspaces/values-aro.yaml | 15 ++ .../pca-devspaces/values-rosa.yaml | 0 .../pca-devspaces/values.yaml | 2 + .../pca-operators/Chart.yaml | 0 .../pca-operators/templates/cert-manager.yaml | 0 .../templates/leader-worker-set.yaml | 0 .../templates/subscriptions.yaml | 116 ++++++--- charts/pca-operators/values-aro.yaml | 11 + charts/pca-operators/values-rosa.yaml | 1 + .../pca-operators/values.yaml | 10 + .../pca-platform-config/Chart.lock | 0 .../pca-platform-config/Chart.yaml | 0 .../charts/pca-guardrails/Chart.yaml | 0 .../charts/pca-guardrails/README.md | 0 .../pca-guardrails/files/custom_detectors.py | 0 .../pca-guardrails/files/guardrails_proxy.py | 0 .../pca-guardrails/templates/_helpers.tpl | 0 .../templates/detector-model-cache-pvc.yaml | 0 .../templates/detector-serving-runtime.yaml | 0 .../templates/guardrails-gateway-config.yaml | 0 .../guardrails-orchestrator-config.yaml | 0 .../templates/guardrails-orchestrator.yaml | 0 .../templates/guardrails-proxy.yaml | 0 .../templates/prompt-injection-detector.yaml | 0 .../charts/pca-guardrails/values.yaml | 0 .../charts/pca-mcp/Chart.yaml | 0 .../charts/pca-mcp/README.md | 0 .../templates/mcp-gateway-extension.yaml | 0 .../charts/pca-mcp/templates/mcp-gateway.yaml | 0 .../pca-mcp/templates/mcpserver-mariadb.yaml | 0 .../templates/mcpserver-openshift.yaml | 0 .../templates/mcpserver-registration.yaml | 0 .../charts/pca-mcp/templates/rbac.yaml | 0 .../charts/pca-mcp/values.yaml | 0 .../templates/checluster.yaml | 0 .../templates/datasciencecluster.yaml | 0 .../templates/dscinitializations.yaml | 0 .../templates/hf-token-placeholder.yaml | 0 .../templates/lws-operator-cr.yaml | 0 .../templates/maas-gateway.yaml | 0 .../templates/namespaces.yaml | 0 .../templates/nfd-instance.yaml | 0 .../templates/nvidia-cluster-policy.yaml | 0 .../templates/oauth-htpasswd.yaml | 0 charts/pca-platform-config/values-aro.yaml | 7 + charts/pca-platform-config/values-rosa.yaml | 1 + .../pca-platform-config/values.yaml | 0 138 files changed, 340 insertions(+), 1569 deletions(-) delete mode 100644 PCA_Deployment_ARO/charts/pca-ai-serving/Chart.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-ai-serving/templates/llm-d-gateway.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-ai-serving/templates/llminferenceservice.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-ai-serving/templates/pca-ai-gateway.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-ai-serving/templates/pvcs.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-ai-serving/values.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-app-of-apps/values.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-devspaces/Chart.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-devspaces/templates/_helpers.tpl delete mode 100644 PCA_Deployment_ARO/charts/pca-devspaces/templates/devworkspaces.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-devspaces/templates/opencode-image-build.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-devspaces/templates/roo-code-configmaps.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-devspaces/values.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-operators/templates/cert-manager.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-operators/templates/leader-worker-set.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-operators/templates/lws-operator-cr.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-operators/templates/nvidia-cluster-policy.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-platform-config/Chart.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-platform-config/templates/checluster.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-platform-config/templates/datasciencecluster.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-platform-config/templates/hf-token-placeholder.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-platform-config/templates/namespaces.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-platform-config/templates/rbac.yaml delete mode 100644 PCA_Deployment_ARO/charts/pca-platform-config/values.yaml delete mode 100644 PCA_Deployment_ROSA/charts/pca-app-of-apps/Chart.yaml delete mode 100644 PCA_Deployment_ROSA/charts/pca-app-of-apps/templates/00-app-of-apps.yaml delete mode 100644 PCA_Deployment_ROSA/charts/pca-operators/Chart.yaml delete mode 100644 PCA_Deployment_ROSA/charts/pca-operators/templates/subscriptions.yaml delete mode 100644 PCA_Deployment_ROSA/charts/pca-operators/values.yaml rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/Chart.lock (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/Chart.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/Chart.lock (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/Chart.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/README.md (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/charts/langfuse-1.5.38.tgz (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/_helpers.tpl (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/dashboards/board-a.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/dashboards/board-b.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/dashboards/board-c.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/dashboards/board-d.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/grafana-dashboards-provider.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/grafana-datasources.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/grafana-rbac.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/grafana.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/langfuse-model-prices.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/langfuse-route.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/langfuse-secret.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/templates/otel-collector.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/charts/pca-observability/values.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/files/pca_langfuse_io.py (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/_helpers.tpl (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/hardware-profiles.yaml (55%) rename {PCA_Deployment_ARO/charts => charts}/pca-ai-serving/templates/inference-routing.yaml (77%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/langfuse-io-middleware-configmap.yaml (100%) rename {PCA_Deployment_ARO/charts => charts}/pca-ai-serving/templates/llm-d-epp.yaml (96%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/llm-d-gateway-httproute.yaml (86%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/llm-d-gateway.yaml (85%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/llminferenceservice.yaml (75%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/pca-ai-gateway-authpolicy.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/pca-ai-gateway-httproute.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/pca-ai-gateway-kuadrant.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/pca-ai-gateway.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/pvcs.yaml (68%) rename {PCA_Deployment_ARO/charts => charts}/pca-ai-serving/templates/tls-secret-job.yaml (81%) rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/templates/vllm-neuron-runtime-template.yaml (100%) create mode 100644 charts/pca-ai-serving/values-aro.yaml create mode 100644 charts/pca-ai-serving/values-rosa.yaml rename {PCA_Deployment_ROSA/charts => charts}/pca-ai-serving/values.yaml (81%) rename {PCA_Deployment_ARO/charts => charts}/pca-app-of-apps/Chart.yaml (100%) rename {PCA_Deployment_ARO/charts => charts}/pca-app-of-apps/templates/00-app-of-apps.yaml (84%) rename {PCA_Deployment_ROSA/charts => charts}/pca-app-of-apps/values.yaml (93%) rename {PCA_Deployment_ARO/charts => charts}/pca-benchmarks/Chart.yaml (100%) rename {PCA_Deployment_ARO/charts => charts}/pca-benchmarks/templates/guidellm-sweep.yaml (95%) create mode 100644 charts/pca-benchmarks/values-aro.yaml create mode 100644 charts/pca-benchmarks/values-rosa.yaml create mode 100644 charts/pca-benchmarks/values.yaml rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/Chart.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/_helpers.tpl (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/cline-configmaps.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/continue-configmaps.yaml (100%) rename {PCA_Deployment_ARO/charts => charts}/pca-devspaces/templates/devspaces-dashboard-samples.yaml (96%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/devspaces-global-config.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/devworkspaces.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/opencode-image-build.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/opencode-web-password-secret.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/rbac.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/templates/roo-code-configmaps.yaml (100%) rename {PCA_Deployment_ARO/charts => charts}/pca-devspaces/templates/vscode-extensions-config.yaml (100%) create mode 100644 charts/pca-devspaces/values-aro.yaml rename PCA_Deployment_ARO/charts/pca-benchmarks/values.yaml => charts/pca-devspaces/values-rosa.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-devspaces/values.yaml (96%) rename {PCA_Deployment_ARO/charts => charts}/pca-operators/Chart.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-operators/templates/cert-manager.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-operators/templates/leader-worker-set.yaml (100%) rename {PCA_Deployment_ARO/charts => charts}/pca-operators/templates/subscriptions.yaml (75%) create mode 100644 charts/pca-operators/values-aro.yaml create mode 100644 charts/pca-operators/values-rosa.yaml rename {PCA_Deployment_ARO/charts => charts}/pca-operators/values.yaml (71%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/Chart.lock (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/Chart.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/Chart.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/README.md (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/files/custom_detectors.py (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/files/guardrails_proxy.py (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/_helpers.tpl (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/detector-model-cache-pvc.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/detector-serving-runtime.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/guardrails-gateway-config.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator-config.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/guardrails-proxy.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/templates/prompt-injection-detector.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-guardrails/values.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/Chart.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/README.md (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/templates/mcp-gateway-extension.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/templates/mcp-gateway.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/templates/mcpserver-mariadb.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/templates/mcpserver-openshift.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/templates/mcpserver-registration.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/templates/rbac.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/charts/pca-mcp/values.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/checluster.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/datasciencecluster.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/dscinitializations.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/hf-token-placeholder.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/lws-operator-cr.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/maas-gateway.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/namespaces.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/nfd-instance.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/nvidia-cluster-policy.yaml (100%) rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/templates/oauth-htpasswd.yaml (100%) create mode 100644 charts/pca-platform-config/values-aro.yaml create mode 100644 charts/pca-platform-config/values-rosa.yaml rename {PCA_Deployment_ROSA/charts => charts}/pca-platform-config/values.yaml (100%) diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/Chart.yaml b/PCA_Deployment_ARO/charts/pca-ai-serving/Chart.yaml deleted file mode 100644 index 80f5a98..0000000 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/Chart.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v2 -name: pca-ai-serving -version: 0.1.0 -description: PCA AI Serving — models, gateway, PVCs, inference routing diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llm-d-gateway.yaml b/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llm-d-gateway.yaml deleted file mode 100644 index 4cc2e03..0000000 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llm-d-gateway.yaml +++ /dev/null @@ -1,79 +0,0 @@ -# Red Hat AI Gateway (llm-d) with EPP-based intelligent routing. -# -# Traffic flow (scalable pattern): -# Client → Data Science Gateway (TLS termination, port 443) -# → HTTPRoute → EPP Envoy proxy (port 8081) -# → EPP ExtProc (picks optimal replica via queue depth + prefix cache scoring) -# → vLLM pod (port 8000) -# -# The /v1/models endpoint routes directly to the predictor Service -# since it's a metadata query, not an inference request. -# -# Internal DNS endpoint: -# https://llm-d-gateway-data-science-gateway-class.ai-serving.svc.cluster.local -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - name: llm-d-gateway - namespace: ai-serving - annotations: - argocd.argoproj.io/sync-wave: "3" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - gatewayClassName: data-science-gateway-class - listeners: - - name: https - port: 443 - protocol: HTTPS - tls: - mode: Terminate - certificateRefs: - - name: llm-d-gateway-tls - kind: Secret - allowedRoutes: - namespaces: - from: Same ---- -# Inference requests route through EPP Envoy for intelligent replica selection. -# Metadata requests (/v1/models) bypass EPP and go directly to the predictor. -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: model-route - namespace: ai-serving - annotations: - argocd.argoproj.io/sync-wave: "5" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: llm-d-gateway - namespace: ai-serving - rules: - - matches: - - path: - type: PathPrefix - value: /v1/models - backendRefs: - - group: "" - kind: Service - name: qwen36-vllm-predictor - port: 80 - weight: 1 - timeouts: - backendRequest: "0s" - request: "0s" - - matches: - - path: - type: PathPrefix - value: /v1 - backendRefs: - - group: "" - kind: Service - name: llm-d-epp - port: 8081 - weight: 1 - timeouts: - backendRequest: "0s" - request: "0s" diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llminferenceservice.yaml b/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llminferenceservice.yaml deleted file mode 100644 index e63903e..0000000 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llminferenceservice.yaml +++ /dev/null @@ -1,224 +0,0 @@ -# Qwen3.6-35B-A3B-FP8 on NVIDIA H100 NVL 94 GB -# Served via KServe RawDeployment with custom vLLM v0.19.0 ServingRuntime -# Routed through the Red Hat AI Gateway (llm-d) for production traffic -# -# Why vLLM v0.19.0 (upstream) instead of RHOAI bundled vLLM? -# - RHOAI 3.3.1 bundles vllm-cuda-rhel9 based on vLLM ~0.13, which uses -# transformers <5.x and does not recognise Qwen3_5MoeForConditionalGeneration. -# - Qwen3.6-35B-A3B-FP8 requires transformers >=5.1 and vLLM >=0.18 for native -# Qwen3.5-MoE architecture support, DeepGEMM FP8 MoE kernels, and -# FlashAttention v3 on H100. -# - vLLM v0.19.0 ships with PyTorch 2.10 + CUDA 12.9. The host NVIDIA driver -# is 550 (CUDA 12.4), so VLLM_ENABLE_CUDA_COMPATIBILITY=1 bridges the gap -# using compat libs (575.57.08). -# -# Model: Qwen3.6 MoE — 35B total / 3B active, 256 experts, FP8 weights (~35GB). -# Fits H100 94GB HBM3 with ample KV cache headroom. -# -# PVC for model weights is defined in pvcs.yaml (100Gi managed-csi). -# -# ─── Tool Calling & Reasoning Parser Configuration ─────────────────────────── -# -# Qwen3.x models use XML-format tool calls and emit ... blocks. -# The vLLM parser configuration MUST match the model family: -# -# --tool-call-parser=qwen3_xml Qwen3.x XML tool calls (required) -# --reasoning-parser=qwen3 Strips into the reasoning field -# --enable-auto-tool-choice Lets the model decide when to invoke tools -# -# DO NOT USE for Qwen3.x: -# --tool-call-parser=hermes Causes leak, tool calls silently dropped -# --tool-call-parser=qwen3_coder Streaming bugs in vLLM 0.19 (fixed in 0.20+) -# tool_choice="required" JSON-only server path; fails with XML tool calls -# -# Client-side requirements (OpenCode / any OpenAI-compatible client): -# enable_thinking: true Default; lets model reason before tool calls -# tool_choice: "auto" NEVER use "required" with Qwen3.x -# -# Parser compatibility matrix (change these args when swapping models): -# -# Model Family tool-call-parser reasoning-parser min vLLM -# ───────────────────── ────────────────── ────────────────── ──────── -# Qwen3.6 / Qwen3.5 qwen3_xml qwen3 0.19.0 -# Qwen2.5 hermes (none) 0.13+ -# DeepSeek R1 / V3 hermes deepseek_r1 0.18+ -# Llama 3.x llama3_json (none) 0.15+ -# Mistral / Mixtral mistral (none) 0.14+ -# -# ───────────────────────────────────────────────────────────────────────────── -apiVersion: infrastructure.opendatahub.io/v1 -kind: HardwareProfile -metadata: - name: nvidia-h100-gpu - namespace: redhat-ods-applications - labels: - app.kubernetes.io/part-of: hardwareprofile - app.opendatahub.io/hardwareprofile: "true" - annotations: - opendatahub.io/display-name: "NVIDIA H100 GPU" - opendatahub.io/description: "NVIDIA H100 NVL 94GB HBM3 for LLM inference with vLLM." - opendatahub.io/disabled: "false" - opendatahub.io/managed: "false" - opendatahub.io/dashboard-feature-visibility: '["model-serving"]' -spec: - identifiers: - - displayName: CPU - identifier: cpu - resourceType: CPU - defaultCount: 8 - minCount: 4 - maxCount: 16 - - displayName: Memory - identifier: memory - resourceType: Memory - defaultCount: 80Gi - minCount: 40Gi - maxCount: 120Gi - - displayName: NVIDIA GPU - identifier: nvidia.com/gpu - defaultCount: 1 - minCount: 1 - maxCount: 1 - nodeSelectors: - - key: nvidia.com/gpu.product - value: NVIDIA-H100-NVL ---- -apiVersion: serving.kserve.io/v1alpha1 -kind: ServingRuntime -metadata: - name: vllm-cuda-v0190 - namespace: ai-serving - labels: - opendatahub.io/dashboard: "true" - annotations: - openshift.io/display-name: "vLLM v0.19.0 NVIDIA GPU (Custom)" - opendatahub.io/template-display-name: "vLLM v0.19.0 NVIDIA GPU (Custom)" - opendatahub.io/template-name: vllm-cuda-v0190 - opendatahub.io/apiProtocol: REST - opendatahub.io/accelerator-name: nvidia.com/gpu -spec: - annotations: - prometheus.io/port: "8000" - prometheus.io/path: /metrics - prometheus.io/scrape: "true" - multiModel: false - supportedModelFormats: - - name: vLLM - version: "1" - autoSelect: true - containers: - - name: kserve-container - image: vllm/vllm-openai:v0.19.0 - command: - - python3 - - -m - - vllm.entrypoints.openai.api_server - args: - - --port=8000 - - --served-model-name=Qwen/Qwen3.6-35B-A3B-FP8 - - --trust-remote-code - - --enable-prefix-caching - - --enable-auto-tool-choice - - --tool-call-parser=qwen3_xml - - --reasoning-parser=qwen3 - env: - - name: VLLM_ENABLE_CUDA_COMPATIBILITY - value: "1" - - name: LD_LIBRARY_PATH - value: "/usr/local/cuda/compat:/usr/local/cuda/lib64:/usr/lib64" - - name: HF_HOME - value: "/model-cache" - - name: HF_HUB_OFFLINE - value: "0" - - name: TRITON_CACHE_DIR - value: "/model-cache/triton-cache" - - name: XDG_CACHE_HOME - value: "/model-cache/xdg-cache" - - name: HOME - value: "/tmp" - - name: DG_JIT_CACHE_DIR - value: "/model-cache/deep-gemm" - - name: VLLM_CACHE_ROOT - value: "/model-cache/vllm-cache" - ports: - - containerPort: 8000 - name: http - protocol: TCP - startupProbe: - httpGet: - path: /health - port: 8000 - initialDelaySeconds: 30 - periodSeconds: 30 - failureThreshold: 120 - timeoutSeconds: 10 - readinessProbe: - httpGet: - path: /health - port: 8000 - periodSeconds: 10 - failureThreshold: 3 - timeoutSeconds: 5 - livenessProbe: - httpGet: - path: /health - port: 8000 - periodSeconds: 30 - failureThreshold: 3 - timeoutSeconds: 10 - volumeMounts: - - name: model-cache - mountPath: /model-cache - - name: shm - mountPath: /dev/shm - volumes: - - name: model-cache - persistentVolumeClaim: - claimName: model-cache - - name: shm - emptyDir: - medium: Memory - sizeLimit: 16Gi ---- -apiVersion: serving.kserve.io/v1beta1 -kind: InferenceService -metadata: - name: qwen36-vllm - namespace: ai-serving - labels: - opendatahub.io/dashboard: "true" - annotations: - openshift.io/display-name: "Qwen 3.6-35B-A3B-FP8" - serving.kserve.io/deploymentMode: RawDeployment - opendatahub.io/accelerator-name: nvidia.com/gpu - # Scaling: increase maxReplicas and add GPU nodes to scale out. - # Each replica requires 1x H100 GPU. The InferencePool + EPP - # automatically discovers new replicas and routes intelligently. - # To scale: oc scale machineset --replicas=N - # then update maxReplicas below to match. -spec: - predictor: - minReplicas: 1 - maxReplicas: 4 - tolerations: - - key: nvidia.com/gpu - operator: Equal - value: "present" - effect: NoSchedule - model: - modelFormat: - name: vLLM - runtime: vllm-cuda-v0190 - args: - - --model=Qwen/Qwen3.6-35B-A3B-FP8 - - --tensor-parallel-size=1 - - --max-model-len=262144 - resources: - requests: - cpu: "8" - memory: 80Gi - nvidia.com/gpu: "1" - limits: - cpu: "16" - memory: 120Gi - nvidia.com/gpu: "1" diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/pca-ai-gateway.yaml b/PCA_Deployment_ARO/charts/pca-ai-serving/templates/pca-ai-gateway.yaml deleted file mode 100644 index 2701cd5..0000000 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/pca-ai-gateway.yaml +++ /dev/null @@ -1,92 +0,0 @@ -{{- if .Values.aiGateway.enabled | default false }} -{{/* - RHCL AI Gateway front door (ARO). Separate hop in front of llm-d. - Client URL: https://{{ .Values.aiGateway.name | default "pca-ai-gateway" }}-data-science-gateway-class.ai-serving.svc.cluster.local/v1 -*/}} -{{- $ns := .Values.namespace | default "ai-serving" }} -{{- $gwName := .Values.aiGateway.name | default "pca-ai-gateway" }} -{{- $tlsSecret := (.Values.aiGateway.tls).secretName | default "llm-d-gateway-tls" }} -apiVersion: gateway.networking.k8s.io/v1 -kind: Gateway -metadata: - name: {{ $gwName }} - namespace: {{ $ns }} - labels: - kuadrant.io/gateway: "true" - app.kubernetes.io/component: pca-ai-gateway - annotations: - argocd.argoproj.io/sync-wave: "3" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - gatewayClassName: data-science-gateway-class - listeners: - - name: https - port: 443 - protocol: HTTPS - tls: - mode: Terminate - certificateRefs: - - name: {{ $tlsSecret }} - kind: Secret - allowedRoutes: - namespaces: - from: Same ---- -{{- if (.Values.aiGateway.backends).local.enabled | default true }} -apiVersion: gateway.networking.k8s.io/v1 -kind: HTTPRoute -metadata: - name: {{ $gwName }}-local - namespace: {{ $ns }} - labels: - app.kubernetes.io/component: pca-ai-gateway - annotations: - argocd.argoproj.io/sync-wave: "5" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - parentRefs: - - group: gateway.networking.k8s.io - kind: Gateway - name: {{ $gwName }} - namespace: {{ $ns }} - rules: - - matches: - - path: - type: PathPrefix - value: /v1 - backendRefs: - - group: "" - kind: Service - name: llm-d-gateway-data-science-gateway-class - port: 443 - weight: 1 - timeouts: - backendRequest: "0s" - request: "0s" ---- -apiVersion: kuadrant.io/v1 -kind: AuthPolicy -metadata: - name: {{ $gwName }}-apikey - namespace: {{ $ns }} - labels: - app.kubernetes.io/component: pca-ai-gateway - annotations: - argocd.argoproj.io/sync-wave: "6" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - targetRef: - group: gateway.networking.k8s.io - kind: HTTPRoute - name: {{ $gwName }}-local - rules: - authentication: - "pca-ai-gateway-apikey": - apiKey: - allNamespaces: true - selector: - matchLabels: - app.kubernetes.io/component: pca-ai-gateway-apikey - authorino.kuadrant.io/managed-by: authorino -{{- end }} -{{- end }} diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/pvcs.yaml b/PCA_Deployment_ARO/charts/pca-ai-serving/templates/pvcs.yaml deleted file mode 100644 index 60bfa9a..0000000 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/pvcs.yaml +++ /dev/null @@ -1,17 +0,0 @@ -# Persistent Volume Claims for model weight caching. -# Using PVCs avoids re-downloading models on pod restarts (~30GB for Qwen3.6-35B-A3B-FP8). -# Azure managed-csi (default ARO storage class) replaces AWS gp3-csi. -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: model-cache - namespace: ai-serving - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - accessModes: - - ReadWriteOnce - storageClassName: managed-csi - resources: - requests: - storage: 100Gi diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/values.yaml b/PCA_Deployment_ARO/charts/pca-ai-serving/values.yaml deleted file mode 100644 index 8d1ce66..0000000 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/values.yaml +++ /dev/null @@ -1,21 +0,0 @@ -# ARO pca-ai-serving values (namespace often hardcoded in templates; kept for overrides). -namespace: ai-serving -aiGateway: - enabled: true - name: pca-ai-gateway - escapeHatchToLlmd: false - tls: - secretName: llm-d-gateway-tls - backends: - local: - enabled: true - otherCluster: - enabled: false - url: "" - external: - enabled: false - url: "" - rateLimits: - enabled: false - ha: - replicas: 1 diff --git a/PCA_Deployment_ARO/charts/pca-app-of-apps/values.yaml b/PCA_Deployment_ARO/charts/pca-app-of-apps/values.yaml deleted file mode 100644 index 49ff894..0000000 --- a/PCA_Deployment_ARO/charts/pca-app-of-apps/values.yaml +++ /dev/null @@ -1,6 +0,0 @@ -gitops: - repoURL: "__overridden_at_deploy_time__" - targetRevision: main - basePath: "__overridden_at_deploy_time__" -hfToken: - raw: "__overridden_at_deploy_time__" diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/Chart.yaml b/PCA_Deployment_ARO/charts/pca-devspaces/Chart.yaml deleted file mode 100644 index 6da3a41..0000000 --- a/PCA_Deployment_ARO/charts/pca-devspaces/Chart.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v2 -name: pca-devspaces -version: 0.1.0 -description: PCA DevSpaces — workspaces, extensions, OpenCode, dashboard samples diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/templates/_helpers.tpl b/PCA_Deployment_ARO/charts/pca-devspaces/templates/_helpers.tpl deleted file mode 100644 index ce054d6..0000000 --- a/PCA_Deployment_ARO/charts/pca-devspaces/templates/_helpers.tpl +++ /dev/null @@ -1,78 +0,0 @@ -{{/* - llm-d ClusterIP URL (escape hatch / direct path). -*/}} -{{- define "pca-devspaces.llmdBaseUrl" -}} -{{- $ns := .Values.aiServingNamespace | default "ai-serving" -}} -{{- printf "https://llm-d-gateway-data-science-gateway-class.%s.svc.cluster.local/v1" $ns -}} -{{- end -}} - -{{/* - Default IDE OpenAI-compatible base URL. - - Priority: - 1. guardrails.enabled → guardrails.endpoint/v1 - 2. escapeHatchToLlmd OR aiGateway disabled → llm-d - 3. else → RHCL pca-ai-gateway /v1 -*/}} -{{- define "pca-devspaces.aiGateway.baseUrl" -}} -{{- $ai := .Values.aiGateway | default dict -}} -{{- if .Values.guardrails.enabled -}} -{{- printf "%s/v1" .Values.guardrails.endpoint -}} -{{- else if or ($ai.escapeHatchToLlmd | default false) (not ($ai.enabled | default true)) -}} -{{- include "pca-devspaces.llmdBaseUrl" . -}} -{{- else -}} -{{- $ns := .Values.aiServingNamespace | default "ai-serving" -}} -{{- $name := $ai.name | default "pca-ai-gateway" -}} -{{- $class := $ai.gatewayClassName | default "data-science-gateway-class" -}} -{{- printf "https://%s-%s.%s.svc.cluster.local/v1" $name $class $ns -}} -{{- end -}} -{{- end -}} - -{{/* - Whether IDEs must present an RHCL API key (Bearer). -*/}} -{{- define "pca-devspaces.aiGateway.requiresApiKey" -}} -{{- $ai := .Values.aiGateway | default dict -}} -{{- if and ($ai.enabled | default true) (not ($ai.escapeHatchToLlmd | default false)) (not .Values.guardrails.enabled) -}} -true -{{- else -}} -false -{{- end -}} -{{- end -}} - -{{/* - API key for a DevSpaces namespace. - - Prefer an existing Secret (survives upgrades / rotation). - Otherwise use a deterministic key shared across Secret + ConfigMap templates - in the same Helm render (lookup cannot see Secrets created in this release). - - Caller: dict "root" $ "ns" $devNamespace -*/}} -{{- define "pca-devspaces.aiGateway.apiKey" -}} -{{- $root := .root -}} -{{- $ns := .ns -}} -{{- $secretName := (($root.Values.aiGateway).apiKeySecretName | default "pca-ai-gw-apikey") -}} -{{- $existing := lookup "v1" "Secret" $ns $secretName -}} -{{- if and $existing $existing.data (index $existing.data "api_key") -}} -{{- index $existing.data "api_key" | b64dec -}} -{{- else -}} -{{- $seed := (($root.Values.aiGateway).apiKeySeed | default $root.Release.Name) -}} -{{- printf "%s/%s/pca-ai-gw" $seed $ns | sha256sum | trunc 48 -}} -{{- end -}} -{{- end -}} - -{{/* - IDE apiKey field value: real RHCL key when required, else EMPTY (llm-d has auth off). - Caller: dict "root" $ "ns" $devNamespace - - OpenCode: image/auth.json may bake EMPTY; overwritten at workspace postStart - from OPENAI_API_KEY (this helper) — same pattern as ROSA. -*/}} -{{- define "pca-devspaces.aiGateway.ideApiKey" -}} -{{- if eq (include "pca-devspaces.aiGateway.requiresApiKey" .root) "true" -}} -{{- include "pca-devspaces.aiGateway.apiKey" . -}} -{{- else -}} -EMPTY -{{- end -}} -{{- end -}} diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/templates/devworkspaces.yaml b/PCA_Deployment_ARO/charts/pca-devspaces/templates/devworkspaces.yaml deleted file mode 100644 index 4f4d20f..0000000 --- a/PCA_Deployment_ARO/charts/pca-devspaces/templates/devworkspaces.yaml +++ /dev/null @@ -1,143 +0,0 @@ -# DevWorkspace TEMPLATE for OpenCode workspaces. -# -# IMPORTANT — DevSpaces Namespace Provisioning: -# DevWorkspaces CANNOT be pre-deployed via ArgoCD into statically-named -# namespaces. DevSpaces auto-provisions a unique namespace for each user -# the first time they log into the DevSpaces dashboard: -# -# Pattern: -devspaces- -# Example: Dev1 → dev1-devspaces-wk1ug6 -# -# The DevWorkspace controller sets a `controller.devfile.io/creator` label -# to the user's UID. The dashboard ONLY shows workspaces where this label -# matches the logged-in user's UID. Workspaces created by kubeadmin (or -# any other user) will be invisible to the target user. -# -# Correct workspace creation procedure: -# 1. Create users via HTPasswd IDP (see scripts/setup-devspaces-users.sh) -# 2. Each user logs into the DevSpaces dashboard (triggers NS provisioning) -# 3. Run scripts/setup-devspaces-users.sh which: -# a. Logs in as each user via `oc login` -# b. Discovers the auto-provisioned namespace -# c. Creates per-ns RHCL API key Secrets (+ AI ns mirror for Authorino) -# d. Grants image-puller RBAC for the custom OpenCode image -# e. Creates the DevWorkspace AS the user with OPENAI_API_KEY set -# f. postStart write-opencode-config overwrites image-baked auth.json EMPTY -# -# This file is a REFERENCE TEMPLATE — it is not applied by ArgoCD. -# The actual workspace creation is handled by the setup script. -# -# Extension auto-installation: -# The OpenCode VS Code extension (sst-dev.opencode) is auto-installed via -# the DEFAULT_EXTENSIONS env var (official CheCode mechanism). The postStart -# command downloads the .vsix from Open VSX and the editor picks it up. -# See: https://eclipse.dev/che/docs/stable/administration-guide/default-extensions-for-microsoft-visual-studio-code/ -# -# Model endpoint (RHCL AI Gateway → llm-d EPP → vLLM): -# {{ include "pca-devspaces.aiGateway.baseUrl" . }} -# Escape hatch (direct llm-d): set aiGateway.escapeHatchToLlmd=true. -{{- $baseUrl := include "pca-devspaces.aiGateway.baseUrl" . }} -apiVersion: workspace.devfile.io/v1alpha2 -kind: DevWorkspace -metadata: - name: opencode-PLACEHOLDER_USERNAME - # namespace: Set dynamically — must be the DevSpaces auto-provisioned namespace - # (e.g., dev1-devspaces-wk1ug6), NOT a statically-named namespace. - labels: - che.eclipse.org/devworkspace: "true" - annotations: - che.eclipse.org/devfile-source: | - factory: - params: url=https://github.com/manujoy7/Private_AI_Coding_Assistant.git -spec: - started: true - routingClass: che - contributions: - - name: editor - uri: "https://eclipse-che.github.io/che-plugin-registry/main/v3/plugins/che-incubator/che-code/latest/devfile.yaml" - template: - projects: - - name: private-ai-coding-assistant - git: - remotes: - origin: https://github.com/manujoy7/Private_AI_Coding_Assistant.git - components: - - name: dev-tools - container: - image: image-registry.openshift-image-registry.svc:5000/opencode-build/devspaces-opencode:latest - memoryLimit: 8Gi - memoryRequest: 1Gi - cpuLimit: "4000m" - cpuRequest: 500m - mountSources: true - env: - - name: VLLM_ENDPOINT - value: {{ $baseUrl | quote }} - - name: VLLM_MODEL_ID - value: {{ .Values.modelId | quote }} - # PLACEHOLDER_API_KEY — setup-devspaces-users.sh overwrites at provision time - # with the per-ns RHCL key (same as ROSA ideApiKey → OPENAI_API_KEY). - - name: OPENAI_API_KEY - value: "PLACEHOLDER_API_KEY" - - name: OPENAI_BASE_URL - value: {{ $baseUrl | quote }} - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: "0" - - name: OPENCODE_SERVER_PASSWORD - value: "PLACEHOLDER_PASSWORD" - - name: DEFAULT_EXTENSIONS - value: "/tmp/opencode-ext/sst-dev.opencode.vsix" - endpoints: - - name: opencode-web - targetPort: 4096 - exposure: public - protocol: https - attributes: - cookiesAuthEnabled: true - commands: - - id: write-opencode-config - exec: - label: "Write OpenCode Config" - component: dev-tools - commandLine: | - mkdir -p ~/.config/opencode ~/.local/share/opencode - python3 -c " - import json, os - config = { - '\x24schema': 'https://opencode.ai/config.json', - 'provider': { - 'vllm': { - 'npm': '@ai-sdk/openai-compatible', - 'name': 'Private AI Gateway (llm-d)', - 'options': {'baseURL': os.environ['OPENAI_BASE_URL']}, - 'models': {os.environ['VLLM_MODEL_ID']: {'name': os.environ['VLLM_MODEL_ID']}} - } - }, - 'model': 'vllm/' + os.environ['VLLM_MODEL_ID'] - } - open(os.path.expanduser('~/.config/opencode/opencode.json'), 'w').write(json.dumps(config, indent=2)) - " - # Overwrites image-baked auth.json EMPTY at workspace postStart - echo "{\"vllm\":{\"type\":\"api\",\"key\":\"$OPENAI_API_KEY\"}}" > ~/.local/share/opencode/auth.json - echo "OpenCode config written" - - id: download-opencode-extension - exec: - component: dev-tools - commandLine: | - mkdir -p /tmp/opencode-ext - curl -fsSL "https://open-vsx.org/api/sst-dev/opencode/latest/file/sst-dev.opencode-0.0.13.vsix" \ - --location -o /tmp/opencode-ext/sst-dev.opencode.vsix - echo "OpenCode extension downloaded" - label: "Download OpenCode Extension" - - id: start-opencode-web - exec: - component: dev-tools - commandLine: | - nohup opencode web --port 4096 --hostname 0.0.0.0 > /tmp/opencode-web.log 2>&1 & - echo "OpenCode Web UI started on port 4096" - label: "Start OpenCode Web UI" - events: - postStart: - - write-opencode-config - - download-opencode-extension - - start-opencode-web diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/templates/opencode-image-build.yaml b/PCA_Deployment_ARO/charts/pca-devspaces/templates/opencode-image-build.yaml deleted file mode 100644 index c3cc8e7..0000000 --- a/PCA_Deployment_ARO/charts/pca-devspaces/templates/opencode-image-build.yaml +++ /dev/null @@ -1,100 +0,0 @@ -# OpenCode custom DevSpaces image — build infrastructure. -# Automatically builds the custom image on cluster deploy via GitOps. -# -# The BuildConfig creates the image from an inline Dockerfile -# and stores it in the internal registry. DevWorkspaces reference -# this image for OpenCode-enabled workspaces. -# -# auth.json key EMPTY is a bake-time placeholder; overwritten at workspace -# postStart (write-opencode-config) from OPENAI_API_KEY — same as ROSA. -apiVersion: v1 -kind: Namespace -metadata: - name: opencode-build - annotations: - argocd.argoproj.io/sync-wave: "1" ---- -apiVersion: image.openshift.io/v1 -kind: ImageStream -metadata: - name: devspaces-opencode - namespace: opencode-build - annotations: - argocd.argoproj.io/sync-wave: "1" ---- -apiVersion: build.openshift.io/v1 -kind: BuildConfig -metadata: - name: devspaces-opencode - namespace: opencode-build - annotations: - argocd.argoproj.io/sync-wave: "2" -spec: - output: - to: - kind: ImageStreamTag - name: devspaces-opencode:latest - source: - type: Dockerfile - dockerfile: | - FROM registry.redhat.io/devspaces/udi-rhel8:latest - USER root - RUN curl -fsSL https://opencode.ai/install | bash && \ - cp /home/user/.opencode/bin/opencode /usr/local/bin/opencode && \ - chmod 755 /usr/local/bin/opencode - RUN mkdir -p /home/user/.config/opencode /home/user/.local/share/opencode && \ - echo '{"$schema":"https://opencode.ai/config.json","provider":{"vllm":{"npm":"@ai-sdk/openai-compatible","name":"Private AI Gateway","options":{"baseURL":"{{ include "pca-devspaces.aiGateway.baseUrl" . }}"},"models":{"{{ .Values.modelId }}":{"name":"{{ .Values.modelId }}"}}}},"model":"vllm/{{ .Values.modelId }}"}' \ - > /home/user/.config/opencode/opencode.json && \ - echo '{"vllm":{"type":"api","key":"EMPTY"}}' > /home/user/.local/share/opencode/auth.json && \ - chown -R 1001:0 /home/user/.config/opencode /home/user/.local/share/opencode && \ - chmod -R g=u /home/user/.config/opencode /home/user/.local/share/opencode - ENV NODE_TLS_REJECT_UNAUTHORIZED=0 - USER 1001 - strategy: - type: Docker - dockerStrategy: - from: - kind: DockerImage - name: registry.redhat.io/devspaces/udi-rhel8:latest - triggers: [] ---- -# Grant image-puller so DevSpaces workspaces can pull the custom OpenCode image. -# -# DevSpaces auto-provisions namespaces with random suffixes (e.g., -# dev1-devspaces-wk1ug6) so static per-namespace RoleBindings don't work. -# Instead, grant to the openshift-devspaces SA group (handles all DevSpaces -# workloads) and to all authenticated SAs (covers user-specific namespaces). -# -# The setup-devspaces-users.sh script also grants image-puller per auto- -# provisioned namespace for defense-in-depth. -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: devspaces-image-puller-main - namespace: opencode-build - annotations: - argocd.argoproj.io/sync-wave: "2" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:image-puller -subjects: - - kind: Group - name: system:serviceaccounts:openshift-devspaces - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: devspaces-image-puller-authenticated - namespace: opencode-build - annotations: - argocd.argoproj.io/sync-wave: "2" -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:image-puller -subjects: - - kind: Group - name: system:authenticated - apiGroup: rbac.authorization.k8s.io diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml b/PCA_Deployment_ARO/charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml deleted file mode 100644 index e2d6586..0000000 --- a/PCA_Deployment_ARO/charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml +++ /dev/null @@ -1,48 +0,0 @@ -{{/* - Per-DevSpaces API key for RHCL AuthPolicy. - - - Secret in the DevSpaces namespace (IDE env / postStart read the same value). - - Mirror Secret in the AI serving namespace for Authorino (label selector). - - Populate .Values.devspaces (or run setup-devspaces-users.sh which creates - the same Secrets for auto-provisioned namespaces). -*/}} -{{- $ai := .Values.aiGateway | default dict }} -{{- if and ($ai.enabled | default true) (not ($ai.escapeHatchToLlmd | default false)) (not .Values.guardrails.enabled) }} -{{- range $i, $devspace := .Values.devspaces }} -{{- $ns := $devspace.namespace | default $.Release.Namespace }} -{{- $secretName := ($.Values.aiGateway.apiKeySecretName | default "pca-ai-gw-apikey") }} -{{- $apiKey := include "pca-devspaces.aiGateway.apiKey" (dict "root" $ "ns" $ns) }} -{{- $aiNs := $.Values.aiServingNamespace | default "ai-serving" }} -{{- $aiSecretName := printf "pca-ai-gw-apikey-%s" ($ns | trunc 40 | trimSuffix "-") }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ $secretName }} - namespace: {{ $ns }} - labels: - app.kubernetes.io/name: {{ $secretName }} - app.kubernetes.io/part-of: pca-devspaces - app.kubernetes.io/component: pca-ai-gateway-apikey -type: Opaque -stringData: - api_key: {{ $apiKey | quote }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ $aiSecretName }} - namespace: {{ $aiNs }} - labels: - authorino.kuadrant.io/managed-by: authorino - app.kubernetes.io/component: pca-ai-gateway-apikey - app.kubernetes.io/part-of: pca-devspaces - pca.ai/dev-namespace: {{ $ns | quote }} - annotations: - pca.ai/dev-namespace: {{ $ns | quote }} -type: Opaque -stringData: - api_key: {{ $apiKey | quote }} -{{- end }} -{{- end }} diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/templates/roo-code-configmaps.yaml b/PCA_Deployment_ARO/charts/pca-devspaces/templates/roo-code-configmaps.yaml deleted file mode 100644 index 7626c5a..0000000 --- a/PCA_Deployment_ARO/charts/pca-devspaces/templates/roo-code-configmaps.yaml +++ /dev/null @@ -1,41 +0,0 @@ -# OpenCode configuration ConfigMaps for DevSpaces workspaces. -# -# These ConfigMaps are mounted into each workspace and provide the OpenCode -# global config pointing to the RHCL AI gateway (or llm-d escape hatch). -# API key is not stored here — set via OPENAI_API_KEY + postStart auth.json -# overwrite (see setup-devspaces-users.sh / write-opencode-config). -{{- $baseUrl := include "pca-devspaces.aiGateway.baseUrl" . }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: opencode-config - namespace: openshift-devspaces - labels: - app.kubernetes.io/component: workspaces-config - app.kubernetes.io/part-of: che.eclipse.org - controller.devfile.io/mount-to-devworkspace: "true" - controller.devfile.io/watch-configmap: "true" - annotations: - argocd.argoproj.io/sync-wave: "0" - controller.devfile.io/mount-as: subpath - controller.devfile.io/mount-path: /home/user/.config/opencode -data: - opencode.json: | - { - "$schema": "https://opencode.ai/config.json", - "provider": { - "vllm": { - "npm": "@ai-sdk/openai-compatible", - "name": "Private AI Gateway (llm-d)", - "options": { - "baseURL": {{ $baseUrl | quote }} - }, - "models": { - {{ .Values.modelId | quote }}: { - "name": {{ .Values.modelId | quote }} - } - } - } - }, - "model": {{ printf "vllm/%s" .Values.modelId | quote }} - } diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/values.yaml b/PCA_Deployment_ARO/charts/pca-devspaces/values.yaml deleted file mode 100644 index c7e12b4..0000000 --- a/PCA_Deployment_ARO/charts/pca-devspaces/values.yaml +++ /dev/null @@ -1,17 +0,0 @@ -aiServingNamespace: ai-serving -modelId: "Qwen/Qwen3.6-35B-A3B-FP8" -# RHCL AI Gateway — default IDE base URL (see _helpers.tpl aiGateway.baseUrl). -aiGateway: - enabled: true - name: pca-ai-gateway - gatewayClassName: data-science-gateway-class - escapeHatchToLlmd: false - apiKeySecretName: pca-ai-gw-apikey - # Seed for deterministic keys when Secret does not exist yet (setup script uses "pca-aro"). - apiKeySeed: pca-aro -guardrails: - enabled: false - endpoint: "http://pca-guardrails:8034/guardrailed" -# Optional static DevSpaces list for Helm-managed API key Secrets. -# Auto-provisioned namespaces (setup-devspaces-users.sh) create Secrets in the script instead. -devspaces: [] diff --git a/PCA_Deployment_ARO/charts/pca-operators/templates/cert-manager.yaml b/PCA_Deployment_ARO/charts/pca-operators/templates/cert-manager.yaml deleted file mode 100644 index b14a0a3..0000000 --- a/PCA_Deployment_ARO/charts/pca-operators/templates/cert-manager.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# cert-manager — required by KServe for webhook certificates -# Installed via kustomize overlay from llm-d-playbook -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: cert-manager - namespace: openshift-gitops - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - project: private-code-assistant - source: - repoURL: https://github.com/llm-d/llm-d-playbook.git - targetRevision: main - path: components/cert-manager/overlays/stable - destination: - server: https://kubernetes.default.svc - syncPolicy: - automated: - selfHeal: true - syncOptions: - - ServerSideApply=true diff --git a/PCA_Deployment_ARO/charts/pca-operators/templates/leader-worker-set.yaml b/PCA_Deployment_ARO/charts/pca-operators/templates/leader-worker-set.yaml deleted file mode 100644 index 014d33e..0000000 --- a/PCA_Deployment_ARO/charts/pca-operators/templates/leader-worker-set.yaml +++ /dev/null @@ -1,21 +0,0 @@ -# LeaderWorkerSet Operator — required by KServe for multi-node inference -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: leader-worker-set - namespace: openshift-gitops - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - project: private-code-assistant - source: - repoURL: https://github.com/llm-d/llm-d-playbook.git - targetRevision: main - path: components/lws/overlays/stable - destination: - server: https://kubernetes.default.svc - syncPolicy: - automated: - selfHeal: true - syncOptions: - - ServerSideApply=true diff --git a/PCA_Deployment_ARO/charts/pca-operators/templates/lws-operator-cr.yaml b/PCA_Deployment_ARO/charts/pca-operators/templates/lws-operator-cr.yaml deleted file mode 100644 index e5aa1d3..0000000 --- a/PCA_Deployment_ARO/charts/pca-operators/templates/lws-operator-cr.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# LeaderWorkerSet Operator instance — enables the LWS controller. -# Applied after the LWS CRD is installed (wave 1). -apiVersion: leaderworkerset.x-k8s.io/v1 -kind: LeaderWorkerSetOperator -metadata: - name: cluster - annotations: - argocd.argoproj.io/sync-wave: "5" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - managementState: Managed diff --git a/PCA_Deployment_ARO/charts/pca-operators/templates/nvidia-cluster-policy.yaml b/PCA_Deployment_ARO/charts/pca-operators/templates/nvidia-cluster-policy.yaml deleted file mode 100644 index bed09be..0000000 --- a/PCA_Deployment_ARO/charts/pca-operators/templates/nvidia-cluster-policy.yaml +++ /dev/null @@ -1,36 +0,0 @@ -# NVIDIA GPU Operator ClusterPolicy — activates the GPU stack on ARO. -# useOpenShiftDriverToolkit: true is required for ARO to use the Red Hat -# Driver Toolkit (DTK) for in-cluster kernel module compilation, avoiding -# the need for pre-compiled drivers or privileged node access. -apiVersion: nvidia.com/v1 -kind: ClusterPolicy -metadata: - name: gpu-cluster-policy - annotations: - argocd.argoproj.io/sync-wave: "5" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - operator: - defaultRuntime: crio - daemonsets: {} - driver: - enabled: true - useOpenShiftDriverToolkit: true - upgradePolicy: - autoUpgrade: true - maxParallelUpgrades: 1 - maxUnavailable: "25%" - toolkit: - enabled: true - devicePlugin: - enabled: true - dcgm: - enabled: true - dcgmExporter: - enabled: true - nodeStatusExporter: - enabled: true - gfd: - enabled: true - migManager: - enabled: false diff --git a/PCA_Deployment_ARO/charts/pca-platform-config/Chart.yaml b/PCA_Deployment_ARO/charts/pca-platform-config/Chart.yaml deleted file mode 100644 index ba3fc6b..0000000 --- a/PCA_Deployment_ARO/charts/pca-platform-config/Chart.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v2 -name: pca-platform-config -version: 0.1.0 -description: PCA Platform Configuration — namespaces, RBAC, secrets, DSC diff --git a/PCA_Deployment_ARO/charts/pca-platform-config/templates/checluster.yaml b/PCA_Deployment_ARO/charts/pca-platform-config/templates/checluster.yaml deleted file mode 100644 index 6d033eb..0000000 --- a/PCA_Deployment_ARO/charts/pca-platform-config/templates/checluster.yaml +++ /dev/null @@ -1,52 +0,0 @@ -# OpenShift Dev Spaces instance — creates the dashboard, workspace controller, registries. -# Configured with always-active workspaces (idle timeout disabled) to support -# long-running OpenCode sessions without interruption. -apiVersion: org.eclipse.che/v2 -kind: CheCluster -metadata: - name: devspaces - namespace: openshift-devspaces - annotations: - argocd.argoproj.io/sync-wave: "3" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - devEnvironments: - secondsOfInactivityBeforeIdling: -1 - secondsOfRunBeforeIdling: -1 - maxNumberOfWorkspacesPerUser: -1 - startTimeoutSeconds: 300 - defaultComponents: - - name: dev-tools - container: - image: image-registry.openshift-image-registry.svc:5000/opencode-build/devspaces-opencode:latest - memoryLimit: 8Gi - memoryRequest: 1Gi - cpuLimit: 4000m - cpuRequest: 500m - env: - - name: VLLM_ENDPOINT - value: "https://llm-d-gateway-data-science-gateway-class.ai-serving.svc.cluster.local/v1" - - name: VLLM_MODEL_ID - value: "Qwen/Qwen3.6-35B-A3B-FP8" - - name: OPENAI_API_KEY - value: "EMPTY" - - name: OPENAI_BASE_URL - value: "https://llm-d-gateway-data-science-gateway-class.ai-serving.svc.cluster.local/v1" - - name: NODE_TLS_REJECT_UNAUTHORIZED - value: "0" - storage: - perUserStrategyPvcConfig: - claimSize: 50Gi - perWorkspaceStrategyPvcConfig: - claimSize: 50Gi - components: - cheServer: - debug: false - dashboard: - headerMessage: - show: true - text: "Private AI Code Assistant — OpenCode + Qwen3.6 via llm-d Gateway" - devWorkspace: {} - devfileRegistry: {} - pluginRegistry: {} - networking: {} diff --git a/PCA_Deployment_ARO/charts/pca-platform-config/templates/datasciencecluster.yaml b/PCA_Deployment_ARO/charts/pca-platform-config/templates/datasciencecluster.yaml deleted file mode 100644 index 9aad5b6..0000000 --- a/PCA_Deployment_ARO/charts/pca-platform-config/templates/datasciencecluster.yaml +++ /dev/null @@ -1,29 +0,0 @@ -# Patch DataScienceCluster for KServe "Headed" mode (required for llm-d + Gateway API) -# The DSC is created by the RHOAI operator; this resource ensures the correct configuration. -apiVersion: datasciencecluster.opendatahub.io/v1 -kind: DataScienceCluster -metadata: - name: default-dsc - annotations: - argocd.argoproj.io/sync-wave: "2" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - components: - kserve: - managementState: Managed - serving: - ingressGateway: - certificate: - type: OpenshiftDefaultIngress - managementState: Managed - rawDeploymentServiceConfig: Headed - modelregistry: - managementState: Managed - dashboard: - managementState: Managed - datasciencepipelines: - managementState: Managed - modelmeshserving: - managementState: Managed - workbenches: - managementState: Managed diff --git a/PCA_Deployment_ARO/charts/pca-platform-config/templates/hf-token-placeholder.yaml b/PCA_Deployment_ARO/charts/pca-platform-config/templates/hf-token-placeholder.yaml deleted file mode 100644 index 8702088..0000000 --- a/PCA_Deployment_ARO/charts/pca-platform-config/templates/hf-token-placeholder.yaml +++ /dev/null @@ -1,12 +0,0 @@ -# HuggingFace token secret — PLACEHOLDER -# For production, use External Secrets Operator or Sealed Secrets instead. -apiVersion: v1 -kind: Secret -metadata: - name: hf-token - namespace: ai-serving - annotations: - argocd.argoproj.io/sync-wave: "1" -type: Opaque -data: - token: {{ .Values.hfToken.raw | b64enc }} diff --git a/PCA_Deployment_ARO/charts/pca-platform-config/templates/namespaces.yaml b/PCA_Deployment_ARO/charts/pca-platform-config/templates/namespaces.yaml deleted file mode 100644 index d2488b6..0000000 --- a/PCA_Deployment_ARO/charts/pca-platform-config/templates/namespaces.yaml +++ /dev/null @@ -1,22 +0,0 @@ -# Namespaces for the AI platform. -# -# NOTE: DevSpaces user namespaces are NOT defined here. DevSpaces -# auto-provisions unique namespaces per user (e.g., dev1-devspaces-wk1ug6) -# when they first log into the dashboard. See setup-devspaces-users.sh. -apiVersion: v1 -kind: Namespace -metadata: - name: ai-serving - labels: - app.kubernetes.io/part-of: private-code-assistant - annotations: - argocd.argoproj.io/sync-wave: "0" ---- -apiVersion: v1 -kind: Namespace -metadata: - name: opencode-build - labels: - app.kubernetes.io/part-of: private-code-assistant - annotations: - argocd.argoproj.io/sync-wave: "0" diff --git a/PCA_Deployment_ARO/charts/pca-platform-config/templates/rbac.yaml b/PCA_Deployment_ARO/charts/pca-platform-config/templates/rbac.yaml deleted file mode 100644 index 76d37cf..0000000 --- a/PCA_Deployment_ARO/charts/pca-platform-config/templates/rbac.yaml +++ /dev/null @@ -1,28 +0,0 @@ -# RBAC for DevSpaces users. -# -# NOTE: These RoleBindings target statically-named namespaces (dev1-devspaces, -# dev2-devspaces) which are useful for shared team resources. However, actual -# DevWorkspaces run in auto-provisioned namespaces (e.g., dev1-devspaces-wk1ug6). -# -# The setup-devspaces-users.sh script handles RBAC for the auto-provisioned -# namespaces dynamically. These static bindings are kept for completeness. -# -# Users Dev1 and Dev2 are created via HTPasswd identity provider by the -# setup-devspaces-users.sh script. -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: devspaces-self-provisioner - annotations: - argocd.argoproj.io/sync-wave: "1" -subjects: - - kind: User - name: Dev1 - apiGroup: rbac.authorization.k8s.io - - kind: User - name: Dev2 - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: ClusterRole - name: self-provisioner - apiGroup: rbac.authorization.k8s.io diff --git a/PCA_Deployment_ARO/charts/pca-platform-config/values.yaml b/PCA_Deployment_ARO/charts/pca-platform-config/values.yaml deleted file mode 100644 index 57fda47..0000000 --- a/PCA_Deployment_ARO/charts/pca-platform-config/values.yaml +++ /dev/null @@ -1,2 +0,0 @@ -hfToken: - raw: "__overridden_at_deploy_time__" diff --git a/PCA_Deployment_ROSA/charts/pca-app-of-apps/Chart.yaml b/PCA_Deployment_ROSA/charts/pca-app-of-apps/Chart.yaml deleted file mode 100644 index 13ef217..0000000 --- a/PCA_Deployment_ROSA/charts/pca-app-of-apps/Chart.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v2 -name: pca-app-of-apps -version: 0.1.0 -description: PCA root App-of-Apps — creates AppProject and child Application CRs diff --git a/PCA_Deployment_ROSA/charts/pca-app-of-apps/templates/00-app-of-apps.yaml b/PCA_Deployment_ROSA/charts/pca-app-of-apps/templates/00-app-of-apps.yaml deleted file mode 100644 index 57fa43d..0000000 --- a/PCA_Deployment_ROSA/charts/pca-app-of-apps/templates/00-app-of-apps.yaml +++ /dev/null @@ -1,155 +0,0 @@ -# Root App-of-Apps: ArgoCD discovers child Applications in this directory. -# Each child Application below points to a subdirectory of manifests. -# Sync waves ensure correct ordering: operators first, then platform, then workloads. -apiVersion: argoproj.io/v1alpha1 -kind: AppProject -metadata: - name: private-code-assistant - namespace: openshift-gitops -spec: - description: Private AI Code Assistant — full stack - sourceRepos: - - '*' - destinations: - - namespace: '*' - server: https://kubernetes.default.svc - clusterResourceWhitelist: - - group: '*' - kind: '*' - namespaceResourceWhitelist: - - group: '*' - kind: '*' ---- -# Wave 1: Operators -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: pca-operators - namespace: openshift-gitops - annotations: - argocd.argoproj.io/sync-wave: "1" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: private-code-assistant - source: - repoURL: {{ .Values.gitops.repoURL }} - targetRevision: {{ .Values.gitops.targetRevision }} - path: {{ .Values.gitops.basePath }}/pca-operators - destination: - server: https://kubernetes.default.svc - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - ServerSideApply=true - - RespectIgnoreDifferences=true - retry: - limit: 5 - backoff: - duration: 30s - factor: 2 - maxDuration: 5m ---- -# Wave 2: Platform Configuration -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: pca-platform-config - namespace: openshift-gitops - annotations: - argocd.argoproj.io/sync-wave: "2" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: private-code-assistant - source: - repoURL: {{ .Values.gitops.repoURL }} - targetRevision: {{ .Values.gitops.targetRevision }} - path: {{ .Values.gitops.basePath }}/pca-platform-config - helm: - parameters: - - name: hfToken.raw - value: {{ .Values.hfToken.raw | quote }} - destination: - server: https://kubernetes.default.svc - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - ServerSideApply=true - retry: - limit: 5 - backoff: - duration: 30s - factor: 2 - maxDuration: 5m ---- -# Wave 3: AI Serving (Models, Gateway, PVCs) -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: pca-ai-serving - namespace: openshift-gitops - annotations: - argocd.argoproj.io/sync-wave: "3" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: private-code-assistant - source: - repoURL: {{ .Values.gitops.repoURL }} - targetRevision: {{ .Values.gitops.targetRevision }} - path: {{ .Values.gitops.basePath }}/pca-ai-serving - destination: - server: https://kubernetes.default.svc - namespace: ai-serving - syncPolicy: - automated: - prune: false - selfHeal: true - syncOptions: - - CreateNamespace=true - - ServerSideApply=true - retry: - limit: 3 - backoff: - duration: 60s - factor: 2 - maxDuration: 10m ---- -# Wave 4: DevSpaces Workspaces and Extension Configuration -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: pca-devspaces - namespace: openshift-gitops - annotations: - argocd.argoproj.io/sync-wave: "4" - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - project: private-code-assistant - source: - repoURL: {{ .Values.gitops.repoURL }} - targetRevision: {{ .Values.gitops.targetRevision }} - path: {{ .Values.gitops.basePath }}/pca-devspaces - destination: - server: https://kubernetes.default.svc - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - ServerSideApply=true - retry: - limit: 3 - backoff: - duration: 30s - factor: 2 - maxDuration: 5m diff --git a/PCA_Deployment_ROSA/charts/pca-operators/Chart.yaml b/PCA_Deployment_ROSA/charts/pca-operators/Chart.yaml deleted file mode 100644 index 95e5a0b..0000000 --- a/PCA_Deployment_ROSA/charts/pca-operators/Chart.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v2 -name: pca-operators -version: 0.1.0 -description: PCA Operators wave — subscriptions, cluster policies, cert-manager diff --git a/PCA_Deployment_ROSA/charts/pca-operators/templates/subscriptions.yaml b/PCA_Deployment_ROSA/charts/pca-operators/templates/subscriptions.yaml deleted file mode 100644 index 41f05e6..0000000 --- a/PCA_Deployment_ROSA/charts/pca-operators/templates/subscriptions.yaml +++ /dev/null @@ -1,181 +0,0 @@ -# All operator Subscriptions managed by ArgoCD. -# Sync wave 1: these must install before platform config (wave 2) uses their CRDs. -# Red Hat OpenShift AI (RHOAI) 3.3+ -apiVersion: v1 -kind: Namespace -metadata: - name: redhat-ods-operator - annotations: - argocd.argoproj.io/sync-wave: "0" ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: redhat-ods-operator - namespace: redhat-ods-operator - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: {} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: rhods-operator - namespace: redhat-ods-operator - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - channel: stable-3.4 - installPlanApproval: Automatic - name: rhods-operator - source: redhat-operators - sourceNamespace: openshift-marketplace ---- -# NVIDIA GPU Operator -apiVersion: v1 -kind: Namespace -metadata: - name: nvidia-gpu-operator - annotations: - argocd.argoproj.io/sync-wave: "0" ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: nvidia-gpu-operator - namespace: nvidia-gpu-operator - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - targetNamespaces: - - nvidia-gpu-operator ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: gpu-operator-certified - namespace: nvidia-gpu-operator - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - channel: v25.3 - installPlanApproval: Automatic - name: gpu-operator-certified - source: certified-operators - sourceNamespace: openshift-marketplace ---- -# OpenShift Dev Spaces -apiVersion: v1 -kind: Namespace -metadata: - name: openshift-devspaces - annotations: - argocd.argoproj.io/sync-wave: "0" - labels: - app.kubernetes.io/part-of: che.eclipse.org ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: openshift-devspaces - namespace: openshift-devspaces - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: {} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: devspaces - namespace: openshift-devspaces - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - channel: stable - installPlanApproval: Automatic - name: devspaces - source: redhat-operators - sourceNamespace: openshift-marketplace ---- -# Node Feature Discovery (required by NVIDIA GPU Operator to detect GPUs) -apiVersion: v1 -kind: Namespace -metadata: - name: openshift-nfd - annotations: - argocd.argoproj.io/sync-wave: "0" ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: openshift-nfd - namespace: openshift-nfd - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - targetNamespaces: - - openshift-nfd ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: nfd - namespace: openshift-nfd - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - channel: stable - installPlanApproval: Automatic - name: nfd - source: redhat-operators - sourceNamespace: openshift-marketplace -{{- if (.Values.operators).rhcl.enabled | default true }} ---- -# Red Hat Connectivity Link (RHCL / Kuadrant) — AI Gateway auth + future quotas -# Authorino and Limitador Operators are installed automatically as RHCL dependencies. -apiVersion: v1 -kind: Namespace -metadata: - name: {{ (.Values.operators).rhcl.namespace | default "kuadrant-system" }} - annotations: - argocd.argoproj.io/sync-wave: "0" ---- -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: kuadrant - namespace: {{ (.Values.operators).rhcl.namespace | default "kuadrant-system" }} - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: {} ---- -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: rhcl-operator - namespace: {{ (.Values.operators).rhcl.namespace | default "kuadrant-system" }} - annotations: - argocd.argoproj.io/sync-wave: "1" -spec: - channel: {{ (.Values.operators).rhcl.channel | default "stable" }} - installPlanApproval: Automatic - name: rhcl-operator - source: redhat-operators - sourceNamespace: openshift-marketplace - config: - env: - - name: ISTIO_GATEWAY_CONTROLLER_NAMES - # OpenShift AI data-science-gateway-class uses openshift.io/gateway-controller/v1 - value: {{ (.Values.operators).rhcl.gatewayControllerNames | default "openshift.io/gateway-controller/v1" | quote }} ---- -# Kuadrant CR deploys Authorino + Limitador instances used by AuthPolicy / RateLimitPolicy. -apiVersion: kuadrant.io/v1beta1 -kind: Kuadrant -metadata: - name: kuadrant - namespace: {{ (.Values.operators).rhcl.namespace | default "kuadrant-system" }} - annotations: - argocd.argoproj.io/sync-wave: "2" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: {} -{{- end }} diff --git a/PCA_Deployment_ROSA/charts/pca-operators/values.yaml b/PCA_Deployment_ROSA/charts/pca-operators/values.yaml deleted file mode 100644 index 2e9c213..0000000 --- a/PCA_Deployment_ROSA/charts/pca-operators/values.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# Operator install toggles (ROSA / ARO GitOps only). -# Existing OpenShift assumes RHCL is already installed — see deploy_existing_openshift/README.md. -operators: - rhcl: - enabled: true - namespace: kuadrant-system - channel: stable - # Must match GatewayClass controller for data-science-gateway-class (OpenShift AI). - gatewayControllerNames: "openshift.io/gateway-controller/v1" diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/Chart.lock b/charts/pca-ai-serving/Chart.lock similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/Chart.lock rename to charts/pca-ai-serving/Chart.lock diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/Chart.yaml b/charts/pca-ai-serving/Chart.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/Chart.yaml rename to charts/pca-ai-serving/Chart.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/Chart.lock b/charts/pca-ai-serving/charts/pca-observability/Chart.lock similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/Chart.lock rename to charts/pca-ai-serving/charts/pca-observability/Chart.lock diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/Chart.yaml b/charts/pca-ai-serving/charts/pca-observability/Chart.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/Chart.yaml rename to charts/pca-ai-serving/charts/pca-observability/Chart.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/README.md b/charts/pca-ai-serving/charts/pca-observability/README.md similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/README.md rename to charts/pca-ai-serving/charts/pca-observability/README.md diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/charts/langfuse-1.5.38.tgz b/charts/pca-ai-serving/charts/pca-observability/charts/langfuse-1.5.38.tgz similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/charts/langfuse-1.5.38.tgz rename to charts/pca-ai-serving/charts/pca-observability/charts/langfuse-1.5.38.tgz diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/_helpers.tpl b/charts/pca-ai-serving/charts/pca-observability/templates/_helpers.tpl similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/_helpers.tpl rename to charts/pca-ai-serving/charts/pca-observability/templates/_helpers.tpl diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-a.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-a.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-a.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-a.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-b.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-b.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-b.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-b.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-c.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-c.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-c.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-c.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-d.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-d.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-d.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/dashboards/board-d.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-dashboards-provider.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/grafana-dashboards-provider.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-dashboards-provider.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/grafana-dashboards-provider.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-datasources.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/grafana-datasources.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-datasources.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/grafana-datasources.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-rbac.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/grafana-rbac.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-rbac.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/grafana-rbac.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-model-prices.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-model-prices.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-model-prices.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/langfuse-model-prices.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-route.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-route.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-route.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/langfuse-route.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-secret.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-secret.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/langfuse-secret.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/langfuse-secret.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/otel-collector.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/otel-collector.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/templates/otel-collector.yaml rename to charts/pca-ai-serving/charts/pca-observability/templates/otel-collector.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/values.yaml b/charts/pca-ai-serving/charts/pca-observability/values.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/charts/pca-observability/values.yaml rename to charts/pca-ai-serving/charts/pca-observability/values.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/files/pca_langfuse_io.py b/charts/pca-ai-serving/files/pca_langfuse_io.py similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/files/pca_langfuse_io.py rename to charts/pca-ai-serving/files/pca_langfuse_io.py diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/_helpers.tpl b/charts/pca-ai-serving/templates/_helpers.tpl similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/_helpers.tpl rename to charts/pca-ai-serving/templates/_helpers.tpl diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/hardware-profiles.yaml b/charts/pca-ai-serving/templates/hardware-profiles.yaml similarity index 55% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/hardware-profiles.yaml rename to charts/pca-ai-serving/templates/hardware-profiles.yaml index 2545cb1..34c5d2e 100644 --- a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/hardware-profiles.yaml +++ b/charts/pca-ai-serving/templates/hardware-profiles.yaml @@ -1,42 +1,40 @@ {{- if .Values.clusterResources }} -# HardwareProfile for NVIDIA L40S (g6e.2xlarge) — matches Terraform GPU machine pool apiVersion: infrastructure.opendatahub.io/v1 kind: HardwareProfile metadata: - name: gpu-l40s + name: gpu-{{ .Values.hardware.gpuProduct | lower | replace "." "-" | replace "_" "-" }} namespace: redhat-ods-applications labels: app.opendatahub.io/hardwareprofile: "true" annotations: argocd.argoproj.io/sync-wave: "1" argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - opendatahub.io/display-name: NVIDIA L40S (g6e.2xlarge) - opendatahub.io/description: >- - AWS g6e.2xlarge with 1x NVIDIA L40S GPU (48 GB VRAM), 8 vCPUs, 32 GiB RAM. + opendatahub.io/display-name: {{ .Values.hardware.gpuProduct }} + opendatahub.io/description: GPU node for LLM inference with vLLM. spec: identifiers: - displayName: CPU identifier: cpu resourceType: CPU - defaultCount: 4 + defaultCount: {{ .Values.hardware.cpu.request }} minCount: 1 - maxCount: 8 + maxCount: {{ .Values.hardware.cpu.limit }} - displayName: Memory identifier: memory resourceType: Memory - defaultCount: 16Gi + defaultCount: {{ .Values.hardware.memory.request }} minCount: 4Gi - maxCount: 32Gi + maxCount: {{ .Values.hardware.memory.limit }} - displayName: GPU identifier: nvidia.com/gpu - defaultCount: 1 + defaultCount: {{ .Values.hardware.gpuCount }} minCount: 1 - maxCount: 1 + maxCount: {{ .Values.hardware.gpuCount }} scheduling: type: Node node: nodeSelector: - node.kubernetes.io/instance-type: g6e.2xlarge + {{ .Values.hardware.instanceTypeLabel }}: {{ .Values.hardware.gpuProduct }} tolerations: - key: nvidia.com/gpu operator: Exists diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/inference-routing.yaml b/charts/pca-ai-serving/templates/inference-routing.yaml similarity index 77% rename from PCA_Deployment_ARO/charts/pca-ai-serving/templates/inference-routing.yaml rename to charts/pca-ai-serving/templates/inference-routing.yaml index ac7aa22..66c032d 100644 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/inference-routing.yaml +++ b/charts/pca-ai-serving/templates/inference-routing.yaml @@ -1,3 +1,4 @@ +{{- if .Values.epp.enabled }} # InferencePool + InferenceModel — scalable model routing through EPP. # # InferencePool selects vLLM predictor pods by label and routes through the @@ -12,8 +13,8 @@ apiVersion: inference.networking.k8s.io/v1 kind: InferencePool metadata: - name: qwen36-vllm-pool - namespace: ai-serving + name: {{ .Values.model.poolName }} + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "4" argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true @@ -22,14 +23,14 @@ spec: - number: 8000 selector: matchLabels: - serving.kserve.io/inferenceservice: qwen36-vllm + serving.kserve.io/inferenceservice: {{ .Values.model.name }} endpointPickerRef: name: llm-d-epp port: number: 9002 --- # InferenceModel maps model name to pool for Gateway API routing. -# Clients request "Qwen/Qwen3.6-35B-A3B-FP8" and the Gateway routes +# Clients request the model by ID and the Gateway routes # to the correct InferencePool via the model field in the request body. # # For multi-model setups, create additional InferenceModel resources @@ -37,13 +38,14 @@ spec: apiVersion: inference.networking.x-k8s.io/v1alpha2 kind: InferenceModel metadata: - name: qwen36-model - namespace: ai-serving + name: {{ .Values.model.name }}-model + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "4" argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true spec: - modelName: "Qwen/Qwen3.6-35B-A3B-FP8" + modelName: {{ .Values.model.id | quote }} criticality: Critical poolRef: - name: qwen36-vllm-pool + name: {{ .Values.model.poolName }} +{{- end }} diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/langfuse-io-middleware-configmap.yaml b/charts/pca-ai-serving/templates/langfuse-io-middleware-configmap.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/langfuse-io-middleware-configmap.yaml rename to charts/pca-ai-serving/templates/langfuse-io-middleware-configmap.yaml diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llm-d-epp.yaml b/charts/pca-ai-serving/templates/llm-d-epp.yaml similarity index 96% rename from PCA_Deployment_ARO/charts/pca-ai-serving/templates/llm-d-epp.yaml rename to charts/pca-ai-serving/templates/llm-d-epp.yaml index 1c16419..70706cb 100644 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/llm-d-epp.yaml +++ b/charts/pca-ai-serving/templates/llm-d-epp.yaml @@ -1,3 +1,4 @@ +{{- if .Values.epp.enabled }} # Endpoint Picker Plugin (EPP) with Envoy Proxy — intelligent request scheduling for llm-d. # # Architecture: @@ -18,7 +19,7 @@ apiVersion: v1 kind: ServiceAccount metadata: name: llm-d-epp - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "2" --- @@ -26,7 +27,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: llm-d-epp - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "2" rules: @@ -53,7 +54,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: llm-d-epp - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "2" roleRef: @@ -63,13 +64,13 @@ roleRef: subjects: - kind: ServiceAccount name: llm-d-epp - namespace: ai-serving + namespace: {{ .Values.namespace }} --- apiVersion: v1 kind: ConfigMap metadata: name: llm-d-epp-config - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "2" data: @@ -91,7 +92,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: envoy-epp-config - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "2" data: @@ -257,7 +258,7 @@ apiVersion: apps/v1 kind: Deployment metadata: name: llm-d-epp - namespace: ai-serving + namespace: {{ .Values.namespace }} labels: app: llm-d-epp annotations: @@ -277,8 +278,8 @@ spec: - name: epp image: registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9@sha256:c7abb4c34c70096fcf00db80cfbff09625c0bb9b58d271fe04cf51efdd591c31 args: - - -pool-name=qwen36-vllm-pool - - -pool-namespace=ai-serving + - -pool-name={{ .Values.model.poolName }} + - -pool-namespace={{ .Values.namespace }} - -grpc-port=9002 - -metrics-port=9090 - -secure-serving=false @@ -368,7 +369,7 @@ apiVersion: v1 kind: Service metadata: name: llm-d-epp - namespace: ai-serving + namespace: {{ .Values.namespace }} labels: app: llm-d-epp annotations: @@ -389,3 +390,4 @@ spec: port: 9090 targetPort: 9090 protocol: TCP +{{- end }} diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml similarity index 86% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml rename to charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml index f7cedc8..0a96bcd 100644 --- a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml +++ b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml @@ -15,7 +15,7 @@ spec: backendRefs: - group: inference.networking.k8s.io kind: InferencePool - name: qwen3-coder-inference-pool + name: {{ .Values.model.poolName }} port: 8000 timeouts: request: "0s" @@ -27,7 +27,7 @@ spec: backendRefs: - group: inference.networking.k8s.io kind: InferencePool - name: qwen3-coder-inference-pool + name: {{ .Values.model.poolName }} port: 8000 timeouts: request: "0s" @@ -39,7 +39,7 @@ spec: backendRefs: - group: inference.networking.k8s.io kind: InferencePool - name: qwen3-coder-inference-pool + name: {{ .Values.model.poolName }} port: 8000 timeouts: request: "0s" @@ -49,7 +49,7 @@ spec: type: PathPrefix value: / backendRefs: - - name: qwen3-coder-kserve-workload-svc + - name: {{ .Values.model.name }}-kserve-workload-svc port: 8000 timeouts: request: "0s" diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llm-d-gateway.yaml b/charts/pca-ai-serving/templates/llm-d-gateway.yaml similarity index 85% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llm-d-gateway.yaml rename to charts/pca-ai-serving/templates/llm-d-gateway.yaml index ec26560..518749b 100644 --- a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llm-d-gateway.yaml +++ b/charts/pca-ai-serving/templates/llm-d-gateway.yaml @@ -18,7 +18,7 @@ spec: tls: mode: Terminate certificateRefs: - - name: qwen3-coder-kserve-self-signed-certs + - name: {{ .Values.aiGateway.tls.secretName | default "qwen3-coder-kserve-self-signed-certs" }} kind: Secret allowedRoutes: namespaces: diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llminferenceservice.yaml b/charts/pca-ai-serving/templates/llminferenceservice.yaml similarity index 75% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llminferenceservice.yaml rename to charts/pca-ai-serving/templates/llminferenceservice.yaml index 5863e72..14cb9c3 100644 --- a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/llminferenceservice.yaml +++ b/charts/pca-ai-serving/templates/llminferenceservice.yaml @@ -6,7 +6,7 @@ apiVersion: serving.kserve.io/v1alpha2 kind: LLMInferenceService metadata: - name: qwen3-coder + name: {{ .Values.model.name }} namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "2" @@ -15,8 +15,8 @@ metadata: spec: replicas: 1 model: - uri: hf://Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8 - name: Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8 + uri: hf://{{ .Values.model.id }} + name: {{ .Values.model.id }} router: route: {} gateway: @@ -36,14 +36,17 @@ spec: {{- end }} containers: - name: main + {{- if .Values.vllm.image }} + image: {{ .Values.vllm.image }} + {{- end }} args: - --disable-uvicorn-access-log - --max-model-len={{ .Values.vllm.maxModelLen }} - --gpu-memory-utilization=0.90 - --enable-prefix-caching - --enable-auto-tool-choice - - --tool-call-parser=qwen3_coder - - --reasoning-parser=qwen3 + - --tool-call-parser={{ .Values.vllm.toolCallParser }} + - --reasoning-parser={{ .Values.vllm.reasoningParser }} - --kv-cache-dtype=fp8 {{- if $langfuseEnabled }} - --otlp-traces-endpoint=http://pca-otel-collector.{{ .Values.namespace }}.svc.cluster.local:4317 @@ -53,11 +56,11 @@ spec: - --middleware - pca_langfuse_io.langfuse_io_middleware {{- end }} - {{- if or $langfuseEnabled $ioFull }} + {{- if or $langfuseEnabled $ioFull .Values.vllm.extraEnv }} env: {{- if $langfuseEnabled }} - name: OTEL_SERVICE_NAME - value: vllm-qwen3-coder + value: vllm-{{ .Values.model.name }} - name: OTEL_EXPORTER_OTLP_ENDPOINT value: http://pca-otel-collector.{{ .Values.namespace }}.svc.cluster.local:4317 - name: OTEL_TRACES_SAMPLER @@ -81,6 +84,10 @@ spec: name: pca-langfuse-credentials key: init-project-secret-key {{- end }} + {{- range $key, $val := .Values.vllm.extraEnv }} + - name: {{ $key }} + value: {{ $val | quote }} + {{- end }} {{- end }} {{- if $ioFull }} volumeMounts: @@ -90,15 +97,15 @@ spec: {{- end }} resources: limits: - cpu: "4" - memory: 48Gi - nvidia.com/gpu: "1" + cpu: {{ .Values.hardware.cpu.limit | quote }} + memory: {{ .Values.hardware.memory.limit }} + nvidia.com/gpu: {{ .Values.hardware.gpuCount | quote }} requests: - cpu: "2" - memory: 16Gi - nvidia.com/gpu: "1" + cpu: {{ .Values.hardware.cpu.request | quote }} + memory: {{ .Values.hardware.memory.request }} + nvidia.com/gpu: {{ .Values.hardware.gpuCount | quote }} nodeSelector: - node.kubernetes.io/instance-type: g6e.2xlarge + {{ .Values.hardware.instanceTypeLabel }}: {{ .Values.hardware.gpuProduct }} tolerations: - key: nvidia.com/gpu operator: Exists diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway-authpolicy.yaml b/charts/pca-ai-serving/templates/pca-ai-gateway-authpolicy.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway-authpolicy.yaml rename to charts/pca-ai-serving/templates/pca-ai-gateway-authpolicy.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway-httproute.yaml b/charts/pca-ai-serving/templates/pca-ai-gateway-httproute.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway-httproute.yaml rename to charts/pca-ai-serving/templates/pca-ai-gateway-httproute.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway-kuadrant.yaml b/charts/pca-ai-serving/templates/pca-ai-gateway-kuadrant.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway-kuadrant.yaml rename to charts/pca-ai-serving/templates/pca-ai-gateway-kuadrant.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway.yaml b/charts/pca-ai-serving/templates/pca-ai-gateway.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pca-ai-gateway.yaml rename to charts/pca-ai-serving/templates/pca-ai-gateway.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pvcs.yaml b/charts/pca-ai-serving/templates/pvcs.yaml similarity index 68% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pvcs.yaml rename to charts/pca-ai-serving/templates/pvcs.yaml index fe4d3eb..d9e552b 100644 --- a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/pvcs.yaml +++ b/charts/pca-ai-serving/templates/pvcs.yaml @@ -8,7 +8,7 @@ metadata: spec: accessModes: - ReadWriteOnce - storageClassName: gp3-csi + storageClassName: {{ .Values.storage.storageClass }} resources: requests: - storage: 100Gi + storage: {{ .Values.storage.modelCacheSize }} diff --git a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/tls-secret-job.yaml b/charts/pca-ai-serving/templates/tls-secret-job.yaml similarity index 81% rename from PCA_Deployment_ARO/charts/pca-ai-serving/templates/tls-secret-job.yaml rename to charts/pca-ai-serving/templates/tls-secret-job.yaml index 8eaad27..40b0829 100644 --- a/PCA_Deployment_ARO/charts/pca-ai-serving/templates/tls-secret-job.yaml +++ b/charts/pca-ai-serving/templates/tls-secret-job.yaml @@ -1,10 +1,11 @@ +{{- if .Values.tlsJob.enabled }} # Job to generate a self-signed TLS certificate for the llm-d Gateway. # Runs once after the namespace is created. apiVersion: batch/v1 kind: Job metadata: name: create-gateway-tls - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "1" argocd.argoproj.io/hook: Sync @@ -23,7 +24,7 @@ spec: - -c - | set -e - HOSTNAME="llm-d-gateway-data-science-gateway-class.ai-serving.svc.cluster.local" + HOSTNAME="{{ .Values.tlsJob.gatewayHostname | default (printf "llm-d-gateway-data-science-gateway-class.%s.svc.cluster.local" .Values.namespace) }}" openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \ -keyout /tmp/tls.key -out /tmp/tls.crt \ -subj "/CN=${HOSTNAME}" \ @@ -35,7 +36,7 @@ spec: "kind": "Secret", "metadata": { "name": "llm-d-gateway-tls", - "namespace": "ai-serving" + "namespace": "{{ .Values.namespace }}" }, "type": "kubernetes.io/tls", "data": { @@ -53,13 +54,13 @@ spec: -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ --cacert ${CACERT} \ - "${APISERVER}/api/v1/namespaces/ai-serving/secrets" \ + "${APISERVER}/api/v1/namespaces/{{ .Values.namespace }}/secrets" \ -d @/tmp/secret.json || \ curl -sf -X PUT \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ --cacert ${CACERT} \ - "${APISERVER}/api/v1/namespaces/ai-serving/secrets/llm-d-gateway-tls" \ + "${APISERVER}/api/v1/namespaces/{{ .Values.namespace }}/secrets/llm-d-gateway-tls" \ -d @/tmp/secret.json echo "TLS secret llm-d-gateway-tls created/updated successfully" @@ -68,7 +69,7 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: tls-secret-creator - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "0" rules: @@ -80,14 +81,15 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: tls-secret-creator - namespace: ai-serving + namespace: {{ .Values.namespace }} annotations: argocd.argoproj.io/sync-wave: "0" subjects: - kind: ServiceAccount name: default - namespace: ai-serving + namespace: {{ .Values.namespace }} roleRef: kind: Role name: tls-secret-creator apiGroup: rbac.authorization.k8s.io +{{- end }} diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/templates/vllm-neuron-runtime-template.yaml b/charts/pca-ai-serving/templates/vllm-neuron-runtime-template.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/templates/vllm-neuron-runtime-template.yaml rename to charts/pca-ai-serving/templates/vllm-neuron-runtime-template.yaml diff --git a/charts/pca-ai-serving/values-aro.yaml b/charts/pca-ai-serving/values-aro.yaml new file mode 100644 index 0000000..dff271c --- /dev/null +++ b/charts/pca-ai-serving/values-aro.yaml @@ -0,0 +1,42 @@ +model: + id: "Qwen/Qwen3.6-35B-A3B-FP8" + name: "qwen36-vllm" + poolName: "qwen36-vllm-pool" +vllm: + image: "vllm/vllm-openai:v0.19.0" + maxModelLen: 262144 + toolCallParser: "qwen3_xml" + reasoningParser: "qwen3" + extraEnv: + VLLM_ENABLE_CUDA_COMPATIBILITY: "1" + LD_LIBRARY_PATH: "/usr/local/cuda/compat:/usr/local/cuda/lib64:/usr/lib64" + HF_HOME: "/model-cache" + HF_HUB_OFFLINE: "0" + TRITON_CACHE_DIR: "/model-cache/triton-cache" + XDG_CACHE_HOME: "/model-cache/xdg-cache" + HOME: "/tmp" + DG_JIT_CACHE_DIR: "/model-cache/deep-gemm" + VLLM_CACHE_ROOT: "/model-cache/vllm-cache" +hardware: + gpuProduct: "NVIDIA-H100-NVL" + instanceTypeLabel: "nvidia.com/gpu.product" + gpuCount: 1 + cpu: + request: "8" + limit: "16" + memory: + request: 80Gi + limit: 120Gi +storage: + storageClass: "managed-csi" + modelCacheSize: 100Gi +epp: + enabled: true +tlsJob: + enabled: true +aiGateway: + enabled: true + tls: + secretName: "llm-d-gateway-tls" +observability: + enabled: false diff --git a/charts/pca-ai-serving/values-rosa.yaml b/charts/pca-ai-serving/values-rosa.yaml new file mode 100644 index 0000000..0ef7bcd --- /dev/null +++ b/charts/pca-ai-serving/values-rosa.yaml @@ -0,0 +1,30 @@ +model: + id: "Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8" + name: "qwen3-coder" + poolName: "qwen3-coder-inference-pool" +vllm: + maxModelLen: 32768 + toolCallParser: "qwen3_coder" + reasoningParser: "qwen3" +hardware: + gpuProduct: "g6e.2xlarge" + instanceTypeLabel: "node.kubernetes.io/instance-type" + gpuCount: 1 + cpu: + request: "2" + limit: "4" + memory: + request: 16Gi + limit: 48Gi +storage: + storageClass: "gp3-csi" + modelCacheSize: 100Gi +observability: + enabled: true +pca-observability: + grafana: + enabled: true + langfuse: + enabled: false + prometheus: + accessMode: cluster diff --git a/PCA_Deployment_ROSA/charts/pca-ai-serving/values.yaml b/charts/pca-ai-serving/values.yaml similarity index 81% rename from PCA_Deployment_ROSA/charts/pca-ai-serving/values.yaml rename to charts/pca-ai-serving/values.yaml index 10b8498..094339d 100644 --- a/PCA_Deployment_ROSA/charts/pca-ai-serving/values.yaml +++ b/charts/pca-ai-serving/values.yaml @@ -1,7 +1,33 @@ namespace: ai-serving clusterResources: true +model: + id: "Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8" + name: "qwen3-coder" + poolName: "qwen3-coder-inference-pool" vllm: maxModelLen: 32768 + toolCallParser: "qwen3_coder" + reasoningParser: "qwen3" + image: "" + extraEnv: {} +hardware: + gpuProduct: "g6e.2xlarge" + instanceTypeLabel: "node.kubernetes.io/instance-type" + gpuCount: 1 + cpu: + request: "2" + limit: "4" + memory: + request: 16Gi + limit: 48Gi +storage: + storageClass: "gp3-csi" + modelCacheSize: 100Gi +epp: + enabled: false +tlsJob: + enabled: false + gatewayHostname: "" gatewayName: llm-d-gateway # RHCL AI Gateway in front of llm-d (auth + future multi-destination / quotas). # Does not replace llm-d-gateway / EPP / InferencePool. diff --git a/PCA_Deployment_ARO/charts/pca-app-of-apps/Chart.yaml b/charts/pca-app-of-apps/Chart.yaml similarity index 100% rename from PCA_Deployment_ARO/charts/pca-app-of-apps/Chart.yaml rename to charts/pca-app-of-apps/Chart.yaml diff --git a/PCA_Deployment_ARO/charts/pca-app-of-apps/templates/00-app-of-apps.yaml b/charts/pca-app-of-apps/templates/00-app-of-apps.yaml similarity index 84% rename from PCA_Deployment_ARO/charts/pca-app-of-apps/templates/00-app-of-apps.yaml rename to charts/pca-app-of-apps/templates/00-app-of-apps.yaml index d7e967f..3c21886 100644 --- a/PCA_Deployment_ARO/charts/pca-app-of-apps/templates/00-app-of-apps.yaml +++ b/charts/pca-app-of-apps/templates/00-app-of-apps.yaml @@ -1,13 +1,13 @@ # Root App-of-Apps: ArgoCD discovers child Applications in this directory. -# Each child Application points to a subdirectory of manifests. -# Sync waves ensure correct ordering: operators → platform → workloads. +# Each child Application below points to a subdirectory of manifests. +# Sync waves ensure correct ordering: operators first, then platform, then workloads. apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: name: private-code-assistant namespace: openshift-gitops spec: - description: Private AI Code Assistant — ARO deployment + description: Private AI Code Assistant — full stack sourceRepos: - '*' destinations: @@ -36,6 +36,10 @@ spec: repoURL: {{ .Values.gitops.repoURL }} targetRevision: {{ .Values.gitops.targetRevision }} path: {{ .Values.gitops.basePath }}/pca-operators + helm: + valueFiles: + - values.yaml + - values-{{ .Values.gitops.cloud }}.yaml destination: server: https://kubernetes.default.svc syncPolicy: @@ -70,6 +74,9 @@ spec: targetRevision: {{ .Values.gitops.targetRevision }} path: {{ .Values.gitops.basePath }}/pca-platform-config helm: + valueFiles: + - values.yaml + - values-{{ .Values.gitops.cloud }}.yaml parameters: - name: hfToken.raw value: {{ .Values.hfToken.raw | quote }} @@ -105,8 +112,13 @@ spec: repoURL: {{ .Values.gitops.repoURL }} targetRevision: {{ .Values.gitops.targetRevision }} path: {{ .Values.gitops.basePath }}/pca-ai-serving + helm: + valueFiles: + - values.yaml + - values-{{ .Values.gitops.cloud }}.yaml destination: server: https://kubernetes.default.svc + namespace: ai-serving syncPolicy: automated: prune: false @@ -137,6 +149,10 @@ spec: repoURL: {{ .Values.gitops.repoURL }} targetRevision: {{ .Values.gitops.targetRevision }} path: {{ .Values.gitops.basePath }}/pca-devspaces + helm: + valueFiles: + - values.yaml + - values-{{ .Values.gitops.cloud }}.yaml destination: server: https://kubernetes.default.svc syncPolicy: @@ -153,7 +169,7 @@ spec: factor: 2 maxDuration: 5m --- -# Wave 5: Benchmarks (GuideLLM sweep) +# Wave 5: Benchmarks (one-shot GuideLLM sweep — not continuously reconciled) apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -169,6 +185,10 @@ spec: repoURL: {{ .Values.gitops.repoURL }} targetRevision: {{ .Values.gitops.targetRevision }} path: {{ .Values.gitops.basePath }}/pca-benchmarks + helm: + valueFiles: + - values.yaml + - values-{{ .Values.gitops.cloud }}.yaml destination: server: https://kubernetes.default.svc syncPolicy: diff --git a/PCA_Deployment_ROSA/charts/pca-app-of-apps/values.yaml b/charts/pca-app-of-apps/values.yaml similarity index 93% rename from PCA_Deployment_ROSA/charts/pca-app-of-apps/values.yaml rename to charts/pca-app-of-apps/values.yaml index 49ff894..effc7d6 100644 --- a/PCA_Deployment_ROSA/charts/pca-app-of-apps/values.yaml +++ b/charts/pca-app-of-apps/values.yaml @@ -2,5 +2,6 @@ gitops: repoURL: "__overridden_at_deploy_time__" targetRevision: main basePath: "__overridden_at_deploy_time__" + cloud: "" hfToken: raw: "__overridden_at_deploy_time__" diff --git a/PCA_Deployment_ARO/charts/pca-benchmarks/Chart.yaml b/charts/pca-benchmarks/Chart.yaml similarity index 100% rename from PCA_Deployment_ARO/charts/pca-benchmarks/Chart.yaml rename to charts/pca-benchmarks/Chart.yaml diff --git a/PCA_Deployment_ARO/charts/pca-benchmarks/templates/guidellm-sweep.yaml b/charts/pca-benchmarks/templates/guidellm-sweep.yaml similarity index 95% rename from PCA_Deployment_ARO/charts/pca-benchmarks/templates/guidellm-sweep.yaml rename to charts/pca-benchmarks/templates/guidellm-sweep.yaml index b117b40..af86c01 100644 --- a/PCA_Deployment_ARO/charts/pca-benchmarks/templates/guidellm-sweep.yaml +++ b/charts/pca-benchmarks/templates/guidellm-sweep.yaml @@ -1,3 +1,4 @@ +{{- if .Values.enabled }} # GuideLLM benchmark sweep for Qwen3.6-35B-A3B-FP8 on NVIDIA H100 NVL. # Runs multiple concurrency levels across code-assistant-relevant workloads. # Results are stored in a PVC and printed to Job logs for extraction. @@ -5,7 +6,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: name: guidellm-results - namespace: ai-serving + namespace: {{ .Values.namespace }} spec: accessModes: - ReadWriteOnce @@ -17,7 +18,7 @@ apiVersion: batch/v1 kind: Job metadata: name: guidellm-sweep-h100 - namespace: ai-serving + namespace: {{ .Values.namespace }} spec: backoffLimit: 2 ttlSecondsAfterFinished: 86400 @@ -45,9 +46,9 @@ spec: - name: HOME value: "/tmp" - name: GUIDELLM_TARGET - value: "https://llm-d-gateway-data-science-gateway-class.ai-serving.svc.cluster.local" + value: "https://llm-d-gateway-data-science-gateway-class.{{ .Values.namespace }}.svc.cluster.local" - name: GUIDELLM_MODEL - value: "Qwen/Qwen3.6-35B-A3B-FP8" + value: {{ .Values.model.id | quote }} command: - /bin/bash - -c @@ -122,3 +123,4 @@ spec: - name: results persistentVolumeClaim: claimName: guidellm-results +{{- end }} diff --git a/charts/pca-benchmarks/values-aro.yaml b/charts/pca-benchmarks/values-aro.yaml new file mode 100644 index 0000000..2af17eb --- /dev/null +++ b/charts/pca-benchmarks/values-aro.yaml @@ -0,0 +1,3 @@ +enabled: true +model: + id: "Qwen/Qwen3.6-35B-A3B-FP8" diff --git a/charts/pca-benchmarks/values-rosa.yaml b/charts/pca-benchmarks/values-rosa.yaml new file mode 100644 index 0000000..bc11441 --- /dev/null +++ b/charts/pca-benchmarks/values-rosa.yaml @@ -0,0 +1 @@ +enabled: false diff --git a/charts/pca-benchmarks/values.yaml b/charts/pca-benchmarks/values.yaml new file mode 100644 index 0000000..d85a99e --- /dev/null +++ b/charts/pca-benchmarks/values.yaml @@ -0,0 +1,4 @@ +enabled: true +model: + id: "Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8" +namespace: "ai-serving" diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/Chart.yaml b/charts/pca-devspaces/Chart.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/Chart.yaml rename to charts/pca-devspaces/Chart.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/_helpers.tpl b/charts/pca-devspaces/templates/_helpers.tpl similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/_helpers.tpl rename to charts/pca-devspaces/templates/_helpers.tpl diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/cline-configmaps.yaml b/charts/pca-devspaces/templates/cline-configmaps.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/cline-configmaps.yaml rename to charts/pca-devspaces/templates/cline-configmaps.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/continue-configmaps.yaml b/charts/pca-devspaces/templates/continue-configmaps.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/continue-configmaps.yaml rename to charts/pca-devspaces/templates/continue-configmaps.yaml diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/templates/devspaces-dashboard-samples.yaml b/charts/pca-devspaces/templates/devspaces-dashboard-samples.yaml similarity index 96% rename from PCA_Deployment_ARO/charts/pca-devspaces/templates/devspaces-dashboard-samples.yaml rename to charts/pca-devspaces/templates/devspaces-dashboard-samples.yaml index acf4d4d..3a7f540 100644 --- a/PCA_Deployment_ARO/charts/pca-devspaces/templates/devspaces-dashboard-samples.yaml +++ b/charts/pca-devspaces/templates/devspaces-dashboard-samples.yaml @@ -1,3 +1,4 @@ +{{- if .Values.dashboardSamples.enabled }} # DevSpaces dashboard configuration — custom samples and default image. # Makes the OpenCode workspace visible on the DevSpaces landing page. # @@ -18,8 +19,8 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "3" che.eclipse.org/display-name: "OpenCode - Private AI Code Assistant" - che.eclipse.org/description: "AI-powered coding workspace with OpenCode extension + Web UI, pre-configured for private Qwen3.6-35B model via llm-d Gateway." - che.eclipse.org/tags: '["AI","OpenCode","Private","Qwen3.6"]' + che.eclipse.org/description: "AI-powered coding workspace with OpenCode extension + Web UI, pre-configured for private {{ .Values.modelId }} model via llm-d Gateway." + che.eclipse.org/tags: '["AI","OpenCode","Private"]' che.eclipse.org/icon: "https://opencode.ai/favicon.ico" data: devfile.yaml: | @@ -138,3 +139,4 @@ data: } } ] +{{- end }} diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/devspaces-global-config.yaml b/charts/pca-devspaces/templates/devspaces-global-config.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/devspaces-global-config.yaml rename to charts/pca-devspaces/templates/devspaces-global-config.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/devworkspaces.yaml b/charts/pca-devspaces/templates/devworkspaces.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/devworkspaces.yaml rename to charts/pca-devspaces/templates/devworkspaces.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/opencode-image-build.yaml b/charts/pca-devspaces/templates/opencode-image-build.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/opencode-image-build.yaml rename to charts/pca-devspaces/templates/opencode-image-build.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/opencode-web-password-secret.yaml b/charts/pca-devspaces/templates/opencode-web-password-secret.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/opencode-web-password-secret.yaml rename to charts/pca-devspaces/templates/opencode-web-password-secret.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml b/charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml rename to charts/pca-devspaces/templates/pca-ai-gateway-apikey-secrets.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/rbac.yaml b/charts/pca-devspaces/templates/rbac.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/rbac.yaml rename to charts/pca-devspaces/templates/rbac.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/templates/roo-code-configmaps.yaml b/charts/pca-devspaces/templates/roo-code-configmaps.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-devspaces/templates/roo-code-configmaps.yaml rename to charts/pca-devspaces/templates/roo-code-configmaps.yaml diff --git a/PCA_Deployment_ARO/charts/pca-devspaces/templates/vscode-extensions-config.yaml b/charts/pca-devspaces/templates/vscode-extensions-config.yaml similarity index 100% rename from PCA_Deployment_ARO/charts/pca-devspaces/templates/vscode-extensions-config.yaml rename to charts/pca-devspaces/templates/vscode-extensions-config.yaml diff --git a/charts/pca-devspaces/values-aro.yaml b/charts/pca-devspaces/values-aro.yaml new file mode 100644 index 0000000..f100e7c --- /dev/null +++ b/charts/pca-devspaces/values-aro.yaml @@ -0,0 +1,15 @@ +modelId: "Qwen/Qwen3.6-35B-A3B-FP8" +opencodeBuild: + enabled: true + opencodeVersion: "1.15.13" +aiGateway: + apiKeySeed: "pca-aro" +dashboardSamples: + enabled: true +devspaces: + - namespace: "dev1-devspaces" + username: "Dev1" + workspaceName: "pca-workspace" + - namespace: "dev2-devspaces" + username: "Dev2" + workspaceName: "pca-workspace" diff --git a/PCA_Deployment_ARO/charts/pca-benchmarks/values.yaml b/charts/pca-devspaces/values-rosa.yaml similarity index 100% rename from PCA_Deployment_ARO/charts/pca-benchmarks/values.yaml rename to charts/pca-devspaces/values-rosa.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-devspaces/values.yaml b/charts/pca-devspaces/values.yaml similarity index 96% rename from PCA_Deployment_ROSA/charts/pca-devspaces/values.yaml rename to charts/pca-devspaces/values.yaml index 6f39fb2..2838da8 100644 --- a/PCA_Deployment_ROSA/charts/pca-devspaces/values.yaml +++ b/charts/pca-devspaces/values.yaml @@ -20,6 +20,8 @@ mcp: # Direct MCP server SSE URL. Defaults to openshift-mcp service in aiServingNamespace. # Override if deploying to a different namespace or using the MCP Gateway. serverUrl: "" +dashboardSamples: + enabled: false devspaces: - namespace: dev-user1-devspaces name: code-workspace-1 diff --git a/PCA_Deployment_ARO/charts/pca-operators/Chart.yaml b/charts/pca-operators/Chart.yaml similarity index 100% rename from PCA_Deployment_ARO/charts/pca-operators/Chart.yaml rename to charts/pca-operators/Chart.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-operators/templates/cert-manager.yaml b/charts/pca-operators/templates/cert-manager.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-operators/templates/cert-manager.yaml rename to charts/pca-operators/templates/cert-manager.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-operators/templates/leader-worker-set.yaml b/charts/pca-operators/templates/leader-worker-set.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-operators/templates/leader-worker-set.yaml rename to charts/pca-operators/templates/leader-worker-set.yaml diff --git a/PCA_Deployment_ARO/charts/pca-operators/templates/subscriptions.yaml b/charts/pca-operators/templates/subscriptions.yaml similarity index 75% rename from PCA_Deployment_ARO/charts/pca-operators/templates/subscriptions.yaml rename to charts/pca-operators/templates/subscriptions.yaml index 6b83e22..287d6ca 100644 --- a/PCA_Deployment_ARO/charts/pca-operators/templates/subscriptions.yaml +++ b/charts/pca-operators/templates/subscriptions.yaml @@ -1,6 +1,6 @@ # All operator Subscriptions managed by ArgoCD. # Sync wave 1: these must install before platform config (wave 2) uses their CRDs. -# Red Hat OpenShift AI (RHOAI) 3.3 — AI Gateway (llm-d) is GA at v0.4 +# Red Hat OpenShift AI (RHOAI) 3.3+ apiVersion: v1 kind: Namespace metadata: @@ -25,40 +25,60 @@ metadata: annotations: argocd.argoproj.io/sync-wave: "1" spec: - channel: fast-3.x + channel: {{ (.Values.operators).rhoai.channel | default "stable-3.4" }} installPlanApproval: Automatic name: rhods-operator source: redhat-operators sourceNamespace: openshift-marketplace --- -# OpenShift Service Mesh 3.x +# NVIDIA GPU Operator +apiVersion: v1 +kind: Namespace +metadata: + name: nvidia-gpu-operator + annotations: + argocd.argoproj.io/sync-wave: "0" +--- +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: nvidia-gpu-operator + namespace: nvidia-gpu-operator + annotations: + argocd.argoproj.io/sync-wave: "0" +spec: + targetNamespaces: + - nvidia-gpu-operator +--- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: - name: servicemeshoperator3 - namespace: openshift-operators + name: gpu-operator-certified + namespace: nvidia-gpu-operator annotations: argocd.argoproj.io/sync-wave: "1" spec: - channel: stable + channel: {{ (.Values.operators).nvidiaGpu.channel | default "v25.3" }} installPlanApproval: Automatic - name: servicemeshoperator3 - source: redhat-operators + name: gpu-operator-certified + source: certified-operators sourceNamespace: openshift-marketplace --- -# OpenShift Serverless (KNative — KServe dependency) +# OpenShift Dev Spaces apiVersion: v1 kind: Namespace metadata: - name: openshift-serverless + name: openshift-devspaces annotations: argocd.argoproj.io/sync-wave: "0" + labels: + app.kubernetes.io/part-of: che.eclipse.org --- apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: - name: openshift-serverless - namespace: openshift-serverless + name: openshift-devspaces + namespace: openshift-devspaces annotations: argocd.argoproj.io/sync-wave: "0" spec: {} @@ -66,65 +86,90 @@ spec: {} apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: - name: serverless-operator - namespace: openshift-serverless + name: devspaces + namespace: openshift-devspaces annotations: argocd.argoproj.io/sync-wave: "1" spec: channel: stable installPlanApproval: Automatic - name: serverless-operator + name: devspaces source: redhat-operators sourceNamespace: openshift-marketplace +{{- if (.Values.operators).nfd.enabled | default true }} --- -# NVIDIA GPU Operator +# Node Feature Discovery (required by NVIDIA GPU Operator to detect GPUs) apiVersion: v1 kind: Namespace metadata: - name: nvidia-gpu-operator + name: openshift-nfd annotations: argocd.argoproj.io/sync-wave: "0" --- apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: - name: nvidia-gpu-operator - namespace: nvidia-gpu-operator + name: openshift-nfd + namespace: openshift-nfd annotations: argocd.argoproj.io/sync-wave: "0" spec: targetNamespaces: - - nvidia-gpu-operator + - openshift-nfd --- apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: - name: gpu-operator-certified - namespace: nvidia-gpu-operator + name: nfd + namespace: openshift-nfd annotations: argocd.argoproj.io/sync-wave: "1" spec: - channel: v26.3 + channel: stable installPlanApproval: Automatic - name: gpu-operator-certified - source: certified-operators + name: nfd + source: redhat-operators sourceNamespace: openshift-marketplace +{{- end }} +{{- if (.Values.operators).serviceMesh.enabled | default false }} --- -# OpenShift Dev Spaces +# OpenShift Service Mesh (required by llm-d/Gateway on ARO) apiVersion: v1 kind: Namespace metadata: - name: openshift-devspaces + name: openshift-operators + annotations: + argocd.argoproj.io/sync-wave: "0" +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + name: servicemeshoperator3 + namespace: openshift-operators + annotations: + argocd.argoproj.io/sync-wave: "1" +spec: + channel: stable + installPlanApproval: Automatic + name: servicemeshoperator3 + source: redhat-operators + sourceNamespace: openshift-marketplace +{{- end }} +{{- if (.Values.operators).serverless.enabled | default false }} +--- +# OpenShift Serverless (KNative, required by KServe on ARO) +apiVersion: v1 +kind: Namespace +metadata: + name: openshift-serverless annotations: argocd.argoproj.io/sync-wave: "0" - labels: - app.kubernetes.io/part-of: che.eclipse.org --- apiVersion: operators.coreos.com/v1 kind: OperatorGroup metadata: - name: openshift-devspaces - namespace: openshift-devspaces + name: openshift-serverless + namespace: openshift-serverless annotations: argocd.argoproj.io/sync-wave: "0" spec: {} @@ -132,16 +177,17 @@ spec: {} apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: - name: devspaces - namespace: openshift-devspaces + name: serverless-operator + namespace: openshift-serverless annotations: argocd.argoproj.io/sync-wave: "1" spec: channel: stable installPlanApproval: Automatic - name: devspaces + name: serverless-operator source: redhat-operators sourceNamespace: openshift-marketplace +{{- end }} {{- if (.Values.operators).rhcl.enabled | default true }} --- # Red Hat Connectivity Link (RHCL / Kuadrant) — AI Gateway auth + future quotas @@ -178,8 +224,10 @@ spec: config: env: - name: ISTIO_GATEWAY_CONTROLLER_NAMES + # OpenShift AI data-science-gateway-class uses openshift.io/gateway-controller/v1 value: {{ (.Values.operators).rhcl.gatewayControllerNames | default "openshift.io/gateway-controller/v1" | quote }} --- +# Kuadrant CR deploys Authorino + Limitador instances used by AuthPolicy / RateLimitPolicy. apiVersion: kuadrant.io/v1beta1 kind: Kuadrant metadata: diff --git a/charts/pca-operators/values-aro.yaml b/charts/pca-operators/values-aro.yaml new file mode 100644 index 0000000..000abe6 --- /dev/null +++ b/charts/pca-operators/values-aro.yaml @@ -0,0 +1,11 @@ +operators: + rhoai: + channel: fast-3.x + nvidiaGpu: + channel: v26.3 + nfd: + enabled: false + serviceMesh: + enabled: true + serverless: + enabled: true diff --git a/charts/pca-operators/values-rosa.yaml b/charts/pca-operators/values-rosa.yaml new file mode 100644 index 0000000..0967ef4 --- /dev/null +++ b/charts/pca-operators/values-rosa.yaml @@ -0,0 +1 @@ +{} diff --git a/PCA_Deployment_ARO/charts/pca-operators/values.yaml b/charts/pca-operators/values.yaml similarity index 71% rename from PCA_Deployment_ARO/charts/pca-operators/values.yaml rename to charts/pca-operators/values.yaml index 2e9c213..c80c5b3 100644 --- a/PCA_Deployment_ARO/charts/pca-operators/values.yaml +++ b/charts/pca-operators/values.yaml @@ -1,6 +1,16 @@ # Operator install toggles (ROSA / ARO GitOps only). # Existing OpenShift assumes RHCL is already installed — see deploy_existing_openshift/README.md. operators: + rhoai: + channel: stable-3.4 + nvidiaGpu: + channel: v25.3 + nfd: + enabled: true + serviceMesh: + enabled: false + serverless: + enabled: false rhcl: enabled: true namespace: kuadrant-system diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/Chart.lock b/charts/pca-platform-config/Chart.lock similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/Chart.lock rename to charts/pca-platform-config/Chart.lock diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/Chart.yaml b/charts/pca-platform-config/Chart.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/Chart.yaml rename to charts/pca-platform-config/Chart.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/Chart.yaml b/charts/pca-platform-config/charts/pca-guardrails/Chart.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/Chart.yaml rename to charts/pca-platform-config/charts/pca-guardrails/Chart.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/README.md b/charts/pca-platform-config/charts/pca-guardrails/README.md similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/README.md rename to charts/pca-platform-config/charts/pca-guardrails/README.md diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/files/custom_detectors.py b/charts/pca-platform-config/charts/pca-guardrails/files/custom_detectors.py similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/files/custom_detectors.py rename to charts/pca-platform-config/charts/pca-guardrails/files/custom_detectors.py diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/files/guardrails_proxy.py b/charts/pca-platform-config/charts/pca-guardrails/files/guardrails_proxy.py similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/files/guardrails_proxy.py rename to charts/pca-platform-config/charts/pca-guardrails/files/guardrails_proxy.py diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/_helpers.tpl b/charts/pca-platform-config/charts/pca-guardrails/templates/_helpers.tpl similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/_helpers.tpl rename to charts/pca-platform-config/charts/pca-guardrails/templates/_helpers.tpl diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/detector-model-cache-pvc.yaml b/charts/pca-platform-config/charts/pca-guardrails/templates/detector-model-cache-pvc.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/detector-model-cache-pvc.yaml rename to charts/pca-platform-config/charts/pca-guardrails/templates/detector-model-cache-pvc.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/detector-serving-runtime.yaml b/charts/pca-platform-config/charts/pca-guardrails/templates/detector-serving-runtime.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/detector-serving-runtime.yaml rename to charts/pca-platform-config/charts/pca-guardrails/templates/detector-serving-runtime.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-gateway-config.yaml b/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-gateway-config.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-gateway-config.yaml rename to charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-gateway-config.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator-config.yaml b/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator-config.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator-config.yaml rename to charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator-config.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator.yaml b/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator.yaml rename to charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-orchestrator.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-proxy.yaml b/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-proxy.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-proxy.yaml rename to charts/pca-platform-config/charts/pca-guardrails/templates/guardrails-proxy.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/prompt-injection-detector.yaml b/charts/pca-platform-config/charts/pca-guardrails/templates/prompt-injection-detector.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/templates/prompt-injection-detector.yaml rename to charts/pca-platform-config/charts/pca-guardrails/templates/prompt-injection-detector.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/values.yaml b/charts/pca-platform-config/charts/pca-guardrails/values.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-guardrails/values.yaml rename to charts/pca-platform-config/charts/pca-guardrails/values.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/Chart.yaml b/charts/pca-platform-config/charts/pca-mcp/Chart.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/Chart.yaml rename to charts/pca-platform-config/charts/pca-mcp/Chart.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/README.md b/charts/pca-platform-config/charts/pca-mcp/README.md similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/README.md rename to charts/pca-platform-config/charts/pca-mcp/README.md diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway-extension.yaml b/charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway-extension.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway-extension.yaml rename to charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway-extension.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway.yaml b/charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway.yaml rename to charts/pca-platform-config/charts/pca-mcp/templates/mcp-gateway.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-mariadb.yaml b/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-mariadb.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-mariadb.yaml rename to charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-mariadb.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-openshift.yaml b/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-openshift.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-openshift.yaml rename to charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-openshift.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-registration.yaml b/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-registration.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-registration.yaml rename to charts/pca-platform-config/charts/pca-mcp/templates/mcpserver-registration.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/rbac.yaml b/charts/pca-platform-config/charts/pca-mcp/templates/rbac.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/templates/rbac.yaml rename to charts/pca-platform-config/charts/pca-mcp/templates/rbac.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/values.yaml b/charts/pca-platform-config/charts/pca-mcp/values.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/charts/pca-mcp/values.yaml rename to charts/pca-platform-config/charts/pca-mcp/values.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/checluster.yaml b/charts/pca-platform-config/templates/checluster.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/checluster.yaml rename to charts/pca-platform-config/templates/checluster.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/datasciencecluster.yaml b/charts/pca-platform-config/templates/datasciencecluster.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/datasciencecluster.yaml rename to charts/pca-platform-config/templates/datasciencecluster.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/dscinitializations.yaml b/charts/pca-platform-config/templates/dscinitializations.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/dscinitializations.yaml rename to charts/pca-platform-config/templates/dscinitializations.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/hf-token-placeholder.yaml b/charts/pca-platform-config/templates/hf-token-placeholder.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/hf-token-placeholder.yaml rename to charts/pca-platform-config/templates/hf-token-placeholder.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/lws-operator-cr.yaml b/charts/pca-platform-config/templates/lws-operator-cr.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/lws-operator-cr.yaml rename to charts/pca-platform-config/templates/lws-operator-cr.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/maas-gateway.yaml b/charts/pca-platform-config/templates/maas-gateway.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/maas-gateway.yaml rename to charts/pca-platform-config/templates/maas-gateway.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/namespaces.yaml b/charts/pca-platform-config/templates/namespaces.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/namespaces.yaml rename to charts/pca-platform-config/templates/namespaces.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/nfd-instance.yaml b/charts/pca-platform-config/templates/nfd-instance.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/nfd-instance.yaml rename to charts/pca-platform-config/templates/nfd-instance.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/nvidia-cluster-policy.yaml b/charts/pca-platform-config/templates/nvidia-cluster-policy.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/nvidia-cluster-policy.yaml rename to charts/pca-platform-config/templates/nvidia-cluster-policy.yaml diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/templates/oauth-htpasswd.yaml b/charts/pca-platform-config/templates/oauth-htpasswd.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/templates/oauth-htpasswd.yaml rename to charts/pca-platform-config/templates/oauth-htpasswd.yaml diff --git a/charts/pca-platform-config/values-aro.yaml b/charts/pca-platform-config/values-aro.yaml new file mode 100644 index 0000000..6609eaf --- /dev/null +++ b/charts/pca-platform-config/values-aro.yaml @@ -0,0 +1,7 @@ +auth: + htpasswd: + enabled: true +guardrails: + enabled: false +mcp: + enabled: false diff --git a/charts/pca-platform-config/values-rosa.yaml b/charts/pca-platform-config/values-rosa.yaml new file mode 100644 index 0000000..0967ef4 --- /dev/null +++ b/charts/pca-platform-config/values-rosa.yaml @@ -0,0 +1 @@ +{} diff --git a/PCA_Deployment_ROSA/charts/pca-platform-config/values.yaml b/charts/pca-platform-config/values.yaml similarity index 100% rename from PCA_Deployment_ROSA/charts/pca-platform-config/values.yaml rename to charts/pca-platform-config/values.yaml From 25320663158393afc4c87d5785f3c690f92aafb3 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 12:13:11 +0300 Subject: [PATCH 04/16] chore: update the installation skill --- .../skills/deploy-existing-openshift/SKILL.md | 22 ++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/.cursor/skills/deploy-existing-openshift/SKILL.md b/.cursor/skills/deploy-existing-openshift/SKILL.md index 92e0154..150b7c4 100644 --- a/.cursor/skills/deploy-existing-openshift/SKILL.md +++ b/.cursor/skills/deploy-existing-openshift/SKILL.md @@ -13,7 +13,16 @@ Before deploying, verify these automatically (do NOT ask the user unless somethi 2. **Cluster access** — run `oc whoami` directly on the host (not inside the container). If it fails, ask the user to log in. 3. **AI serving namespace** — always use `private-assistant-ai-serving` (the default). Do not ask. 4. **DevSpace namespace** — ask the user for a suffix. The namespace will be `private-assistant-` (e.g. if the user says "itay", the namespace is `private-assistant-itay`). -5. **RHCL (AI Gateway)** — existing OpenShift does not install the RHCL *operator* via make. Confirm `oc get crd authpolicies.kuadrant.io`. The ai-serving chart creates a `Kuadrant` CR in `kuadrant-system` when `aiGateway.kuadrant.create=true`. IDE traffic defaults to `pca-ai-gateway` with per-DevSpaces API keys. llm-d Gateway is annotated `opendatahub.io/managed=false` so ODH does not attach conflicting AuthPolicies. +5. **RHCL (AI Gateway)** — existing OpenShift does not install the RHCL *operator* via make. Confirm `oc get crd authpolicies.kuadrant.io`. The ai-serving chart creates a `Kuadrant` CR in `kuadrant-system` when `aiGateway.kuadrant.create=true` (the default for existing OCP). IDE traffic defaults to `pca-ai-gateway` with per-DevSpaces API keys. llm-d Gateway is annotated `opendatahub.io/managed=false` so ODH does not attach conflicting AuthPolicies. + + **If `kuadrant-system` is already owned by another Helm release** (shared cluster), the install will fail with an ownership conflict. Detect with: + ```bash + oc get namespace kuadrant-system -o jsonpath='{.metadata.annotations.meta\.helm\.sh/release-name}' 2>/dev/null + ``` + If it prints a different release name, add `HELM_ARGS='--set aiGateway.kuadrant.create=false'` to reuse the existing Kuadrant instance: + ```bash + make ai-serving-deploy-existing-openshift HELM_ARGS='--set aiGateway.kuadrant.create=false' + ``` ## Deployment Steps @@ -125,3 +134,14 @@ make devspace-undeploy-existing-openshift DEV_NAMESPACE= # Remove the AI serving stack (removes namespace) make ai-serving-undeploy-existing-openshift ``` + +**If the namespace gets stuck terminating**, it is almost always a `GuardrailsOrchestrator` finalizer (`trustyai.opendatahub.io/gorch-finalizer`) blocking deletion. Check and clear it: +```bash +# Confirm the blocker +oc get namespace -o jsonpath='{.status.conditions[?(@.type=="NamespaceContentRemaining")].message}' + +# Remove the finalizer so the namespace can complete termination +oc patch $(oc get guardrailsorchestrators -n -o name) \ + -n --type=merge -p '{"metadata":{"finalizers":[]}}' +``` +This is safe — the TrustyAI operator has already been notified of deletion; patching the finalizer just unblocks the namespace controller. From 0bc2b803ea4f6d8b241311c1ae726258d87c53a8 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 13:39:09 +0300 Subject: [PATCH 05/16] fix: deploymnet bugs --- .../templates/devspaces-global-config.yaml | 20 +++++++++---------- .../templates/vscode-extensions-config.yaml | 2 ++ 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/charts/pca-devspaces/templates/devspaces-global-config.yaml b/charts/pca-devspaces/templates/devspaces-global-config.yaml index 9e1acc5..111b52c 100644 --- a/charts/pca-devspaces/templates/devspaces-global-config.yaml +++ b/charts/pca-devspaces/templates/devspaces-global-config.yaml @@ -1,8 +1,10 @@ {{- if .Values.devspacesGlobalConfig.enabled }} # Continue config (source namespace — synced to all user namespaces by DevSpaces operator). -# apiKey EMPTY is a cluster-wide placeholder; overwritten at Helm deploy time by the -# per-namespace continue-config (continue-configmaps.yaml → ideApiKey). +# The DevSpaces operator propagates this via subpath mount, so the propagated copy is +# read-only in workspace pods. This global ConfigMap MUST carry the real API key — +# per-namespace overrides are overwritten by propagation and cannot be updated in-place. {{- $baseUrl := include "pca-devspaces.aiGateway.baseUrl" . }} +{{- $apiKey := include "pca-devspaces.aiGateway.ideApiKey" (dict "root" . "ns" .Release.Namespace) }} apiVersion: v1 kind: ConfigMap metadata: @@ -23,12 +25,11 @@ data: version: 1.0.0 schema: v1 models: - - name: Qwen3-Coder (llm-d) + - name: Qwen3-Coder (RHCL) provider: openai - model: Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8 + model: {{ .Values.modelId }} apiBase: {{ $baseUrl }} - # EMPTY: overwritten at Helm deploy by per-ns continue-config (ideApiKey) - apiKey: EMPTY + apiKey: {{ $apiKey }} systemMessage: "You are a helpful coding assistant. Respond using natural language and code blocks only. Never use XML tool-call syntax such as , , or in your responses." requestOptions: verifySsl: false @@ -43,12 +44,11 @@ data: {{- end }} {{- end }} tabAutocompleteModel: - name: Qwen3-Coder Autocomplete (llm-d) + name: Qwen3-Coder Autocomplete provider: openai - model: Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8 + model: {{ .Values.modelId }} apiBase: {{ $baseUrl }} - # EMPTY: overwritten at Helm deploy by per-ns continue-config (ideApiKey) - apiKey: EMPTY + apiKey: {{ $apiKey }} requestOptions: verifySsl: false --- diff --git a/charts/pca-devspaces/templates/vscode-extensions-config.yaml b/charts/pca-devspaces/templates/vscode-extensions-config.yaml index 4b8149a..31159df 100644 --- a/charts/pca-devspaces/templates/vscode-extensions-config.yaml +++ b/charts/pca-devspaces/templates/vscode-extensions-config.yaml @@ -1,3 +1,4 @@ +{{- if .Values.devspacesGlobalConfig.enabled }} # Cluster-wide VS Code extension recommendations for all DevSpaces workspaces. # NOTE: "recommendations" only show the extension in the sidebar — they do NOT # auto-install. For auto-installation, use the DEFAULT_EXTENSIONS env var @@ -23,3 +24,4 @@ data: "sst-dev.opencode" ] } +{{- end }} From 099520467880ec2369f34e0277d4732a9dcb6771 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 14:04:08 +0300 Subject: [PATCH 06/16] fix: remove duplicate vscode-extensions-config and rename datasciencepipelines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Delete standalone vscode-extensions-config.yaml (already created in devspaces-global-config.yaml with full 4-extension list) - Rename datasciencepipelines → aipipelines in DataScienceCluster template (RHOAI 3.4 renamed the component; fixes ArgoCD ComparisonError on ARO) Co-Authored-By: Claude Sonnet 4.6 (1M context) --- .../templates/vscode-extensions-config.yaml | 27 ------------------- .../templates/datasciencecluster.yaml | 2 +- 2 files changed, 1 insertion(+), 28 deletions(-) delete mode 100644 charts/pca-devspaces/templates/vscode-extensions-config.yaml diff --git a/charts/pca-devspaces/templates/vscode-extensions-config.yaml b/charts/pca-devspaces/templates/vscode-extensions-config.yaml deleted file mode 100644 index 31159df..0000000 --- a/charts/pca-devspaces/templates/vscode-extensions-config.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if .Values.devspacesGlobalConfig.enabled }} -# Cluster-wide VS Code extension recommendations for all DevSpaces workspaces. -# NOTE: "recommendations" only show the extension in the sidebar — they do NOT -# auto-install. For auto-installation, use the DEFAULT_EXTENSIONS env var -# pointing to .vsix file paths (downloaded in a postStart command). -# See: https://eclipse.dev/che/docs/stable/administration-guide/default-extensions-for-microsoft-visual-studio-code/ -# This auto-install mechanism is configured in devworkspaces.yaml and -# setup-devspaces-users.sh via DEFAULT_EXTENSIONS + postStart download. -apiVersion: v1 -kind: ConfigMap -metadata: - name: vscode-extensions-config - namespace: openshift-devspaces - labels: - app.kubernetes.io/component: workspaces-config - app.kubernetes.io/part-of: che.eclipse.org - controller.devfile.io/watch-configmap: "true" - annotations: - argocd.argoproj.io/sync-wave: "0" -data: - .vscode-extensions.json: | - { - "recommendations": [ - "sst-dev.opencode" - ] - } -{{- end }} diff --git a/charts/pca-platform-config/templates/datasciencecluster.yaml b/charts/pca-platform-config/templates/datasciencecluster.yaml index eaf5cf3..69ac2fd 100644 --- a/charts/pca-platform-config/templates/datasciencecluster.yaml +++ b/charts/pca-platform-config/templates/datasciencecluster.yaml @@ -22,7 +22,7 @@ spec: managementState: Managed dashboard: managementState: Managed - datasciencepipelines: + aipipelines: managementState: Managed modelmeshserving: managementState: Managed From 9c42adb6f575926b4968296279ca4894f8f69775 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 14:30:22 +0300 Subject: [PATCH 07/16] fix: use ne-false guard for nfd.enabled to avoid Sprig default-true bug Sprig's default function treats boolean false as empty, so `false | default true` returns true. Use `not (eq false ...)` instead, which correctly respects an explicit false value. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- charts/pca-operators/templates/subscriptions.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/pca-operators/templates/subscriptions.yaml b/charts/pca-operators/templates/subscriptions.yaml index 287d6ca..ebf49fb 100644 --- a/charts/pca-operators/templates/subscriptions.yaml +++ b/charts/pca-operators/templates/subscriptions.yaml @@ -96,7 +96,7 @@ spec: name: devspaces source: redhat-operators sourceNamespace: openshift-marketplace -{{- if (.Values.operators).nfd.enabled | default true }} +{{- if not (eq false ((.Values.operators).nfd).enabled) }} --- # Node Feature Discovery (required by NVIDIA GPU Operator to detect GPUs) apiVersion: v1 From a96865adc4a33f6513e7ce46a3ee4d4d82a5d9ff Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 14:32:15 +0300 Subject: [PATCH 08/16] fix: use deterministic Grafana password hash (ArgoCD-safe) Replace lookup+randAlphaNum with sha256sum(ns/release/pca-grafana). lookup and randAlphaNum produce different values on each ArgoCD sync, causing constant drift. Deterministic hash survives restarts and syncs. Add checksum annotation to Deployment to roll on password change. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- .../pca-observability/templates/grafana-secret.yaml | 10 +++------- .../charts/pca-observability/templates/grafana.yaml | 2 ++ 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml index 22b8384..52821b0 100644 --- a/charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml +++ b/charts/pca-ai-serving/charts/pca-observability/templates/grafana-secret.yaml @@ -1,14 +1,10 @@ {{- if .Values.grafana.enabled }} {{- $ns := include "pca-observability.namespace" . -}} {{- $secretName := "pca-grafana-admin" -}} -{{- $existing := lookup "v1" "Secret" $ns $secretName -}} -{{- $password := .Values.grafana.adminPassword -}} +{{- /* Prefer explicit values; else stable hash (Argo-safe: lookup/rand drifts each sync). */ -}} +{{- $password := .Values.grafana.adminPassword | default "" -}} {{- if not $password -}} - {{- if and $existing (index $existing.data "admin-password") -}} - {{- $password = index $existing.data "admin-password" | b64dec -}} - {{- else -}} - {{- $password = randAlphaNum 24 -}} - {{- end -}} + {{- $password = printf "%s/%s/pca-grafana" $ns .Release.Name | sha256sum | trunc 24 -}} {{- end -}} apiVersion: v1 kind: Secret diff --git a/charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml b/charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml index fc9ec67..82e0a7f 100644 --- a/charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml +++ b/charts/pca-ai-serving/charts/pca-observability/templates/grafana.yaml @@ -20,6 +20,8 @@ spec: labels: app.kubernetes.io/name: pca-grafana app.kubernetes.io/part-of: pca-observability + annotations: + checksum/admin-secret: {{ include (print $.Template.BasePath "/grafana-secret.yaml") . | sha256sum }} spec: serviceAccountName: pca-grafana containers: From 610e78e4309419ee90469f17807f4b5576e09ba0 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 15:02:59 +0300 Subject: [PATCH 09/16] =?UTF-8?q?=20fix:=20ARO=20values=20=E2=80=94=20disa?= =?UTF-8?q?ble=20tlsJob,=20enable=20full=20observability,=20fix=20devspace?= =?UTF-8?q?s=20fields?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - tlsJob.enabled: false (RHOAI auto-creates qwen36-vllm-kserve-self-signed-certs) - aiGateway.tls.secretName updated to match RHOAI-created cert - observability.enabled: true with Grafana + Langfuse + OTel for ARO - pca-observability.prometheus.accessMode: namespace (existing OCP) - devspaces list uses correct field names (name/user not workspaceName/username) --- charts/pca-ai-serving/values-aro.yaml | 18 +++++++++++++++--- charts/pca-devspaces/values-aro.yaml | 8 ++++---- 2 files changed, 19 insertions(+), 7 deletions(-) diff --git a/charts/pca-ai-serving/values-aro.yaml b/charts/pca-ai-serving/values-aro.yaml index dff271c..7ae8919 100644 --- a/charts/pca-ai-serving/values-aro.yaml +++ b/charts/pca-ai-serving/values-aro.yaml @@ -33,10 +33,22 @@ storage: epp: enabled: true tlsJob: - enabled: true + enabled: false aiGateway: enabled: true tls: - secretName: "llm-d-gateway-tls" + secretName: "qwen36-vllm-kserve-self-signed-certs" observability: - enabled: false + enabled: true +pca-observability: + namespace: hacohen-ai-coder + grafana: + enabled: true + langfuse: + enabled: true + ioCapture: full + prometheus: + accessMode: namespace + cost: + gpuHourlyUsd: 4.50 + gpuHourlyUsdIsPlaceholder: true diff --git a/charts/pca-devspaces/values-aro.yaml b/charts/pca-devspaces/values-aro.yaml index f100e7c..a79acfd 100644 --- a/charts/pca-devspaces/values-aro.yaml +++ b/charts/pca-devspaces/values-aro.yaml @@ -8,8 +8,8 @@ dashboardSamples: enabled: true devspaces: - namespace: "dev1-devspaces" - username: "Dev1" - workspaceName: "pca-workspace" + name: "pca-workspace" + user: "Dev1" - namespace: "dev2-devspaces" - username: "Dev2" - workspaceName: "pca-workspace" + name: "pca-workspace" + user: "Dev2" From a1d07b376a3d133f6d6e11bb46ebbcf329f54918 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Wed, 22 Jul 2026 17:34:14 +0300 Subject: [PATCH 10/16] fix: align charts with upstream PR #14 fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Remove continue-config from devspaces-global-config.yaml; DevSpaces operator propagates global CMs into user namespaces (subpath mount, read-only) and would clobber per-ns API key/headers. Continue config lives only in per-namespace continue-configmaps.yaml. - DSC: modelsAsService → Removed, remove modelmeshserving (RHOAI 3.4) - NFD image: v4.17 → v4.21 Co-Authored-By: Itay Katav Co-Authored-By: Claude Sonnet 4.6 (1M context) --- .../templates/devspaces-global-config.yaml | 59 ++----------------- .../templates/datasciencecluster.yaml | 4 +- .../templates/nfd-instance.yaml | 2 +- 3 files changed, 7 insertions(+), 58 deletions(-) diff --git a/charts/pca-devspaces/templates/devspaces-global-config.yaml b/charts/pca-devspaces/templates/devspaces-global-config.yaml index 111b52c..2cf5494 100644 --- a/charts/pca-devspaces/templates/devspaces-global-config.yaml +++ b/charts/pca-devspaces/templates/devspaces-global-config.yaml @@ -1,58 +1,9 @@ {{- if .Values.devspacesGlobalConfig.enabled }} -# Continue config (source namespace — synced to all user namespaces by DevSpaces operator). -# The DevSpaces operator propagates this via subpath mount, so the propagated copy is -# read-only in workspace pods. This global ConfigMap MUST carry the real API key — -# per-namespace overrides are overwritten by propagation and cannot be updated in-place. -{{- $baseUrl := include "pca-devspaces.aiGateway.baseUrl" . }} -{{- $apiKey := include "pca-devspaces.aiGateway.ideApiKey" (dict "root" . "ns" .Release.Namespace) }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: continue-config - namespace: openshift-devspaces - labels: - app.kubernetes.io/component: workspaces-config - app.kubernetes.io/part-of: che.eclipse.org - controller.devfile.io/mount-to-devworkspace: "true" - controller.devfile.io/watch-configmap: "true" - annotations: - argocd.argoproj.io/sync-wave: "0" - controller.devfile.io/mount-as: subpath - controller.devfile.io/mount-path: /home/user/.continue -data: - config.yaml: | - name: Private Code Assistant - version: 1.0.0 - schema: v1 - models: - - name: Qwen3-Coder (RHCL) - provider: openai - model: {{ .Values.modelId }} - apiBase: {{ $baseUrl }} - apiKey: {{ $apiKey }} - systemMessage: "You are a helpful coding assistant. Respond using natural language and code blocks only. Never use XML tool-call syntax such as , , or in your responses." - requestOptions: - verifySsl: false - {{- if .Values.mcp.enabled }} - mcpServers: - - name: "openshift-ai-mcp" - type: sse - {{- if .Values.mcp.serverUrl }} - url: {{ .Values.mcp.serverUrl | quote }} - {{- else }} - url: "http://openshift-mcp.{{ .Values.aiServingNamespace }}.svc.cluster.local:8080/sse" - {{- end }} - {{- end }} - tabAutocompleteModel: - name: Qwen3-Coder Autocomplete - provider: openai - model: {{ .Values.modelId }} - apiBase: {{ $baseUrl }} - apiKey: {{ $apiKey }} - requestOptions: - verifySsl: false ---- -# Cluster-wide VS Code extension recommendations for all DevSpaces workspaces +# Cluster-wide VS Code extension recommendations for all DevSpaces workspaces. +# Continue config lives ONLY in per-namespace continue-configmaps.yaml (real +# ideApiKey + X-PCA-* headers). Do not put a mountable continue-config here — +# DevSpaces copies openshift-devspaces ConfigMaps with mount-to-devworkspace +# into user namespaces and would clobber the per-ns key/headers with EMPTY. apiVersion: v1 kind: ConfigMap metadata: diff --git a/charts/pca-platform-config/templates/datasciencecluster.yaml b/charts/pca-platform-config/templates/datasciencecluster.yaml index 69ac2fd..6b831c2 100644 --- a/charts/pca-platform-config/templates/datasciencecluster.yaml +++ b/charts/pca-platform-config/templates/datasciencecluster.yaml @@ -12,7 +12,7 @@ spec: kserve: managementState: Managed modelsAsService: - managementState: Managed + managementState: Removed nim: managementState: Managed rawDeploymentServiceConfig: Headed @@ -24,8 +24,6 @@ spec: managementState: Managed aipipelines: managementState: Managed - modelmeshserving: - managementState: Managed workbenches: managementState: Managed {{- if .Values.guardrails.enabled }} diff --git a/charts/pca-platform-config/templates/nfd-instance.yaml b/charts/pca-platform-config/templates/nfd-instance.yaml index 4094e10..2e24d24 100644 --- a/charts/pca-platform-config/templates/nfd-instance.yaml +++ b/charts/pca-platform-config/templates/nfd-instance.yaml @@ -10,7 +10,7 @@ metadata: argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true spec: operand: - image: registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9:v4.17 + image: registry.redhat.io/openshift4/ose-node-feature-discovery-rhel9:v4.21 workerConfig: configData: | core: From 640ae1157656deace8dd6460e09fa669e72580bd Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Thu, 23 Jul 2026 09:14:43 +0300 Subject: [PATCH 11/16] =?UTF-8?q?feat:=20ARO=20vLLM=20compat=20=E2=80=94?= =?UTF-8?q?=20custom=20ServingRuntime=20+=20routing=20+=20TLS=20fixes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add vllm.useCustomRuntime flag for ARO where RHOAI bundled vLLM does not support Qwen3.5-MoE (Qwen3.6-35B requires vLLM >= 0.18). When enabled, renders ServingRuntime + InferenceService instead of LLMInferenceService. - servingruntime.yaml: new, conditional on vllm.useCustomRuntime - inferenceservice.yaml: new, conditional on vllm.useCustomRuntime - llminferenceservice.yaml: gated on not .Values.vllm.useCustomRuntime - llm-d-gateway-httproute.yaml: InferencePool rules only when epp.enabled; fallback service uses configurable model.workloadServiceSuffix (default kserve-workload-svc for ROSA, predictor for ARO) - tls-secret-job.yaml: fix CN > 64 char limit; use short CN=llm-d-gateway, full FQDN in SAN only (modern TLS ignores CN, checks SAN) - values.yaml: add vllm.useCustomRuntime: false default - values-aro.yaml: useCustomRuntime: true, tlsJob: true, predictor suffix, full observability enabled, CUDA compat env vars removed (driver 580+ supports vLLM 0.19.0 natively without compat shims) Co-Authored-By: Claude Sonnet 4.6 (1M context) --- .../templates/inferenceservice.yaml | 45 +++++++++ .../templates/llm-d-gateway-httproute.yaml | 4 +- .../templates/llminferenceservice.yaml | 6 +- .../templates/servingruntime.yaml | 99 +++++++++++++++++++ .../templates/tls-secret-job.yaml | 3 +- charts/pca-ai-serving/values-aro.yaml | 8 +- charts/pca-ai-serving/values.yaml | 4 + 7 files changed, 162 insertions(+), 7 deletions(-) create mode 100644 charts/pca-ai-serving/templates/inferenceservice.yaml create mode 100644 charts/pca-ai-serving/templates/servingruntime.yaml diff --git a/charts/pca-ai-serving/templates/inferenceservice.yaml b/charts/pca-ai-serving/templates/inferenceservice.yaml new file mode 100644 index 0000000..d0e2c35 --- /dev/null +++ b/charts/pca-ai-serving/templates/inferenceservice.yaml @@ -0,0 +1,45 @@ +{{- if .Values.vllm.useCustomRuntime }} +# InferenceService using custom ServingRuntime — paired with servingruntime.yaml. +# Used when LLMInferenceService + RHOAI bundled vLLM cannot serve the target model. +# Set vllm.useCustomRuntime: true and vllm.image in values-aro.yaml. +apiVersion: serving.kserve.io/v1beta1 +kind: InferenceService +metadata: + name: {{ .Values.model.name }} + namespace: {{ .Values.namespace }} + labels: + opendatahub.io/dashboard: "true" + annotations: + argocd.argoproj.io/sync-wave: "2" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + openshift.io/display-name: {{ .Values.model.id | quote }} + serving.kserve.io/deploymentMode: RawDeployment + opendatahub.io/accelerator-name: nvidia.com/gpu + opendatahub.io/dashboard: "true" +spec: + predictor: + minReplicas: 1 + maxReplicas: 4 + tolerations: + - key: nvidia.com/gpu + operator: Equal + value: "present" + effect: NoSchedule + model: + modelFormat: + name: vLLM + runtime: vllm-cuda-{{ .Values.model.name }} + args: + - --model={{ .Values.model.id }} + - --tensor-parallel-size={{ .Values.hardware.gpuCount }} + - --max-model-len={{ .Values.vllm.maxModelLen }} + resources: + requests: + cpu: {{ .Values.hardware.cpu.request | quote }} + memory: {{ .Values.hardware.memory.request }} + nvidia.com/gpu: {{ .Values.hardware.gpuCount | quote }} + limits: + cpu: {{ .Values.hardware.cpu.limit | quote }} + memory: {{ .Values.hardware.memory.limit }} + nvidia.com/gpu: {{ .Values.hardware.gpuCount | quote }} +{{- end }} diff --git a/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml index 0a96bcd..39e8948 100644 --- a/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml +++ b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml @@ -8,6 +8,7 @@ spec: - name: llm-d-gateway namespace: {{ .Values.namespace }} rules: +{{- if .Values.epp.enabled }} - matches: - path: type: PathPrefix @@ -44,12 +45,13 @@ spec: timeouts: request: "0s" backendRequest: "0s" +{{- end }} - matches: - path: type: PathPrefix value: / backendRefs: - - name: {{ .Values.model.name }}-kserve-workload-svc + - name: {{ .Values.model.name }}-{{ .Values.model.workloadServiceSuffix | default "kserve-workload-svc" }} port: 8000 timeouts: request: "0s" diff --git a/charts/pca-ai-serving/templates/llminferenceservice.yaml b/charts/pca-ai-serving/templates/llminferenceservice.yaml index 14cb9c3..e60ec1a 100644 --- a/charts/pca-ai-serving/templates/llminferenceservice.yaml +++ b/charts/pca-ai-serving/templates/llminferenceservice.yaml @@ -1,4 +1,7 @@ -# LLMInferenceService — Qwen3-Coder-30B via llm-d (EPP + vLLM + Gateway API) +# LLMInferenceService — used when RHOAI bundled vLLM supports the model. +# Set vllm.useCustomRuntime: true (values-aro.yaml) to skip this and use +# ServingRuntime + InferenceService instead (e.g. Qwen3.6-35B needs vLLM >= 0.18). +{{- if not .Values.vllm.useCustomRuntime }} {{- include "pca-ai-serving.langfuse.validate" . -}} {{- $langfuseEnabled := eq (include "pca-ai-serving.langfuseEnabled" .) "true" -}} {{- $ioCapture := include "pca-ai-serving.langfuseIoCapture" . -}} @@ -113,3 +116,4 @@ spec: - key: g6e-gpu operator: Exists effect: NoSchedule +{{- end }} diff --git a/charts/pca-ai-serving/templates/servingruntime.yaml b/charts/pca-ai-serving/templates/servingruntime.yaml new file mode 100644 index 0000000..1bc544c --- /dev/null +++ b/charts/pca-ai-serving/templates/servingruntime.yaml @@ -0,0 +1,99 @@ +{{- if .Values.vllm.useCustomRuntime }} +# Custom ServingRuntime for upstream vLLM — used when RHOAI bundled vLLM does not +# support the target model architecture (e.g. Qwen3.5-MoE requires vLLM >= 0.18). +# ARO: vllm.useCustomRuntime: true, vllm.image: vllm/vllm-openai:v0.19.0 +# ROSA: useCustomRuntime: false — uses LLMInferenceService with RHOAI bundled vLLM. +apiVersion: serving.kserve.io/v1alpha1 +kind: ServingRuntime +metadata: + name: vllm-cuda-{{ .Values.model.name }} + namespace: {{ .Values.namespace }} + labels: + opendatahub.io/dashboard: "true" + annotations: + argocd.argoproj.io/sync-wave: "1" + argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true + openshift.io/display-name: "vLLM Custom ({{ .Values.vllm.image }})" + opendatahub.io/template-display-name: "vLLM Custom" + opendatahub.io/template-name: vllm-cuda-{{ .Values.model.name }} + opendatahub.io/apiProtocol: REST + opendatahub.io/accelerator-name: nvidia.com/gpu +spec: + annotations: + prometheus.io/port: "8000" + prometheus.io/path: /metrics + prometheus.io/scrape: "true" + multiModel: false + supportedModelFormats: + - name: vLLM + version: "1" + autoSelect: true + containers: + - name: kserve-container + image: {{ .Values.vllm.image }} + command: + - python3 + - -m + - vllm.entrypoints.openai.api_server + args: + - --port=8000 + - --served-model-name={{ .Values.model.id }} + - --trust-remote-code + - --enable-prefix-caching + - --enable-auto-tool-choice + - --tool-call-parser={{ .Values.vllm.toolCallParser }} + - --reasoning-parser={{ .Values.vllm.reasoningParser }} + env: + {{- range $key, $val := .Values.vllm.extraEnv }} + - name: {{ $key }} + value: {{ $val | quote }} + {{- end }} + ports: + - containerPort: 8000 + name: http + protocol: TCP + startupProbe: + httpGet: + path: /health + port: 8000 + initialDelaySeconds: 30 + periodSeconds: 30 + failureThreshold: 120 + timeoutSeconds: 10 + readinessProbe: + httpGet: + path: /health + port: 8000 + periodSeconds: 10 + failureThreshold: 3 + timeoutSeconds: 5 + livenessProbe: + httpGet: + path: /health + port: 8000 + periodSeconds: 30 + failureThreshold: 3 + timeoutSeconds: 10 + resources: + requests: + cpu: {{ .Values.hardware.cpu.request | quote }} + memory: {{ .Values.hardware.memory.request }} + nvidia.com/gpu: {{ .Values.hardware.gpuCount | quote }} + limits: + cpu: {{ .Values.hardware.cpu.limit | quote }} + memory: {{ .Values.hardware.memory.limit }} + nvidia.com/gpu: {{ .Values.hardware.gpuCount | quote }} + volumeMounts: + - name: model-cache + mountPath: /model-cache + - name: shm + mountPath: /dev/shm + volumes: + - name: model-cache + persistentVolumeClaim: + claimName: model-cache + - name: shm + emptyDir: + medium: Memory + sizeLimit: 16Gi +{{- end }} diff --git a/charts/pca-ai-serving/templates/tls-secret-job.yaml b/charts/pca-ai-serving/templates/tls-secret-job.yaml index 40b0829..382a752 100644 --- a/charts/pca-ai-serving/templates/tls-secret-job.yaml +++ b/charts/pca-ai-serving/templates/tls-secret-job.yaml @@ -25,9 +25,10 @@ spec: - | set -e HOSTNAME="{{ .Values.tlsJob.gatewayHostname | default (printf "llm-d-gateway-data-science-gateway-class.%s.svc.cluster.local" .Values.namespace) }}" + # CN is limited to 64 chars; put full FQDN in SAN instead openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \ -keyout /tmp/tls.key -out /tmp/tls.crt \ - -subj "/CN=${HOSTNAME}" \ + -subj "/CN=llm-d-gateway" \ -addext "subjectAltName=DNS:${HOSTNAME}" cat < /tmp/secret.json diff --git a/charts/pca-ai-serving/values-aro.yaml b/charts/pca-ai-serving/values-aro.yaml index 7ae8919..7011682 100644 --- a/charts/pca-ai-serving/values-aro.yaml +++ b/charts/pca-ai-serving/values-aro.yaml @@ -2,14 +2,14 @@ model: id: "Qwen/Qwen3.6-35B-A3B-FP8" name: "qwen36-vllm" poolName: "qwen36-vllm-pool" + workloadServiceSuffix: "predictor" vllm: + useCustomRuntime: true image: "vllm/vllm-openai:v0.19.0" maxModelLen: 262144 toolCallParser: "qwen3_xml" reasoningParser: "qwen3" extraEnv: - VLLM_ENABLE_CUDA_COMPATIBILITY: "1" - LD_LIBRARY_PATH: "/usr/local/cuda/compat:/usr/local/cuda/lib64:/usr/lib64" HF_HOME: "/model-cache" HF_HUB_OFFLINE: "0" TRITON_CACHE_DIR: "/model-cache/triton-cache" @@ -33,11 +33,11 @@ storage: epp: enabled: true tlsJob: - enabled: false + enabled: true aiGateway: enabled: true tls: - secretName: "qwen36-vllm-kserve-self-signed-certs" + secretName: "llm-d-gateway-tls" observability: enabled: true pca-observability: diff --git a/charts/pca-ai-serving/values.yaml b/charts/pca-ai-serving/values.yaml index 094339d..3331584 100644 --- a/charts/pca-ai-serving/values.yaml +++ b/charts/pca-ai-serving/values.yaml @@ -10,6 +10,10 @@ vllm: reasoningParser: "qwen3" image: "" extraEnv: {} + # Set true when RHOAI bundled vLLM doesn't support the model architecture. + # Renders ServingRuntime + InferenceService instead of LLMInferenceService. + # Requires vllm.image to be set. + useCustomRuntime: false hardware: gpuProduct: "g6e.2xlarge" instanceTypeLabel: "node.kubernetes.io/instance-type" From 6c90388734dbbfbaa0b26a616b3ab67b420a1cd4 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Thu, 23 Jul 2026 10:26:30 +0300 Subject: [PATCH 12/16] fix: ARO routing port, observability values comment, NFD required on ARO MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - llm-d-gateway-httproute: fallback service uses port 80 (KServe service exposes 80→8000; port 8000 is pod-direct only for InferencePool/EPP) - pca-observability/values.yaml: update adminPassword comment to reflect deterministic hash approach (aligned with upstream PR #14) - values-aro.yaml (operators): nfd.enabled: true — ARO requires NFD to label GPU nodes with nvidia.com/gpu.deploy.* so driver DaemonSet schedules Co-Authored-By: Claude Sonnet 4.6 (1M context) --- charts/pca-ai-serving/charts/pca-observability/values.yaml | 2 +- charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml | 2 +- charts/pca-operators/values-aro.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/pca-ai-serving/charts/pca-observability/values.yaml b/charts/pca-ai-serving/charts/pca-observability/values.yaml index e0b0630..e1ad0fc 100644 --- a/charts/pca-ai-serving/charts/pca-observability/values.yaml +++ b/charts/pca-ai-serving/charts/pca-observability/values.yaml @@ -3,7 +3,7 @@ grafana: enabled: true image: docker.io/grafana/grafana:11.5.2 replicas: 1 - # Optional override; empty → Helm generates and stores in Secret pca-grafana-admin + # Optional override; empty → deterministic password from namespace/release (Argo-safe) adminPassword: "" route: enabled: true diff --git a/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml index 39e8948..6cb796a 100644 --- a/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml +++ b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml @@ -52,7 +52,7 @@ spec: value: / backendRefs: - name: {{ .Values.model.name }}-{{ .Values.model.workloadServiceSuffix | default "kserve-workload-svc" }} - port: 8000 + port: 80 timeouts: request: "0s" backendRequest: "0s" diff --git a/charts/pca-operators/values-aro.yaml b/charts/pca-operators/values-aro.yaml index 000abe6..e014e42 100644 --- a/charts/pca-operators/values-aro.yaml +++ b/charts/pca-operators/values-aro.yaml @@ -4,7 +4,7 @@ operators: nvidiaGpu: channel: v26.3 nfd: - enabled: false + enabled: true serviceMesh: enabled: true serverless: From 76272983425e33eb849e7f5f8917cc24a28dc613 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Thu, 23 Jul 2026 11:05:50 +0300 Subject: [PATCH 13/16] fix: make fallback service port configurable (ROSA=8000, ARO=80) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit kserve-workload-svc (ROSA/LLMInferenceService) exposes port 8000. InferenceService predictor (ARO/useCustomRuntime) exposes port 80→8000. Add model.workloadServicePort (default 8000) and override to 80 in values-aro.yaml so the llm-d gateway HTTPRoute uses the correct port for each cloud. Co-Authored-By: Claude Sonnet 4.6 (1M context) --- charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml | 2 +- charts/pca-ai-serving/values-aro.yaml | 1 + charts/pca-ai-serving/values.yaml | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml index 6cb796a..986b848 100644 --- a/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml +++ b/charts/pca-ai-serving/templates/llm-d-gateway-httproute.yaml @@ -52,7 +52,7 @@ spec: value: / backendRefs: - name: {{ .Values.model.name }}-{{ .Values.model.workloadServiceSuffix | default "kserve-workload-svc" }} - port: 80 + port: {{ .Values.model.workloadServicePort | default 8000 }} timeouts: request: "0s" backendRequest: "0s" diff --git a/charts/pca-ai-serving/values-aro.yaml b/charts/pca-ai-serving/values-aro.yaml index 7011682..8ab9b22 100644 --- a/charts/pca-ai-serving/values-aro.yaml +++ b/charts/pca-ai-serving/values-aro.yaml @@ -3,6 +3,7 @@ model: name: "qwen36-vllm" poolName: "qwen36-vllm-pool" workloadServiceSuffix: "predictor" + workloadServicePort: 80 vllm: useCustomRuntime: true image: "vllm/vllm-openai:v0.19.0" diff --git a/charts/pca-ai-serving/values.yaml b/charts/pca-ai-serving/values.yaml index 3331584..a0f3f2a 100644 --- a/charts/pca-ai-serving/values.yaml +++ b/charts/pca-ai-serving/values.yaml @@ -4,6 +4,8 @@ model: id: "Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8" name: "qwen3-coder" poolName: "qwen3-coder-inference-pool" + workloadServiceSuffix: "kserve-workload-svc" + workloadServicePort: 8000 vllm: maxModelLen: 32768 toolCallParser: "qwen3_coder" From 67d58c7e94c29821a1a70bb91ea75c37d6b94013 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Thu, 23 Jul 2026 12:11:45 +0300 Subject: [PATCH 14/16] fix: address PR bugs: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - pca-observability.namespace: hacohen-ai-coder → ai-serving (test artifact) - add {{- fail }} guard for empty gitops.cloud in app-of-apps template - pca-benchmarks/values.yaml: enabled: false (opt-in, not opt-out) - hardware-profiles.yaml: add | int cast for cpu counts (HardwareProfile CRD expects integer) - subscriptions.yaml: double-chain serviceMesh/serverless guards to match NFD pattern - datasciencecluster.yaml: add modelmeshserving: Removed explicitly - values-aro.yaml: epp.enabled: false (InferencePool/InferenceModel CRDs absent on RHOAI 3.3.1) --- charts/pca-ai-serving/templates/hardware-profiles.yaml | 4 ++-- charts/pca-ai-serving/values-aro.yaml | 8 ++++++-- charts/pca-app-of-apps/templates/00-app-of-apps.yaml | 3 +++ charts/pca-benchmarks/values.yaml | 2 +- charts/pca-operators/templates/subscriptions.yaml | 4 ++-- .../pca-platform-config/templates/datasciencecluster.yaml | 2 ++ 6 files changed, 16 insertions(+), 7 deletions(-) diff --git a/charts/pca-ai-serving/templates/hardware-profiles.yaml b/charts/pca-ai-serving/templates/hardware-profiles.yaml index 34c5d2e..31f76ec 100644 --- a/charts/pca-ai-serving/templates/hardware-profiles.yaml +++ b/charts/pca-ai-serving/templates/hardware-profiles.yaml @@ -16,9 +16,9 @@ spec: - displayName: CPU identifier: cpu resourceType: CPU - defaultCount: {{ .Values.hardware.cpu.request }} + defaultCount: {{ .Values.hardware.cpu.request | int }} minCount: 1 - maxCount: {{ .Values.hardware.cpu.limit }} + maxCount: {{ .Values.hardware.cpu.limit | int }} - displayName: Memory identifier: memory resourceType: Memory diff --git a/charts/pca-ai-serving/values-aro.yaml b/charts/pca-ai-serving/values-aro.yaml index 8ab9b22..c76aa74 100644 --- a/charts/pca-ai-serving/values-aro.yaml +++ b/charts/pca-ai-serving/values-aro.yaml @@ -11,6 +11,9 @@ vllm: toolCallParser: "qwen3_xml" reasoningParser: "qwen3" extraEnv: + # NOTE: VLLM_ENABLE_CUDA_COMPATIBILITY and LD_LIBRARY_PATH compat shims are NOT needed + # on driver 580+ (CUDA 13.0) — they caused Error 803 and were deliberately removed. + # Add them back only if the GPU node has driver 550 (CUDA 12.4) or older. HF_HOME: "/model-cache" HF_HUB_OFFLINE: "0" TRITON_CACHE_DIR: "/model-cache/triton-cache" @@ -32,7 +35,8 @@ storage: storageClass: "managed-csi" modelCacheSize: 100Gi epp: - enabled: true + # InferencePool/InferenceModel CRDs missing on RHOAI 3.3.1 — re-enable once ARO upgrades + enabled: false tlsJob: enabled: true aiGateway: @@ -42,7 +46,7 @@ aiGateway: observability: enabled: true pca-observability: - namespace: hacohen-ai-coder + namespace: ai-serving grafana: enabled: true langfuse: diff --git a/charts/pca-app-of-apps/templates/00-app-of-apps.yaml b/charts/pca-app-of-apps/templates/00-app-of-apps.yaml index 3c21886..58da46c 100644 --- a/charts/pca-app-of-apps/templates/00-app-of-apps.yaml +++ b/charts/pca-app-of-apps/templates/00-app-of-apps.yaml @@ -1,6 +1,9 @@ # Root App-of-Apps: ArgoCD discovers child Applications in this directory. # Each child Application below points to a subdirectory of manifests. # Sync waves ensure correct ordering: operators first, then platform, then workloads. +{{- if not .Values.gitops.cloud }} +{{- fail "gitops.cloud must be set to 'aro' or 'rosa' (injected by Terraform gitops-bootstrap)" }} +{{- end }} apiVersion: argoproj.io/v1alpha1 kind: AppProject metadata: diff --git a/charts/pca-benchmarks/values.yaml b/charts/pca-benchmarks/values.yaml index d85a99e..a8525f7 100644 --- a/charts/pca-benchmarks/values.yaml +++ b/charts/pca-benchmarks/values.yaml @@ -1,4 +1,4 @@ -enabled: true +enabled: false model: id: "Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8" namespace: "ai-serving" diff --git a/charts/pca-operators/templates/subscriptions.yaml b/charts/pca-operators/templates/subscriptions.yaml index ebf49fb..9f77790 100644 --- a/charts/pca-operators/templates/subscriptions.yaml +++ b/charts/pca-operators/templates/subscriptions.yaml @@ -131,7 +131,7 @@ spec: source: redhat-operators sourceNamespace: openshift-marketplace {{- end }} -{{- if (.Values.operators).serviceMesh.enabled | default false }} +{{- if ((.Values.operators).serviceMesh).enabled | default false }} --- # OpenShift Service Mesh (required by llm-d/Gateway on ARO) apiVersion: v1 @@ -155,7 +155,7 @@ spec: source: redhat-operators sourceNamespace: openshift-marketplace {{- end }} -{{- if (.Values.operators).serverless.enabled | default false }} +{{- if ((.Values.operators).serverless).enabled | default false }} --- # OpenShift Serverless (KNative, required by KServe on ARO) apiVersion: v1 diff --git a/charts/pca-platform-config/templates/datasciencecluster.yaml b/charts/pca-platform-config/templates/datasciencecluster.yaml index 6b831c2..a95c8fa 100644 --- a/charts/pca-platform-config/templates/datasciencecluster.yaml +++ b/charts/pca-platform-config/templates/datasciencecluster.yaml @@ -24,6 +24,8 @@ spec: managementState: Managed aipipelines: managementState: Managed + modelmeshserving: + managementState: Removed workbenches: managementState: Managed {{- if .Values.guardrails.enabled }} From 9d54655d0b8c326a01ad433143c02dc356f4f2bb Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Thu, 23 Jul 2026 12:25:45 +0300 Subject: [PATCH 15/16] docs: update AGENTS.md for benchmark opt-in default and gitops.cloud requirement --- AGENTS.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index c96807f..02b9560 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -32,7 +32,7 @@ ArgoCD syncs these Helm charts in order (via `pca-app-of-apps`): | `pca-platform-config` | 2 | Namespaces, HF token, DSC/DSCI, NFD, NVIDIA ClusterPolicy, CheCluster, OAuth HTPasswd, Maas gateway, LWS CR; optional `pca-guardrails` / `pca-mcp` | AI ns (default `ai-serving`); optional per-dev namespaces | | `pca-ai-serving` | 3 | PVC, HardwareProfile, LLMInferenceService (llm-d/vLLM), llm-d gateway + HTTPRoute, RHCL AI Gateway (`pca-ai-gateway`) + AuthPolicy; `pca-observability` (Grafana; optional Langfuse/OTel) | AI ns | | `pca-devspaces` | 4 | DevWorkspace, Roo/Continue/Cline ConfigMaps, per-ns API keys, RBAC; global DevSpaces ConfigMaps | Per-dev ns; globals in `openshift-devspaces` | -| `pca-benchmarks` | 5 | GuideLLM sweep Job (one-shot; enabled per-cloud); disabled on ROSA by default | AI ns | +| `pca-benchmarks` | 5 | GuideLLM sweep Job (one-shot; **disabled by default — opt-in via cloud values files**) | AI ns | ## Where each target deploys @@ -42,7 +42,7 @@ ArgoCD syncs these Helm charts in order (via `pca-app-of-apps`): | **ARO** | All six via ArgoCD (`charts/`) | `values-aro.yaml` per chart | | **Existing OpenShift** | `pca-platform-config`, `pca-ai-serving`, `pca-devspaces` only (Helm) | `deploy_existing_openshift/values-*.yaml` | -Both ROSA and ARO use the same unified `charts/` directory at the repo root. Cloud-specific values (hardware, storage class, model, enabled features) are in `values-aro.yaml` / `values-rosa.yaml` within each chart. Terraform injects `gitops.cloud: aro|rosa` to select the right overlay via ArgoCD `valueFiles`. +Both ROSA and ARO use the same unified `charts/` directory at the repo root. Cloud-specific values (hardware, storage class, model, enabled features) are in `values-aro.yaml` / `values-rosa.yaml` within each chart. Terraform injects `gitops.cloud: aro|rosa` to select the right overlay via ArgoCD `valueFiles`. **`gitops.cloud` must be explicitly set — an empty or missing value causes a hard Helm render error in `pca-app-of-apps`.** ## ROSA / ARO — full from-scratch From 6f115bb9b608ec3a90aa0f15acabfdeda3067542 Mon Sep 17 00:00:00 2001 From: Hadar Cohen Date: Thu, 23 Jul 2026 18:31:04 +0300 Subject: [PATCH 16/16] feat: ARO naming alignment + vllm.enableThinking + model.servedName MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - model.name: qwen36-vllm → qwen3-coder in values-aro.yaml so service names and pod labels match ROSA smoke test expectations - model.servedName: new field lets vLLM serve a model under a different API name (ARO: serves Qwen3.6-35B as Qwen3-Coder-30B for test parity) - vllm.enableThinking: false adds --chat-template-kwargs to ServingRuntime args to disable Qwen3 thinking mode per cloud (default true = enabled) - epp.enabled: false in values-aro.yaml (InferencePool CRDs absent RHOAI 3.3.1) - pca-observability.namespace: ai-serving (was hacohen-ai-coder test artifact) - ARO HELM_ARGS documented in deploy-existing-openshift Cursor skill Co-Authored-By: Claude Sonnet 4.6 (1M context) --- .../skills/deploy-existing-openshift/SKILL.md | 36 +++++++++++++++++++ .../templates/inferenceservice.yaml | 1 + .../templates/servingruntime.yaml | 10 +++++- charts/pca-ai-serving/values-aro.yaml | 7 ++-- charts/pca-ai-serving/values.yaml | 4 +++ 5 files changed, 54 insertions(+), 4 deletions(-) diff --git a/.cursor/skills/deploy-existing-openshift/SKILL.md b/.cursor/skills/deploy-existing-openshift/SKILL.md index 150b7c4..8f34f0b 100644 --- a/.cursor/skills/deploy-existing-openshift/SKILL.md +++ b/.cursor/skills/deploy-existing-openshift/SKILL.md @@ -24,6 +24,42 @@ Before deploying, verify these automatically (do NOT ask the user unless somethi make ai-serving-deploy-existing-openshift HELM_ARGS='--set aiGateway.kuadrant.create=false' ``` +## ARO-specific overrides + +On ARO (Azure), the chart defaults use AWS storage/hardware. Add these to `HELM_ARGS` for any ARO deployment: + +```bash +HELM_ARGS="--set storage.storageClass=managed-csi \ + --set hardware.instanceTypeLabel=nvidia.com/gpu.product \ + --set hardware.gpuProduct=NVIDIA-H100-NVL \ + --set hardware.cpu.request=8 --set hardware.cpu.limit=16 \ + --set hardware.memory.request=80Gi --set hardware.memory.limit=120Gi \ + --set model.id=Qwen/Qwen3.6-35B-A3B-FP8 \ + --set model.name=qwen36-vllm \ + --set vllm.useCustomRuntime=true \ + --set vllm.image=vllm/vllm-openai:v0.19.0 \ + --set vllm.maxModelLen=262144 \ + --set vllm.toolCallParser=qwen3_xml \ + --set epp.enabled=false \ + --set aiGateway.kuadrant.create=false" +``` + +Also enable TrustyAI in the DSC before deploying with guardrails (ARO only — RHOAI doesn't enable TrustyAI by default): +```bash +oc patch datasciencecluster default-dsc --type=merge \ + -p '{"spec":{"components":{"trustyai":{"managementState":"Managed"}}}}' +# Wait ~1 min for GuardrailsOrchestrator CRD to appear +oc get crd guardrailsorchestrators.trustyai.opendatahub.io +``` + +GPU node management (ARO, `aro-pca-aue` cluster): +```bash +# Scale up before testing (H100 node costs money) +oc scale machineset aro-pca-aue-cq6r2-gpu-h100 -n openshift-machine-api --replicas=1 +# Scale down when done — CRITICAL +oc scale machineset aro-pca-aue-cq6r2-gpu-h100 -n openshift-machine-api --replicas=0 +``` + ## Deployment Steps ### AI Serving (once per cluster) diff --git a/charts/pca-ai-serving/templates/inferenceservice.yaml b/charts/pca-ai-serving/templates/inferenceservice.yaml index d0e2c35..032abc3 100644 --- a/charts/pca-ai-serving/templates/inferenceservice.yaml +++ b/charts/pca-ai-serving/templates/inferenceservice.yaml @@ -31,6 +31,7 @@ spec: runtime: vllm-cuda-{{ .Values.model.name }} args: - --model={{ .Values.model.id }} + - --served-model-name={{ .Values.model.servedName | default .Values.model.id }} - --tensor-parallel-size={{ .Values.hardware.gpuCount }} - --max-model-len={{ .Values.vllm.maxModelLen }} resources: diff --git a/charts/pca-ai-serving/templates/servingruntime.yaml b/charts/pca-ai-serving/templates/servingruntime.yaml index 1bc544c..6959d9e 100644 --- a/charts/pca-ai-serving/templates/servingruntime.yaml +++ b/charts/pca-ai-serving/templates/servingruntime.yaml @@ -37,17 +37,25 @@ spec: - vllm.entrypoints.openai.api_server args: - --port=8000 - - --served-model-name={{ .Values.model.id }} + - --served-model-name={{ .Values.model.servedName | default .Values.model.id }} - --trust-remote-code - --enable-prefix-caching - --enable-auto-tool-choice - --tool-call-parser={{ .Values.vllm.toolCallParser }} - --reasoning-parser={{ .Values.vllm.reasoningParser }} + {{- if not .Values.vllm.enableThinking }} + - --chat-template-kwargs + - '{"enable_thinking": false}' + {{- end }} env: + {{- if .Values.vllm.extraEnv }} {{- range $key, $val := .Values.vllm.extraEnv }} - name: {{ $key }} value: {{ $val | quote }} {{- end }} + {{- else }} + [] + {{- end }} ports: - containerPort: 8000 name: http diff --git a/charts/pca-ai-serving/values-aro.yaml b/charts/pca-ai-serving/values-aro.yaml index c76aa74..357edc5 100644 --- a/charts/pca-ai-serving/values-aro.yaml +++ b/charts/pca-ai-serving/values-aro.yaml @@ -1,7 +1,8 @@ model: - id: "Qwen/Qwen3.6-35B-A3B-FP8" - name: "qwen36-vllm" - poolName: "qwen36-vllm-pool" + id: "Qwen/Qwen3.6-35B-A3B-FP8" # actual HF model loaded from disk/HF Hub + servedName: "Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8" # API name exposed by vLLM (aligned with ROSA smoke tests) + name: "qwen3-coder" # service/pod label name (aligned with ROSA) + poolName: "qwen3-coder-inference-pool" workloadServiceSuffix: "predictor" workloadServicePort: 80 vllm: diff --git a/charts/pca-ai-serving/values.yaml b/charts/pca-ai-serving/values.yaml index a0f3f2a..89fcd74 100644 --- a/charts/pca-ai-serving/values.yaml +++ b/charts/pca-ai-serving/values.yaml @@ -2,6 +2,7 @@ namespace: ai-serving clusterResources: true model: id: "Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8" + servedName: "" # empty = use model.id as the vLLM --served-model-name name: "qwen3-coder" poolName: "qwen3-coder-inference-pool" workloadServiceSuffix: "kserve-workload-svc" @@ -16,6 +17,9 @@ vllm: # Renders ServingRuntime + InferenceService instead of LLMInferenceService. # Requires vllm.image to be set. useCustomRuntime: false + # Set false to disable Qwen3 thinking mode (adds --chat-template-kwargs). + # Use false when the model's thinking blocks exceed test max_tokens budgets. + enableThinking: true hardware: gpuProduct: "g6e.2xlarge" instanceTypeLabel: "node.kubernetes.io/instance-type"