Revert and re-adapt test/e2e/common/utils.py

This reverts changes done in commit ecff079 to test/e2e/common/utils.py.
It is possible to revert since opendatahub-io/odh-model-controller#59 is
solved.

After the revert, another adaptation was needed. CI in upstream assumes
that the URL in the InferenceService cannot be resolved, so it uses the
IP of the istio-ingressgateway together with the HTTP Host header to
workaround this limitation. However, in ODH testing environment the URL
of InferenceServices can be resolved. The adaptation adds a flag to use
the URL of the isvc, rather than using the IP of the
istio-ingressgateway.

This adaptation can be contributed to upstream, because the community
can benefit from it.

The CI setup is updated, so that the revert works correctly:
* odh-model-controller is now being installed
* TLS is removed from the istio-ingressgateway

Additionally, the following other changes were done to the CI setup:
* Turn off Mesh-related components that are not needed for CI
* Prefer usage of the ServiceMeshMember CRD to enroll namespaces to the
  Mesh

Fixes #50

Signed-off-by: Edgar Hernández <[email protected]>

test/e2e/common/utils.py

@@ -80,23 +80,20 @@ def predict_str(service_name, input_json, protocol_version="v1",
     )
     # temporary sleep until this is fixed https://github.com/kserve/kserve/issues/604
     time.sleep(10)
-    # cluster_ip = get_cluster_ip()
-    host = urlparse(isvc["status"]["components"]["predictor"]["url"]).netloc
-    path = urlparse(isvc["status"]["components"]["predictor"]["url"]).path
-    cluster_ip = host
+    cluster_ip, host, path = get_isvc_endpoint(isvc)
     headers = {"Host": host, "Content-Type": "application/json"}
 
     if model_name is None:
         model_name = service_name
 
-    url = f"https://{cluster_ip}{path}/v1/models/{model_name}:predict"
+    url = f"http://{cluster_ip}{path}/v1/models/{model_name}:predict"
     if protocol_version == "v2":
-        url = f"https://{cluster_ip}{path}/v2/models/{model_name}/infer"
+        url = f"http://{cluster_ip}{path}/v2/models/{model_name}/infer"
 
     logging.info("Sending Header = %s", headers)
     logging.info("Sending url = %s", url)
     logging.info("Sending request data: %s", input_json)
-    response = requests.post(url, input_json, headers=headers, verify=False)
+    response = requests.post(url, input_json, headers=headers)
     logging.info("Got response code %s, content %s", response.status_code, response.content)
     if response.status_code == 200:
         preds = json.loads(response.content.decode("utf-8"))
@@ -118,8 +115,7 @@ def predict_ig(ig_name, input_json, protocol_version="v1",
             version=version,
         )
 
-        cluster_ip = get_cluster_ip()
-        host = urlparse(ig["status"]["components"]["predictor"]["url"]).netloc
+        cluster_ip, host = get_isvc_endpoint(ig)
         headers = {"Host": host}
         url = f"http://{cluster_ip}"
 
@@ -154,8 +150,7 @@ def explain_response(service_name, input_json):
     )
     # temporary sleep until this is fixed https://github.com/kserve/kserve/issues/604
     time.sleep(10)
-    cluster_ip = get_cluster_ip()
-    host = urlparse(isvc["status"]["components"]["predictor"]["url"]).netloc
+    cluster_ip, host = get_isvc_endpoint(isvc)
     url = "http://{}/v1/models/{}:explain".format(cluster_ip, service_name)
     headers = {"Host": host}
     with open(input_json) as json_file:
@@ -210,15 +205,14 @@ def get_cluster_ip(name="istio-ingressgateway", namespace="istio-system"):
 
 
 def predict_grpc(service_name, payload, parameters=None, version=constants.KSERVE_V1BETA1_VERSION, model_name=None):
-    cluster_ip = get_cluster_ip()
     kfs_client = KServeClient(
         config_file=os.environ.get("KUBECONFIG", "~/.kube/config"))
     isvc = kfs_client.get(
         service_name,
         namespace=KSERVE_TEST_NAMESPACE,
         version=version,
     )
-    host = urlparse(isvc["status"]["components"]["predictor"]["url"]).netloc
+    cluster_ip, host = get_isvc_endpoint(isvc)
     if ":" not in cluster_ip:
         cluster_ip = cluster_ip + ":80"
 
@@ -244,3 +238,14 @@ def predict_modelmesh(service_name, input_json, pod_name, model_name=None):
             url = f"http://localhost:8008/v2/models/{model_name}/infer"
             response = requests.post(url, json.dumps(data))
             return json.loads(response.content.decode("utf-8"))
+
+
+def get_isvc_endpoint(isvc):
+    host = urlparse(isvc["status"]["url"]).netloc
+    path = urlparse(isvc["status"]["url"]).path
+    if os.environ.get("CI_USE_ISVC_HOST") == "1":
+        cluster_ip = host
+    else:
+        cluster_ip = get_cluster_ip()
+    return cluster_ip, host, path
+

test/e2e/predictor/test_tensorflow.py

@@ -38,7 +38,7 @@ def test_tensorflow_kserve():
             storage_uri='gs://kfserving-examples/models/tensorflow/flowers',
             resources=V1ResourceRequirements(
                 requests={'cpu': '10m', 'memory': '128Mi'},
-                limits={'cpu': '100m', 'memory': '256Mi'}
+                limits={'cpu': '100m', 'memory': '512Mi'}
             )
         )
     )

test/scripts/openshift-ci/deploy.ossm.sh

@@ -134,26 +134,4 @@ EOF
 # Waiting for OSSM minimum start
 waitpodready "istio-system" "app=istiod"
 
-# Create SMMR to enroll namespaces via a label. Also, set mTLS policy to strict by default.
-cat <<EOF | oc apply -f -
-apiVersion: maistra.io/v1
-kind: ServiceMeshMemberRoll
-metadata:
-  name: default
-  namespace: istio-system
-spec:
-  memberSelectors:
-  - matchLabels:
-      testing.kserve.io/add-to-mesh: "true"
----
-apiVersion: security.istio.io/v1beta1
-kind: PeerAuthentication
-metadata:
-  name: default
-  namespace: istio-system
-spec:
-  mtls:
-    mode: STRICT
-EOF
-
 echo -e "\n  OSSM has partially started and should be fully ready soon."

test/scripts/openshift-ci/deploy.serverless.sh

@@ -69,12 +69,15 @@ waitpodready "openshift-serverless" "name=knative-operator"
 
 # Install KNative
 cat <<EOF | oc apply -f -
-apiVersion: v1
-kind: Namespace
+apiVersion: maistra.io/v1
+kind: ServiceMeshMember
 metadata:
-  name: knative-serving
-  labels:
-    testing.kserve.io/add-to-mesh: "true"
+  name: default
+  namespace: knative-serving
+spec:
+  controlPlaneRef:
+    namespace: istio-system
+    name: basic
 ---
 apiVersion: operator.knative.dev/v1beta1
 kind: KnativeServing
@@ -144,12 +147,9 @@ spec:
     - hosts:
         - '*'
       port:
-        name: https
-        number: 443
-        protocol: HTTPS
-      tls:
-        credentialName: wildcard-certs
-        mode: SIMPLE
+        name: http
+        number: 80
+        protocol: HTTP
 ---
 apiVersion: networking.istio.io/v1beta1
 kind: Gateway
@@ -167,14 +167,4 @@ spec:
         number: 8081
         protocol: HTTP
 ---
-apiVersion: v1
-data:
-  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMzekNDQWNjQ0FRQXdEUVlKS29aSWh2Y05BUUVMQlFBd0tURVRNQkVHQTFVRUNnd0tRMnhoYzJnZ1NXNWoKTGpFU01CQUdBMVVFQXd3SlkyeGhjMmd1WTI5dE1CNFhEVEl6TURNeE1ERXdNakExT1ZvWERUSTBNRE13T1RFdwpNakExT1Zvd1FqRXJNQ2tHQTFVRUF3d2lLaTVqYkdGemFDNWhjSEJ6TG05d1pXNXphR2xtZEM1bGVHRnRjR3hsCkxtTnZiVEVUTUJFR0ExVUVDZ3dLUTJ4aGMyZ2dTVzVqTGpDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVAKQURDQ0FRb0NnZ0VCQU1QYklqTzIrNFpwN05GZHFIM1c3WTZXb25zMnZWbmJORXBBb2t3OTdIb1Q3R0tyYXA1MQppL0M3N2pyTXdsUnpua2M4MHI1Y3FsWXBLNUd3eml0bEhSWkc5bU5HZzMrKzFRdTk2NjdQV0NRUE1lNzZ2T3VPCnlCdmtvM01wSUI4QkFmZHFJVk45L3BFdWFtdThVZS92U0xTb2hmZk5lSkNyM2oxNzY2MUdFcnVGUjhqRFAxcXEKeDltU09zQ0U0RVJSallJeWE4blFMZE5aMVg4WEYrVGpXekJCdlJ1R3FzS2VZVzNwWEFGamVXaHozcG1aZXovKwphaHljbVM2ckVMU0N1aUIwSU9xZTVsZ0EvcUVoc2xOd2pYSzNvZndicDAxVDJhWFdWenY3K2Z5dURQc3hacktZCnNNMlY3eWx0dlJRZ01YOFZmenEyTkRSeWlnRzU5eWdNQVVFQ0F3RUFBVEFOQmdrcWhraUc5dzBCQVFzRkFBT0MKQVFFQUgxaUUzZmJxY3pQblBITko4WVpyYUtVSUxLd0dDRGRNWllJYlpsK25zSFIyUERSRW5kd3g3T24yengyUwoxTWx1MTYzRjFETlpBVTZZUVp1bGFLN2xrWlpSQllja0xzREcwKzVyb1VxQ2sySU1iaE9FYlE4STNNQi94NytjCkc3NDU0cGZ6YU9nM0hOQlFzSGtzVHN5cUVSQUZranNwQTRBNVhoOUdKMEFrS1d6emZyaGVScGtpOWFzcmhPUjMKUDdJTnR4eDNXbmVrbUJGZzdIYm9pQzZuWXRHUExxMW5sQy84S1lKRk0rYmxpOENHTHVzb2NXS3dzSXkybCtFbQp2UUVLQXMzKzY3SVZ5M0ZtRlFrdFArVzQvQlhuazM0YWZRTUZhZzlnTkdoQVd3elJ6VDNuSmtEN2psWXZmUHZzClNqcUtKU2lONlJRWTBmM2JDNVhNaHlnMFhnPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRREQyeUl6dHZ1R2FlelIKWGFoOTF1Mk9scUo3TnIxWjJ6UktRS0pNUGV4NkUreGlxMnFlZFl2d3UrNDZ6TUpVYzU1SFBOSytYS3BXS1N1UgpzTTRyWlIwV1J2WmpSb04vdnRVTHZldXV6MWdrRHpIdStyenJqc2diNUtOektTQWZBUUgzYWlGVGZmNlJMbXByCnZGSHY3MGkwcUlYM3pYaVFxOTQ5ZSt1dFJoSzdoVWZJd3o5YXFzZlpranJBaE9CRVVZMkNNbXZKMEMzVFdkVi8KRnhmazQxc3dRYjBiaHFyQ25tRnQ2VndCWTNsb2M5NlptWHMvL21vY25Ka3VxeEMwZ3JvZ2RDRHFudVpZQVA2aApJYkpUY0kxeXQ2SDhHNmROVTltbDFsYzcrL244cmd6N01XYXltTERObGU4cGJiMFVJREYvRlg4NnRqUTBjb29CCnVmY29EQUZCQWdNQkFBRUNnZ0VBRmY3R0dJaTBOcVF1dEZTUVY1R0xuRGZPaDRmZU8va2lKalNjQlhQdTJzYmkKQlRLN0JwQ3M1cHcwWk9ZWjdPSVBKSER3T2ZDdU1IN3ZKYTExZWVvaEdoOWVERWdlL0hteDgxK2cyRUR3NVJ2UAp2OGJvOEl0WWJjbC9rYTlNckM2d3lkaGhaYjhBbDgxZXBqcS8rUEltZUNOMDZCOXJLdFFpWVVWSmNtd3NMbUxYCklhSW4yMEQrMzhRQW9ZZVBoV2NUOUExYVBWTmZ6NXFhOXpsdUtwOUt0bnR5cHdiMnFObmN3UmRSbm5tb0c4bkQKODRjWHJyS1JMZC9JTFBFamVwc2Juc1Q5SHJ3aldIbGJxU1FVc0lhQ29GenI5aWR3eTcrU0hPVWlkTmF3YVhwYQozNDROUnB4Sk5EaEd4ZDhidnJVbTJIMVhLZ2ZIYlBSaWsyU0wvVmRRQVFLQmdRRGdrMTArR0J5N3RBbzdUa2d0Ckh4cDhsQ3lkSUFaYVkzYXUweGRvMXlXNEV0UDVpNjEySk1kYm9TQmhpbGJJQmFpRjRiZ3AzRjA3WFJQeWJBRFgKS1c2aitvTW5SMlRwd1ZsUmJIeW1OT1FYT1hOUEhRWForUFM2bDVjaWs1QlVRVi8vL2NySUFvS3pIUHpOckl3OQpZMGZoWmNrZHRpL0pIZVJZandnWCsvb3I2UUtCZ1FEZlF2ME1ld01mQ3JmWVRCdlVGZldncm9pbU9PWEFhV2M4ClVBVVB2MXdQYjVSbkY5eWdDQjRQL2l5QVlwOWl1aHBodDM3NjdVcGVsL3pCQitmNzZ0bHZaNWIySzBDWHNwaUIKdGNSSnU2ZWZLdEFqZGNqQ3BRM3hpelpTNjNFSHJIWDREY2s4QlhVcG96Q3R5N1BPeXZobDRwMFdyL2gwWW1OYgplU0FWcFViTG1RS0JnUURLTHFIUmwyKzI1WDRZcW45OGIvWXVsbEFjSFlyYXNaVldDNkdWdDZ5enJlKzlTSzBnCklqaUJHK3pGSkFEQkQ2Y0s4WTRWMGRqMTZ2UmNXalBmZ2VPa0taTU9OODU0VEtRWEZDNmNqQjJWY3htRzdrQW8KWDJRazRQa21IZWZna3dMVXV5NW5KeXQ0Q2U3blZDTGwyWTRMTk5IOXQ5b0puS25KdU91MmZCcGNrUUtCZ0F6OApkSU9aVkNFbUduTjJXZGdJUHZWTnNaMFppaU9hL2VwQUxVc3hNa1dqazlvN1JSWDU0dVhEUHd0b3NTU285b2ZnCmlINUg5eDl4Yjc0Nm0zL0h0VVlKbkhwTkljQ3hIclhNd05JWkhETGg1cUZwWkhnTjZiVzNCejNqZS91YVNISloKT3U5RzBmM09CRExYdW1tNDNLSHdnSHFsV2FwTFhzUWZVNEp1enFOaEFvR0FYRGhoaFBZTWt3TFhzQUdxSmlpOApUcnd3cGExN21vbzJoQ2FncFRsemdaR281bjZFandoM1ZoN0JaQ0hJc0FmY3ZoUUZ2OE1UZXVGQzBvNUZGU3gwCjN0MHpKQWdrWFBXYnhXQU9mU3FZc1NGR0tyVHFuNngzcTRWQXVyZ09Qa2pFd3VIUkFMajJyMFZVWUg4OWRab0QKWDBGcUM4SUNRWjRlbDFVd0c5bXAvaEE9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
-kind: Secret
-metadata:
-  name: wildcard-certs
-  namespace: istio-system
-type: kubernetes.io/tls
----
 EOF

test/scripts/openshift-ci/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - github.com/opendatahub-io/odh-model-controller/config/base?ref=main
+
+namespace: kserve

test/scripts/openshift-ci/run-e2e-tests.sh

@@ -77,6 +77,9 @@ kustomize build $PROJECT_ROOT/config/overlays/test | \
   oc apply -f -
 oc wait --for=condition=ready pod -l control-plane=kserve-controller-manager -n kserve --timeout=300s
 
+echo "Installing odh-model-controller"
+oc apply -k $PROJECT_ROOT/test/scripts/openshift-ci
+
 echo "Add testing models to minio storage ..." # Reference: config/overlays/test/minio/minio-init-job.yaml
 curl -L https://storage.googleapis.com/kfserving-examples/models/sklearn/1.0/model/model.joblib -o /tmp/sklearn-model.joblib
 oc expose service minio-service -n kserve && sleep 5
@@ -93,8 +96,16 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: kserve-ci-e2e-test
-  labels:
-    testing.kserve.io/add-to-mesh: "true"
+---
+apiVersion: maistra.io/v1
+kind: ServiceMeshMember
+metadata:
+  name: default
+  namespace: kserve-ci-e2e-test
+spec:
+  controlPlaneRef:
+    namespace: istio-system
+    name: basic
 EOF
 
 oc apply -f $PROJECT_ROOT/config/overlays/test/minio/minio-user-secret.yaml -n kserve-ci-e2e-test
@@ -108,5 +119,6 @@ kustomize build $PROJECT_ROOT/config/overlays/test/clusterresources | \
 echo "Run E2E tests: $1"
 pushd $PROJECT_ROOT >/dev/null
   export GITHUB_SHA=$(git rev-parse HEAD)
+  export CI_USE_ISVC_HOST="1"
   ./test/scripts/gh-actions/run-e2e-tests.sh "$1"
 popd