Chapter 2. Setting up OpenShift AI Connector for Red Hat Developer Hub with Red Hat OpenShift AI

Procedure

1. Configure RHOAI-related RBAC and credentials. A Kubernetes ServiceAccount and a service-account-token Secret are required for the connector to retrieve data from RHOAI. The following resources must be created, replacing namespace names (ai-rhdh for RHDH, rhoai-model-registries for RHOAI) as needed:

   • ServiceAccount (rhdh-rhoai-connector). For example:

     apiVersion: v1
     kind: ServiceAccount
     metadata:
       name: rhdh-rhoai-connector
       namespace: ai-rhdh

   • ClusterRole and ClusterRoleBinding (rhdh-rhoai-connector) to allow access to OCP resources like routes, services, and inferenceservices. For example:

     # Example for `ClusterRole`
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
       name: rhdh-rhoai-connector
       annotations:
         argocd.argoproj.io/sync-wave: "0"
     rules:
       - apiGroups:
           - apiextensions.k8s.io
         resources:
           - customresourcedefinitions
         verbs:
           - get
       - apiGroups:
           - route.openshift.io
         resources:
           - routes
         verbs:
           - get
           - list
           - watch
       - apiGroups: [""]
         resources:
           - serviceaccounts
           - services
         verbs:
           - get
           - list
           - watch
     
       - apiGroups: ["serving.kserve.io"]
         resources: ["inferenceservices"]
         verbs: ["get", "list", "watch"]

     # Example for `ClusterRoleBinding`
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
       name: rhdh-rhoai-connector
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: ClusterRole
       name: rhdh-rhoai-connector
     subjects:
       - kind: ServiceAccount
         name: rhdh-rhoai-connector
         namespace: ai-rhdh

   • Role and RoleBinding to allow ConfigMap updates within the RHDH namespace (ai-rhdh). For example:

     # Example for `Role` and `Rolebinding` in the {product-very-short} namespace (`ai-rhdh`)
     apiVersion: rbac.authorization.k8s.io/v1
     kind: Role
     metadata:
       name: rhdh-rhoai-connector
       namespace: ai-rhdh
     rules:
       - apiGroups: [""]
         resources: ["configmaps"]
         verbs: ["get", "list", "watch", "create", "update", "patch"]
     ---
     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: rhdh-rhoai-connector
       namespace: ai-rhdh
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: Role
       name: rhdh-rhoai-connector
     subjects:
       - kind: ServiceAccount
         name: rhdh-rhoai-connector
         namespace: ai-rhdh

   • RoleBinding in the RHOAI namespace (rhoai-model-registries) to grant the RHDH ServiceAccount read permissions to the model registry data (binding to registry-user-modelregistry-public).

     # Example for `RoleBinding` in the {rhoai-short} namespace (rhoai-model-registries)
     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       # if using ODH then change rhoai to odh in the name and namespace here
       name: rhdh-rhoai-dashboard-permissions
       # namespace: odh-model-registries
       namespace: rhoai-model-registries
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: Role
       name: registry-user-modelregistry-public
     subjects:
       - apiGroup: rbac.authorization.k8s.io
         kind: Group
         name: system:serviceaccounts:ai-rhdh

   • Secret (rhdh-rhoai-connector-token) of type kubernetes.io/service-account-token that goes along with the rhdh-rhoai-connector ServiceAccount.

     apiVersion: v1
     kind: Secret
     metadata:
       name: rhdh-rhoai-connector-token
       namespace: ai-rhdh
       annotations:
         kubernetes.io/service-account.name: rhdh-rhoai-connector
     type: kubernetes.io/service-account-token

2. Update your RHDH dynamic plugin configuration. The RHDH Pod requires two dynamic plugins.

   1. In your RHDH dynamic plugins ConfigMap, add the following code:

      plugins:
        - disabled: false
          package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-catalog-backend-module-model-catalog:bs_1.42.5__0.7.0!red-hat-developer-hub-backstage-plugin-catalog-backend-module-model-catalog
        - disabled: false
          package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-catalog-techdoc-url-reader-backend:bs_1.42.5__0.3.0!red-hat-developer-hub-backstage-plugin-catalog-techdoc-url-reader-backend

3. Add the Connector sidecar containers to the RHDH Pod.

   • If RHDH was installed using the Operator, modify your RHDH custom resource (CR) instance.
   • If RHDH was installed using the Helm charts, modify the Deployment specification.
4. The system relies on three sidecar containers (OpenShift AI Connector for Red Hat Developer Hub) running alongside the backstage-backend container.

1. Enable Connector in your RHDHapp-config.yaml file. In your Backstage `app-config.extra.yaml file, configure Entity Provider under the catalog.providers section:

   providers:
     modelCatalog:
       development:
         baseUrl: http://localhost:9090

   where:

   modelCatalog

   Specifies the name of the provider.

   development

   Defines future connector capability beyond a single baseUrl.

   baseUrl

   For Developer Preview, this value is the only one supported. Future releases might support external routes.