第 2 章 使用 Red Hat OpenShift AI 为 Red Hat Developer Hub 设置 OpenShift AI 连接器

流程

1. 配置 RHOAI 相关的 RBAC 和凭证。连接器需要 Kubernetes ServiceAccount 和 service-account-token Secret 从 RHOAI 检索数据。必须创建以下资源，根据需要替换命名空间名称(ai-rhdh for RHDH, rhoai-model-registries for RHOAI)：

   • ServiceAccount (rhdh-rhoai-connector)。例如：

     apiVersion: v1
     kind: ServiceAccount
     metadata:
       name: rhdh-rhoai-connector
       namespace: ai-rhdh

   • ClusterRole 和 ClusterRoleBinding (rhdh-rhoai-connector)允许访问 OCP 资源，如路由、服务和 inferenceservices 。例如：

     # Example for `ClusterRole`
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRole
     metadata:
       name: rhdh-rhoai-connector
       annotations:
         argocd.argoproj.io/sync-wave: "0"
     rules:
       - apiGroups:
           - apiextensions.k8s.io
         resources:
           - customresourcedefinitions
         verbs:
           - get
       - apiGroups:
           - route.openshift.io
         resources:
           - routes
         verbs:
           - get
           - list
           - watch
       - apiGroups: [""]
         resources:
           - serviceaccounts
           - services
         verbs:
           - get
           - list
           - watch
     
       - apiGroups: ["serving.kserve.io"]
         resources: ["inferenceservices"]
         verbs: ["get", "list", "watch"]

     # Example for `ClusterRoleBinding`
     apiVersion: rbac.authorization.k8s.io/v1
     kind: ClusterRoleBinding
     metadata:
       name: rhdh-rhoai-connector
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: ClusterRole
       name: rhdh-rhoai-connector
     subjects:
       - kind: ServiceAccount
         name: rhdh-rhoai-connector
         namespace: ai-rhdh

   • Role 和 RoleBinding 以允许 RHDH 命名空间中的 ConfigMap 更新(ai-rhdh)。例如：

     # Example for `Role` and `Rolebinding` in the {product-very-short} namespace (`ai-rhdh`)
     apiVersion: rbac.authorization.k8s.io/v1
     kind: Role
     metadata:
       name: rhdh-rhoai-connector
       namespace: ai-rhdh
     rules:
       - apiGroups: [""]
         resources: ["configmaps"]
         verbs: ["get", "list", "watch", "create", "update", "patch"]
     ---
     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       name: rhdh-rhoai-connector
       namespace: ai-rhdh
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: Role
       name: rhdh-rhoai-connector
     subjects:
       - kind: ServiceAccount
         name: rhdh-rhoai-connector
         namespace: ai-rhdh

   • RHOAI 命名空间中的 RoleBinding (rhoai-model-registries)，向模型 registry 数据（绑定到 registry-user-modelregistry-public）授予 RHDH ServiceAccount 的读取权限。

     # Example for `RoleBinding` in the {rhoai-short} namespace (rhoai-model-registries)
     apiVersion: rbac.authorization.k8s.io/v1
     kind: RoleBinding
     metadata:
       # if using ODH then change rhoai to odh in the name and namespace here
       name: rhdh-rhoai-dashboard-permissions
       # namespace: odh-model-registries
       namespace: rhoai-model-registries
     roleRef:
       apiGroup: rbac.authorization.k8s.io
       kind: Role
       name: registry-user-modelregistry-public
     subjects:
       - apiGroup: rbac.authorization.k8s.io
         kind: Group
         name: system:serviceaccounts:ai-rhdh

   • Secret (rhdh-rhoai-connector-token)类型为 kubernetes.io/service-account-token，它与 rhdh-rhoai-connector ServiceAccount 一起提供。

     apiVersion: v1
     kind: Secret
     metadata:
       name: rhdh-rhoai-connector-token
       namespace: ai-rhdh
       annotations:
         kubernetes.io/service-account.name: rhdh-rhoai-connector
     type: kubernetes.io/service-account-token

2. 更新 RHDH 动态插件配置。RHDH Pod 需要两个动态插件。

   1. 在 RHDH 动态插件 ConfigMap 中，添加以下代码：

      plugins:
        - disabled: false
          package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-catalog-backend-module-model-catalog:bs_1.42.5__0.7.0!red-hat-developer-hub-backstage-plugin-catalog-backend-module-model-catalog
        - disabled: false
          package: oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/red-hat-developer-hub-backstage-plugin-catalog-techdoc-url-reader-backend:bs_1.42.5__0.3.0!red-hat-developer-hub-backstage-plugin-catalog-techdoc-url-reader-backend

3. 将 Connector sidecar 容器添加到 RHDH Pod。

   • 如果使用 Operator 安装 RHDH，请修改 RHDH 自定义资源(CR)实例。
   • 如果使用 Helm chart 安装 RHDH，请修改 Deployment 规格。
4. 系统依赖于三个 sidecar 容器(OpenShift AI Connector for Red Hat Developer Hub)和 backstage-backend 容器一起运行。

1. 在 RHDHapp-config.yaml 文件中启用 Connector。在 Backstage 'app-config.extra.yaml 文件中，在 catalog.providers 部分下配置 Entity Provider ：

   providers:
     modelCatalog:
       development:
         baseUrl: http://localhost:9090

   其中：

   modelCatalog

   指定供应商的名称。

   开发

   定义除一个 baseUrl 外的未来连接器功能。

   baseUrl

   对于开发者预览，这个值是唯一支持的值。将来的版本可能会支持外部路由。