trustyai-service-operator/controllers/evalhub/constants.go at 43c9e8193e62e98294ce2594158bd3f70081ca94 · trustyai-explainability/trustyai-service-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
package evalhub

import (
	corev1 "k8s.io/api/core/v1"
	"k8s.io/apimachinery/pkg/api/resource"
)

const (
	// Service name for registration
	ServiceName = "EVALHUB"

	// Default image configuration
	defaultEvalHubImage = "quay.io/evalhub/evalhub:latest"

	// Container configuration
	containerName = "evalhub"
	// evalHubAppPort is where eval-hub binds TLS (loopback only); kube-rbac-proxy listens on servicePort.
	evalHubAppPort = 8444
	// evalHubHealthPath is forwarded by kube-rbac-proxy; use --ignore-paths so kubelet probes skip authn/z.
	evalHubHealthPath = "/api/v1/health"

	// Service configuration (public HTTPS targets kube-rbac-proxy on this port)
	serviceName = "evalhub"
	servicePort = 8443

	// kube-rbac-proxy sidecar
	kubeRBACProxyContainerName       = "kube-rbac-proxy"
	kubeRBACProxyConfigMountPath     = "/etc/kube-rbac-proxy/auth.yaml"
	evalHubAuthConfigMapKey          = "auth.yaml"
	kubeRBACProxyUpstreamCAMountPath = "/etc/kube-rbac-proxy/upstream-ca"
	kubeRBACProxyHealthPort          = 9443

	// Configuration constants
	configMapName                  = "trustyai-service-operator-config"
	configMapEvalHubImageKey       = "evalHubImage"
	configMapKubeRBACProxyImageKey = "kube-rbac-proxy"
	defaultKubeRBACProxyImage      = "quay.io/openshift/origin-kube-rbac-proxy:4.19"

	// TLS configuration (OpenShift service serving certificates)
	tlsSecretMountPath = "/etc/tls/private"
	tlsCertFile        = "tls.crt"
	tlsKeyFile         = "tls.key"

	// Route configuration
	routeName = "evalhub"

	// Database configuration
	dbSecretVolumeName = "evalhub-db-secret"
	dbSecretMountPath  = "/etc/evalhub/secrets"
	dbSecretKey        = "db-url"
	dbDriver           = "pgx"
	dbDefaultMaxOpen   = 25
	dbDefaultMaxIdle   = 5

	// Service CA configuration
	serviceCAVolumeName = "service-ca"
	serviceCAMountPath  = "/etc/evalhub/ca"
	serviceCACertFile   = "service-ca.crt"

	// MLFlow projected token configuration
	mlflowTokenVolumeName = "mlflow-token"
	mlflowTokenMountPath  = "/var/run/secrets/mlflow"
	mlflowTokenFile       = "token"
	mlflowTokenExpiration = 3600 // seconds

	// EvalHub config directory (contains config.yaml and providers/ subdir)
	configDirPath = "/etc/evalhub/config"

	// Provider ConfigMap configuration
	providerLabel       = "trustyai.opendatahub.io/evalhub-provider-type"
	providerNameLabel   = "trustyai.opendatahub.io/evalhub-provider-name"
	providersVolumeName = "evalhub-providers"
	providersMountPath  = configDirPath + "/providers"

	// Sidecar configuration
	sidecarBaseURL = "http://localhost:8080"

	// Collection ConfigMap configuration
	collectionLabel       = "trustyai.opendatahub.io/evalhub-collection-type"
	collectionNameLabel   = "trustyai.opendatahub.io/evalhub-collection-name"
	collectionsVolumeName = "evalhub-collections"
	collectionsMountPath  = configDirPath + "/collections"
)

var (
	// Default resource requirements based on k8s examples
	defaultResourceRequirements = corev1.ResourceRequirements{
		Requests: corev1.ResourceList{
			corev1.ResourceCPU:    resource.MustParse("500m"),
			corev1.ResourceMemory: resource.MustParse("512Mi"),
		},
		Limits: corev1.ResourceList{
			corev1.ResourceCPU:    resource.MustParse("2000m"),
			corev1.ResourceMemory: resource.MustParse("2Gi"),
		},
	}

	// Default security context
	allowPrivilegeEscalation = false
	runAsNonRoot             = true
	defaultSecurityContext   = &corev1.SecurityContext{
		AllowPrivilegeEscalation: &allowPrivilegeEscalation,
		RunAsNonRoot:             &runAsNonRoot,
		// RunAsUser omitted to let OpenShift assign from allowed range
		Capabilities: &corev1.Capabilities{
			Drop: []corev1.Capability{
				"ALL",
			},
		},
		SeccompProfile: &corev1.SeccompProfile{
			Type: corev1.SeccompProfileTypeRuntimeDefault,
		},
	}

	// Default pod security context
	runAsNonRootUser          = true
	defaultPodSecurityContext = &corev1.PodSecurityContext{
		RunAsNonRoot: &runAsNonRootUser,
		// FSGroup omitted to let OpenShift assign from allowed range
		SeccompProfile: &corev1.SeccompProfile{
			Type: corev1.SeccompProfileTypeRuntimeDefault,
		},
	}
)