Update odh-dashboard to v2.2.1

odh-dashboard/OWNERS

@@ -1,6 +1,7 @@
 approvers:
 - andrewballantyne
 - dlabaj
+- samuelvl
 
 reviewers:
 - DaoDaoNoCode

odh-dashboard/base/cluster-monitoring-role-binding.yaml

@@ -0,0 +1,11 @@
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: odh-dashboard-monitoring
+subjects:
+  - kind: ServiceAccount
+    name: odh-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-monitoring-view

odh-dashboard/base/cluster-role-binding.yaml

@@ -1,11 +1,10 @@
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: odh-dashboard-$(namespace)
+  name: odh-dashboard
 subjects:
   - kind: ServiceAccount
     name: odh-dashboard
-    namespace: $(namespace)
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole

odh-dashboard/base/cluster-role.yaml

@@ -21,15 +21,27 @@ rules:
     resources:
       - clusterserviceversions
       - subscriptions
-  - verbs:
+  - apiGroups:
+      - ''
+      - image.openshift.io
+    resources:
+      - imagestreams/layers
+    verbs:
+      - get
+  - apiGroups:
+      - ''
+    verbs:
+      - create
+      - delete
       - get
       - list
+      - patch
+      - update
       - watch
-    apiGroups:
-      - ''
     resources:
-      - services
       - configmaps
+      - persistentvolumeclaims
+      - secrets
   - verbs:
       - get
       - list
@@ -71,3 +83,49 @@ rules:
       - user.openshift.io
     resources:
       - groups
+  - verbs:
+      - get
+      - list
+      - watch
+    apiGroups:
+      - ''
+    resources:
+      - pods
+      - serviceaccounts
+      - services
+      - namespaces
+  - apiGroups:
+      - rbac.authorization.k8s.io
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+    resources:
+      - rolebindings
+      - clusterrolebindings
+      - roles
+  - apiGroups:
+      - ''
+      - events.k8s.io
+    resources:
+      - events
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - kubeflow.org
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+    resources:
+      - notebooks

odh-dashboard/base/deployment.yaml

@@ -27,7 +27,7 @@ spec:
       serviceAccount: odh-dashboard
       containers:
       - name: odh-dashboard
-        image: quay.io/opendatahub/odh-dashboard:v2.0
+        image: odh-dashboard
         imagePullPolicy: Always
         ports:
         - containerPort: 8080
@@ -39,18 +39,16 @@ spec:
             cpu: 1000m
             memory: 2Gi
         livenessProbe:
-          httpGet:
-            path: /api/status
+          tcpSocket:
             port: 8080
-            scheme: HTTP
           initialDelaySeconds: 30
           timeoutSeconds: 15
           periodSeconds: 30
           successThreshold: 1
           failureThreshold: 3
         readinessProbe:
           httpGet:
-            path: /api/status
+            path: /api/health
             port: 8080
             scheme: HTTP
           initialDelaySeconds: 30

odh-dashboard/base/kustomization.yaml

@@ -3,27 +3,18 @@ kind: Kustomization
 commonLabels:
   app: odh-dashboard
   app.kubernetes.io/part-of: odh-dashboard
-
 resources:
 - odh-dashboard-crd.yaml
 - role.yaml
 - cluster-role.yaml
 - service-account.yaml
 - role-binding.yaml
 - cluster-role-binding.yaml
+- cluster-monitoring-role-binding.yaml
 - deployment.yaml
 - routes.yaml
 - service.yaml
-
-vars:
-- name: namespace
-  objref:
-    kind: Deployment
-    name: odh-dashboard
-    group: apps
-    apiVersion: v1
-  fieldref:
-    fieldpath: metadata.namespace
-
-configurations:
-- params.yaml
+images:
+- name: odh-dashboard
+  newName: quay.io/opendatahub/odh-dashboard
+  newTag: v2.2.1

odh-dashboard/base/odh-dashboard-crd.yaml

@@ -16,6 +16,8 @@ spec:
       schema:
         openAPIV3Schema:
           type: object
+          required:
+            - spec
           properties:
             spec:
               type: object
@@ -37,6 +39,18 @@ spec:
                       type: boolean
                     disableISVBadges:
                       type: boolean
+                    disableUserManagement:
+                      type: boolean
+                groupsConfig:
+                  type: object
+                  required:
+                    - adminGroups
+                    - allowedGroups
+                  properties:
+                    adminGroups:
+                      type: string
+                    allowedGroups:
+                      type: string
                 notebookSizes:
                   type: array
                   items:
@@ -66,38 +80,19 @@ spec:
                                 type: string
                 notebookController:
                   type: object
+                  required:
+                    - enabled
                   properties:
                     enabled:
                       type: boolean
-                    gpuConfig:
+                    notebookNamespace:
+                      type: string
+                    pvcSize:
+                      type: string
+                    notebookTolerationSettings:
                       type: object
                       properties:
-                        enabled:
-                          type: boolean
-                    envVarConfig:
-                      type: object
-                      properties:
-                        enabled: 
-                          type: boolean
-                notebookControllerState:
-                  type: array
-                  items:
-                    type: object
-                    properties:
-                      user: 
-                        type: string
-                      lastSelectedImage:
-                        type: string
-                      lastSelectedSize:
-                        type: string
-                      environmentVariables:
-                        type: array
-                        items:
-                          type: object
-                          properties:
-                            key:
-                              type: string
-                            value: 
-                              type: string
-                      secrets:
-                        type: string
+                          enabled:
+                            type: boolean
+                          key:
+                            type: string

odh-dashboard/base/role.yaml

@@ -19,19 +19,6 @@ rules:
       - get
       - list
       - watch
-  - apiGroups:
-      - ''
-    verbs:
-      - create
-      - delete
-      - get
-      - list
-      - patch
-      - update
-      - watch
-    resources:
-      - configmaps
-      - secrets
   - apiGroups:
       - batch
     verbs:
@@ -70,12 +57,13 @@ rules:
       - builds
       - buildconfigs
       - buildconfigs/instantiate
-  - verbs:
-      - list
-    apiGroups:
-      - rbac.authorization.k8s.io
+  - apiGroups:
+      - apps
+    verbs:
+      - patch
+      - update
     resources:
-      - rolebindings
+      - deployments
   - apiGroups:
       - apps.openshift.io
     verbs:
@@ -101,3 +89,15 @@ rules:
       - delete
     resources:
       - odhdashboardconfigs
+  - apiGroups:
+      - kubeflow.org
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - patch
+      - delete
+    resources:
+      - notebooks

odh-dashboard/overlays/authentication/clusterrolebinding.yaml

@@ -1,12 +1,11 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  name: odh-dashboard-auth-delegator-$(namespace)
+  name: odh-dashboard-auth-delegator
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: system:auth-delegator
 subjects:
   - kind: ServiceAccount
     name: odh-dashboard
-    namespace: $(namespace)

odh-dashboard/overlays/authentication/deployment.yaml

@@ -9,10 +9,11 @@
       - --upstream=http://localhost:8080
       - --tls-cert=/etc/tls/private/tls.crt
       - --tls-key=/etc/tls/private/tls.key
-      - --cookie-secret=SECRET
-      - '--openshift-delegate-urls={"/": {"resource": "route", "verb": "get", "name": "odh-dashboard"}}'
+      - --cookie-secret-file=/etc/oauth/config/cookie_secret
+      - --pass-access-token
+      - '--openshift-delegate-urls={"/": {"resource": "services", "verb": "get", "name": "odh-dashboard"}}'
       - --skip-auth-regex=^/metrics
-    image: registry.redhat.io/openshift4/ose-oauth-proxy:v4.8
+    image: oauth-proxy
     ports:
       - containerPort: 8443
         name: https
@@ -46,9 +47,15 @@
     volumeMounts:
       - mountPath: /etc/tls/private
         name: proxy-tls
+      - mountPath: /etc/oauth/config
+        name: oauth-config
+
 - op: add
   path: /spec/template/spec/volumes
   value:
     - name: proxy-tls
       secret:
         secretName: dashboard-proxy-tls
+    - name: oauth-config
+      secret:
+        secretName: dashboard-oauth-config

odh-dashboard/overlays/authentication/kustomization.yaml

@@ -4,6 +4,7 @@ bases:
   - ../../base
 resources:
   - clusterrolebinding.yaml
+  - secret.yaml
 patchesJson6902:
   - path: deployment.yaml
     target:
@@ -27,3 +28,7 @@ patchesJson6902:
       kind: Route
       name: odh-dashboard
     path: route.yaml
+images:
+- name: oauth-proxy
+  newName: registry.redhat.io/openshift4/ose-oauth-proxy
+  newTag: v4.8

odh-dashboard/overlays/authentication/secret.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: dashboard-oauth-config
+type: Opaque
+data:
+  cookie_secret: VGtob01rbFVkRzFJUkdwNlkyTm1jSEZMZVdOQmR6MDk=

odh-dashboard/overlays/odhdashboardconfig/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+  # Reference the authentication overlay as a base because it relies on these configs
+bases:
+- ../authentication
+resources:
+- groups-config.configmap.yaml
+- odh-dashboard-config.yaml
+- odh-enabled-applications-config.configmap.yaml