From 60cbae3b555d4de2abcfab365a734e002696a449 Mon Sep 17 00:00:00 2001
From: Yulia Krimerman <juliapiterova@hotmail.com>
Date: Thu, 12 Dec 2024 12:55:30 -0500
Subject: [PATCH 1/3] Support 'undeploy' in model registry (don't hide the
 Edit/Delete kebab when rendering deployments table in MR) (#3571)

* saving

* finalize

* simplify
---
 .../ModelVersionRegisteredDeploymentsView.tsx         | 11 +++++------
 .../src/pages/modelServing/screens/global/data.ts     |  1 +
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/frontend/src/pages/modelRegistry/screens/ModelVersionDetails/ModelVersionRegisteredDeploymentsView.tsx b/frontend/src/pages/modelRegistry/screens/ModelVersionDetails/ModelVersionRegisteredDeploymentsView.tsx
index 844b7bd2b7..b6d44c2c87 100644
--- a/frontend/src/pages/modelRegistry/screens/ModelVersionDetails/ModelVersionRegisteredDeploymentsView.tsx
+++ b/frontend/src/pages/modelRegistry/screens/ModelVersionDetails/ModelVersionRegisteredDeploymentsView.tsx
@@ -1,13 +1,11 @@
 import React from 'react';
 import { Link } from 'react-router-dom';
-
 import { Alert, Stack } from '@patternfly/react-core';
-
-import EmptyModelRegistryState from '~/pages/modelRegistry/screens/components/EmptyModelRegistryState';
 import InferenceServiceTable from '~/pages/modelServing/screens/global/InferenceServiceTable';
 import { getVersionDetailsInferenceServiceColumns } from '~/pages/modelServing/screens/global/data';
-import { typedEmptyImage, ProjectObjectType } from '~/concepts/design/utils';
-import ModelVersionDetailsTabs from './ModelVersionDetailsTabs';
+import ModelVersionDetailsTabs from '~/pages/modelRegistry/screens/ModelVersionDetails/ModelVersionDetailsTabs';
+import { ProjectObjectType, typedEmptyImage } from '~/concepts/design/utils';
+import EmptyModelRegistryState from '~/pages/modelRegistry/screens/components/EmptyModelRegistryState';
 
 type ModelVersionRegisteredDeploymentsViewProps = Pick<
   React.ComponentProps<typeof ModelVersionDetailsTabs>,
@@ -45,7 +43,7 @@ const ModelVersionRegisteredDeploymentsView: React.FC<
 
       <InferenceServiceTable
         isGlobal
-        getColumns={(projects) => getVersionDetailsInferenceServiceColumns(projects)}
+        getColumns={getVersionDetailsInferenceServiceColumns}
         inferenceServices={inferenceServices.data}
         servingRuntimes={servingRuntimes.data}
         isLoading={isLoading}
@@ -53,4 +51,5 @@ const ModelVersionRegisteredDeploymentsView: React.FC<
     </Stack>
   );
 };
+
 export default ModelVersionRegisteredDeploymentsView;
diff --git a/frontend/src/pages/modelServing/screens/global/data.ts b/frontend/src/pages/modelServing/screens/global/data.ts
index b17542f37a..37656b20b3 100644
--- a/frontend/src/pages/modelServing/screens/global/data.ts
+++ b/frontend/src/pages/modelServing/screens/global/data.ts
@@ -103,6 +103,7 @@ export const getVersionDetailsInferenceServiceColumns = (
   COL_ENDPOINT,
   COL_API_PROTOCOL,
   COL_STATUS,
+  COL_KEBAB,
 ];
 
 export const getProjectInferenceServiceColumns = (): SortableData<InferenceServiceKind>[] => [

From f155ba2e428a02a27c4ef423e1162667925cffdd Mon Sep 17 00:00:00 2001
From: Yulia Krimerman <juliapiterova@hotmail.com>
Date: Thu, 12 Dec 2024 17:11:22 -0500
Subject: [PATCH 2/3] Home Page MR card in the "Manage models" section (#3537)

* waiting for recons

* fixed test

* addressed comments
---
 .../tests/mocked/home/homeAIFlows.cy.ts       |  5 +-
 .../home/aiFlows/DeployAndMonitorGallery.tsx  | 63 ++++++++++++++-----
 .../src/pages/home/aiFlows/useAIFlows.tsx     |  8 ++-
 3 files changed, 55 insertions(+), 21 deletions(-)

diff --git a/frontend/src/__tests__/cypress/cypress/tests/mocked/home/homeAIFlows.cy.ts b/frontend/src/__tests__/cypress/cypress/tests/mocked/home/homeAIFlows.cy.ts
index 3da816e1e2..6bb7c02239 100644
--- a/frontend/src/__tests__/cypress/cypress/tests/mocked/home/homeAIFlows.cy.ts
+++ b/frontend/src/__tests__/cypress/cypress/tests/mocked/home/homeAIFlows.cy.ts
@@ -57,7 +57,10 @@ describe('Home page AI Flows', () => {
 
     homeAISection.getProjectCard().find().should('not.exist');
 
-    homePage.initHomeIntercepts({ disableModelServing: true });
+    homePage.initHomeIntercepts({
+      disableModelServing: true,
+      disableModelRegistry: true,
+    });
     homePage.visit();
 
     homeAISection.getModelsFlowCard().find().should('not.exist');
diff --git a/frontend/src/pages/home/aiFlows/DeployAndMonitorGallery.tsx b/frontend/src/pages/home/aiFlows/DeployAndMonitorGallery.tsx
index 2627a21195..d99a59a59a 100644
--- a/frontend/src/pages/home/aiFlows/DeployAndMonitorGallery.tsx
+++ b/frontend/src/pages/home/aiFlows/DeployAndMonitorGallery.tsx
@@ -3,14 +3,40 @@ import { Content } from '@patternfly/react-core';
 import { ProjectObjectType, SectionType } from '~/concepts/design/utils';
 import InfoGalleryItem from '~/concepts/design/InfoGalleryItem';
 import useServingPlatformStatuses from '~/pages/modelServing/useServingPlatformStatuses';
+import useIsAreaAvailable from '~/concepts/areas/useIsAreaAvailable';
+import { SupportedArea } from '~/concepts/areas';
 import InfoGallery from './InfoGallery';
 
 const DeployAndMonitorGallery: React.FC<{ onClose: () => void }> = ({ onClose }) => {
   const servingPlatformStatuses = useServingPlatformStatuses();
+  const { status: modelRegistryAvailable } = useIsAreaAvailable(SupportedArea.MODEL_REGISTRY);
   const modelMeshEnabled = servingPlatformStatuses.modelMesh.enabled;
+  const kServeEnabled = servingPlatformStatuses.kServe.enabled;
 
   const infoItems = [];
 
+  if (modelRegistryAvailable) {
+    infoItems.push(
+      <InfoGalleryItem
+        key="model-registry"
+        data-testid="ai-flows-model-registry-info"
+        title="Model registry"
+        resourceType={ProjectObjectType.modelRegistrySettings}
+        sectionType={SectionType.serving}
+        description={
+          <Content>
+            <Content component="small">
+              Model registries provide a structured and organized way to store, version, deploy, and
+              track models, ensuring that they are easily accessible and manageable throughout their
+              lifecycle.
+            </Content>
+          </Content>
+        }
+        isOpen
+      />,
+    );
+  }
+
   if (modelMeshEnabled) {
     infoItems.push(
       <InfoGalleryItem
@@ -34,24 +60,27 @@ const DeployAndMonitorGallery: React.FC<{ onClose: () => void }> = ({ onClose })
     );
   }
 
-  infoItems.push(
-    <InfoGalleryItem
-      key="model-deploy"
-      data-testid="ai-flows-model-deploy-info"
-      title="Deploying models"
-      resourceType={ProjectObjectType.deployingModels}
-      sectionType={SectionType.serving}
-      description={
-        <Content>
-          <Content component="small">
-            Deploy models to test them and integrate them into applications. Deploying a model makes
-            it accessible via an API, enabling you to return predictions based on data inputs.
+  if (modelMeshEnabled || kServeEnabled) {
+    infoItems.push(
+      <InfoGalleryItem
+        key="model-deploy"
+        data-testid="ai-flows-model-deploy-info"
+        title="Deploying models"
+        resourceType={ProjectObjectType.deployingModels}
+        sectionType={SectionType.serving}
+        description={
+          <Content>
+            <Content component="small">
+              Deploy models to test them and integrate them into applications. Deploying a model
+              makes it accessible via an API, enabling you to return predictions based on data
+              inputs.
+            </Content>
           </Content>
-        </Content>
-      }
-      isOpen
-    />,
-  );
+        }
+        isOpen
+      />,
+    );
+  }
 
   return (
     <InfoGallery
diff --git a/frontend/src/pages/home/aiFlows/useAIFlows.tsx b/frontend/src/pages/home/aiFlows/useAIFlows.tsx
index f2926509d9..82730d4a0d 100644
--- a/frontend/src/pages/home/aiFlows/useAIFlows.tsx
+++ b/frontend/src/pages/home/aiFlows/useAIFlows.tsx
@@ -15,6 +15,7 @@ export const useAIFlows = (): React.ReactNode => {
   const { status: pipelinesAvailable } = useIsAreaAvailable(SupportedArea.DS_PIPELINES);
   const { status: projectsAvailable } = useIsAreaAvailable(SupportedArea.DS_PROJECTS_VIEW);
   const { status: modelServingAvailable } = useIsAreaAvailable(SupportedArea.MODEL_SERVING);
+  const { status: modelRegistryAvailable } = useIsAreaAvailable(SupportedArea.MODEL_REGISTRY);
   const [selected, setSelected] = React.useState<string | undefined>();
 
   return React.useMemo(() => {
@@ -55,12 +56,12 @@ export const useAIFlows = (): React.ReactNode => {
         />,
       );
     }
-    if (modelServingAvailable) {
+    if (modelServingAvailable || modelRegistryAvailable) {
       cards.push(
         <AIFlowCard
           key="models"
           data-testid="ai-flow-models-card"
-          title="Deploy and monitor models"
+          title="Manage models"
           image={
             <ModelIcon
               aria-hidden="true"
@@ -82,7 +83,7 @@ export const useAIFlows = (): React.ReactNode => {
       <PageSection hasBodyWrapper={false} data-testid="home-page-ai-flows">
         <Stack hasGutter>
           <Content>
-            <Content component="h1">Train, serve, monitor, and manage AI/ML models</Content>
+            <Content component="h1">Work with AI/ML models</Content>
           </Content>
           <EvenlySpacedGallery itemCount={cards.length} hasGutter>
             {cards}
@@ -101,6 +102,7 @@ export const useAIFlows = (): React.ReactNode => {
     );
   }, [
     modelServingAvailable,
+    modelRegistryAvailable,
     pipelinesAvailable,
     projectsAvailable,
     selected,

From 5331d690aa5f6224361fa2d640311e2a4c1df3c1 Mon Sep 17 00:00:00 2001
From: Andrew Ballantyne <8126518+andrewballantyne@users.noreply.github.com>
Date: Thu, 12 Dec 2024 17:39:27 -0500
Subject: [PATCH 3/3] Reduce Namespace Permissions (#3563)

---
 backend/src/utils/resourceUtils.ts          | 129 +-------------------
 manifests/core-bases/base/cluster-role.yaml |   6 -
 2 files changed, 1 insertion(+), 134 deletions(-)

diff --git a/backend/src/utils/resourceUtils.ts b/backend/src/utils/resourceUtils.ts
index f503c0182c..2ac5ed2c63 100644
--- a/backend/src/utils/resourceUtils.ts
+++ b/backend/src/utils/resourceUtils.ts
@@ -1,14 +1,6 @@
 import * as _ from 'lodash';
 import createError from 'http-errors';
-import {
-  PatchUtils,
-  V1ConfigMap,
-  V1Namespace,
-  V1NamespaceList,
-  V1Role,
-  V1RoleBinding,
-  V1RoleBindingList,
-} from '@kubernetes/client-node';
+import { V1ConfigMap, V1Role, V1RoleBinding, V1RoleBindingList } from '@kubernetes/client-node';
 import {
   AcceleratorProfileKind,
   BuildPhase,
@@ -40,7 +32,6 @@ import {
 import { getComponentFeatureFlags } from './features';
 import { blankDashboardCR } from './constants';
 import { getIsAppEnabled, getRouteForApplication, getRouteForClusterId } from './componentUtils';
-import { createCustomError } from './requestUtils';
 import { getDetectedAccelerators } from '../routes/api/accelerators/acceleratorUtils';
 import { FastifyRequest } from 'fastify';
 import { fetchClusterStatus } from './dsc';
@@ -908,124 +899,6 @@ export const cleanupGPU = async (fastify: KubeFastifyInstance): Promise<void> =>
     await createSuccessfulMigrationConfigMap(fastify, CONFIG_MAP_NAME, DESCRIPTION);
   }
 };
-/**
- * @deprecated - Look to remove asap (see comments below)
- * Converts namespaces that have a display-name annotation suffixed with `[DSP]` over to using a label.
- * This is migration code from 1.19 to 1.20+. When customers are no longer on 1.19, we should remove
- * this code.
- */
-export const cleanupDSPSuffix = async (fastify: KubeFastifyInstance): Promise<void> => {
-  const CONFIG_MAP_NAME = 'dsg-prune-flag';
-
-  const continueProcessing = await fastify.kube.coreV1Api
-    .readNamespacedConfigMap(CONFIG_MAP_NAME, fastify.kube.namespace)
-    .then(() => {
-      // Found configmap, we're note continuing
-      return false;
-    })
-    .catch((e) => {
-      if (e.statusCode === 404) {
-        // No config saying we have already pruned settings
-        return true;
-      }
-      throw e;
-    });
-
-  if (continueProcessing) {
-    const configMap: V1ConfigMap = {
-      metadata: {
-        name: CONFIG_MAP_NAME,
-        namespace: fastify.kube.namespace,
-      },
-      data: {
-        startedPrune: 'true',
-      },
-    };
-    await fastify.kube.coreV1Api
-      .createNamespacedConfigMap(fastify.kube.namespace, configMap)
-      .then(() => fastify.log.info('Successfully created prune setting'))
-      .catch((e) => {
-        throw createCustomError(
-          'Unable to create DSG prune setting configmap',
-          e.response?.body?.message || e.message,
-        );
-      });
-  } else {
-    // Already processed, exit early and save the processing
-    return;
-  }
-
-  let namespaces: V1Namespace[] = [];
-
-  let continueValue: string | undefined = undefined;
-  do {
-    const listNamespaces: V1NamespaceList = await fastify.kube.coreV1Api
-      .listNamespace(undefined, undefined, continueValue, undefined, undefined, 100)
-      .then((response) => response.body);
-
-    const {
-      metadata: { _continue: continueProp },
-      items,
-    } = listNamespaces;
-
-    namespaces = namespaces.concat(items);
-    continueValue = continueProp;
-  } while (continueValue);
-
-  const SUFFIX = '[DSP]';
-
-  const toChangeNamespaces = namespaces.filter(
-    (namespace) =>
-      // Don't touch any openshift or kube namespaces
-      !(
-        namespace.metadata.name.startsWith('openshift') ||
-        namespace.metadata.name.startsWith('kube')
-      ) &&
-      // Just get the namespaces who are suffixed so we can convert them
-      namespace.metadata.annotations?.['openshift.io/display-name']?.endsWith(SUFFIX),
-  );
-
-  if (toChangeNamespaces.length === 0) {
-    return;
-  }
-
-  fastify.log.info(`Updating ${toChangeNamespaces.length} Namespace(s) over to DSG with labels.`);
-
-  const data = (namespace: V1Namespace) => {
-    const displayName = namespace.metadata.annotations['openshift.io/display-name'];
-
-    return {
-      metadata: {
-        annotations: {
-          'openshift.io/display-name': displayName.slice(0, displayName.length - SUFFIX.length),
-        },
-        labels: {
-          'opendatahub.io/dashboard': 'true',
-        },
-      },
-    };
-  };
-
-  const calls = toChangeNamespaces.map((namespace) =>
-    fastify.kube.coreV1Api
-      .patchNamespace(
-        namespace.metadata.name,
-        data(namespace),
-        undefined,
-        undefined,
-        undefined,
-        undefined,
-        {
-          headers: { 'Content-type': PatchUtils.PATCH_FORMAT_JSON_MERGE_PATCH },
-        },
-      )
-      .then(() => fastify.log.info(`Converted ${namespace.metadata.name} over to using labels.`)),
-  );
-
-  Promise.all(calls).then(() => {
-    fastify.log.info('Completed updating Namespaces');
-  });
-};
 
 /**
  * TODO: There should be a better way to go about this... but the namespace is unlikely to ever change
diff --git a/manifests/core-bases/base/cluster-role.yaml b/manifests/core-bases/base/cluster-role.yaml
index aec0dd435c..d2c172e765 100644
--- a/manifests/core-bases/base/cluster-role.yaml
+++ b/manifests/core-bases/base/cluster-role.yaml
@@ -127,13 +127,7 @@ rules:
   - apiGroups:
       - ''
     verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
       - patch
-      - delete
     resources:
       - namespaces
   - apiGroups: