Add authorization to kserve

[lucferbux]

Closes https://issues.redhat.com/browse/RHOAIENG-2223

Description

Add the following changes:

Add section to enable route protection in kserve

New token section in kserve deployments

Check of Authorino availability to enable/disable the feature in kserve

How Has This Been Tested?

Local environment

1. Go to backend/src/utils/dsci.ts and add the following code in line 15

Code

const result: DataScienceClusterInitializationKind | null = await fastify.kube.customObjectsApi
  .listClusterCustomObject('dscinitialization.opendatahub.io', 'v1', 'dscinitializations')
  .then((res) => (res.body as DataScienceClusterInitializationList).items[0])
  .then((dsci) => {
    return {
      ...dsci,
      status: {
        ...dsci.status,
        conditions: [
          {
            lastHeartbeatTime: '2024-04-03T18:25:35Z',
            lastTransitionTime: '2024-04-03T18:25:35Z',
            message: 'Initializing DSCInitialization resource',
            reason: 'ReconcileInit',
            status: 'Unknown',
            type: 'ReconcileComplete',
          },
          {
            lastHeartbeatTime: '2024-04-03T18:25:35Z',
            lastTransitionTime: '2024-04-03T18:25:35Z',
            message: 'Initializing DSCInitialization resource',
            reason: 'ReconcileInit',
            status: 'False',
            type: 'Available',
          },
          {
            lastHeartbeatTime: '2024-04-03T18:25:35Z',
            lastTransitionTime: '2024-04-03T18:25:35Z',
            message: 'Initializing DSCInitialization resource',
            reason: 'ReconcileInit',
            status: 'True',
            type: 'Progressing',
          },
          {
            lastHeartbeatTime: '2024-04-03T18:25:35Z',
            lastTransitionTime: '2024-04-03T18:25:35Z',
            message: 'Initializing DSCInitialization resource',
            reason: 'ReconcileInit',
            status: 'False',
            type: 'Degraded',
          },
          {
            lastHeartbeatTime: '2024-04-03T18:25:35Z',
            lastTransitionTime: '2024-04-03T18:25:35Z',
            message: 'Initializing DSCInitialization resource',
            reason: 'ReconcileInit',
            status: 'Unknown',
            type: 'Upgradeable',
          },
          {
            lastHeartbeatTime: '2024-04-03T19:11:08Z',
            lastTransitionTime: '2024-04-03T18:49:23Z',
            message: 'Service Mesh configured properly',
            reason: 'Configured',
            status: 'True',
            type: 'CapabilityServiceMesh',
          },
          {
            lastHeartbeatTime: '2024-04-03T19:11:09Z',
            lastTransitionTime: '2024-04-03T19:10:27Z',
            message:
              'Authorino operator is not installed on the cluster, skipping authorization capability',
            reason: 'MissingOperator',
            status: 'True',
            type: 'CapabilityServiceMeshAuthorization',
          },
        ],
      },
    };
  })
  .catch((e) => {
    fastify.log.error(`Failure to fetch dsci: ${e.response.body}`);
    return null;
  });

(note: you should add the feature flag and the crd with oc apply)

2. Go to model serving section and deploy a new model
3. You should see the auth token section
4. Deploy the model and check that you cannot access the model without the bearer token (you should have the authorino operator installed)
5. Add the bearer token to the request, it should work now
6. Edit the model and uncheck the auth token
7. You should. be able to do a request without authentication
8. Delete the block of code you've added
9. Token section should be hidden

Test Impact

Testing added

Request review criteria:

Self checklist (all need to be checked):

• The developer has manually tested the changes and verified that the changes work
• Commits have been squashed into descriptive, self-contained units of work (e.g. 'WIP' and 'Implements feedback' style messages have been removed)
• Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
• The developer has added tests or explained why testing cannot be added (unit or cypress tests for related changes)

If you have UI changes:

• Included any necessary screenshots or gifs if it was a UI change.
• Included tags to the UX team if it was a UI/UX change (find relevant UX in the SMEs section).

After the PR is posted & before it merges:

• The developer has tested their solution on a cluster by using the image produced by the PR to main

[lucferbux]

/hold

[christianvogt]

/retest

[andrewballantyne]

Skimmed it, reviewed the Area stuff -- needs a more contextual review and testing.

[lucferbux]

@vconzola Can you check the screenshots to make sure everything is right here?

[christianvogt]

Tested various scenarios with @lucferbux
One minor issue with form errors not clearing regarding duplicate SA names which Lucas will log separately.
Overall it seems to be working.

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: christianvogt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [christianvogt]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment