Add kubectl-ai for debugging namespace issues

.github/workflows/kubectl_ai_build.yaml

@@ -0,0 +1,23 @@
+name: Kubeclt-ai Image Build on Push
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "The tag to apply to this build. Defaults to 'latest'."
+        default: "latest"
+        required: false
+  push:
+    paths:
+      - gen3-integration-tests/gen3_ci/kubectl_ai/**
+
+jobs:
+  AmazonLinuxBase2023:
+    name: Build Helm Cleanup Image
+    uses: uc-cdis/.github/.github/workflows/image_build_push.yaml@master
+    with:
+      DOCKERFILE_LOCATION: "./gen3-integration-tests/gen3_ci/kubectl_ai/Dockerfile"
+      OVERRIDE_REPO_NAME: "kubectl_ai"
+      OVERRIDE_TAG_NAME: "$(echo ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tag || format('{0}', github.head_ref || github.ref_name) }} | tr / _)"
+      USE_QUAY_ONLY: true
+    secrets: inherit

gen3-integration-tests/gen3_ci/kubectl_ai/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: kubectl-ai
+description: A Helm chart for kubeclt-ai
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "master"

gen3-integration-tests/gen3_ci/kubectl_ai/Dockerfile

@@ -0,0 +1,23 @@
+ARG AZLINUX_BASE_VERSION=master
+
+FROM quay.io/cdis/amazonlinux-base:${AZLINUX_BASE_VERSION} AS base
+
+# Install curl
+RUN dnf install -y --allowerasing \
+    curl \
+    findutils \
+    zstd \
+    tar \
+    gzip
+
+# Create kubectl directory
+WORKDIR /kubectl
+
+# Install kubectl-ai
+RUN curl -fsSL https://raw.githubusercontent.com/GoogleCloudPlatform/kubectl-ai/main/install.sh -o install.sh \
+    && sed -i 's/sudo //g' install.sh \
+    && bash install.sh
+
+# Install Kubectl
+RUN curl -LO https://dl.k8s.io/release/v1.33.0/bin/linux/amd64/kubectl && \
+    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

gen3-integration-tests/gen3_ci/kubectl_ai/templates/_helpers.tpl

@@ -0,0 +1,6 @@
+{{/*
+Return the fully qualified app name
+*/}}
+{{- define "kubectl-ai.fullname" -}}
+{{- printf "%s" .Release.Name -}}
+{{- end }}

gen3-integration-tests/gen3_ci/kubectl_ai/templates/deployment.yaml

@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kubectl-ai
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kubectl-ai
+  template:
+    metadata:
+      labels:
+        app: kubectl-ai
+    spec:
+      serviceAccountName: kubectl-access-kubectl-ai
+      containers:
+        - name: ollama
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          ports:
+            - containerPort: 11434
+          env:
+            - name: OLLAMA_LOG_LEVEL
+              value: "debug"
+            - name: OLLAMA_HOST
+              value: "0.0.0.0:11434"
+            - name: OLLAMA_KEEP_ALIVE
+              value: "-1"
+            - name: KUBECTL_AI_TIMEOUT
+              value: "300"

gen3-integration-tests/gen3_ci/kubectl_ai/templates/kubectl-ai-pdb.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.pdb }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: kubectl-ai-pdb
+spec:
+  maxUnavailable: 0
+  selector:
+    matchLabels:
+       app.kubernetes.io/name: "kubectl-ai"
+{{- end }}

gen3-integration-tests/gen3_ci/kubectl_ai/templates/service-account.yaml

@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubectl-access-kubectl-ai
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kubectl-access-role-kubectl-ai
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods", "pods/exec", "pods/log", "configmaps", "namespaces", "labels"]
+    verbs: ["get", "list", "create", "patch"]
+  - apiGroups: ["batch"]
+    resources: ["cronjobs", "jobs"]
+    verbs: ["get", "list", "create", "delete", "watch", "patch"]
+  - apiGroups: ["apps"]
+    resources: [deployments, deployments/scale]
+    verbs: ["get", "list", "create", "delete", "watch", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubectl-access-binding-kubectl-ai
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubectl-access-role-kubectl-ai
+subjects:
+  - kind: ServiceAccount
+    name: kubectl-access-kubectl-ai
+    namespace: {{ .Release.Namespace }}
+---
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    eks.amazonaws.com/role-arn: {{ .Values.serviceAccount.iamRoleArn }}
+{{- end }}

gen3-integration-tests/gen3_ci/kubectl_ai/templates/service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: kubectl-ai
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: {{ .Values.service.port }}
+  selector:
+    app: kubectl-ai

gen3-integration-tests/gen3_ci/kubectl_ai/values.yaml

@@ -0,0 +1,24 @@
+image:
+  repository: quay.io/cdis/kubectl_ai
+  tag: chore_add_kubectl_ai
+  pullPolicy: Always
+
+pdb: true
+
+resources:
+  requests:
+    cpu: 2
+    memory: "2Gi"
+  limits:
+    cpu: 4
+    memory: "4Gi"
+
+service:
+  type: ClusterIP
+  port: 11434
+
+# Service account for accessing S3 bedrock access
+serviceAccount:
+  create: true
+  name: s3-bedrock-access
+  iamRoleArn: arn:aws:iam::707767160287:role/kubectl-ai-irsa

gen3-integration-tests/gen3_ci/ollama/Dockerfile

@@ -7,7 +7,8 @@ RUN dnf install -y --allowerasing \
     curl \
     findutils \
     zstd \
-    tar
+    tar \
+    gzip
 
 # Create model directory
 WORKDIR /models
@@ -22,6 +23,7 @@ RUN bash -c "\
     ollama pull gemma4:e4b \
 "
 
+
 # List ollama model
 RUN bash -c "\
     ollama serve & \

gen3-integration-tests/gen3_ci/ollama/templates/deployment.yaml

@@ -12,6 +12,7 @@ spec:
       labels:
         app: ollama
     spec:
+      serviceAccountName: kubectl-access-ollama
       containers:
         - name: ollama
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -25,3 +26,7 @@ spec:
               value: "debug"
             - name: OLLAMA_HOST
               value: "0.0.0.0:11434"
+            - name: OLLAMA_KEEP_ALIVE
+              value: "-1"
+            - name: KUBECTL_AI_TIMEOUT
+              value: "300"

gen3-integration-tests/gen3_ci/ollama/values.yaml

@@ -1,17 +1,17 @@
 image:
   repository: quay.io/cdis/ollama
   tag: master
-  pullPolicy: IfNotPresent
+  pullPolicy: Always
 
 pdb: true
 
 resources:
   requests:
     cpu: 4
-    memory: "10Gi"
+    memory: "8Gi"
   limits:
     cpu: 6
-    memory: "12Gi"
+    memory: "10Gi"
 
 service:
   type: ClusterIP