Fix serving runtime edit creation

frontend/src/api/k8s/serviceAccounts.ts

@@ -1,4 +1,8 @@
-import { k8sCreateResource, k8sDeleteResource } from '@openshift/dynamic-plugin-sdk-utils';
+import {
+  k8sCreateResource,
+  k8sDeleteResource,
+  k8sGetResource,
+} from '@openshift/dynamic-plugin-sdk-utils';
 import { ServiceAccountModel } from '~/api/models';
 import { K8sAPIOptions, K8sStatus, ServiceAccountKind } from '~/k8sTypes';
 import { applyK8sAPIOptions } from '~/api/apiMergeUtils';
@@ -15,7 +19,13 @@ export const assembleServiceAccount = (name: string, namespace: string): Service
   return serviceAccount;
 };
 
-export const createServiceAccount = async (
+export const getServiceAccount = (name: string, namespace: string): Promise<ServiceAccountKind> =>
+  k8sGetResource<ServiceAccountKind>({
+    model: ServiceAccountModel,
+    queryOptions: { name, ns: namespace },
+  });
+
+export const createServiceAccount = (
   data: ServiceAccountKind,
   opts?: K8sAPIOptions,
 ): Promise<ServiceAccountKind> =>
@@ -26,7 +36,7 @@ export const createServiceAccount = async (
     }),
   );
 
-export const deleteServiceAccount = async (
+export const deleteServiceAccount = (
   name: string,
   ns: string,
   opts?: K8sAPIOptions,

frontend/src/pages/modelServing/screens/projects/ServingRuntimeModal/ManageServingRuntimeModal.tsx

@@ -15,17 +15,26 @@ import {
   isGpuDisabled,
   useCreateServingRuntimeObject,
 } from '~/pages/modelServing/screens/projects/utils';
-import { ServingRuntimeKind, SecretKind, TemplateKind, ProjectKind } from '~/k8sTypes';
-import { addSupportModelMeshProject, createServingRuntime, updateServingRuntime } from '~/api';
+import {
+  ServingRuntimeKind,
+  SecretKind,
+  TemplateKind,
+  ProjectKind,
+  AccessReviewResourceAttributes,
+} from '~/k8sTypes';
+import {
+  addSupportModelMeshProject,
+  createServingRuntime,
+  updateServingRuntime,
+  useAccessReview,
+} from '~/api';
 import {
   requestsUnderLimits,
   resourcesArePositive,
   setUpTokenAuth,
-  updateSecrets,
 } from '~/pages/modelServing/utils';
 import useCustomServingRuntimesEnabled from '~/pages/modelServing/customServingRuntimes/useCustomServingRuntimesEnabled';
 import { getServingRuntimeFromName } from '~/pages/modelServing/customServingRuntimes/utils';
-import { CreatingServingRuntimeObject } from '~/pages/modelServing/screens/types';
 import { translateDisplayNameForK8s } from '~/pages/projects/utils';
 import ServingRuntimeReplicaSection from './ServingRuntimeReplicaSection';
 import ServingRuntimeSizeSection from './ServingRuntimeSizeSection';
@@ -46,6 +55,12 @@ type ManageServingRuntimeModalProps = {
   }
 >;
 
+const accessReviewResource: AccessReviewResourceAttributes = {
+  group: 'rbac.authorization.k8s.io',
+  resource: 'rolebindings',
+  verb: 'create',
+};
+
 const ManageServingRuntimeModal: React.FC<ManageServingRuntimeModalProps> = ({
   isOpen,
   onClose,
@@ -60,6 +75,12 @@ const ManageServingRuntimeModal: React.FC<ManageServingRuntimeModalProps> = ({
   const customServingRuntimesEnabled = useCustomServingRuntimesEnabled();
 
   const namespace = currentProject.metadata.name;
+
+  const [allowCreate, rbacLoaded] = useAccessReview({
+    ...accessReviewResource,
+    namespace,
+  });
+
   const tokenErrors = createData.tokens.filter((token) => token.error !== '').length > 0;
   const baseInputValueValid =
     createData.numReplicas >= 0 &&
@@ -71,7 +92,7 @@ const ManageServingRuntimeModal: React.FC<ManageServingRuntimeModalProps> = ({
   const inputValueValid = customServingRuntimesEnabled
     ? baseInputValueValid && createData.name && servingRuntimeTemplateNameValid
     : baseInputValueValid;
-  const canCreate = !actionInProgress && !tokenErrors && inputValueValid;
+  const canCreate = !actionInProgress && !tokenErrors && inputValueValid && rbacLoaded;
 
   const servingRuntimeSelected = React.useMemo(
     () =>
@@ -92,59 +113,83 @@ const ManageServingRuntimeModal: React.FC<ManageServingRuntimeModalProps> = ({
     setActionInProgress(false);
   };
 
-  const updateModelServer = (
-    fillData: CreatingServingRuntimeObject,
-    servingRuntime: ServingRuntimeKind,
-    secrets: SecretKind[],
-  ): Promise<void> =>
-    Promise.all([
-      updateSecrets(
-        fillData,
-        servingRuntime.metadata.name,
-        servingRuntime.metadata.namespace,
-        secrets,
-        { dryRun: true },
-      ),
-      updateServingRuntime(fillData, servingRuntime, customServingRuntimesEnabled, {
-        dryRun: true,
-      }),
-    ])
-      .then(() =>
-        Promise.all([
-          updateSecrets(
-            fillData,
-            servingRuntime.metadata.name,
-            servingRuntime.metadata.namespace,
-            secrets,
-          ),
-          updateServingRuntime(fillData, servingRuntime, customServingRuntimesEnabled),
-        ]).then(() => {
-          setActionInProgress(false);
-          onBeforeClose(true);
-        }),
-      )
-      .catch((e) => setErrorModal(e));
+  const submit = () => {
+    setError(undefined);
+    setActionInProgress(true);
 
-  const createModelServer = (
-    fillData: CreatingServingRuntimeObject,
-    servingRuntime: ServingRuntimeKind,
-    namespace: string,
-  ): Promise<ServingRuntimeKind | string | void> => {
-    const servingRuntimeName = translateDisplayNameForK8s(fillData.name);
+    if (!servingRuntimeSelected) {
+      setErrorModal(new Error('Error retrieving Serving Runtime'));
+      return;
+    }
+    const servingRuntimeData = {
+      ...createData,
+      gpus: isGpuDisabled(servingRuntimeSelected) ? 0 : createData.gpus,
+    };
+    const servingRuntimeName = translateDisplayNameForK8s(servingRuntimeData.name);
+    const createRolebinding = servingRuntimeData.tokenAuth && allowCreate;
 
-    return Promise.all<ServingRuntimeKind | string | void>([
-      createServingRuntime(fillData, namespace, servingRuntime, customServingRuntimesEnabled, {
-        dryRun: true,
-      }),
-      setUpTokenAuth(fillData, servingRuntimeName, namespace, { dryRun: true }),
+    Promise.all<ServingRuntimeKind | string | void>([
+      ...(editInfo?.servingRuntime
+        ? [
+            updateServingRuntime(
+              servingRuntimeData,
+              editInfo?.servingRuntime,
+              customServingRuntimesEnabled,
+              {
+                dryRun: true,
+              },
+            ),
+          ]
+        : [
+            createServingRuntime(
+              servingRuntimeData,
+              namespace,
+              servingRuntimeSelected,
+              customServingRuntimesEnabled,
+              {
+                dryRun: true,
+              },
+            ),
+          ]),
+      setUpTokenAuth(
+        servingRuntimeData,
+        servingRuntimeName,
+        namespace,
+        createRolebinding,
+        editInfo?.secrets,
+        {
+          dryRun: true,
+        },
+      ),
     ])
       .then(() =>
         Promise.all<ServingRuntimeKind | string | void>([
-          ...(currentProject.metadata.labels?.['modelmesh-enabled']
+          ...(currentProject.metadata.labels?.['modelmesh-enabled'] && allowCreate
             ? [addSupportModelMeshProject(currentProject.metadata.name)]
             : []),
-          createServingRuntime(fillData, namespace, servingRuntime, customServingRuntimesEnabled),
-          setUpTokenAuth(fillData, servingRuntimeName, namespace),
+          ...(editInfo?.servingRuntime
+            ? [
+                updateServingRuntime(
+                  servingRuntimeData,
+                  editInfo?.servingRuntime,
+                  customServingRuntimesEnabled,
+                ),
+              ]
+            : [
+                createServingRuntime(
+                  servingRuntimeData,
+                  namespace,
+                  servingRuntimeSelected,
+                  customServingRuntimesEnabled,
+                ),
+              ]),
+          setUpTokenAuth(
+            servingRuntimeData,
+            servingRuntimeName,
+            namespace,
+            createRolebinding,
+            editInfo?.secrets,
+          ),
         ])
           .then(() => {
             setActionInProgress(false);
@@ -159,31 +204,6 @@ const ManageServingRuntimeModal: React.FC<ManageServingRuntimeModalProps> = ({
       });
   };
 
-  const submit = () => {
-    setError(undefined);
-    setActionInProgress(true);
-
-    if (!servingRuntimeSelected) {
-      setErrorModal(new Error('Error retrieving Serving Runtime'));
-      return;
-    }
-
-    const servingRuntimeData = {
-      ...createData,
-      gpus: isGpuDisabled(servingRuntimeSelected) ? 0 : createData.gpus,
-    };
-
-    if (editInfo) {
-      if (!editInfo.secrets) {
-        setErrorModal(new Error('Error retrieving secrets'));
-        return;
-      }
-      updateModelServer(servingRuntimeData, servingRuntimeSelected, editInfo.secrets);
-    } else {
-      createModelServer(servingRuntimeData, servingRuntimeSelected, namespace);
-    }
-  };
-
   return (
     <Modal
       title="Configure model server"
@@ -246,7 +266,12 @@ const ManageServingRuntimeModal: React.FC<ManageServingRuntimeModalProps> = ({
                 </FormSection>
               </StackItem>
               <StackItem>
-                <ServingRuntimeTokenSection data={createData} setData={setCreateData} />
+                <ServingRuntimeTokenSection
+                  data={createData}
+                  setData={setCreateData}
+                  allowCreate={allowCreate}
+                  rbacLoaded={rbacLoaded}
+                />
               </StackItem>
             </Stack>
           </Form>

frontend/src/pages/modelServing/screens/projects/ServingRuntimeModal/ServingRuntimeTokenInput.tsx

@@ -19,12 +19,14 @@ type ServingRuntimeTokenInputProps = {
   data: CreatingServingRuntimeObject;
   setData: UpdateObjectAtPropAndValue<CreatingServingRuntimeObject>;
   token: ServingRuntimeToken;
+  disabled?: boolean;
 };
 
 const ServingRuntimeTokenInput: React.FC<ServingRuntimeTokenInputProps> = ({
   data,
   setData,
   token,
+  disabled,
 }) => {
   const checkDuplicates = (name: string): boolean => {
     const duplicates = data.tokens.filter(
@@ -61,6 +63,7 @@ const ServingRuntimeTokenInput: React.FC<ServingRuntimeTokenInputProps> = ({
             name="service-account-form-name"
             aria-describedby="service-account-form-name-helper"
             validated={token.error ? ValidatedOptions.error : ValidatedOptions.default}
+            isDisabled={disabled}
             onChange={(value) => {
               const tokens = data.tokens?.map((item) =>
                 item.uuid === token.uuid
@@ -81,6 +84,7 @@ const ServingRuntimeTokenInput: React.FC<ServingRuntimeTokenInputProps> = ({
             variant="plain"
             aria-label="Remove service account"
             icon={<MinusCircleIcon />}
+            isDisabled={disabled}
             onClick={() => {
               setData(
                 'tokens',