Dahsboard WebConsole not working on ODH 3

[acolodreroarion]

Im testing the installation for OPenShift 4.19, and choiced Fast-3 channel -> 3.0.0 version. I tested the fast channel, but the operator didint find the requirements

Once i enabled DSC and enabled datascience, all components are find. The init of datascience cluster didnt generate the route, but the Dashboard component was created.

Then i created the route to the odh-dashboard service, but my brownser is complaining about "odh-dashboard.opendatahub.svc" certificates.

tests:

1. Created the route with passtrought -> Fail

2. Created a Edge route and a service with port 8080:
   i get the issue "Danger alert:General loading error

      Request failed with status code 401
      
      Logging out and logging back in may solve the issue."
   

probably not using Auth

3. i injected a custom-ca cert in DSC init:
   `spec:
   applicationsNamespace: opendatahub
   monitoring:
   managementState: Managed
   metrics: {}
   namespace: opendatahub
   trustedCABundle:
   customCABundle: custom-ca
   managementState: Managed

And custom-ca is a configMap with the pem certificate.

is it possible to disable tls in the whole cluster components?
am i injecting incorrectly my *domain.com pem certificate?
Or can i just reuse my *.apps.clustername.domain.com certs?

[zdtsw]

1. DSCI .spec.trustedCABundle.customCABundle takes pure cert as string , not the name of a ConfigMa which refers to a cert as its data.
   If this is not clearly stated anywhere in our documentation, we are happy to correct that.
2. Is there any specific reason you tried to create Route yourself? Was dashboard not avaiable to access after DSC status showed "Ready"? I do not think it would require user to create Route in order to login Dashboard. If that is the case, please file a bug issue with detail steps following templates and we will look into it.
3. To your question about disable TLS: I do not think we have any feature flag on that aspect. But I am also happy to understand the uses case behind this requirement.

[acolodreroarion]

Hi and thanks for your answer.
The route has not being created after i deployed a datascience cluster, but i can see the link of Open Data Hub in OPenshift UI Console pointing to https://data-science-gateway.apps.mycluster.domain.com

So i needed to create manually the route pointing to odh-dahsboard service on opendatahub namespace, but i get always certificate error.

As you mention before, yes DSC was ready even if i didnt get the route.

i have tried also to setup in DSC initialization:
trustedCABundle:
customCABundle: |
-----BEGIN CERTIFICATE-----

but im noy sure what cert to include here, as the route will get *.apps.clustername.domain.com url

I deployed before OPenshift AI 2.24 with no problems and route worked with https.

[acolodreroarion]

i wonder if i will need to do some cleanup after installing Openshift AI 2.24?
is there documentation for ODH 3.0.0?

Starting from version 3.0.0, the required **OCP ** version is 4.19 or higher. This is essential because llm-d components will not work below OCP version 4.19.
The 3.0.0 release supports fresh installations only — upgrades from version 2.35 (or earlier) are not supported.
This release will be available in the community only on the fast-3 channel.

[zdtsw]

Thanks for pointing out this releasenotes, and yes, for ODH 3.0.0 the only support installation is to start from scratch, a.k.a we do not support smooth upgrade from v2.x to 3.0 directly.
so the best approatch for you to get 3.0.0 is either to install it on a cluster was not used with v2 in the past. or you need to uninstall ODH v2 and might be some leftover on the cluster and better cleanup them on the safe side.

as for the Route part, we are not creating Route in 3.0 for dashboard. Thus what you obeserved that "lack of Route" even dashboard is ready, this is the correct behavior.

back to the questions: which cert ot use.
I think this is something for user to correctly config.
I would suggest: if you did not config trustCAbundle in DSCI when you were with v2, then you probably would not need to do that as well just because you are on v3.

One other side note, may you share what infrastructue you are having for your Openshift cluster? bare-metal? VMware? Openstack? public cloud? etc.

[acolodreroarion]

HI,
so do. you think my issues could be related to i had installed Openshift AI 2.34?

So i did a full cleanup of namespaces and libraries and also full clean up for my old OpenShift AI instance.

I redeployed ODH 3, everythings seems good and all Pods are running well. But when i click over the new created dashboard: https://data-science-gateway.apps.clustername.domain.com it just come application not available. the dashboard pods are running.

i can see instances of Dashboards, OdhDashboardConfig and GatewayConfig.

am missiing something? I have installed RedHat Openshift Service mesh2 and 3, and openshift serverlsss in the same cluster.

[acolodreroarion]

As i understand now that ODH 3 wont create routes, i edit the issue name.

I can see like all the gateway crds has been created .
BUt when i reach the url to access dashboard, o get "Application not available". i guess it will be some wrong config in some of the drds.

and the HTTPRoute looks like:
namespace: opendatahub labels: app: odh-dashboard app.kubernetes.io/part-of: dashboard app.opendatahub.io/dashboard: 'true' platform.opendatahub.io/part-of: dashboard spec: parentRefs: - group: gateway.networking.k8s.io kind: Gateway name: data-science-gateway namespace: openshift-ingress rules: - backendRefs: - group: '' kind: Service name: odh-dashboard port: 8443 weight: 1 matches: - path: type: PathPrefix value: /

Also, if the gateway is configured in mode terminate, shouldnt be the odh-dashboard ui listen on http?
tls:
certificateRefs:
- group: ''
kind: Secret
name: default-gateway-tls
mode: Terminate

[acolodreroarion]

Im on SNO cluster, and the gateway class is trying to generate a LoadBalancer IP
oc get svc -n openshift-ingress
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
data-science-gateway-data-science-gateway-class LoadBalancer 172.30.10.92 15021:31451/TCP,443:31182/TCP 130m

does that mean that i need to provied external IPs for each DSC console? can i use the default openshift gateway controller?

[acolodreroarion]

Based on redhat documentation for OpenShift AI, https://access.redhat.com/articles/7133770 , i need to create a new external IP (in my case a baremetal cluster with metalLB) and create a DNS entry to https://data-science-gateway.apps.clustername.domain.com/ that bypass the openshift-ingress route.

Thats a bit odd an cumbersome, as i cant change the data-science gateway DNS name in any configuration file or DSC init,