Remove explainer configs and organize manifests (#893)

* References to Alibi and ART explainers are removed from the
`inferenceservice-config` ConfigMap.
* User cluster roles are moved into an overlay in opendatahub-io/kserve

Signed-off-by: Edgar Hernández <23639005+israel-hdez@users.noreply.github.com>

kserve/base/inferenceservice-config-patch.yaml

@@ -4,17 +4,7 @@ metadata:
   name: inferenceservice-config
   namespace: kserve
 data:
-  explainers: |-
-    {
-        "alibi": {
-            "image" : "$(kserve-alibi-explainer)",
-            "defaultImageVersion": "$(kserve-alibi-explainer-version)"
-        },
-        "art": {
-            "image" : "$(kserve-art-explainer)",
-            "defaultImageVersion": "$(kserve-art-explainer-version)"
-        }
-    }
+  explainers: "{}"
   storageInitializer: |-
     {
         "image" : "$(kserve-storage-initializer)",

kserve/base/kustomization.yaml

@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../kserve-built
-  - ./user_cluster_roles.yaml
 
 namespace: opendatahub
 
@@ -26,34 +25,6 @@ vars:
     apiVersion: v1
     kind: ConfigMap
     name: kserve-parameters
-- fieldref:
-    fieldpath: data.kserve-alibi-explainer
-  name: kserve-alibi-explainer
-  objref:
-    apiVersion: v1
-    kind: ConfigMap
-    name: kserve-parameters
-- fieldref:
-    fieldpath: data.kserve-alibi-explainer-version
-  name: kserve-alibi-explainer-version
-  objref:
-    apiVersion: v1
-    kind: ConfigMap
-    name: kserve-parameters
-- fieldref:
-    fieldpath: data.kserve-art-explainer
-  name: kserve-art-explainer
-  objref:
-    apiVersion: v1
-    kind: ConfigMap
-    name: kserve-parameters
-- fieldref:
-    fieldpath: data.kserve-art-explainer-version
-  name: kserve-art-explainer-version
-  objref:
-    apiVersion: v1
-    kind: ConfigMap
-    name: kserve-parameters
 - fieldref:
     fieldpath: data.kserve-storage-initializer
   name: kserve-storage-initializer

kserve/base/params.env

@@ -1,8 +1,4 @@
 kserve-controller=quay.io/opendatahub/kserve-controller:v0.10.2
-kserve-alibi-explainer-version=v0.10.2
-kserve-alibi-explainer=quay.io/opendatahub/kserve-alibi-explainer
-kserve-art-explainer-version=latest
-kserve-art-explainer=quay.io/opendatahub/kserve-art-explainer
 kserve-agent=quay.io/opendatahub/kserve-agent:v0.10.2
 kserve-router=quay.io/opendatahub/kserve-router:v0.10.2
 kserve-storage-initializer=quay.io/opendatahub/kserve-storage-initializer:v0.10.2

kserve/hack/kustomization.yaml

@@ -2,4 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - github.com/opendatahub-io/kserve/config/default?ref=release-0.10
+  - github.com/opendatahub-io/kserve/config/overlays/odh?ref=release-v0.10

kserve/kserve-built/kserve-built.yaml

@@ -1,13 +1,3 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/part-of: kserve
-    control-plane: kserve-controller-manager
-    controller-tools.k8s.io: "1.0"
-    istio-injection: disabled
-  name: kserve
----
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
@@ -17917,6 +17907,40 @@ rules:
   verbs:
   - create
 ---
+aggregationRule:
+  clusterRoleSelectors:
+  - matchLabels:
+      rbac.authorization.k8s.io/aggregate-to-kserve-admin: "true"
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+  name: kserve-admin
+rules: []
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+    rbac.authorization.k8s.io/aggregate-to-kserve-admin: "true"
+  name: kserve-edit
+rules:
+- apiGroups:
+  - serving.kserve.io
+  resources:
+  - inferenceservices
+  - servingruntimes
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -18233,6 +18257,27 @@ rules:
   - create
 ---
 apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    rbac.authorization.k8s.io/aggregate-to-view: "true"
+  name: kserve-view
+rules:
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - servingruntimes
+  - servingruntimes/status
+  - servingruntimes/finalizers
+  - inferenceservices
+  - inferenceservices/status
+  - inferenceservices/finalizers
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels: