Synchronize kubeflow pipelines manifests 2.15.0 (#3283)

* Update kubeflow/pipelines manifests from 2.15.0

Signed-off-by: juliusvonkohout <[email protected]>

* update script

Signed-off-by: juliusvonkohout <[email protected]>

* remove seaweedfs duplication

Signed-off-by: juliusvonkohout <[email protected]>

* adjust example

Signed-off-by: juliusvonkohout <[email protected]>

* workaround remove duplicate default-allow-same-namespace from KFP

Signed-off-by: juliusvonkohout <[email protected]>

* update kfp SDK

Signed-off-by: juliusvonkohout <[email protected]>

* reorder such that networkpolicies are installed first

Signed-off-by: juliusvonkohout <[email protected]>

* reorder tests

Signed-off-by: juliusvonkohout <[email protected]>

* minio -> seaweedfs

Signed-off-by: juliusvonkohout <[email protected]>

---------

Signed-off-by: juliusvonkohout <[email protected]>

Author: juliusvonkohout

.github/workflows/full_kubeflow_integration_test.yaml

@@ -66,11 +66,8 @@ jobs:
     - name: Install KServe
       run: ./tests/kserve_install.sh
 
-    # - name: Install Pipelines
-    #  run: ./tests/pipelines_install.sh
-
     - name: Install Pipelines with SeaweedFS
-      run: ./tests/pipelines_swfs_install.sh
+      run: ./tests/pipelines_install.sh
 
     - name: Create KF Profile
       run: ./tests/kubeflow_profile_install.sh
@@ -161,7 +158,7 @@ jobs:
 
     - name: V2 Pipeline Test
       run: |
-        pip3 install -U "kfp>=2.14.3"
+        pip3 install -U "kfp>=2.15.0"
         TOKEN="$(kubectl -n $KF_PROFILE create token default-editor)"
         python3 tests/pipeline_v2_test.py run_pipeline "${TOKEN}" "${KF_PROFILE}"
 

.github/workflows/pipeline_run_from_notebook.yaml

@@ -41,15 +41,15 @@ jobs:
     - name: Install cert-manager
       run: ./tests/cert_manager_install.sh
 
-    - name: Install kubeflow-istio-resources
+    - name: Install Kubeflow Istio Resources
       run: kustomize build common/istio/kubeflow-istio-resources/base | kubectl apply -f -
 
+    - name: Install Multi-Tenancy
+      run: ./tests/multi_tenancy_install.sh
+
     - name: Install KF Pipelines
       run: ./tests/pipelines_install.sh
 
-    - name: Install KF Multi Tenancy
-      run: ./tests/multi_tenancy_install.sh
-
     - name: Build & Apply manifests
       run: |
         kustomize build applications/jupyter/jupyter-web-app/upstream/overlays/istio/ | kubectl apply -f -

.github/workflows/pipeline_swfs_test.yaml

@@ -49,14 +49,14 @@ jobs:
     - name: Install cert-manager
       run: ./tests/cert_manager_install.sh
 
-    - name: Install KF Pipelines
-      run: ./tests/pipelines_install.sh
+    - name: Install Kubeflow Istio Resources
+      run: kustomize build common/istio/kubeflow-istio-resources/base | kubectl apply -f -
 
-    - name: Install KF Multi Tenancy
+    - name: Install Multi-Tenancy
       run: ./tests/multi_tenancy_install.sh
 
-    - name: Install kubeflow-istio-resources
-      run: kustomize build common/istio/kubeflow-istio-resources/base | kubectl apply -f -
+    - name: Install KF Pipelines
+      run: ./tests/pipelines_install.sh
 
     - name: Create KF Profile
       run: ./tests/kubeflow_profile_install.sh
@@ -88,7 +88,7 @@ jobs:
 
     - name: V2 Pipeline Test
       run: |
-        pip3 install "kfp>=2.14.3"
+        pip3 install "kfp>=2.15.0"
         TOKEN="$(kubectl -n $KF_PROFILE create token default-editor)"
         python3 tests/pipeline_v2_test.py run_pipeline "${TOKEN}" "${KF_PROFILE}"
 
@@ -98,5 +98,8 @@ jobs:
         python3 tests/pipeline_v2_test.py test_unauthorized_access "${TOKEN}" "${KF_PROFILE}"
         echo "Test succeeded. Token from unauthorized ServiceAccount cannot list pipelines in $KF_PROFILE namespace."
 
+    - name: Test SeaweedFS Namespace Isolation
+      run: ./tests/swfs_namespace_isolation_test.sh
+
     - name: Apply Pod Security Standards restricted levels
       run: ./tests/PSS_enable.sh

.github/workflows/pipeline_test.yaml

@@ -70,7 +70,7 @@ This repository periodically synchronizes all official Kubeflow components from
 | Katib | applications/katib/upstream | [v0.18.0](https://github.com/kubeflow/katib/tree/v0.18.0/manifests/v1beta1) | 13m | 476Mi | 10GB |
 | KServe | applications/kserve/kserve | [v0.15.0](https://github.com/kserve/kserve/releases/tag/v0.15.0/install/v0.15.0) | 600m | 1200Mi | 0GB |
 | KServe Models Web Application | applications/kserve/models-web-app | [v0.15.0](https://github.com/kserve/models-web-app/tree/v0.15.0/config) | 6m | 259Mi  | 0GB |
-| Kubeflow Pipelines | applications/pipeline/upstream | [2.14.3](https://github.com/kubeflow/pipelines/tree/2.14.3/manifests/kustomize) | 970m | 3552Mi | 35GB |
+| Kubeflow Pipelines | applications/pipeline/upstream | [2.15.0](https://github.com/kubeflow/pipelines/tree/2.15.0/manifests/kustomize) | 970m | 3552Mi | 35GB |
 | Kubeflow Model Registry | applications/model-registry/upstream | [v0.3.3](https://github.com/kubeflow/model-registry/tree/v0.3.3/manifests/kustomize) | 510m | 2112Mi | 20GB |
 | Spark Operator	|	applications/spark/spark-operator	|	[2.3.0](https://github.com/kubeflow/spark-operator/tree/v2.3.0) | 9m | 41Mi | 0GB |
 | Istio | common/istio | [1.28.0](https://github.com/istio/istio/releases/tag/1.28.0) | 750m | 2364Mi | 0GB |

README.md

@@ -5,3 +5,4 @@ reviewers:
   - mprahl
   - droctothorpe
   - hbelmiro
+  - gmfrasca

applications/pipeline/upstream/OWNERS

@@ -1,6 +1,6 @@
 # Install Kubeflow Pipelines Standalone using Kustomize Manifests
 
-This folder contains [Kubeflow Pipelines Standalone](https://www.kubeflow.org/docs/components/pipelines/installation/standalone-deployment/) 
+This folder contains [Kubeflow Pipelines Standalone](https://www.kubeflow.org/docs/components/pipelines/installation/standalone-deployment/)
 Kustomize manifests.
 
 Kubeflow Pipelines Standalone is one option to install Kubeflow Pipelines. You can review all other options in
@@ -40,20 +40,6 @@ Data:
 
 Application data are persisted in in-cluster PersistentVolumeClaim storage.
 
-### (env/gcp) install on Google Cloud with Cloud Storage and Cloud SQL
-
-Cloud Storage and Cloud SQL are better for operating a production cluster.
-
-Refer to [Google Cloud Instructions](sample/README.md) for installation.
-
-### (env/aws) install on AWS with S3 and RDS MySQL
-
-S3 and RDS MySQL are better for operating a production cluster.
-
-Refer to [AWS Instructions](env/aws/README.md) for installation.
-
-Note: Community maintains a different opinionated installation manifests for AWS, refer to [e2fyi/kubeflow-aws](https://github.com/e2fyi/kubeflow-aws/tree/master/pipelines).
-
 ## Uninstall
 
 If the installation is based on CloudSQL/GCS, after the uninstall, the data is still there,
@@ -66,8 +52,6 @@ kubectl kustomize env/platform-agnostic | kubectl delete -f -
 # or
 kubectl kustomize env/dev | kubectl delete -f -
 # or
-kubectl kustomize env/gcp | kubectl delete -f -
-# or
 kubectl delete applications/pipeline -n kubeflow
 
 ### 2. cluster scoped

applications/pipeline/upstream/README.md

@@ -6,7 +6,7 @@ resources:
   - cache-deployer-deployment.yaml
 images:
   - name: ghcr.io/kubeflow/kfp-cache-deployer
-    newTag: 2.14.3
+    newTag: 2.15.0
 labels:
   - includeSelectors: true
     pairs:

applications/pipeline/upstream/base/cache-deployer/kustomization.yaml

@@ -8,7 +8,7 @@ resources:
   - cache-service.yaml
 images:
   - name: ghcr.io/kubeflow/kfp-cache-server
-    newTag: 2.14.3
+    newTag: 2.15.0
 labels:
   - includeSelectors: true
     pairs:

applications/pipeline/upstream/base/cache/kustomization.yaml

@@ -11,7 +11,7 @@ data:
     until the changes take effect. A quick way to restart all deployments in a
     namespace: `kubectl rollout restart deployment -n <your-namespace>`.
   appName: pipeline
-  appVersion: 2.14.3
+  appVersion: 2.15.0
   dbHost: mysql # relic to be removed after release
   dbPort: "3306" # relic to be removed after release
   dbType: mysql
@@ -94,3 +94,16 @@ data:
   ## to be nanoseconds.
   ConMaxLifeTime: "120s"
   LOG_LEVEL: "info"
+  ## ARTIFACTS_PROXY_ENABLED: Controls whether the artifact proxy is enabled
+  ## to support accessing out-of-kubeflow scope buckets. The artifact proxy
+  ## has known security and architectural flaws, so it should only be enabled
+  ## if you specifically need to access unique pipeline root buckets per
+  ## namespace that are outside the kubeflow namespace's access.
+  ## Valid values are 'true' and 'false'. Defaults to 'false'.
+  ## For more information see: https://github.com/kubeflow/pipelines/pull/11965
+  ARTIFACTS_PROXY_ENABLED: "false"
+  ## ARTIFACT_RETENTION_DAYS: Defines the retention period (in days) for artifacts stored in SeaweedFS.  
+  ## - A positive integer specifies the number of days after which the artifact will be automatically deleted.  
+  ## - A negative integer (e.g., -1) disables automatic deletion, meaning artifacts are retained indefinitely.  
+  ## Note: The unit of this configuration is always in days.  
+  ARTIFACT_RETENTION_DAYS: "-1"