fix(backend): Remove the default workspace configuration (#12369)

This was added as a mistake as this is environment specific and not a
safe default.

Signed-off-by: mprahl <[email protected]>

Author: mprahl

backend/src/apiserver/config/config.json

@@ -24,13 +24,5 @@
   "CacheEnabled": "true",
   "CRON_SCHEDULE_TIMEZONE": "UTC",
   "CACHE_IMAGE": "ghcr.io/containerd/busybox",
-  "CACHE_NODE_RESTRICTIONS": "false",
-  "Workspace": {
-    "VolumeClaimTemplateSpec": {
-      "accessModes": [
-        "ReadWriteOnce"
-      ],
-      "storageClassName": "standard-csi"
-    }
-  }
+  "CACHE_NODE_RESTRICTIONS": "false"
 }

backend/src/v2/compiler/argocompiler/argo.go

@@ -542,6 +542,17 @@ func GetWorkspacePVC(
 		}
 	}
 
+	// Access modes define the read/write semantics for the underlying volume and
+	// gate whether multiple pods can mount it concurrently. It is required when creating the
+	// underlying PVC for the workspace.
+	if len(pvcSpec.AccessModes) == 0 {
+		return k8score.PersistentVolumeClaim{}, fmt.Errorf("workspace PVC spec must specify accessModes")
+	}
+
+	if pvcSpec.StorageClassName == nil || *pvcSpec.StorageClassName == "" {
+		return k8score.PersistentVolumeClaim{}, fmt.Errorf("workspace PVC spec must specify storageClassName")
+	}
+
 	quantity, err := k8sres.ParseQuantity(sizeStr)
 	if err != nil {
 		return k8score.PersistentVolumeClaim{}, fmt.Errorf("invalid size value for workspace PVC: %v", err)

backend/src/v2/compiler/argocompiler/argo_workspace_test.go

@@ -35,16 +35,28 @@ func TestGetWorkspacePVC(t *testing.T) {
 		expectError bool
 	}{
 		{
-			name: "workspace with size specified",
+			name: "workspace with size specified and default workspace",
 			workspace: &pipelinespec.WorkspaceConfig{
-				Size: "5Gi",
+				Size:       "5Gi",
+				Kubernetes: nil,
+			},
+			opts: &argocompiler.Options{
+				DefaultWorkspace: &k8score.PersistentVolumeClaimSpec{
+					AccessModes: []k8score.PersistentVolumeAccessMode{
+						k8score.ReadWriteOnce,
+					},
+					StorageClassName: stringPtr("standard"),
+				},
 			},
-			opts: nil,
 			expectedPVC: k8score.PersistentVolumeClaim{
 				ObjectMeta: k8smeta.ObjectMeta{
 					Name: "kfp-workspace",
 				},
 				Spec: k8score.PersistentVolumeClaimSpec{
+					AccessModes: []k8score.PersistentVolumeAccessMode{
+						k8score.ReadWriteOnce,
+					},
+					StorageClassName: stringPtr("standard"),
 					Resources: k8score.VolumeResourceRequirements{
 						Requests: map[k8score.ResourceName]resource.Quantity{
 							k8score.ResourceStorage: resource.MustParse("5Gi"),
@@ -68,7 +80,14 @@ func TestGetWorkspacePVC(t *testing.T) {
 			workspace: &pipelinespec.WorkspaceConfig{
 				Size: "", // no size specified
 			},
-			opts:        nil, // no options
+			opts: &argocompiler.Options{
+				DefaultWorkspace: &k8score.PersistentVolumeClaimSpec{
+					AccessModes: []k8score.PersistentVolumeAccessMode{
+						k8score.ReadWriteOnce,
+					},
+					StorageClassName: stringPtr("standard"),
+				},
+			},
 			expectedPVC: k8score.PersistentVolumeClaim{},
 			expectError: true,
 		},
@@ -108,6 +127,17 @@ func TestGetWorkspacePVC(t *testing.T) {
 			},
 			expectError: false,
 		},
+		{
+			name: "default workspace missing required fields should fail",
+			workspace: &pipelinespec.WorkspaceConfig{
+				Size: "10Gi",
+			},
+			opts: &argocompiler.Options{
+				DefaultWorkspace: &k8score.PersistentVolumeClaimSpec{},
+			},
+			expectedPVC: k8score.PersistentVolumeClaim{},
+			expectError: true,
+		},
 		{
 			name: "workspace with Kubernetes PVC spec patch",
 			workspace: &pipelinespec.WorkspaceConfig{
@@ -160,6 +190,24 @@ func TestGetWorkspacePVC(t *testing.T) {
 			expectedPVC: k8score.PersistentVolumeClaim{},
 			expectError: true,
 		},
+		{
+			name: "workspace patch missing accessModes should fail",
+			workspace: &pipelinespec.WorkspaceConfig{
+				Size: "20Gi",
+				Kubernetes: &pipelinespec.KubernetesWorkspaceConfig{
+					PvcSpecPatch: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"storageClassName": structpb.NewStringValue("fast-ssd"),
+						},
+					},
+				},
+			},
+			opts: &argocompiler.Options{
+				DefaultWorkspace: &k8score.PersistentVolumeClaimSpec{},
+			},
+			expectedPVC: k8score.PersistentVolumeClaim{},
+			expectError: true,
+		},
 		{
 			name: "workspace with invalid PVC spec patch",
 			workspace: &pipelinespec.WorkspaceConfig{
@@ -221,50 +269,6 @@ func TestGetWorkspacePVC(t *testing.T) {
 			},
 			expectError: false,
 		},
-		{
-			name: "workspace with nil Kubernetes config",
-			workspace: &pipelinespec.WorkspaceConfig{
-				Size:       "30Gi",
-				Kubernetes: nil,
-			},
-			opts: nil,
-			expectedPVC: k8score.PersistentVolumeClaim{
-				ObjectMeta: k8smeta.ObjectMeta{
-					Name: "kfp-workspace",
-				},
-				Spec: k8score.PersistentVolumeClaimSpec{
-					Resources: k8score.VolumeResourceRequirements{
-						Requests: map[k8score.ResourceName]resource.Quantity{
-							k8score.ResourceStorage: resource.MustParse("30Gi"),
-						},
-					},
-				},
-			},
-			expectError: false,
-		},
-		{
-			name: "workspace with empty Kubernetes config",
-			workspace: &pipelinespec.WorkspaceConfig{
-				Size: "40Gi",
-				Kubernetes: &pipelinespec.KubernetesWorkspaceConfig{
-					PvcSpecPatch: nil,
-				},
-			},
-			opts: nil,
-			expectedPVC: k8score.PersistentVolumeClaim{
-				ObjectMeta: k8smeta.ObjectMeta{
-					Name: "kfp-workspace",
-				},
-				Spec: k8score.PersistentVolumeClaimSpec{
-					Resources: k8score.VolumeResourceRequirements{
-						Requests: map[k8score.ResourceName]resource.Quantity{
-							k8score.ResourceStorage: resource.MustParse("40Gi"),
-						},
-					},
-				},
-			},
-			expectError: false,
-		},
 	}
 
 	for _, tt := range tests {
@@ -299,17 +303,41 @@ func TestGetWorkspacePVC_EdgeCases(t *testing.T) {
 			name: "workspace with very large size",
 			workspace: &pipelinespec.WorkspaceConfig{
 				Size: "1000Ti",
+				Kubernetes: &pipelinespec.KubernetesWorkspaceConfig{
+					PvcSpecPatch: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"accessModes": structpb.NewListValue(&structpb.ListValue{
+								Values: []*structpb.Value{
+									structpb.NewStringValue("ReadWriteOnce"),
+								},
+							}),
+							"storageClassName": structpb.NewStringValue("gp2"),
+						},
+					},
+				},
 			},
 			opts:        nil,
-			expectError: false, // should be valid
+			expectError: false,
 		},
 		{
 			name: "workspace with decimal size",
 			workspace: &pipelinespec.WorkspaceConfig{
 				Size: "1.5Gi",
+				Kubernetes: &pipelinespec.KubernetesWorkspaceConfig{
+					PvcSpecPatch: &structpb.Struct{
+						Fields: map[string]*structpb.Value{
+							"accessModes": structpb.NewListValue(&structpb.ListValue{
+								Values: []*structpb.Value{
+									structpb.NewStringValue("ReadWriteOnce"),
+								},
+							}),
+							"storageClassName": structpb.NewStringValue("standard"),
+						},
+					},
+				},
 			},
 			opts:        nil,
-			expectError: false, // should be valid
+			expectError: false,
 		},
 		{
 			name: "workspace with invalid size format",

test_data/compiled-workflows/pipeline_with_workspace.yaml

@@ -387,6 +387,8 @@ spec:
       resources:
         requests:
           storage: 1Gi
+      accessModes:
+      - ReadWriteOnce
       storageClassName: standard
     status: {}
 status:

test_data/sdk_compiled_pipelines/valid/critical/pipeline_with_workspace.py

@@ -56,7 +56,10 @@ def read_from_workspace(file_path: str) -> str:
         workspace=dsl.WorkspaceConfig(
             size='1Gi',
             kubernetes=dsl.KubernetesWorkspaceConfig(
-                pvcSpecPatch={'storageClassName': 'standard'}
+                pvcSpecPatch={
+                    'storageClassName': 'standard',
+                    'accessModes': ['ReadWriteOnce'],
+                }
             )
         ),
     ),

test_data/sdk_compiled_pipelines/valid/critical/pipeline_with_workspace.yaml

@@ -146,5 +146,7 @@ platforms:
       workspace:
         kubernetes:
           pvcSpecPatch:
+            accessModes:
+            - ReadWriteOnce
             storageClassName: standard
         size: 1Gi