diff --git a/.github/workflows/dex_oauth2-proxy_test.yaml b/.github/workflows/dex_oauth2-proxy_test.yaml
index 08e8263cb6..4e7c976cee 100644
--- a/.github/workflows/dex_oauth2-proxy_test.yaml
+++ b/.github/workflows/dex_oauth2-proxy_test.yaml
@@ -7,7 +7,8 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- - experimental/security/PSS/*
+ - tests/kubeflow_profile_install.sh
+ - tests/PSS_enable.sh
- common/dex/base/**
- tests/istio*
- tests/dex_login_test.py
diff --git a/.github/workflows/istio_validation.yaml b/.github/workflows/istio_validation.yaml
index da0ad0d909..ac68145149 100644
--- a/.github/workflows/istio_validation.yaml
+++ b/.github/workflows/istio_validation.yaml
@@ -252,7 +252,8 @@ jobs:
- name: Test basic connectivity
run: |
kubectl expose deployment test-application --port=80 --target-port=8080 -n $KF_PROFILE
- kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE -- \
+ kubectl run test-client --image=busybox:1.36.1 --rm -i --restart=Never -n $KF_PROFILE \
+ --overrides='{"spec": {"securityContext": {"runAsNonRoot": true, "runAsUser": 1000, "seccompProfile": {"type": "RuntimeDefault"}}, "containers": [{"name": "test-client", "image": "busybox:1.36.1", "stdin": true, "tty": true, "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsNonRoot": true, "runAsUser": 1000, "seccompProfile": {"type": "RuntimeDefault"}}}]}}' -- \
wget -qO- --timeout=10 test-application.$KF_PROFILE.svc.cluster.local
- name: Apply Pod Security Standards Restricted levels
diff --git a/.github/workflows/katib_test.yaml b/.github/workflows/katib_test.yaml
index 9ff00c4d3a..77b1232ad1 100644
--- a/.github/workflows/katib_test.yaml
+++ b/.github/workflows/katib_test.yaml
@@ -3,7 +3,7 @@ on:
pull_request:
paths:
- tests/install_KinD_create_KinD_cluster_install_kustomize.sh
- - tests/katib_install.sh
+ - tests/katib*
- .github/workflows/katib_test.yaml
- applications/katib/upstream/**
- common/istio*/**
@@ -12,7 +12,8 @@ on:
- tests/profile_controller_install.sh
- applications/dashboard/upstream/profile-controller/**
- common/cert-manager/**
- - experimental/security/PSS/*
+ - tests/kubeflow_profile_install.sh
+ - tests/PSS_enable.sh
permissions:
contents: read
diff --git a/.github/workflows/pipeline_run_from_notebook.yaml b/.github/workflows/pipeline_run_from_notebook.yaml
index 8ffa22f219..573cdf151d 100644
--- a/.github/workflows/pipeline_run_from_notebook.yaml
+++ b/.github/workflows/pipeline_run_from_notebook.yaml
@@ -14,6 +14,9 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
+ - tests/pipeline*
+ - tests/kubeflow_profile_install.sh
+ - tests/PSS_enable.sh
- common/kubeflow-namespace/**
permissions:
diff --git a/.github/workflows/pipeline_test.yaml b/.github/workflows/pipeline_test.yaml
index 8111f7b6c4..df1a7ed34e 100644
--- a/.github/workflows/pipeline_test.yaml
+++ b/.github/workflows/pipeline_test.yaml
@@ -13,9 +13,9 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- - tests/pipeline_v1_test.py
- - tests/pipeline_v2_test.py
- - experimental/security/PSS/*
+ - tests/pipeline*
+ - tests/kubeflow_profile_install.sh
+ - tests/PSS_enable.sh
permissions:
contents: read
diff --git a/.github/workflows/trainer_test.yaml b/.github/workflows/trainer_test.yaml
index 99492409f6..34eea5121b 100644
--- a/.github/workflows/trainer_test.yaml
+++ b/.github/workflows/trainer_test.yaml
@@ -14,7 +14,8 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- - experimental/security/PSS/*
+ - tests/kubeflow_profile_install.sh
+ - tests/PSS_enable.sh
permissions:
contents: read
diff --git a/.github/workflows/training_operator_test.yaml b/.github/workflows/training_operator_test.yaml
index 3d1b2dec3e..d2096f2666 100644
--- a/.github/workflows/training_operator_test.yaml
+++ b/.github/workflows/training_operator_test.yaml
@@ -14,7 +14,8 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- - experimental/security/PSS/*
+ - tests/kubeflow_profile_install.sh
+ - tests/PSS_enable.sh
permissions:
contents: read
diff --git a/README.md b/README.md
index 734e524b46..e4c33ab051 100644
--- a/README.md
+++ b/README.md
@@ -79,12 +79,15 @@ This repository periodically synchronizes all official Kubeflow components from
| Kubeflow Pipelines | applications/pipeline/upstream | [2.16.1](https://github.com/kubeflow/pipelines/tree/2.16.1/manifests/kustomize) | 970m | 3552Mi | 35GB |
| Kubeflow Hub | applications/hub/upstream | [v0.3.9](https://github.com/kubeflow/hub/tree/v0.3.9/manifests/kustomize) | 510m | 2112Mi | 20GB |
| Spark Operator | applications/spark/spark-operator | [2.5.0](https://github.com/kubeflow/spark-operator/tree/v2.5.0) | 9m | 41Mi | 0GB |
-| Istio | common/istio | [1.29.2](https://github.com/istio/istio/releases/tag/1.29.2) | 750m | 2364Mi | 0GB |
+| Istio | common/istio | [1.30.0](https://github.com/istio/istio/releases/tag/1.30.0) | 750m | 2364Mi | 0GB |
| Knative | common/knative/knative-serving
common/knative/knative-eventing | [v1.21.1](https://github.com/knative/serving/releases/tag/knative-v1.21.1)
[v1.21.0](https://github.com/knative/eventing/releases/tag/knative-v1.21.0) | 1450m | 1038Mi | 0GB |
| Cert Manager | common/cert-manager | [1.19.4](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.4) | 3m | 128Mi | 0GB |
| Dex | common/dex | [2.45.0](https://github.com/dexidp/dex/releases/tag/v2.45.0) | 3m | 27Mi | 0GB |
| OAuth2-Proxy | common/oauth2-proxy | [7.14.3](https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.14.3) | 3m | 27Mi | 0GB |
-| **Total** | | | **4380m** | **12341Mi** | **65GB** |
+| **Total** | | | **4380m** | **12341Mi** | **65GB** |
+
+> **Note on Istio Version:** Istio 1.30+ is required for PSS Restricted namespace compatibility. The istio-proxy sidecar in 1.29.x does not meet restricted PSS requirements (missing seccompProfile, non-zero UID in some modes). Do not downgrade.
+
diff --git a/applications/katib/overlays/katib-with-kubeflow/katib-config.yaml b/applications/katib/overlays/katib-with-kubeflow/katib-config.yaml
new file mode 100644
index 0000000000..35b3ba86d8
--- /dev/null
+++ b/applications/katib/overlays/katib-with-kubeflow/katib-config.yaml
@@ -0,0 +1,62 @@
+# Katib Config patch to enable PSS compliance.
+# injectSecurityContext: true clones securityContext properties from primary
+# trial containers to sidecar metrics-collectors, preventing admission blocks.
+apiVersion: config.kubeflow.org/v1beta1
+kind: KatibConfig
+init:
+ controller:
+ webhookPort: 8443
+ injectSecurityContext: true
+ trialResources:
+ - TrainJob.v1alpha1.trainer.kubeflow.org
+ - Job.v1.batch
+ - TFJob.v1.kubeflow.org
+ - PyTorchJob.v1.kubeflow.org
+ - MPIJob.v1.kubeflow.org
+ - XGBoostJob.v1.kubeflow.org
+runtime:
+ metricsCollectors:
+ - kind: StdOut
+ image: ghcr.io/kubeflow/katib/file-metrics-collector:v0.19.0
+ - kind: File
+ image: ghcr.io/kubeflow/katib/file-metrics-collector:v0.19.0
+ - kind: TensorFlowEvent
+ image: ghcr.io/kubeflow/katib/tfevent-metrics-collector:v0.19.0
+ resources:
+ limits:
+ memory: 1Gi
+ suggestions:
+ - algorithmName: random
+ image: ghcr.io/kubeflow/katib/suggestion-hyperopt:v0.19.0
+ - algorithmName: tpe
+ image: ghcr.io/kubeflow/katib/suggestion-hyperopt:v0.19.0
+ - algorithmName: grid
+ image: ghcr.io/kubeflow/katib/suggestion-optuna:v0.19.0
+ - algorithmName: hyperband
+ image: ghcr.io/kubeflow/katib/suggestion-hyperband:v0.19.0
+ - algorithmName: bayesianoptimization
+ image: ghcr.io/kubeflow/katib/suggestion-skopt:v0.19.0
+ - algorithmName: cmaes
+ image: ghcr.io/kubeflow/katib/suggestion-goptuna:v0.19.0
+ - algorithmName: sobol
+ image: ghcr.io/kubeflow/katib/suggestion-goptuna:v0.19.0
+ - algorithmName: multivariate-tpe
+ image: ghcr.io/kubeflow/katib/suggestion-optuna:v0.19.0
+ - algorithmName: enas
+ image: ghcr.io/kubeflow/katib/suggestion-enas:v0.19.0
+ resources:
+ limits:
+ memory: 400Mi
+ - algorithmName: darts
+ image: ghcr.io/kubeflow/katib/suggestion-darts:v0.19.0
+ - algorithmName: pbt
+ image: ghcr.io/kubeflow/katib/suggestion-pbt:v0.19.0
+ persistentVolumeClaimSpec:
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 5Gi
+ earlyStoppings:
+ - algorithmName: medianstop
+ image: ghcr.io/kubeflow/katib/earlystopping-medianstop:v0.19.0
diff --git a/applications/katib/overlays/katib-with-kubeflow/kustomization.yaml b/applications/katib/overlays/katib-with-kubeflow/kustomization.yaml
new file mode 100644
index 0000000000..d0df896f53
--- /dev/null
+++ b/applications/katib/overlays/katib-with-kubeflow/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../upstream/installs/katib-with-kubeflow
+configMapGenerator:
+- behavior: merge
+ files:
+ - katib-config.yaml
+ name: katib-config
+ options:
+ disableNameSuffixHash: true
diff --git a/applications/trainer/overlays/runtimes/kustomization.yaml b/applications/trainer/overlays/runtimes/kustomization.yaml
new file mode 100644
index 0000000000..fb213d2a43
--- /dev/null
+++ b/applications/trainer/overlays/runtimes/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../upstream/overlays/runtimes
+patches:
+- path: torch_distributed_patch.yaml
diff --git a/applications/trainer/overlays/runtimes/torch_distributed_patch.yaml b/applications/trainer/overlays/runtimes/torch_distributed_patch.yaml
new file mode 100644
index 0000000000..43311dfbff
--- /dev/null
+++ b/applications/trainer/overlays/runtimes/torch_distributed_patch.yaml
@@ -0,0 +1,32 @@
+apiVersion: trainer.kubeflow.org/v1alpha1
+kind: ClusterTrainingRuntime
+metadata:
+ name: torch-distributed
+spec:
+ template:
+ spec:
+ replicatedJobs:
+ - name: node
+ template:
+ spec:
+ template:
+ spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ containers:
+ - name: node
+ # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+ # (read-only root fs in base image). Safe for short-running stateless test pods.
+ workingDir: /tmp
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
diff --git a/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml b/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml
index 819d192842..0b2945c171 100644
--- a/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml
+++ b/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml
@@ -7,8 +7,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/rev: default
@@ -26,8 +26,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/dataplane-mode: none
@@ -59,9 +59,9 @@ spec:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
+ app.kubernetes.io/version: 1.30.0
chart: gateways
- helm.sh/chart: istio-ingress-1.29.2
+ helm.sh/chart: istio-ingress-1.30.0
heritage: Tiller
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
@@ -144,7 +144,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- image: registry.istio.io/release/proxyv2:1.29.2
+ image: registry.istio.io/release/proxyv2:1.30.0
name: istio-proxy
ports:
- containerPort: 15020
@@ -260,8 +260,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: IngressGateways
@@ -286,8 +286,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: IngressGateways
@@ -311,8 +311,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/rev: default
@@ -345,8 +345,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/rev: default
diff --git a/common/istio/istio-crds/base/crd.yaml b/common/istio/istio-crds/base/crd.yaml
index 4e9e21f5d4..47b328672b 100644
--- a/common/istio/istio-crds/base/crd.yaml
+++ b/common/istio/istio-crds/base/crd.yaml
@@ -7,8 +7,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: authorizationpolicies.security.istio.io
spec:
group: security.istio.io
@@ -125,6 +125,11 @@ spec:
type: string
maxItems: 16
type: array
+ notTrustDomains:
+ description: Optional.
+ items:
+ type: string
+ type: array
principals:
description: Optional.
items:
@@ -147,6 +152,11 @@ spec:
type: string
maxItems: 16
type: array
+ trustDomains:
+ description: Optional.
+ items:
+ type: string
+ type: array
type: object
x-kubernetes-validations:
- message: Cannot set serviceAccounts with
@@ -506,6 +516,11 @@ spec:
type: string
maxItems: 16
type: array
+ notTrustDomains:
+ description: Optional.
+ items:
+ type: string
+ type: array
principals:
description: Optional.
items:
@@ -528,6 +543,11 @@ spec:
type: string
maxItems: 16
type: array
+ trustDomains:
+ description: Optional.
+ items:
+ type: string
+ type: array
type: object
x-kubernetes-validations:
- message: Cannot set serviceAccounts with
@@ -797,8 +817,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: destinationrules.networking.istio.io
spec:
group: networking.istio.io
@@ -7107,8 +7127,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: envoyfilters.networking.istio.io
spec:
group: networking.istio.io
@@ -7373,7 +7393,7 @@ spec:
type: integer
x-kubernetes-validations:
- message: port must be between 1-65535
- rule: 0 < self && self <= 6553
+ rule: 0 < self && self <= 65535
route:
description: Match a specific route.
properties:
@@ -7581,8 +7601,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: gateways.networking.istio.io
spec:
group: networking.istio.io
@@ -8470,8 +8490,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: peerauthentications.security.istio.io
spec:
group: security.istio.io
@@ -8832,8 +8852,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: proxyconfigs.networking.istio.io
spec:
group: networking.istio.io
@@ -8990,8 +9010,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: requestauthentications.security.istio.io
spec:
group: security.istio.io
@@ -9628,8 +9648,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: serviceentries.networking.istio.io
spec:
group: networking.istio.io
@@ -10586,8 +10606,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: sidecars.networking.istio.io
spec:
group: networking.istio.io
@@ -12424,8 +12444,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: telemetries.telemetry.istio.io
spec:
group: telemetry.istio.io
@@ -12780,6 +12800,12 @@ spec:
type: object
description: Optional.
type: object
+ disableContextPropagation:
+ description: Controls whether trace context headers (e.g.,
+ `traceparent`/`tracestate` for W3C, `X-B3-*` for Zipkin)
+ are propagated in forwarded requests.
+ nullable: true
+ type: boolean
disableSpanReporting:
description: Controls span reporting.
nullable: true
@@ -13258,6 +13284,12 @@ spec:
type: object
description: Optional.
type: object
+ disableContextPropagation:
+ description: Controls whether trace context headers (e.g.,
+ `traceparent`/`tracestate` for W3C, `X-B3-*` for Zipkin)
+ are propagated in forwarded requests.
+ nullable: true
+ type: boolean
disableSpanReporting:
description: Controls span reporting.
nullable: true
@@ -13408,8 +13440,380 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
+ name: trafficextensions.extensions.istio.io
+spec:
+ group: extensions.istio.io
+ names:
+ categories:
+ - istio-io
+ - extensions-istio-io
+ kind: TrafficExtension
+ listKind: TrafficExtensionList
+ plural: trafficextensions
+ singular: trafficextension
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - description: 'CreationTimestamp is a timestamp representing the server time
+ when this object was created. It is not guaranteed to be set in happens-before
+ order across separate operations. Clients may not set this value. It is represented
+ in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
+ lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
+ jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ properties:
+ spec:
+ description: 'Extend the functionality provided by the Istio proxy through
+ WebAssembly or Lua filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/traffic_extension.html'
+ oneOf:
+ - not:
+ anyOf:
+ - required:
+ - wasm
+ - required:
+ - lua
+ - required:
+ - wasm
+ - required:
+ - lua
+ properties:
+ lua:
+ description: Lua filter configuration.
+ properties:
+ inlineCode:
+ description: The inline Lua code to be executed.
+ maxLength: 65536
+ minLength: 1
+ type: string
+ required:
+ - inlineCode
+ type: object
+ match:
+ description: Specifies the criteria to determine which traffic
+ is passed to TrafficExtension.
+ items:
+ properties:
+ mode:
+ description: |-
+ Criteria for selecting traffic by their direction.
+
+ Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER
+ enum:
+ - UNDEFINED
+ - CLIENT
+ - SERVER
+ - CLIENT_AND_SERVER
+ type: string
+ ports:
+ description: Criteria for selecting traffic by their
+ destination port.
+ items:
+ properties:
+ number:
+ maximum: 65535
+ minimum: 1
+ type: integer
+ required:
+ - number
+ type: object
+ type: array
+ x-kubernetes-list-map-keys:
+ - number
+ x-kubernetes-list-type: map
+ type: object
+ type: array
+ phase:
+ description: |-
+ Determines where in the filter chain this `TrafficExtension` is to be injected.
+
+ Valid Options: AUTHN, AUTHZ, STATS
+ enum:
+ - UNSPECIFIED
+ - AUTHN
+ - AUTHZ
+ - STATS
+ type: string
+ priority:
+ description: Determines ordering of `TrafficExtensions` in the
+ same `phase`.
+ format: int32
+ nullable: true
+ type: integer
+ selector:
+ description: Optional.
+ properties:
+ matchLabels:
+ additionalProperties:
+ maxLength: 63
+ type: string
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label value match
+ rule: '!self.contains("*")'
+ description: One or more labels that indicate a specific set
+ of pods/VMs on which a policy should be applied.
+ maxProperties: 4096
+ type: object
+ x-kubernetes-validations:
+ - message: wildcard not allowed in label key match
+ rule: self.all(key, !key.contains("*"))
+ - message: key must not be empty
+ rule: self.all(key, key.size() != 0)
+ type: object
+ targetRefs:
+ description: Optional.
+ items:
+ properties:
+ group:
+ description: group is the group of the target resource.
+ maxLength: 253
+ pattern:
+ ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ kind:
+ description: kind is kind of the target resource.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+ type: string
+ name:
+ description: name is the name of the target resource.
+ maxLength: 253
+ minLength: 1
+ type: string
+ namespace:
+ description: namespace is the namespace of the referent.
+ type: string
+ x-kubernetes-validations:
+ - message: cross namespace referencing is not currently
+ supported
+ rule: self.size() == 0
+ required:
+ - kind
+ - name
+ type: object
+ maxItems: 16
+ type: array
+ wasm:
+ description: WebAssembly filter configuration.
+ properties:
+ failStrategy:
+ description: |-
+ Specifies the failure behavior for the plugin due to fatal errors.
+
+ Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD
+ enum:
+ - FAIL_CLOSE
+ - FAIL_OPEN
+ - FAIL_RELOAD
+ type: string
+ imagePullPolicy:
+ description: |-
+ The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`.
+
+ Valid Options: IfNotPresent, Always
+ enum:
+ - UNSPECIFIED_POLICY
+ - IfNotPresent
+ - Always
+ type: string
+ imagePullSecret:
+ description: Credentials to use for OCI image pulling.
+ maxLength: 253
+ minLength: 1
+ type: string
+ pluginConfig:
+ description: The configuration that will be passed on to the
+ plugin.
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ pluginName:
+ description: The plugin name to be used in the Envoy
+ configuration (used to be called `rootID`).
+ maxLength: 256
+ minLength: 1
+ type: string
+ sha256:
+ description: SHA256 checksum that will be used to verify
+ Wasm module or OCI container.
+ pattern: (^$|^[a-f0-9]{64}$)
+ type: string
+ type:
+ description: |-
+ Specifies the type of Wasm Extension to be used.
+
+ Valid Options: HTTP, NETWORK
+ enum:
+ - UNSPECIFIED_PLUGIN_TYPE
+ - HTTP
+ - NETWORK
+ type: string
+ url:
+ description: URL of a Wasm module or OCI container.
+ minLength: 1
+ type: string
+ x-kubernetes-validations:
+ - message: url must have schema one of [http, https, file,
+ oci]
+ rule: |-
+ isURL(self) ? (url(self).getScheme() in ["", "http", "https", "file", "oci"]) : (isURL("http://" + self) &&
+ url("http://" + self).getScheme() in ["", "http", "https", "file", "oci"])
+ verificationKey:
+ type: string
+ vmConfig:
+ description: Configuration for a Wasm VM.
+ properties:
+ env:
+ description: Specifies environment variables to be
+ injected to this VM.
+ items:
+ properties:
+ name:
+ description: Name of the environment variable.
+ maxLength: 256
+ minLength: 1
+ type: string
+ value:
+ description: Value for the environment variable.
+ maxLength: 2048
+ type: string
+ valueFrom:
+ description: |-
+ Source for the environment variable's value.
+
+ Valid Options: INLINE, HOST
+ enum:
+ - INLINE
+ - HOST
+ type: string
+ required:
+ - name
+ type: object
+ x-kubernetes-validations:
+ - message: value may only be set when valueFrom is
+ INLINE
+ rule: '(has(self.valueFrom) ? self.valueFrom : "") !=
+ "HOST" || !has(self.value)'
+ maxItems: 256
+ type: array
+ x-kubernetes-list-map-keys:
+ - name
+ x-kubernetes-list-type: map
+ type: object
+ required:
+ - url
+ type: object
+ type: object
+ x-kubernetes-validations:
+ - message: only one of targetRefs or selector can be set
+ rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0)
+ <= 1'
+ - message: exactly one of wasm or lua must be set
+ rule: has(self.wasm) != has(self.lua)
+ status:
+ properties:
+ conditions:
+ description: Current service state of the resource.
+ items:
+ properties:
+ lastProbeTime:
+ description: Last time we probed the condition.
+ format: date-time
+ type: string
+ lastTransitionTime:
+ description: Last time the condition transitioned from one
+ status to another.
+ format: date-time
+ type: string
+ message:
+ description: Human-readable message indicating details
+ about last transition.
+ type: string
+ observedGeneration:
+ anyOf:
+ - type: integer
+ - type: string
+ description: Resource Generation to which the Condition
+ refers.
+ x-kubernetes-int-or-string: true
+ reason:
+ description: Unique, one-word, CamelCase reason for the
+ condition's last transition.
+ type: string
+ status:
+ description: Status is the status of the condition.
+ type: string
+ type:
+ description: Type is the type of the condition.
+ type: string
+ type: object
+ type: array
+ observedGeneration:
+ anyOf:
+ - type: integer
+ - type: string
+ x-kubernetes-int-or-string: true
+ validationMessages:
+ description: Includes any errors or warnings detected by Istio's
+ analyzers.
+ items:
+ properties:
+ documentationUrl:
+ description: A url pointing to the Istio documentation for
+ this specific error type.
+ type: string
+ level:
+ description: |-
+ Represents how severe a message is.
+
+ Valid Options: UNKNOWN, ERROR, WARNING, INFO
+ enum:
+ - UNKNOWN
+ - ERROR
+ - WARNING
+ - INFO
+ type: string
+ type:
+ properties:
+ code:
+ description: A 7 character code matching
+ `^IST[0-9]{4}$` intended to uniquely identify the
+ message type.
+ type: string
+ name:
+ description: A human-readable name for the message
+ type.
+ type: string
+ type: object
+ type: object
+ type: array
+ type: object
+ x-kubernetes-preserve-unknown-fields: true
+ required:
+ - spec
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ helm.sh/resource-policy: keep
+ labels:
+ app.kubernetes.io/instance: istio
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/part-of: istio
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: virtualservices.networking.istio.io
spec:
group: networking.istio.io
@@ -16694,8 +17098,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: wasmplugins.extensions.istio.io
spec:
group: extensions.istio.io
@@ -17067,8 +17471,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: workloadentries.networking.istio.io
spec:
group: networking.istio.io
@@ -17593,8 +17997,8 @@ metadata:
app.kubernetes.io/instance: istio
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
name: workloadgroups.networking.istio.io
spec:
group: networking.istio.io
diff --git a/common/istio/istio-install/base/install.yaml b/common/istio/istio-install/base/install.yaml
index 6b48932dc4..12a9a6fece 100644
--- a/common/istio/istio-install/base/install.yaml
+++ b/common/istio/istio-install/base/install.yaml
@@ -7,8 +7,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Cni
@@ -25,8 +25,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: ingressgateway
istio.io/rev: default
@@ -44,8 +44,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-reader
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: base-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: base-1.30.0
release: istio
name: istio-reader-service-account
namespace: istio-system
@@ -59,8 +59,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istiod
namespace: istio-system
@@ -74,8 +74,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Cni
@@ -102,8 +102,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Cni
@@ -135,8 +135,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-reader
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istio-reader-clusterrole-istio-system
rules:
@@ -250,8 +250,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istiod-clusterrole-istio-system
rules:
@@ -415,7 +415,6 @@ rules:
- gateway.networking.x-k8s.io
resources:
- xbackendtrafficpolicies/status
- - xlistenersets/status
verbs:
- update
- patch
@@ -431,6 +430,7 @@ rules:
- tcproutes/status
- tlsroutes/status
- udproutes/status
+ - listenersets/status
verbs:
- update
- patch
@@ -494,8 +494,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istiod-gateway-controller-istio-system
rules:
@@ -569,8 +569,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Cni
@@ -593,8 +593,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
k8s-app: istio-cni-repair
@@ -619,8 +619,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-reader
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istio-reader-clusterrole-istio-system
roleRef:
@@ -641,8 +641,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istiod-clusterrole-istio-system
roleRef:
@@ -663,8 +663,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istiod-gateway-controller-istio-system
roleRef:
@@ -685,8 +685,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
istio: istiod
istio.io/rev: default
release: istio
@@ -745,8 +745,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Pilot
@@ -774,7 +774,7 @@ data:
AMBIENT_IPV6: 'true'
AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: 'true'
CHAINED_CNI_PLUGIN: 'true'
- CURRENT_AGENT_VERSION: 1.29.2
+ CURRENT_AGENT_VERSION: 1.30.0
ENABLE_AMBIENT_DETECTION_RETRY: 'false'
EXCLUDE_NAMESPACES: kube-system
ISTIO_OWNED_CNI_CONFIG: 'false'
@@ -794,8 +794,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Cni
@@ -1164,6 +1164,11 @@ data:
value: "{{ $value }}"
{{- end }}
{{- end }}
+ {{- $otelResAttrs := otelResourceAttributes .MeshConfig .ObjectMeta.Annotations .ObjectMeta.Labels .DeploymentMeta.Namespace .Spec.Containers }}
+ {{- if $otelResAttrs }}
+ - name: OTEL_RESOURCE_ATTRIBUTES
+ value: "{{ $otelResAttrs }}"
+ {{- end }}
{{- range $key, $value := .ProxyConfig.ProxyMetadata }}
- name: {{ $key }}
value: "{{ $value }}"
@@ -3015,6 +3020,12 @@ data:
{{- end }}
- name: XDS_ADDRESS
value: {{ .ProxyConfig.DiscoveryAddress | quote }}
+ - name: CA_ADDRESS
+ {{- if .Values.global.caAddress }}
+ value: {{ .Values.global.caAddress }}
+ {{- else }}
+ value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012
+ {{- end }}
startupProbe:
failureThreshold: 30
httpGet:
@@ -3039,19 +3050,30 @@ data:
- mountPath: /var/run/secrets/xds
name: istiod-ca-cert
- mountPath: /var/run/secrets/xds-tokens
- name: istio-token
+ name: xds-token
- mountPath: /tmp
name: tmp
+ - mountPath: /var/run/secrets/istio
+ name: istiod-ca-cert
+ - mountPath: /var/run/secrets/tokens
+ name: istio-token
volumes:
- emptyDir: {}
name: tmp
- - name: istio-token
+ - name: xds-token
projected:
sources:
- serviceAccountToken:
path: xds-token
expirationSeconds: 43200
audience: {{ .Values.global.sds.token.aud }}
+ - name: istio-token
+ projected:
+ sources:
+ - serviceAccountToken:
+ path: istio-token
+ expirationSeconds: 43200
+ audience: {{ .Values.global.sds.token.aud }}
{{- if eq .Values.global.pilotCertProvider "istiod" }}
- name: istiod-ca-cert
{{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }}
@@ -3254,7 +3276,7 @@ data:
"sts": {
"servicePort": 0
},
- "tag": "1.29.2",
+ "tag": "1.30.0",
"variant": "",
"waypoint": {
"affinity": {},
@@ -3299,8 +3321,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Pilot
@@ -3437,7 +3459,7 @@ data:
"sts": {
"servicePort": 0
},
- "tag": "1.29.2",
+ "tag": "1.30.0",
"variant": "",
"waypoint": {
"affinity": {},
@@ -3561,7 +3583,7 @@ data:
"configValidation": true,
"hub": "registry.istio.io/release",
"istioNamespace": "istio-system",
- "tag": "1.29.2"
+ "tag": "1.30.0"
},
"meshConfig": {
"tcpKeepalive": {
@@ -3591,8 +3613,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Pilot
@@ -3609,8 +3631,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Pilot
@@ -3766,8 +3788,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
k8s-app: istio-cni-node
@@ -3792,8 +3814,8 @@ spec:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-cni
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: cni-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: cni-1.30.0
istio.io/dataplane-mode: none
k8s-app: istio-cni-node
sidecar.istio.io/inject: 'false'
@@ -3840,7 +3862,7 @@ spec:
envFrom:
- configMapRef:
name: istio-cni-config
- image: registry.istio.io/release/install-cni:1.29.2
+ image: registry.istio.io/release/install-cni:1.30.0
name: install-cni
ports:
- containerPort: 15014
@@ -3922,8 +3944,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: ingressgateway
istio.io/dataplane-mode: none
@@ -3955,9 +3977,9 @@ spec:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
+ app.kubernetes.io/version: 1.30.0
chart: gateways
- helm.sh/chart: istio-ingress-1.29.2
+ helm.sh/chart: istio-ingress-1.30.0
heritage: Tiller
install.operator.istio.io/owning-resource: unknown
istio: ingressgateway
@@ -4038,7 +4060,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
- image: registry.istio.io/release/proxyv2:1.29.2
+ image: registry.istio.io/release/proxyv2:1.30.0
name: istio-proxy
ports:
- containerPort: 15021
@@ -4157,8 +4179,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: pilot
istio.io/rev: default
@@ -4186,8 +4208,8 @@ spec:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: pilot
istio.io/dataplane-mode: none
@@ -4243,7 +4265,7 @@ spec:
resource: limits.cpu
- name: PLATFORM
value: ''
- image: registry.istio.io/release/pilot:1.29.2
+ image: registry.istio.io/release/pilot:1.30.0
name: discovery
ports:
- containerPort: 8080
@@ -4338,8 +4360,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: IngressGateways
@@ -4365,8 +4387,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istiod
namespace: istio-system
@@ -4412,8 +4434,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: IngressGateways
@@ -4437,8 +4459,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
release: istio
name: istiod
namespace: istio-system
@@ -4460,8 +4482,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: ingressgateway
istio.io/rev: default
@@ -4493,8 +4515,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: Pilot
@@ -4526,8 +4548,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istio-ingress-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istio-ingress-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: ingressgateway
istio.io/rev: default
@@ -4563,8 +4585,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istiod
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: istiod-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: istiod-1.30.0
install.operator.istio.io/owning-resource: unknown
istio: pilot
istio.io/rev: default
diff --git a/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml b/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml
index ab3254cd4a..c6611514e9 100644
--- a/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml
+++ b/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml
@@ -113,7 +113,7 @@ data:
"sts": {
"servicePort": 0
},
- "tag": "1.29.2",
+ "tag": "1.30.0",
"variant": "",
"waypoint": {
"affinity": {},
diff --git a/common/istio/istio-install/components/ambient-mode/ztunnel.yaml b/common/istio/istio-install/components/ambient-mode/ztunnel.yaml
index fb94200620..be028c8534 100644
--- a/common/istio/istio-install/components/ambient-mode/ztunnel.yaml
+++ b/common/istio/istio-install/components/ambient-mode/ztunnel.yaml
@@ -7,8 +7,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: ztunnel
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: ztunnel-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: ztunnel-1.30.0
name: ztunnel
namespace: istio-system
---
@@ -21,8 +21,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: ztunnel
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: ztunnel-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: ztunnel-1.30.0
name: ztunnel
namespace: istio-system
spec:
@@ -41,8 +41,8 @@ spec:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: ztunnel
app.kubernetes.io/part-of: istio
- app.kubernetes.io/version: 1.29.2
- helm.sh/chart: ztunnel-1.29.2
+ app.kubernetes.io/version: 1.30.0
+ helm.sh/chart: ztunnel-1.30.0
istio.io/dataplane-mode: none
sidecar.istio.io/inject: 'false'
spec:
@@ -90,7 +90,7 @@ spec:
resourceFieldRef:
divisor: '1'
resource: limits.cpu
- image: registry.istio.io/release/ztunnel:1.29.2
+ image: registry.istio.io/release/ztunnel:1.30.0
name: istio-proxy
ports:
- containerPort: 15020
diff --git a/common/istio/istio-install/overlays/insecure/configmap-patch.yaml b/common/istio/istio-install/overlays/insecure/configmap-patch.yaml
index 00b67e9a52..375b6d7112 100644
--- a/common/istio/istio-install/overlays/insecure/configmap-patch.yaml
+++ b/common/istio/istio-install/overlays/insecure/configmap-patch.yaml
@@ -79,7 +79,7 @@ data:
aud: istio-ca
sts:
servicePort: 0
- tag: "1.29.2"
+ tag: "1.30.0-rc.0"
variant: ""
waypoint:
affinity: {}
diff --git a/common/istio/profile.yaml b/common/istio/profile.yaml
index 4cdb25f13f..52c40dfab4 100644
--- a/common/istio/profile.yaml
+++ b/common/istio/profile.yaml
@@ -18,7 +18,7 @@ spec:
value: "true"
hub: registry.istio.io/release
profile: default
- tag: 1.29.2
+ tag: 1.30.0
values:
defaultRevision: ""
gateways:
diff --git a/scripts/synchronize-istio-manifests.sh b/scripts/synchronize-istio-manifests.sh
index 4ffd4204dc..4bd9f0cd6d 100755
--- a/scripts/synchronize-istio-manifests.sh
+++ b/scripts/synchronize-istio-manifests.sh
@@ -5,8 +5,12 @@ source "${SCRIPT_DIRECTORY}/library.sh"
setup_error_handling
COMPONENT_NAME="istio"
REPOSITORY_NAME="istio/istio"
-COMMIT="1.29.2"
-PREVIOUS_COMMIT="1.29.1"
+COMMIT="1.30.0"
+PREVIOUS_COMMIT="1.29.2"
+if [[ "${COMMIT}" =~ -(rc|beta|alpha)([.-]|$) ]]; then
+ echo "Refusing to synchronize pre-release Istio version: ${COMMIT}. Pin COMMIT to a stable GA release tag."
+ exit 1
+fi
SOURCE_DIRECTORY=${SOURCE_DIRECTORY:=/tmp/kubeflow-${COMPONENT_NAME}}
BRANCH_NAME=${BRANCH_NAME:=synchronize-${COMPONENT_NAME}-manifests-${COMMIT?}}
MANIFESTS_DIRECTORY=$(dirname $SCRIPT_DIRECTORY)
@@ -15,12 +19,22 @@ create_branch "$BRANCH_NAME"
mkdir -p "$SOURCE_DIRECTORY"
cd "$SOURCE_DIRECTORY"
if [ ! -d "istio-${COMMIT}" ]; then
- wget "https://github.com/${REPOSITORY_NAME}/releases/download/${COMMIT}/istio-${COMMIT}-linux-amd64.tar.gz"
- tar xvfz istio-${COMMIT}-linux-amd64.tar.gz
+ OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+ ARCH=$(uname -m)
+ if [ "$ARCH" = "x86_64" ]; then
+ ARCH="amd64"
+ elif [ "$ARCH" = "aarch64" ]; then
+ ARCH="arm64"
+ fi
+ if [ "$OS" = "darwin" ]; then
+ OS="osx"
+ fi
+ curl -L -O "https://github.com/${REPOSITORY_NAME}/releases/download/${COMMIT}/istio-${COMMIT}-${OS}-${ARCH}.tar.gz"
+ tar xvfz "istio-${COMMIT}-${OS}-${ARCH}.tar.gz"
fi
ISTIOCTL="${SOURCE_DIRECTORY}/istio-${COMMIT}/bin/istioctl"
cd "$ISTIO_DIRECTORY"
-sed -i "s/tag: .*/tag: $COMMIT/" "$ISTIO_DIRECTORY/profile.yaml"
+perl -pi -e "s/tag: .*/tag: $COMMIT/" "$ISTIO_DIRECTORY/profile.yaml"
$ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \
--set components.cni.enabled=true \
--set components.cni.namespace=kube-system > dump.yaml
@@ -35,12 +49,11 @@ $ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \
./split-istio-packages -f dump-ztunnel.yaml
mv $ISTIO_DIRECTORY/ztunnel.yaml $ISTIO_DIRECTORY/istio-install/components/ambient-mode/
rm dump-ztunnel.yaml crd.yaml install.yaml cluster-local-gateway.yaml
-sed -i "s/\"tag\": \".*\"/\"tag\": \"$COMMIT\"/" "$ISTIO_DIRECTORY/istio-install/base/patches/istio-sidecar-injector-patch.yaml"
+perl -pi -e "s/\"tag\": \".*\"/\"tag\": \"$COMMIT\"/" "$ISTIO_DIRECTORY/istio-install/base/patches/istio-sidecar-injector-patch.yaml"
# Normalize all remaining Istio version references from PREVIOUS_COMMIT to COMMIT.
# This catches any version strings that istioctl generates using the previous release
# (e.g. image tags, helm chart labels). Update PREVIOUS_COMMIT when bumping COMMIT.
-find "$ISTIO_DIRECTORY" -name "*.yaml" | xargs sed -i \
- -e "s/${PREVIOUS_COMMIT}/$COMMIT/g"
+find "$ISTIO_DIRECTORY" -name "*.yaml" | xargs perl -pi -e "s/${PREVIOUS_COMMIT}/$COMMIT/g"
SOURCE_TEXT="\[.*\](https://github.com/${REPOSITORY_NAME}/releases/tag/.*)"
DESTINATION_TEXT="\[$COMMIT\](https://github.com/${REPOSITORY_NAME}/releases/tag/$COMMIT)"
update_readme "$MANIFESTS_DIRECTORY" "$SOURCE_TEXT" "$DESTINATION_TEXT"
diff --git a/tests/istio_dummy_deployment.yaml b/tests/istio_dummy_deployment.yaml
index 310dc6d0f9..0811ab8b90 100644
--- a/tests/istio_dummy_deployment.yaml
+++ b/tests/istio_dummy_deployment.yaml
@@ -13,37 +13,14 @@ spec:
app: test-application
spec:
securityContext:
+ runAsNonRoot: true
+ runAsUser: 101
seccompProfile:
type: RuntimeDefault
containers:
- name: nginx
- image: nginx:alpine
- ports:
- - containerPort: 8080
- command: ["/bin/sh", "-c"]
- args:
- - |
- cat > /tmp/nginx.conf << 'EOF'
- pid /tmp/nginx.pid;
- events {}
- http {
- client_body_temp_path /tmp/client_temp;
- proxy_temp_path /tmp/proxy_temp;
- fastcgi_temp_path /tmp/fastcgi_temp;
- uwsgi_temp_path /tmp/uwsgi_temp;
- scgi_temp_path /tmp/scgi_temp;
- server {
- listen 8080;
- location / { return 200 'Hello from test application\n'; }
- }
- }
- EOF
- nginx -c /tmp/nginx.conf -g 'daemon off;'
+ image: nginxinc/nginx-unprivileged:latest
securityContext:
- runAsNonRoot: true
- runAsUser: 101
allowPrivilegeEscalation: false
- readOnlyRootFilesystem: false
capabilities:
- drop:
- - ALL
+ drop: ["ALL"]
diff --git a/tests/katib_install.sh b/tests/katib_install.sh
index 3fd7ec3c0b..6b9f03a889 100755
--- a/tests/katib_install.sh
+++ b/tests/katib_install.sh
@@ -1,7 +1,7 @@
#!/bin/bash
set -euxo pipefail
-cd applications/katib/upstream && kustomize build installs/katib-with-kubeflow | kubectl apply -f - && cd ../../../
+cd applications/katib && kustomize build overlays/katib-with-kubeflow | kubectl apply -f - && cd ../../
kubectl wait --for=condition=Available deployment/katib-controller -n kubeflow --timeout=300s
diff --git a/tests/katib_test.yaml b/tests/katib_test.yaml
index e369c5f559..93e41632cc 100644
--- a/tests/katib_test.yaml
+++ b/tests/katib_test.yaml
@@ -44,9 +44,26 @@ spec:
annotations:
sidecar.istio.io/inject: "false"
spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
containers:
- name: training-container
image: ghcr.io/kubeflow/katib/pytorch-mnist-cpu:v0.19.0
+ # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+ # (read-only root fs in base image). Safe for short-running stateless test pods.
+ workingDir: /tmp
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
command:
- "python3"
- "/opt/pytorch-mnist/mnist.py"
diff --git a/tests/kubeflow_profile_install.sh b/tests/kubeflow_profile_install.sh
index 4176836970..1193d47bc7 100755
--- a/tests/kubeflow_profile_install.sh
+++ b/tests/kubeflow_profile_install.sh
@@ -6,4 +6,11 @@ PROFILE_CONTROLLER_POD=$(kubectl get pods -n kubeflow -o json | jq -r '.items[]
kubectl logs -n kubeflow "$PROFILE_CONTROLLER_POD"
KF_PROFILE=kubeflow-user-example-com
kubectl -n $KF_PROFILE get pods,configmaps,secrets
-kubectl label namespace $KF_PROFILE pod-security.kubernetes.io/enforce=baseline --overwrite
+# Verify that the PSS label is indeed applied natively (either restricted or privileged for insecure mode)
+LABEL=$(kubectl get ns $KF_PROFILE \
+ -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/enforce}')
+if [ "$LABEL" != "restricted" ] && [ "$LABEL" != "privileged" ]; then
+ echo "ERROR: Namespace is not labeled restricted or privileged natively (got: $LABEL)"
+ exit 1
+fi
+echo "Namespace is successfully labeled $LABEL natively!"
diff --git a/tests/notebook.test.kubeflow-user-example.com.yaml b/tests/notebook.test.kubeflow-user-example.com.yaml
index efc6aeec33..6a16b8ccf6 100644
--- a/tests/notebook.test.kubeflow-user-example.com.yaml
+++ b/tests/notebook.test.kubeflow-user-example.com.yaml
@@ -13,9 +13,20 @@ metadata:
spec:
template:
spec:
+ securityContext:
+ fsGroup: 100
+ runAsNonRoot: true
+ seccompProfile:
+ type: RuntimeDefault
containers:
- name: test
image: ghcr.io/kubeflow/kubeflow/notebook-servers/jupyter-scipy:v1.10.0
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
imagePullPolicy: IfNotPresent
resources:
limits:
diff --git a/tests/profile_controller_install.sh b/tests/profile_controller_install.sh
index 6257301309..c4183a08bf 100755
--- a/tests/profile_controller_install.sh
+++ b/tests/profile_controller_install.sh
@@ -6,3 +6,22 @@ kustomize build applications/dashboard/upstream/profile-controller/overlays/kube
kubectl -n kubeflow rollout status deployment/profiles-deployment --timeout=180s
kubectl -n kubeflow wait --for=condition=Ready pods -l app=profile-controller --timeout=180s
kubectl wait --for=condition=Established --timeout=60s crd/profiles.kubeflow.org
+
+# Patch Profiles namespace labels config to enforce restricted instead of baseline in CI.
+# We use standard json patching to dynamically rewrite the embedded namespace-labels.yaml file
+# inside the ConfigMap.
+# Since Kustomize appends a dynamic hash suffix to the ConfigMap name, we query the exact name first.
+CONFIGMAP_NAME=$(kubectl -n kubeflow get configmaps -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^profiles-namespace-labels-data-' | head -n 1)
+if [ -z "$CONFIGMAP_NAME" ]; then
+ echo "ERROR: Could not find configmap profiles-namespace-labels-data with hash suffix"
+ exit 1
+fi
+
+kubectl patch configmap "$CONFIGMAP_NAME" -n kubeflow --type=json \
+ -p='[{"op": "replace", "path": "/data/namespace-labels.yaml", "value": "app.kubernetes.io/part-of: \"kubeflow-profile\"\nkatib.kubeflow.org/metrics-collector-injection: \"enabled\"\npipelines.kubeflow.org/enabled: \"true\"\nserving.kubeflow.org/inferenceservice: \"enabled\"\npod-security.kubernetes.io/enforce: \"restricted\"\npod-security.kubernetes.io/enforce-version: \"v1.29\"\n"}]'
+
+# Restart profiles deployment to pick up the updated ConfigMap immediately
+kubectl rollout restart deployment/profiles-deployment -n kubeflow
+kubectl rollout status deployment/profiles-deployment -n kubeflow --timeout=120s
+
+
diff --git a/tests/trainer_install.sh b/tests/trainer_install.sh
index e6bbfa8910..c6d221f487 100755
--- a/tests/trainer_install.sh
+++ b/tests/trainer_install.sh
@@ -12,7 +12,8 @@ kubectl wait --for=condition=Available deployment/kubeflow-trainer-controller-ma
kubectl get crd jobsets.jobset.x-k8s.io
kubectl wait --for=condition=Available deployment/jobset-controller-manager -n kubeflow-system --timeout=120s
-kustomize build upstream/overlays/runtimes | kubectl apply --server-side --force-conflicts -f -
+kustomize build overlays/runtimes | kubectl apply --server-side --force-conflicts -f -
+kubectl patch clustertrainingruntime torch-distributed --type='json' -p='[{"op": "add", "path": "/spec/template/spec/replicatedJobs/0/template/metadata", "value": {"labels": {"trainer.kubeflow.org/trainjob-ancestor-step": "trainer"}}}, {"op": "add", "path": "/spec/template/spec/replicatedJobs/0/template/spec/template/spec/containers/0/image", "value": "pytorch/pytorch:2.10.0-cuda12.8-cudnn9-runtime"}]'
kubectl apply -f upstream/overlays/kubeflow-platform/kubeflow-trainer-roles.yaml
diff --git a/tests/training_operator_job.yaml b/tests/training_operator_job.yaml
index 341db77599..23925a2fab 100644
--- a/tests/training_operator_job.yaml
+++ b/tests/training_operator_job.yaml
@@ -14,10 +14,27 @@ spec:
labels:
sidecar.istio.io/inject: "false"
spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
containers:
- name: pytorch
image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
imagePullPolicy: Always
+ # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+ # (read-only root fs in base image). Safe for short-running stateless test pods.
+ workingDir: /tmp
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
command:
- "python3"
- "/opt/pytorch-mnist/mnist.py"
@@ -53,10 +70,44 @@ spec:
labels:
sidecar.istio.io/inject: "false"
spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ initContainers:
+ # Use reproducible, pinned stable busybox image for network probe
+ - name: init-pytorch
+ image: busybox:1.36.1
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ command:
+ - sh
+ - -c
+ - until nslookup pytorch-simple-master-0; do echo waiting for master; sleep 2; done;
containers:
- name: pytorch
image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
imagePullPolicy: Always
+ # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+ # (read-only root fs in base image). Safe for short-running stateless test pods.
+ workingDir: /tmp
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
command:
- "python3"
- "/opt/pytorch-mnist/mnist.py"
diff --git a/tests/workspaces-kustomization/jupyterlab_workspacekind_patch.yaml b/tests/workspaces-kustomization/jupyterlab_workspacekind_patch.yaml
new file mode 100644
index 0000000000..1ec56bc8fb
--- /dev/null
+++ b/tests/workspaces-kustomization/jupyterlab_workspacekind_patch.yaml
@@ -0,0 +1,21 @@
+apiVersion: kubeflow.org/v1beta1
+kind: WorkspaceKind
+metadata:
+ name: jupyterlab
+spec:
+ podTemplate:
+ securityContext:
+ fsGroup: 100
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ containerSecurityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
diff --git a/tests/workspaces-kustomization/kustomization.yaml b/tests/workspaces-kustomization/kustomization.yaml
new file mode 100644
index 0000000000..1589071275
--- /dev/null
+++ b/tests/workspaces-kustomization/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml
+patches:
+- path: jupyterlab_workspacekind_patch.yaml
diff --git a/tests/workspaces_pipeline_run_test.sh b/tests/workspaces_pipeline_run_test.sh
index d69d9f572b..83312e92c0 100755
--- a/tests/workspaces_pipeline_run_test.sh
+++ b/tests/workspaces_pipeline_run_test.sh
@@ -3,7 +3,8 @@ set -euxo pipefail
KF_PROFILE=${1:-kubeflow-user-example-com}
-kubectl apply -f applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml
+kustomize build --load-restrictor LoadRestrictionsNone tests/workspaces-kustomization | kubectl apply -f -
+sleep 15 # Wait for Notebook Controller to sync the new WorkspaceKind definition
kubectl apply -f tests/workspace.test.kubeflow-user-example-com.yaml
kubectl wait --for=jsonpath='{.status.state}'=Running \
workspace/test -n "${KF_PROFILE}" \