diff --git a/.github/workflows/dex_oauth2-proxy_test.yaml b/.github/workflows/dex_oauth2-proxy_test.yaml index 08e8263cb6..4e7c976cee 100644 --- a/.github/workflows/dex_oauth2-proxy_test.yaml +++ b/.github/workflows/dex_oauth2-proxy_test.yaml @@ -7,7 +7,8 @@ on: - common/cert-manager/** - common/oauth2-proxy/** - common/istio*/** - - experimental/security/PSS/* + - tests/kubeflow_profile_install.sh + - tests/PSS_enable.sh - common/dex/base/** - tests/istio* - tests/dex_login_test.py diff --git a/.github/workflows/istio_validation.yaml b/.github/workflows/istio_validation.yaml index da0ad0d909..ac68145149 100644 --- a/.github/workflows/istio_validation.yaml +++ b/.github/workflows/istio_validation.yaml @@ -252,7 +252,8 @@ jobs: - name: Test basic connectivity run: | kubectl expose deployment test-application --port=80 --target-port=8080 -n $KF_PROFILE - kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE -- \ + kubectl run test-client --image=busybox:1.36.1 --rm -i --restart=Never -n $KF_PROFILE \ + --overrides='{"spec": {"securityContext": {"runAsNonRoot": true, "runAsUser": 1000, "seccompProfile": {"type": "RuntimeDefault"}}, "containers": [{"name": "test-client", "image": "busybox:1.36.1", "stdin": true, "tty": true, "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsNonRoot": true, "runAsUser": 1000, "seccompProfile": {"type": "RuntimeDefault"}}}]}}' -- \ wget -qO- --timeout=10 test-application.$KF_PROFILE.svc.cluster.local - name: Apply Pod Security Standards Restricted levels diff --git a/.github/workflows/katib_test.yaml b/.github/workflows/katib_test.yaml index 9ff00c4d3a..77b1232ad1 100644 --- a/.github/workflows/katib_test.yaml +++ b/.github/workflows/katib_test.yaml @@ -3,7 +3,7 @@ on: pull_request: paths: - tests/install_KinD_create_KinD_cluster_install_kustomize.sh - - tests/katib_install.sh + - tests/katib* - .github/workflows/katib_test.yaml - applications/katib/upstream/** - common/istio*/** @@ -12,7 +12,8 @@ on: - tests/profile_controller_install.sh - applications/dashboard/upstream/profile-controller/** - common/cert-manager/** - - experimental/security/PSS/* + - tests/kubeflow_profile_install.sh + - tests/PSS_enable.sh permissions: contents: read diff --git a/.github/workflows/pipeline_run_from_notebook.yaml b/.github/workflows/pipeline_run_from_notebook.yaml index 8ffa22f219..573cdf151d 100644 --- a/.github/workflows/pipeline_run_from_notebook.yaml +++ b/.github/workflows/pipeline_run_from_notebook.yaml @@ -14,6 +14,9 @@ on: - common/cert-manager/** - common/oauth2-proxy/** - common/istio*/** + - tests/pipeline* + - tests/kubeflow_profile_install.sh + - tests/PSS_enable.sh - common/kubeflow-namespace/** permissions: diff --git a/.github/workflows/pipeline_test.yaml b/.github/workflows/pipeline_test.yaml index 8111f7b6c4..df1a7ed34e 100644 --- a/.github/workflows/pipeline_test.yaml +++ b/.github/workflows/pipeline_test.yaml @@ -13,9 +13,9 @@ on: - common/cert-manager/** - common/oauth2-proxy/** - common/istio*/** - - tests/pipeline_v1_test.py - - tests/pipeline_v2_test.py - - experimental/security/PSS/* + - tests/pipeline* + - tests/kubeflow_profile_install.sh + - tests/PSS_enable.sh permissions: contents: read diff --git a/.github/workflows/trainer_test.yaml b/.github/workflows/trainer_test.yaml index 99492409f6..34eea5121b 100644 --- a/.github/workflows/trainer_test.yaml +++ b/.github/workflows/trainer_test.yaml @@ -14,7 +14,8 @@ on: - common/cert-manager/** - common/oauth2-proxy/** - common/istio*/** - - experimental/security/PSS/* + - tests/kubeflow_profile_install.sh + - tests/PSS_enable.sh permissions: contents: read diff --git a/.github/workflows/training_operator_test.yaml b/.github/workflows/training_operator_test.yaml index 3d1b2dec3e..d2096f2666 100644 --- a/.github/workflows/training_operator_test.yaml +++ b/.github/workflows/training_operator_test.yaml @@ -14,7 +14,8 @@ on: - common/cert-manager/** - common/oauth2-proxy/** - common/istio*/** - - experimental/security/PSS/* + - tests/kubeflow_profile_install.sh + - tests/PSS_enable.sh permissions: contents: read diff --git a/README.md b/README.md index 734e524b46..e4c33ab051 100644 --- a/README.md +++ b/README.md @@ -79,12 +79,15 @@ This repository periodically synchronizes all official Kubeflow components from | Kubeflow Pipelines | applications/pipeline/upstream | [2.16.1](https://github.com/kubeflow/pipelines/tree/2.16.1/manifests/kustomize) | 970m | 3552Mi | 35GB | | Kubeflow Hub | applications/hub/upstream | [v0.3.9](https://github.com/kubeflow/hub/tree/v0.3.9/manifests/kustomize) | 510m | 2112Mi | 20GB | | Spark Operator | applications/spark/spark-operator | [2.5.0](https://github.com/kubeflow/spark-operator/tree/v2.5.0) | 9m | 41Mi | 0GB | -| Istio | common/istio | [1.29.2](https://github.com/istio/istio/releases/tag/1.29.2) | 750m | 2364Mi | 0GB | +| Istio | common/istio | [1.30.0](https://github.com/istio/istio/releases/tag/1.30.0) | 750m | 2364Mi | 0GB | | Knative | common/knative/knative-serving
common/knative/knative-eventing | [v1.21.1](https://github.com/knative/serving/releases/tag/knative-v1.21.1)
[v1.21.0](https://github.com/knative/eventing/releases/tag/knative-v1.21.0) | 1450m | 1038Mi | 0GB | | Cert Manager | common/cert-manager | [1.19.4](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.4) | 3m | 128Mi | 0GB | | Dex | common/dex | [2.45.0](https://github.com/dexidp/dex/releases/tag/v2.45.0) | 3m | 27Mi | 0GB | | OAuth2-Proxy | common/oauth2-proxy | [7.14.3](https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.14.3) | 3m | 27Mi | 0GB | -| **Total** | | | **4380m** | **12341Mi** | **65GB** | +| **Total** | | | **4380m** | **12341Mi** | **65GB** | + +> **Note on Istio Version:** Istio 1.30+ is required for PSS Restricted namespace compatibility. The istio-proxy sidecar in 1.29.x does not meet restricted PSS requirements (missing seccompProfile, non-zero UID in some modes). Do not downgrade. + diff --git a/applications/katib/overlays/katib-with-kubeflow/katib-config.yaml b/applications/katib/overlays/katib-with-kubeflow/katib-config.yaml new file mode 100644 index 0000000000..35b3ba86d8 --- /dev/null +++ b/applications/katib/overlays/katib-with-kubeflow/katib-config.yaml @@ -0,0 +1,62 @@ +# Katib Config patch to enable PSS compliance. +# injectSecurityContext: true clones securityContext properties from primary +# trial containers to sidecar metrics-collectors, preventing admission blocks. +apiVersion: config.kubeflow.org/v1beta1 +kind: KatibConfig +init: + controller: + webhookPort: 8443 + injectSecurityContext: true + trialResources: + - TrainJob.v1alpha1.trainer.kubeflow.org + - Job.v1.batch + - TFJob.v1.kubeflow.org + - PyTorchJob.v1.kubeflow.org + - MPIJob.v1.kubeflow.org + - XGBoostJob.v1.kubeflow.org +runtime: + metricsCollectors: + - kind: StdOut + image: ghcr.io/kubeflow/katib/file-metrics-collector:v0.19.0 + - kind: File + image: ghcr.io/kubeflow/katib/file-metrics-collector:v0.19.0 + - kind: TensorFlowEvent + image: ghcr.io/kubeflow/katib/tfevent-metrics-collector:v0.19.0 + resources: + limits: + memory: 1Gi + suggestions: + - algorithmName: random + image: ghcr.io/kubeflow/katib/suggestion-hyperopt:v0.19.0 + - algorithmName: tpe + image: ghcr.io/kubeflow/katib/suggestion-hyperopt:v0.19.0 + - algorithmName: grid + image: ghcr.io/kubeflow/katib/suggestion-optuna:v0.19.0 + - algorithmName: hyperband + image: ghcr.io/kubeflow/katib/suggestion-hyperband:v0.19.0 + - algorithmName: bayesianoptimization + image: ghcr.io/kubeflow/katib/suggestion-skopt:v0.19.0 + - algorithmName: cmaes + image: ghcr.io/kubeflow/katib/suggestion-goptuna:v0.19.0 + - algorithmName: sobol + image: ghcr.io/kubeflow/katib/suggestion-goptuna:v0.19.0 + - algorithmName: multivariate-tpe + image: ghcr.io/kubeflow/katib/suggestion-optuna:v0.19.0 + - algorithmName: enas + image: ghcr.io/kubeflow/katib/suggestion-enas:v0.19.0 + resources: + limits: + memory: 400Mi + - algorithmName: darts + image: ghcr.io/kubeflow/katib/suggestion-darts:v0.19.0 + - algorithmName: pbt + image: ghcr.io/kubeflow/katib/suggestion-pbt:v0.19.0 + persistentVolumeClaimSpec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 5Gi + earlyStoppings: + - algorithmName: medianstop + image: ghcr.io/kubeflow/katib/earlystopping-medianstop:v0.19.0 diff --git a/applications/katib/overlays/katib-with-kubeflow/kustomization.yaml b/applications/katib/overlays/katib-with-kubeflow/kustomization.yaml new file mode 100644 index 0000000000..d0df896f53 --- /dev/null +++ b/applications/katib/overlays/katib-with-kubeflow/kustomization.yaml @@ -0,0 +1,11 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../upstream/installs/katib-with-kubeflow +configMapGenerator: +- behavior: merge + files: + - katib-config.yaml + name: katib-config + options: + disableNameSuffixHash: true diff --git a/applications/trainer/overlays/runtimes/kustomization.yaml b/applications/trainer/overlays/runtimes/kustomization.yaml new file mode 100644 index 0000000000..fb213d2a43 --- /dev/null +++ b/applications/trainer/overlays/runtimes/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../upstream/overlays/runtimes +patches: +- path: torch_distributed_patch.yaml diff --git a/applications/trainer/overlays/runtimes/torch_distributed_patch.yaml b/applications/trainer/overlays/runtimes/torch_distributed_patch.yaml new file mode 100644 index 0000000000..43311dfbff --- /dev/null +++ b/applications/trainer/overlays/runtimes/torch_distributed_patch.yaml @@ -0,0 +1,32 @@ +apiVersion: trainer.kubeflow.org/v1alpha1 +kind: ClusterTrainingRuntime +metadata: + name: torch-distributed +spec: + template: + spec: + replicatedJobs: + - name: node + template: + spec: + template: + spec: + securityContext: + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + containers: + - name: node + # workingDir: /tmp is used as a writable directory workaround under PSS Restricted + # (read-only root fs in base image). Safe for short-running stateless test pods. + workingDir: /tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault diff --git a/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml b/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml index 819d192842..0b2945c171 100644 --- a/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml +++ b/common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/rev: default @@ -26,8 +26,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/dataplane-mode: none @@ -59,9 +59,9 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 + app.kubernetes.io/version: 1.30.0 chart: gateways - helm.sh/chart: istio-ingress-1.29.2 + helm.sh/chart: istio-ingress-1.30.0 heritage: Tiller install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway @@ -144,7 +144,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: registry.istio.io/release/proxyv2:1.29.2 + image: registry.istio.io/release/proxyv2:1.30.0 name: istio-proxy ports: - containerPort: 15020 @@ -260,8 +260,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -286,8 +286,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -311,8 +311,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/rev: default @@ -345,8 +345,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: cluster-local-gateway istio.io/rev: default diff --git a/common/istio/istio-crds/base/crd.yaml b/common/istio/istio-crds/base/crd.yaml index 4e9e21f5d4..47b328672b 100644 --- a/common/istio/istio-crds/base/crd.yaml +++ b/common/istio/istio-crds/base/crd.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: authorizationpolicies.security.istio.io spec: group: security.istio.io @@ -125,6 +125,11 @@ spec: type: string maxItems: 16 type: array + notTrustDomains: + description: Optional. + items: + type: string + type: array principals: description: Optional. items: @@ -147,6 +152,11 @@ spec: type: string maxItems: 16 type: array + trustDomains: + description: Optional. + items: + type: string + type: array type: object x-kubernetes-validations: - message: Cannot set serviceAccounts with @@ -506,6 +516,11 @@ spec: type: string maxItems: 16 type: array + notTrustDomains: + description: Optional. + items: + type: string + type: array principals: description: Optional. items: @@ -528,6 +543,11 @@ spec: type: string maxItems: 16 type: array + trustDomains: + description: Optional. + items: + type: string + type: array type: object x-kubernetes-validations: - message: Cannot set serviceAccounts with @@ -797,8 +817,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: destinationrules.networking.istio.io spec: group: networking.istio.io @@ -7107,8 +7127,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: envoyfilters.networking.istio.io spec: group: networking.istio.io @@ -7373,7 +7393,7 @@ spec: type: integer x-kubernetes-validations: - message: port must be between 1-65535 - rule: 0 < self && self <= 6553 + rule: 0 < self && self <= 65535 route: description: Match a specific route. properties: @@ -7581,8 +7601,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: gateways.networking.istio.io spec: group: networking.istio.io @@ -8470,8 +8490,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: peerauthentications.security.istio.io spec: group: security.istio.io @@ -8832,8 +8852,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: proxyconfigs.networking.istio.io spec: group: networking.istio.io @@ -8990,8 +9010,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: requestauthentications.security.istio.io spec: group: security.istio.io @@ -9628,8 +9648,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: serviceentries.networking.istio.io spec: group: networking.istio.io @@ -10586,8 +10606,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: sidecars.networking.istio.io spec: group: networking.istio.io @@ -12424,8 +12444,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: telemetries.telemetry.istio.io spec: group: telemetry.istio.io @@ -12780,6 +12800,12 @@ spec: type: object description: Optional. type: object + disableContextPropagation: + description: Controls whether trace context headers (e.g., + `traceparent`/`tracestate` for W3C, `X-B3-*` for Zipkin) + are propagated in forwarded requests. + nullable: true + type: boolean disableSpanReporting: description: Controls span reporting. nullable: true @@ -13258,6 +13284,12 @@ spec: type: object description: Optional. type: object + disableContextPropagation: + description: Controls whether trace context headers (e.g., + `traceparent`/`tracestate` for W3C, `X-B3-*` for Zipkin) + are propagated in forwarded requests. + nullable: true + type: boolean disableSpanReporting: description: Controls span reporting. nullable: true @@ -13408,8 +13440,380 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 + name: trafficextensions.extensions.istio.io +spec: + group: extensions.istio.io + names: + categories: + - istio-io + - extensions-istio-io + kind: TrafficExtension + listKind: TrafficExtensionList + plural: trafficextensions + singular: trafficextension + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Extend the functionality provided by the Istio proxy through + WebAssembly or Lua filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/traffic_extension.html' + oneOf: + - not: + anyOf: + - required: + - wasm + - required: + - lua + - required: + - wasm + - required: + - lua + properties: + lua: + description: Lua filter configuration. + properties: + inlineCode: + description: The inline Lua code to be executed. + maxLength: 65536 + minLength: 1 + type: string + required: + - inlineCode + type: object + match: + description: Specifies the criteria to determine which traffic + is passed to TrafficExtension. + items: + properties: + mode: + description: |- + Criteria for selecting traffic by their direction. + + Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER + enum: + - UNDEFINED + - CLIENT + - SERVER + - CLIENT_AND_SERVER + type: string + ports: + description: Criteria for selecting traffic by their + destination port. + items: + properties: + number: + maximum: 65535 + minimum: 1 + type: integer + required: + - number + type: object + type: array + x-kubernetes-list-map-keys: + - number + x-kubernetes-list-type: map + type: object + type: array + phase: + description: |- + Determines where in the filter chain this `TrafficExtension` is to be injected. + + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED + - AUTHN + - AUTHZ + - STATS + type: string + priority: + description: Determines ordering of `TrafficExtensions` in the + same `phase`. + format: int32 + nullable: true + type: integer + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set + of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: + ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently + supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + wasm: + description: WebAssembly filter configuration. + properties: + failStrategy: + description: |- + Specifies the failure behavior for the plugin due to fatal errors. + + Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD + enum: + - FAIL_CLOSE + - FAIL_OPEN + - FAIL_RELOAD + type: string + imagePullPolicy: + description: |- + The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. + + Valid Options: IfNotPresent, Always + enum: + - UNSPECIFIED_POLICY + - IfNotPresent + - Always + type: string + imagePullSecret: + description: Credentials to use for OCI image pulling. + maxLength: 253 + minLength: 1 + type: string + pluginConfig: + description: The configuration that will be passed on to the + plugin. + type: object + x-kubernetes-preserve-unknown-fields: true + pluginName: + description: The plugin name to be used in the Envoy + configuration (used to be called `rootID`). + maxLength: 256 + minLength: 1 + type: string + sha256: + description: SHA256 checksum that will be used to verify + Wasm module or OCI container. + pattern: (^$|^[a-f0-9]{64}$) + type: string + type: + description: |- + Specifies the type of Wasm Extension to be used. + + Valid Options: HTTP, NETWORK + enum: + - UNSPECIFIED_PLUGIN_TYPE + - HTTP + - NETWORK + type: string + url: + description: URL of a Wasm module or OCI container. + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have schema one of [http, https, file, + oci] + rule: |- + isURL(self) ? (url(self).getScheme() in ["", "http", "https", "file", "oci"]) : (isURL("http://" + self) && + url("http://" + self).getScheme() in ["", "http", "https", "file", "oci"]) + verificationKey: + type: string + vmConfig: + description: Configuration for a Wasm VM. + properties: + env: + description: Specifies environment variables to be + injected to this VM. + items: + properties: + name: + description: Name of the environment variable. + maxLength: 256 + minLength: 1 + type: string + value: + description: Value for the environment variable. + maxLength: 2048 + type: string + valueFrom: + description: |- + Source for the environment variable's value. + + Valid Options: INLINE, HOST + enum: + - INLINE + - HOST + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: value may only be set when valueFrom is + INLINE + rule: '(has(self.valueFrom) ? self.valueFrom : "") != + "HOST" || !has(self.value)' + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - url + type: object + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) + <= 1' + - message: exactly one of wasm or lua must be set + rule: has(self.wasm) != has(self.lua) + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details + about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition + refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the + condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's + analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for + this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching + `^IST[0-9]{4}$` intended to uniquely identify the + message type. + type: string + name: + description: A human-readable name for the message + type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: virtualservices.networking.istio.io spec: group: networking.istio.io @@ -16694,8 +17098,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: wasmplugins.extensions.istio.io spec: group: extensions.istio.io @@ -17067,8 +17471,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: workloadentries.networking.istio.io spec: group: networking.istio.io @@ -17593,8 +17997,8 @@ metadata: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 name: workloadgroups.networking.istio.io spec: group: networking.istio.io diff --git a/common/istio/istio-install/base/install.yaml b/common/istio/istio-install/base/install.yaml index 6b48932dc4..12a9a6fece 100644 --- a/common/istio/istio-install/base/install.yaml +++ b/common/istio/istio-install/base/install.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -25,8 +25,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -44,8 +44,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: base-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: base-1.30.0 release: istio name: istio-reader-service-account namespace: istio-system @@ -59,8 +59,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod namespace: istio-system @@ -74,8 +74,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -102,8 +102,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -135,8 +135,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istio-reader-clusterrole-istio-system rules: @@ -250,8 +250,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-clusterrole-istio-system rules: @@ -415,7 +415,6 @@ rules: - gateway.networking.x-k8s.io resources: - xbackendtrafficpolicies/status - - xlistenersets/status verbs: - update - patch @@ -431,6 +430,7 @@ rules: - tcproutes/status - tlsroutes/status - udproutes/status + - listenersets/status verbs: - update - patch @@ -494,8 +494,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-gateway-controller-istio-system rules: @@ -569,8 +569,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -593,8 +593,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default k8s-app: istio-cni-repair @@ -619,8 +619,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-reader app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istio-reader-clusterrole-istio-system roleRef: @@ -641,8 +641,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-clusterrole-istio-system roleRef: @@ -663,8 +663,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod-gateway-controller-istio-system roleRef: @@ -685,8 +685,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 istio: istiod istio.io/rev: default release: istio @@ -745,8 +745,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -774,7 +774,7 @@ data: AMBIENT_IPV6: 'true' AMBIENT_RECONCILE_POD_RULES_ON_STARTUP: 'true' CHAINED_CNI_PLUGIN: 'true' - CURRENT_AGENT_VERSION: 1.29.2 + CURRENT_AGENT_VERSION: 1.30.0 ENABLE_AMBIENT_DETECTION_RETRY: 'false' EXCLUDE_NAMESPACES: kube-system ISTIO_OWNED_CNI_CONFIG: 'false' @@ -794,8 +794,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Cni @@ -1164,6 +1164,11 @@ data: value: "{{ $value }}" {{- end }} {{- end }} + {{- $otelResAttrs := otelResourceAttributes .MeshConfig .ObjectMeta.Annotations .ObjectMeta.Labels .DeploymentMeta.Namespace .Spec.Containers }} + {{- if $otelResAttrs }} + - name: OTEL_RESOURCE_ATTRIBUTES + value: "{{ $otelResAttrs }}" + {{- end }} {{- range $key, $value := .ProxyConfig.ProxyMetadata }} - name: {{ $key }} value: "{{ $value }}" @@ -3015,6 +3020,12 @@ data: {{- end }} - name: XDS_ADDRESS value: {{ .ProxyConfig.DiscoveryAddress | quote }} + - name: CA_ADDRESS + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} startupProbe: failureThreshold: 30 httpGet: @@ -3039,19 +3050,30 @@ data: - mountPath: /var/run/secrets/xds name: istiod-ca-cert - mountPath: /var/run/secrets/xds-tokens - name: istio-token + name: xds-token - mountPath: /tmp name: tmp + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + - mountPath: /var/run/secrets/tokens + name: istio-token volumes: - emptyDir: {} name: tmp - - name: istio-token + - name: xds-token projected: sources: - serviceAccountToken: path: xds-token expirationSeconds: 43200 audience: {{ .Values.global.sds.token.aud }} + - name: istio-token + projected: + sources: + - serviceAccountToken: + path: istio-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} {{- if eq .Values.global.pilotCertProvider "istiod" }} - name: istiod-ca-cert {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} @@ -3254,7 +3276,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.29.2", + "tag": "1.30.0", "variant": "", "waypoint": { "affinity": {}, @@ -3299,8 +3321,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -3437,7 +3459,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.29.2", + "tag": "1.30.0", "variant": "", "waypoint": { "affinity": {}, @@ -3561,7 +3583,7 @@ data: "configValidation": true, "hub": "registry.istio.io/release", "istioNamespace": "istio-system", - "tag": "1.29.2" + "tag": "1.30.0" }, "meshConfig": { "tcpKeepalive": { @@ -3591,8 +3613,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -3609,8 +3631,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -3766,8 +3788,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default k8s-app: istio-cni-node @@ -3792,8 +3814,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-cni app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: cni-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: cni-1.30.0 istio.io/dataplane-mode: none k8s-app: istio-cni-node sidecar.istio.io/inject: 'false' @@ -3840,7 +3862,7 @@ spec: envFrom: - configMapRef: name: istio-cni-config - image: registry.istio.io/release/install-cni:1.29.2 + image: registry.istio.io/release/install-cni:1.30.0 name: install-cni ports: - containerPort: 15014 @@ -3922,8 +3944,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/dataplane-mode: none @@ -3955,9 +3977,9 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 + app.kubernetes.io/version: 1.30.0 chart: gateways - helm.sh/chart: istio-ingress-1.29.2 + helm.sh/chart: istio-ingress-1.30.0 heritage: Tiller install.operator.istio.io/owning-resource: unknown istio: ingressgateway @@ -4038,7 +4060,7 @@ spec: valueFrom: fieldRef: fieldPath: spec.nodeName - image: registry.istio.io/release/proxyv2:1.29.2 + image: registry.istio.io/release/proxyv2:1.30.0 name: istio-proxy ports: - containerPort: 15021 @@ -4157,8 +4179,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default @@ -4186,8 +4208,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/dataplane-mode: none @@ -4243,7 +4265,7 @@ spec: resource: limits.cpu - name: PLATFORM value: '' - image: registry.istio.io/release/pilot:1.29.2 + image: registry.istio.io/release/pilot:1.30.0 name: discovery ports: - containerPort: 8080 @@ -4338,8 +4360,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -4365,8 +4387,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod namespace: istio-system @@ -4412,8 +4434,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: IngressGateways @@ -4437,8 +4459,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 release: istio name: istiod namespace: istio-system @@ -4460,8 +4482,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -4493,8 +4515,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio.io/rev: default operator.istio.io/component: Pilot @@ -4526,8 +4548,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istio-ingressgateway app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istio-ingress-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istio-ingress-1.30.0 install.operator.istio.io/owning-resource: unknown istio: ingressgateway istio.io/rev: default @@ -4563,8 +4585,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: istiod app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: istiod-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: istiod-1.30.0 install.operator.istio.io/owning-resource: unknown istio: pilot istio.io/rev: default diff --git a/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml b/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml index ab3254cd4a..c6611514e9 100644 --- a/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml +++ b/common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml @@ -113,7 +113,7 @@ data: "sts": { "servicePort": 0 }, - "tag": "1.29.2", + "tag": "1.30.0", "variant": "", "waypoint": { "affinity": {}, diff --git a/common/istio/istio-install/components/ambient-mode/ztunnel.yaml b/common/istio/istio-install/components/ambient-mode/ztunnel.yaml index fb94200620..be028c8534 100644 --- a/common/istio/istio-install/components/ambient-mode/ztunnel.yaml +++ b/common/istio/istio-install/components/ambient-mode/ztunnel.yaml @@ -7,8 +7,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: ztunnel-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: ztunnel-1.30.0 name: ztunnel namespace: istio-system --- @@ -21,8 +21,8 @@ metadata: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: ztunnel-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: ztunnel-1.30.0 name: ztunnel namespace: istio-system spec: @@ -41,8 +41,8 @@ spec: app.kubernetes.io/managed-by: Helm app.kubernetes.io/name: ztunnel app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.2 - helm.sh/chart: ztunnel-1.29.2 + app.kubernetes.io/version: 1.30.0 + helm.sh/chart: ztunnel-1.30.0 istio.io/dataplane-mode: none sidecar.istio.io/inject: 'false' spec: @@ -90,7 +90,7 @@ spec: resourceFieldRef: divisor: '1' resource: limits.cpu - image: registry.istio.io/release/ztunnel:1.29.2 + image: registry.istio.io/release/ztunnel:1.30.0 name: istio-proxy ports: - containerPort: 15020 diff --git a/common/istio/istio-install/overlays/insecure/configmap-patch.yaml b/common/istio/istio-install/overlays/insecure/configmap-patch.yaml index 00b67e9a52..375b6d7112 100644 --- a/common/istio/istio-install/overlays/insecure/configmap-patch.yaml +++ b/common/istio/istio-install/overlays/insecure/configmap-patch.yaml @@ -79,7 +79,7 @@ data: aud: istio-ca sts: servicePort: 0 - tag: "1.29.2" + tag: "1.30.0-rc.0" variant: "" waypoint: affinity: {} diff --git a/common/istio/profile.yaml b/common/istio/profile.yaml index 4cdb25f13f..52c40dfab4 100644 --- a/common/istio/profile.yaml +++ b/common/istio/profile.yaml @@ -18,7 +18,7 @@ spec: value: "true" hub: registry.istio.io/release profile: default - tag: 1.29.2 + tag: 1.30.0 values: defaultRevision: "" gateways: diff --git a/scripts/synchronize-istio-manifests.sh b/scripts/synchronize-istio-manifests.sh index 4ffd4204dc..4bd9f0cd6d 100755 --- a/scripts/synchronize-istio-manifests.sh +++ b/scripts/synchronize-istio-manifests.sh @@ -5,8 +5,12 @@ source "${SCRIPT_DIRECTORY}/library.sh" setup_error_handling COMPONENT_NAME="istio" REPOSITORY_NAME="istio/istio" -COMMIT="1.29.2" -PREVIOUS_COMMIT="1.29.1" +COMMIT="1.30.0" +PREVIOUS_COMMIT="1.29.2" +if [[ "${COMMIT}" =~ -(rc|beta|alpha)([.-]|$) ]]; then + echo "Refusing to synchronize pre-release Istio version: ${COMMIT}. Pin COMMIT to a stable GA release tag." + exit 1 +fi SOURCE_DIRECTORY=${SOURCE_DIRECTORY:=/tmp/kubeflow-${COMPONENT_NAME}} BRANCH_NAME=${BRANCH_NAME:=synchronize-${COMPONENT_NAME}-manifests-${COMMIT?}} MANIFESTS_DIRECTORY=$(dirname $SCRIPT_DIRECTORY) @@ -15,12 +19,22 @@ create_branch "$BRANCH_NAME" mkdir -p "$SOURCE_DIRECTORY" cd "$SOURCE_DIRECTORY" if [ ! -d "istio-${COMMIT}" ]; then - wget "https://github.com/${REPOSITORY_NAME}/releases/download/${COMMIT}/istio-${COMMIT}-linux-amd64.tar.gz" - tar xvfz istio-${COMMIT}-linux-amd64.tar.gz + OS=$(uname -s | tr '[:upper:]' '[:lower:]') + ARCH=$(uname -m) + if [ "$ARCH" = "x86_64" ]; then + ARCH="amd64" + elif [ "$ARCH" = "aarch64" ]; then + ARCH="arm64" + fi + if [ "$OS" = "darwin" ]; then + OS="osx" + fi + curl -L -O "https://github.com/${REPOSITORY_NAME}/releases/download/${COMMIT}/istio-${COMMIT}-${OS}-${ARCH}.tar.gz" + tar xvfz "istio-${COMMIT}-${OS}-${ARCH}.tar.gz" fi ISTIOCTL="${SOURCE_DIRECTORY}/istio-${COMMIT}/bin/istioctl" cd "$ISTIO_DIRECTORY" -sed -i "s/tag: .*/tag: $COMMIT/" "$ISTIO_DIRECTORY/profile.yaml" +perl -pi -e "s/tag: .*/tag: $COMMIT/" "$ISTIO_DIRECTORY/profile.yaml" $ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \ --set components.cni.enabled=true \ --set components.cni.namespace=kube-system > dump.yaml @@ -35,12 +49,11 @@ $ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \ ./split-istio-packages -f dump-ztunnel.yaml mv $ISTIO_DIRECTORY/ztunnel.yaml $ISTIO_DIRECTORY/istio-install/components/ambient-mode/ rm dump-ztunnel.yaml crd.yaml install.yaml cluster-local-gateway.yaml -sed -i "s/\"tag\": \".*\"/\"tag\": \"$COMMIT\"/" "$ISTIO_DIRECTORY/istio-install/base/patches/istio-sidecar-injector-patch.yaml" +perl -pi -e "s/\"tag\": \".*\"/\"tag\": \"$COMMIT\"/" "$ISTIO_DIRECTORY/istio-install/base/patches/istio-sidecar-injector-patch.yaml" # Normalize all remaining Istio version references from PREVIOUS_COMMIT to COMMIT. # This catches any version strings that istioctl generates using the previous release # (e.g. image tags, helm chart labels). Update PREVIOUS_COMMIT when bumping COMMIT. -find "$ISTIO_DIRECTORY" -name "*.yaml" | xargs sed -i \ - -e "s/${PREVIOUS_COMMIT}/$COMMIT/g" +find "$ISTIO_DIRECTORY" -name "*.yaml" | xargs perl -pi -e "s/${PREVIOUS_COMMIT}/$COMMIT/g" SOURCE_TEXT="\[.*\](https://github.com/${REPOSITORY_NAME}/releases/tag/.*)" DESTINATION_TEXT="\[$COMMIT\](https://github.com/${REPOSITORY_NAME}/releases/tag/$COMMIT)" update_readme "$MANIFESTS_DIRECTORY" "$SOURCE_TEXT" "$DESTINATION_TEXT" diff --git a/tests/istio_dummy_deployment.yaml b/tests/istio_dummy_deployment.yaml index 310dc6d0f9..0811ab8b90 100644 --- a/tests/istio_dummy_deployment.yaml +++ b/tests/istio_dummy_deployment.yaml @@ -13,37 +13,14 @@ spec: app: test-application spec: securityContext: + runAsNonRoot: true + runAsUser: 101 seccompProfile: type: RuntimeDefault containers: - name: nginx - image: nginx:alpine - ports: - - containerPort: 8080 - command: ["/bin/sh", "-c"] - args: - - | - cat > /tmp/nginx.conf << 'EOF' - pid /tmp/nginx.pid; - events {} - http { - client_body_temp_path /tmp/client_temp; - proxy_temp_path /tmp/proxy_temp; - fastcgi_temp_path /tmp/fastcgi_temp; - uwsgi_temp_path /tmp/uwsgi_temp; - scgi_temp_path /tmp/scgi_temp; - server { - listen 8080; - location / { return 200 'Hello from test application\n'; } - } - } - EOF - nginx -c /tmp/nginx.conf -g 'daemon off;' + image: nginxinc/nginx-unprivileged:latest securityContext: - runAsNonRoot: true - runAsUser: 101 allowPrivilegeEscalation: false - readOnlyRootFilesystem: false capabilities: - drop: - - ALL + drop: ["ALL"] diff --git a/tests/katib_install.sh b/tests/katib_install.sh index 3fd7ec3c0b..6b9f03a889 100755 --- a/tests/katib_install.sh +++ b/tests/katib_install.sh @@ -1,7 +1,7 @@ #!/bin/bash set -euxo pipefail -cd applications/katib/upstream && kustomize build installs/katib-with-kubeflow | kubectl apply -f - && cd ../../../ +cd applications/katib && kustomize build overlays/katib-with-kubeflow | kubectl apply -f - && cd ../../ kubectl wait --for=condition=Available deployment/katib-controller -n kubeflow --timeout=300s diff --git a/tests/katib_test.yaml b/tests/katib_test.yaml index e369c5f559..93e41632cc 100644 --- a/tests/katib_test.yaml +++ b/tests/katib_test.yaml @@ -44,9 +44,26 @@ spec: annotations: sidecar.istio.io/inject: "false" spec: + securityContext: + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault containers: - name: training-container image: ghcr.io/kubeflow/katib/pytorch-mnist-cpu:v0.19.0 + # workingDir: /tmp is used as a writable directory workaround under PSS Restricted + # (read-only root fs in base image). Safe for short-running stateless test pods. + workingDir: /tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault command: - "python3" - "/opt/pytorch-mnist/mnist.py" diff --git a/tests/kubeflow_profile_install.sh b/tests/kubeflow_profile_install.sh index 4176836970..1193d47bc7 100755 --- a/tests/kubeflow_profile_install.sh +++ b/tests/kubeflow_profile_install.sh @@ -6,4 +6,11 @@ PROFILE_CONTROLLER_POD=$(kubectl get pods -n kubeflow -o json | jq -r '.items[] kubectl logs -n kubeflow "$PROFILE_CONTROLLER_POD" KF_PROFILE=kubeflow-user-example-com kubectl -n $KF_PROFILE get pods,configmaps,secrets -kubectl label namespace $KF_PROFILE pod-security.kubernetes.io/enforce=baseline --overwrite +# Verify that the PSS label is indeed applied natively (either restricted or privileged for insecure mode) +LABEL=$(kubectl get ns $KF_PROFILE \ + -o jsonpath='{.metadata.labels.pod-security\.kubernetes\.io/enforce}') +if [ "$LABEL" != "restricted" ] && [ "$LABEL" != "privileged" ]; then + echo "ERROR: Namespace is not labeled restricted or privileged natively (got: $LABEL)" + exit 1 +fi +echo "Namespace is successfully labeled $LABEL natively!" diff --git a/tests/notebook.test.kubeflow-user-example.com.yaml b/tests/notebook.test.kubeflow-user-example.com.yaml index efc6aeec33..6a16b8ccf6 100644 --- a/tests/notebook.test.kubeflow-user-example.com.yaml +++ b/tests/notebook.test.kubeflow-user-example.com.yaml @@ -13,9 +13,20 @@ metadata: spec: template: spec: + securityContext: + fsGroup: 100 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault containers: - name: test image: ghcr.io/kubeflow/kubeflow/notebook-servers/jupyter-scipy:v1.10.0 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsNonRoot: true imagePullPolicy: IfNotPresent resources: limits: diff --git a/tests/profile_controller_install.sh b/tests/profile_controller_install.sh index 6257301309..c4183a08bf 100755 --- a/tests/profile_controller_install.sh +++ b/tests/profile_controller_install.sh @@ -6,3 +6,22 @@ kustomize build applications/dashboard/upstream/profile-controller/overlays/kube kubectl -n kubeflow rollout status deployment/profiles-deployment --timeout=180s kubectl -n kubeflow wait --for=condition=Ready pods -l app=profile-controller --timeout=180s kubectl wait --for=condition=Established --timeout=60s crd/profiles.kubeflow.org + +# Patch Profiles namespace labels config to enforce restricted instead of baseline in CI. +# We use standard json patching to dynamically rewrite the embedded namespace-labels.yaml file +# inside the ConfigMap. +# Since Kustomize appends a dynamic hash suffix to the ConfigMap name, we query the exact name first. +CONFIGMAP_NAME=$(kubectl -n kubeflow get configmaps -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | grep '^profiles-namespace-labels-data-' | head -n 1) +if [ -z "$CONFIGMAP_NAME" ]; then + echo "ERROR: Could not find configmap profiles-namespace-labels-data with hash suffix" + exit 1 +fi + +kubectl patch configmap "$CONFIGMAP_NAME" -n kubeflow --type=json \ + -p='[{"op": "replace", "path": "/data/namespace-labels.yaml", "value": "app.kubernetes.io/part-of: \"kubeflow-profile\"\nkatib.kubeflow.org/metrics-collector-injection: \"enabled\"\npipelines.kubeflow.org/enabled: \"true\"\nserving.kubeflow.org/inferenceservice: \"enabled\"\npod-security.kubernetes.io/enforce: \"restricted\"\npod-security.kubernetes.io/enforce-version: \"v1.29\"\n"}]' + +# Restart profiles deployment to pick up the updated ConfigMap immediately +kubectl rollout restart deployment/profiles-deployment -n kubeflow +kubectl rollout status deployment/profiles-deployment -n kubeflow --timeout=120s + + diff --git a/tests/trainer_install.sh b/tests/trainer_install.sh index e6bbfa8910..c6d221f487 100755 --- a/tests/trainer_install.sh +++ b/tests/trainer_install.sh @@ -12,7 +12,8 @@ kubectl wait --for=condition=Available deployment/kubeflow-trainer-controller-ma kubectl get crd jobsets.jobset.x-k8s.io kubectl wait --for=condition=Available deployment/jobset-controller-manager -n kubeflow-system --timeout=120s -kustomize build upstream/overlays/runtimes | kubectl apply --server-side --force-conflicts -f - +kustomize build overlays/runtimes | kubectl apply --server-side --force-conflicts -f - +kubectl patch clustertrainingruntime torch-distributed --type='json' -p='[{"op": "add", "path": "/spec/template/spec/replicatedJobs/0/template/metadata", "value": {"labels": {"trainer.kubeflow.org/trainjob-ancestor-step": "trainer"}}}, {"op": "add", "path": "/spec/template/spec/replicatedJobs/0/template/spec/template/spec/containers/0/image", "value": "pytorch/pytorch:2.10.0-cuda12.8-cudnn9-runtime"}]' kubectl apply -f upstream/overlays/kubeflow-platform/kubeflow-trainer-roles.yaml diff --git a/tests/training_operator_job.yaml b/tests/training_operator_job.yaml index 341db77599..23925a2fab 100644 --- a/tests/training_operator_job.yaml +++ b/tests/training_operator_job.yaml @@ -14,10 +14,27 @@ spec: labels: sidecar.istio.io/inject: "false" spec: + securityContext: + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault containers: - name: pytorch image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727 imagePullPolicy: Always + # workingDir: /tmp is used as a writable directory workaround under PSS Restricted + # (read-only root fs in base image). Safe for short-running stateless test pods. + workingDir: /tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault command: - "python3" - "/opt/pytorch-mnist/mnist.py" @@ -53,10 +70,44 @@ spec: labels: sidecar.istio.io/inject: "false" spec: + securityContext: + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + initContainers: + # Use reproducible, pinned stable busybox image for network probe + - name: init-pytorch + image: busybox:1.36.1 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + command: + - sh + - -c + - until nslookup pytorch-simple-master-0; do echo waiting for master; sleep 2; done; containers: - name: pytorch image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727 imagePullPolicy: Always + # workingDir: /tmp is used as a writable directory workaround under PSS Restricted + # (read-only root fs in base image). Safe for short-running stateless test pods. + workingDir: /tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault command: - "python3" - "/opt/pytorch-mnist/mnist.py" diff --git a/tests/workspaces-kustomization/jupyterlab_workspacekind_patch.yaml b/tests/workspaces-kustomization/jupyterlab_workspacekind_patch.yaml new file mode 100644 index 0000000000..1ec56bc8fb --- /dev/null +++ b/tests/workspaces-kustomization/jupyterlab_workspacekind_patch.yaml @@ -0,0 +1,21 @@ +apiVersion: kubeflow.org/v1beta1 +kind: WorkspaceKind +metadata: + name: jupyterlab +spec: + podTemplate: + securityContext: + fsGroup: 100 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault diff --git a/tests/workspaces-kustomization/kustomization.yaml b/tests/workspaces-kustomization/kustomization.yaml new file mode 100644 index 0000000000..1589071275 --- /dev/null +++ b/tests/workspaces-kustomization/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- ../../applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml +patches: +- path: jupyterlab_workspacekind_patch.yaml diff --git a/tests/workspaces_pipeline_run_test.sh b/tests/workspaces_pipeline_run_test.sh index d69d9f572b..83312e92c0 100755 --- a/tests/workspaces_pipeline_run_test.sh +++ b/tests/workspaces_pipeline_run_test.sh @@ -3,7 +3,8 @@ set -euxo pipefail KF_PROFILE=${1:-kubeflow-user-example-com} -kubectl apply -f applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml +kustomize build --load-restrictor LoadRestrictionsNone tests/workspaces-kustomization | kubectl apply -f - +sleep 15 # Wait for Notebook Controller to sync the new WorkspaceKind definition kubectl apply -f tests/workspace.test.kubeflow-user-example-com.yaml kubectl wait --for=jsonpath='{.status.state}'=Running \ workspace/test -n "${KF_PROFILE}" \