Merge pull request #302 from nsingla/rb_upstream2

chore: Rebase upstream

Author: openshift-merge-bot[bot]

.github/actions/deploy/action.yml

@@ -128,16 +128,17 @@ runs:
       run: ./.github/resources/squid/deploy-squid.sh
 
     - name: Download Docker Images
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v7
       if: ${{ inputs.skip_load_docker_images != 'true' }}
       with:
-        path: "${{ inputs.image_path }}"
+        path: "images_${{ github.run_id }}"
+        pattern: "!*.dockerbuild"
 
     - name: Load Docker Images
       shell: bash
       if: ${{ inputs.skip_load_docker_images != 'true' }}
       run: |
-        APPS=("apiserver" "driver" "launcher" "scheduledworkflow" "persistenceagent" "frontend" "metadata-writer" "viewer-crd-controller" "visualization-server" "cache-deployer" "cache-server" "metadata-envoy")
+        APPS=("apiserver" "driver" "launcher" "scheduledworkflow" "persistenceagent" "frontend" "metadata-writer" "viewer-crd-controller" "visualization-server" "cache-deployer" "cache-server" "metadata-envoy"  )
         for app in "${APPS[@]}"; do
           docker image load -i ${{ inputs.image_path }}/$app/$app.tar
           docker tag ${{ inputs.image_registry }}/$app:${{ inputs.image_tag }} localhost:5000/$app:${{ inputs.image_tag }}

.github/actions/deploy/infra_deployer.py

@@ -62,6 +62,23 @@ def deploy_cert_manager(self):
                 resource_type=ResourceType.DEPLOYMENT)
             raise RuntimeError('Cert-manager deployment failed')
 
+        # Wait for the cert-manager webhook to be ready to accept requests
+        print('⏳ Waiting for cert-manager webhook to be ready...')
+        webhook_ready = self.deployment_manager.wait_for_resource(
+            resource_type=ResourceType.DEPLOYMENT,
+            resource_name='cert-manager-webhook',
+            namespace=cert_manager_namespace,
+            condition=WaitCondition.AVAILABLE,
+            timeout='120s',
+            description='cert-manager-webhook deployment')
+
+        if not webhook_ready:
+            self.deployment_manager.debug_deployment_failure(
+                namespace=cert_manager_namespace,
+                deployment_name='cert-manager-webhook',
+                resource_type=ResourceType.DEPLOYMENT)
+            raise RuntimeError('Cert-manager webhook deployment failed')
+
         print('✅ Cert-manager deployed successfully')
 
     def apply_webhooks(self):

.github/actions/deploy/tls_manager.py

@@ -15,6 +15,7 @@
 import os
 import subprocess
 import tempfile
+import time
 from typing import Any, Dict, List
 
 import yaml
@@ -89,8 +90,22 @@ def _create_service_ca_issuer(self):
   selfSigned: {}
 """
 
-        self._apply_yaml_content(issuer_yaml, 'service-ca-issuer')
-        print('✅ Service CA issuer created successfully')
+        # Retry applying the ClusterIssuer because the cert-manager webhook
+        # may not be serving yet even after the pod is Ready.
+        max_retries = 12
+        for attempt in range(1, max_retries + 1):
+            try:
+                self._apply_yaml_content(issuer_yaml, 'service-ca-issuer')
+                print('✅ Service CA issuer created successfully')
+                break
+            except Exception:
+                if attempt == max_retries:
+                    raise
+                print(
+                    f'⏳ cert-manager webhook not ready yet, retrying in 10s '
+                    f'(attempt {attempt}/{max_retries})...'
+                )
+                time.sleep(10)
 
     def _create_service_ca_certificate(self):
         """Create the root service CA certificate."""

.github/actions/test-and-report/action.yml

@@ -243,6 +243,10 @@ runs:
           API_SCHEME='http'
           CA_CERT_PATH=''  # Force empty when TLS is disabled
         fi
+        pipelineStoreKubernetes='false'
+        if [ "$PIPELINE_STORE" == "kubernetes" ]; then
+          pipelineStoreKubernetes='true'
+        fi
         PULL_NUMBER="${{ github.event.inputs.pull_number || github.event.pull_request.number }}"
         REPO_NAME="${{ github.repository }}"
         API_URL="${{ steps.configure-api.outputs.API_URL }}"
@@ -260,7 +264,7 @@ runs:
           DISABLE_TLS_CHECK='false'
         fi
 
-        go run github.com/onsi/ginkgo/v2/ginkgo -r -v --cover -p --keep-going --github-output=true --nodes=${{ inputs.num_parallel_nodes }} --label-filter=${{ inputs.test_label }} --silence-skips=true -- -namespace=${{ inputs.default_namespace }} -multiUserMode=$MULTI_USER -useProxy=$USE_PROXY -userNamespace=${{ inputs.user_namespace }} -uploadPipelinesWithKubernetes=${{ inputs.upload_pipelines_with_kubernetes_client}} -disableTlsCheck=$DISABLE_TLS_CHECK -apiScheme=$API_SCHEME -tlsEnabled=$TLS_ENABLED -caCertPath=$CA_CERT_PATH -pullNumber=$PULL_NUMBER -repoName=$REPO_NAME -apiUrl="$API_URL" -authToken="$AUTH_TOKEN" -serviceAccountName="$SERVICE_ACCOUNT_NAME" $BASE_IMAGE_FLAG
+        go run github.com/onsi/ginkgo/v2/ginkgo -r -v --cover -p --keep-going --github-output=true --nodes=${{ inputs.num_parallel_nodes }} --label-filter=${{ inputs.test_label }} --silence-skips=true -- -namespace=${{ inputs.default_namespace }} -multiUserMode=$MULTI_USER -useProxy=$USE_PROXY -userNamespace=${{ inputs.user_namespace }} -uploadPipelinesWithKubernetes=${{ inputs.upload_pipelines_with_kubernetes_client}} -pipelineStoreKubernetes=$pipelineStoreKubernetes -disableTlsCheck=$DISABLE_TLS_CHECK -apiScheme=$API_SCHEME -tlsEnabled=$TLS_ENABLED -caCertPath=$CA_CERT_PATH -pullNumber=$PULL_NUMBER -repoName=$REPO_NAME -apiUrl="$API_URL" -authToken="$AUTH_TOKEN" -serviceAccountName="$SERVICE_ACCOUNT_NAME" $BASE_IMAGE_FLAG
       continue-on-error: true
 
     - name: Collect Pod logs in case of Test Failures
@@ -310,7 +314,7 @@ runs:
 
     - name: Upload HTML Report
       id: upload
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       if: (!cancelled()) && steps.generate-html-report.outcome == 'success'
       with:
         name: ${{ steps.name_gen.outputs.REPORT_NAME }}

.github/resources/manifests/multiuser/artifact-proxy/kustomization.yaml

@@ -38,6 +38,10 @@ images:
     newTag: latest
 
 patches:
+  - path: ../pipeline-crd-rbac.yaml
+    target:
+      kind: ClusterRole
+      name: ml-pipeline
   - path: ../../base/apiserver-env.yaml
     target:
       kind: Deployment

.github/resources/manifests/multiuser/cache-disabled/kustomization.yaml

@@ -38,6 +38,10 @@ images:
     newTag: latest
 
 patches:
+  - path: ../pipeline-crd-rbac.yaml
+    target:
+      kind: ClusterRole
+      name: ml-pipeline
   - path: ../../base/apiserver-env.yaml
     target:
       kind: Deployment

.github/resources/manifests/multiuser/default/kustomization.yaml

@@ -38,6 +38,10 @@ images:
     newTag: latest
 
 patches:
+  - path: ../pipeline-crd-rbac.yaml
+    target:
+      kind: ClusterRole
+      name: ml-pipeline
   - path: ../../base/apiserver-env.yaml
     target:
       kind: Deployment

.github/resources/manifests/multiuser/pipeline-crd-rbac.yaml

@@ -0,0 +1,33 @@
+- op: add
+  path: "/rules/-"
+  value:
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
+    apiGroups:
+      - pipelines.kubeflow.org
+    resources:
+      - pipelines
+      - pipelines/finalizers
+- op: add
+  path: "/rules/-"
+  value:
+    verbs:
+      - create
+      - get
+      - list
+      - watch
+      - update
+      - patch
+      - delete
+    apiGroups:
+      - pipelines.kubeflow.org
+    resources:
+      - pipelineversions
+      - pipelineversions/status
+      - pipelineversions/finalizers

.github/workflows/add-ci-passed-label.yml

@@ -26,26 +26,34 @@ jobs:
       event_action: ${{ steps.extract.outputs.event_action }}
     steps:
       - name: 'Download artifact'
-        uses: actions/github-script@v3.1.0        
+        uses: actions/github-script@v8
         with:
           script: |
-            var artifacts = await github.actions.listWorkflowRunArtifacts({
+            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
               owner: context.repo.owner,
               repo: context.repo.repo,
               run_id: ${{github.event.workflow_run.id}},
             });
-            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
-              return artifact.name == "pr"
-            })[0];
-            var download = await github.actions.downloadArtifact({
+            const matchArtifact = artifacts.data.artifacts.find((artifact) => {
+              return artifact.name === "pr";
+            });
+
+            if (!matchArtifact) {
+              throw new Error(
+                `Required artifact "pr" was not found for workflow run ID ${{github.event.workflow_run.id}}. ` +
+                "It may have expired or failed to upload. Ensure the CI workflow uploads a 'pr' artifact."
+              );
+            }
+
+            const download = await github.rest.actions.downloadArtifact({
               owner: context.repo.owner,
               repo: context.repo.repo,
               artifact_id: matchArtifact.id,
               archive_format: 'zip',
             });
-            var fs = require('fs');
+            const fs = require('fs');
             fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(download.data));
-      
+
       - name: Unzip artifact
         run: unzip pr.zip
 

.github/workflows/api-server-tests.yml

@@ -89,7 +89,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create cluster
         uses: ./.github/actions/create-cluster
@@ -187,7 +187,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create cluster
         uses: ./.github/actions/create-cluster
@@ -243,7 +243,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create cluster
         uses: ./.github/actions/create-cluster