Set up initial async job scaffolding (#1114)

* chore: set up initial async job scaffolding

Signed-off-by: Eric Dobroveanu <[email protected]>

* chore: address pr comments

Signed-off-by: Eric Dobroveanu <[email protected]>

---------

Signed-off-by: Eric Dobroveanu <[email protected]>

Author: Crazyglue

jobs/async-upload/.dockerignore

@@ -0,0 +1,50 @@
+###############################################################################
+#  Asynchronous Model-Sync Job image for Kubeflow Model Registry (https://github.com/kubeflow/model-registry/issues/1108)
+###############################################################################
+
+FROM ubi10/python-312-minimal AS base
+
+# security/env hardening
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=off \
+    PIP_DISABLE_PIP_VERSION_CHECK=on
+
+# Create an unprivileged user
+RUN addgroup --system --gid 1000 app \
+    && adduser  --system --uid 1000 --ingroup app --home /app app
+
+WORKDIR /app
+
+# Copy Python dependencies first to leverage layer caching
+COPY requirements.txt .
+RUN --mount=type=cache,target=/root/.cache \
+    apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+    && pip install --no-cache-dir -r requirements.txt \
+    && apt-get purge -y --auto-remove && rm -rf /var/lib/apt/lists/*
+
+# Copy application source
+COPY . .
+
+# Switch to the non-root user for the final image layer
+USER 1000:1000
+
+# Add an explicit health-check (K8s will surface this in Pod.status)
+HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
+    CMD python -m job.healthcheck
+
+# OCI-recommended labels
+ARG VCS_REF=unknown
+ARG BUILD_DATE
+LABEL org.opencontainers.image.created=$BUILD_DATE \
+    org.opencontainers.image.revision=$VCS_REF \
+    org.opencontainers.image.title="Kubeflow Model Registry Async-Upload Job" \
+    org.opencontainers.image.description="K8s Job image that copies a model between storage back-ends and registers it in Kubeflow Model Registry." \
+    org.opencontainers.image.url="https://github.com/kubeflow/model-registry" \
+    org.opencontainers.image.source="https://github.com/kubeflow/model-registry/tree/main/jobs/async-upload" \
+    org.opencontainers.image.version="0.1.0" \
+    org.opencontainers.image.licenses="Apache-2.0" \
+    org.opencontainers.image.authors="Kubeflow Model Registry maintainers"
+
+# The Job controller will pass CLI flags/ENV-vars described in issue #1108.
+ENTRYPOINT ["python", "-m", "job.entrypoint"]

jobs/async-upload/Dockerfile

@@ -0,0 +1,26 @@
+# Kubeflow Model Registry – Async Upload Job
+
+> Lightweight, non‑root Python Job containerised for **transferring model artefacts** between storage back‑ends (S3, OCI, PVC, …) and registering them in **Kubeflow Model Registry**. Born out of the discussion in [kubeflow/model-registry #1108](https://github.com/kubeflow/model-registry/issues/1108).
+
+---
+
+## Quick start
+
+```bash
+# 1 – Build & tag ( reproducible build args are optional )
+docker build \
+  --build-arg VCS_REF=$(git rev-parse --short HEAD) \
+  --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+  -t quay.io/<org>/async-upload-job:$(git rev-parse --short HEAD) .
+
+# 2 – Push to your registry
+docker push quay.io/<org>/async-upload-job:<tag>
+
+# TODO: Run locally...
+```
+
+## References
+
+- Issue thread : [https://github.com/kubeflow/model-registry/issues/1108](https://github.com/kubeflow/model-registry/issues/1108)
+- OCI Image Spec : [https://github.com/opencontainers/image-spec](https://github.com/opencontainers/image-spec)
+- Kubernetes Pod Security : [https://kubernetes.io/docs/concepts/security/pod-security-standards/](https://kubernetes.io/docs/concepts/security/pod-security-standards/)

jobs/async-upload/README.md

@@ -0,0 +1,11 @@
+def main() -> None:
+    """
+    Placeholder for main entrypoint
+
+    TODO: Implement the main entrypoint
+    """
+    print("Hello, world!")
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

jobs/async-upload/job/__init__.py

@@ -0,0 +1,14 @@
+import sys
+
+
+def main() -> None:
+    """
+    Placeholder for a healthcheck endpoint for the k8s api server to validate the job is still running
+
+    TODO: Implement healthchecks
+    """
+    sys.exit(0)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    main()

jobs/async-upload/job/entrypoint.py

@@ -0,0 +1,16 @@
+[project]
+name = "async-upload"
+version = "0.0.1"
+description = "Model Registry Job to upload a Model from a source to a destination"
+authors = [
+    {name = "Your Name",email = "[email protected]"}
+]
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = [
+]
+
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"