chore: sync upstream kubeflow/pipelines [conflicts] - #396
Open
dsp-developers wants to merge 63 commits into
Open
chore: sync upstream kubeflow/pipelines [conflicts]#396dsp-developers wants to merge 63 commits into
dsp-developers wants to merge 63 commits into
Conversation
…13443) Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
…tomer workloads (kubeflow#13301) * feat(backend): add hostUsers:false default and override guard for customer workloads Thread administrator default defaultSecurityContextHostUsers from ConfigMap through API server, compiler, and driver. Set hostUsers on the PodSpec before attaching click/hashchange listeners, and add a post-processing override guard that unconditionally re-applies the administrator value after all user mutations so a podSpecPatch setting hostUsers:true cannot silently override the administrator configuration. Closes: kubeflow#13211 Co-authored-by: Julius von Kohout <juliusvonkohout@users.noreply.github.com> Signed-off-by: Siddhant Jain <siddhantjainofficial26@gmail.com> * Update pipeline-install-config.yaml Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> --------- Signed-off-by: Siddhant Jain <siddhantjainofficial26@gmail.com> Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> Co-authored-by: Julius von Kohout <juliusvonkohout@users.noreply.github.com> Co-authored-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
Signed-off-by: Jeff Spahr <spahrj@gmail.com>
…beflow#13466) Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) and [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8). These dependencies needed to be updated together. Updates `vitest` from 4.0.17 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest) Updates `@vitest/coverage-v8` from 4.0.17 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/coverage-v8) --- updated-dependencies: - dependency-name: vitest dependency-version: 4.1.8 dependency-type: direct:development - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.8 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Alyssa Goins <agoins@redhat.com>
The KFP components now live at: https://github.com/kubeflow/pipelines-components This deletion is in accordance to and several discussions on the KFP community calls: kubeflow#13051 This also removes the docs/code-tree directory that seems to have been accidentally committed and is now stale. Signed-off-by: mprahl <mprahl@users.noreply.github.com>
…kerfiles (kubeflow#13470) Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
kubeflow#13499) Link to AGENTS.md (the real file) instead of the CLAUDE.md symlink. Signed-off-by: kaikaila <lyk2772@126.com>
* fix(security): patch kfp-metadata-writer Python CVEs Fix the subset of vulnerabilities in kfp-metadata-writer that have upstream fixes available, as identified by Trivy scanning ghcr.io/kubeflow/kfp-metadata-writer:2.16.1. Changes in Dockerfile: - Upgrade libcap2 to 1:2.75-10+deb13u1 (CVE-2026-4878, HIGH) - Upgrade wheel to >=0.46.2 (CVE-2026-24049, HIGH) Changes in requirements.txt: - pyasn1 0.6.2 -> 0.6.3 (CVE-2026-30922, HIGH) - urllib3 2.6.3 -> 2.7.0 (CVE-2026-44431, CVE-2026-44432, HIGH x2) Residual findings with no fix available: - protobuf==4.25.8 (CVE-2026-0994, HIGH): ml-metadata 1.17.1 hard-caps protobuf at <5; upgrading requires a major ml-metadata update. - perl-base (CRITICAL x2, HIGH x3): no Debian trixie fix released yet. - ncurses (HIGH x4): no Debian trixie fix released yet. - jaraco.context 5.3.0 (CVE-2026-23949, HIGH): vendored inside setuptools; fixed when setuptools ships a version that bundles jaraco.context>=6.1.0. Part of the broader security remediation tracked in kubeflow#13449. Signed-off-by: Tolga Tuncoglu <tolgatuncoglu@gmail.com> * fix(metadata_writer): use python3 -m pip consistently Replace pip3 with python3 -m pip throughout the Dockerfile to ensure the pip invocation always matches the active Python interpreter. Addresses review comment from Copilot on PR kubeflow#13465. Signed-off-by: Tolga Tuncoglu <tolgatuncoglu@gmail.com> --------- Signed-off-by: Tolga Tuncoglu <tolgatuncoglu@gmail.com>
* docs: update release documentation Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * Add gh CLI automation Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> --------- Signed-off-by: droctothorpe <mythicalsunlight@gmail.com>
macOS can create `.DS_Store` files when a directory is opened in Finder (see https://en.wikipedia.org/wiki/.DS_Store). The workflow compiler test helper collected all files from test_data so these hidden files could be treated as pipeline specs and break the tests. This change adds dotfiles to the existing file filter and extracts the filter into a shared helper to avoid duplicating. Signed-off-by: arpechenin <arpechenin@avito.ru> Co-authored-by: arpechenin <arpechenin@avito.ru>
…ubeflow#13506) Signed-off-by: kaikaila <lyk2772@126.com>
* fix(frontend): harden TensorBoard proxy routing Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * fix(frontend): address TensorBoard proxy review feedback Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * docs(frontend): clarify TensorBoard proxy helpers Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * fix(frontend): drop TensorBoard proxy rate limiter Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * fix(frontend): address TensorBoard proxy review Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * style(frontend): format TensorBoard proxy tests Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> --------- Signed-off-by: droctothorpe <mythicalsunlight@gmail.com>
* Reduce stale issue and close days in workflow Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * Update stale issue and close days in workflow Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> --------- Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
) * proper-argo-retries Updated Argo workflow controller configmap references and added workflow defaults for metrics and retry strategies. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * Update workflow-controller-configmap-patch.yaml Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * fix: resolve artifact lookup and graph assertion for retry nodes (kubeflow#13500) When templateDefaults.retryStrategy is applied globally, Argo wraps each template execution in a retry parent node. This causes two CI failures: 1. FindObjectStoreArtifactKeyOrEmpty returned empty for retry parent nodes (no artifacts), causing ReadArtifact v1 API to return HTTP 404. Fixed by checking children nodes when the parent has no matching artifact. 2. The helloworld frontend test expected exactly 4 graph nodes, but retry wrappers increase the runtime node count. Updated the runtime graph assertion to accept at least 4 nodes. Signed-off-by: Siddhant Jain <siddhantjainofficial26@gmail.com> * fix: use jq for artifact key lookup in proxy test (kubeflow#13502) The jsonpath expression on kubectl does not reliably resolve artifact keys when templateDefaults.retryStrategy wraps templates in retry parent nodes that lack outputs.artifacts. Using jq with the optional operator (?//) skips nodes without artifacts and selects the first matching key from child execution nodes. Signed-off-by: Siddhant Jain <siddhantjainofficial26@gmail.com> * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * . Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * Update test-artifact-proxy.sh Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * Update test-artifact-proxy.sh Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * fix: use recursive child traversal for artifact lookup with retryStrategy (kubeflow#13514) The NodeTypeRetry guard blocked artifact lookup when the test regex captured a StepGroup node instead of a Retry node. With templateDefaults.retryStrategy, the node hierarchy is: StepGroup -> Retry -> Pod (with artifacts). Replace the type guard with bounded recursive traversal (maxDepth=3) so FindObjectStoreArtifactKeyOrEmpty resolves artifacts regardless of which node in the hierarchy is captured. Add unit test for StepGroup -> Retry -> Pod traversal path. Signed-off-by: Siddhant Jain <siddhantjainofficial26@gmail.com> --------- Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> Signed-off-by: Siddhant Jain <siddhantjainofficial26@gmail.com> Co-authored-by: Siddhant Jain <149181251+Raakshass@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Siddhant Jain <siddhantjainofficial26@gmail.com>
…low#13513) This hook silently reformats single quotes to double quotes across all Python files touched in a commit, including lines unrelated to the actual change. There is no corresponding CI check for this rule, so it creates noisy diffs without providing any enforcement value. Signed-off-by: kaikaila <lyk2772@126.com>
Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>
Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
…eflow#13489) * chore(deps): bump golang.org/x/net to v0.55.0 across all modules Bumps golang.org/x/net from v0.52.0 (root), v0.38.0 (third_party/ml-metadata) and v0.48.0 (test/tools/project-cleaner) to v0.55.0 to address the May 2026 x/net security advisories that none of the modules had picked up: - GO-2026-4918 / CVE-2026-33814 (x/net/http2): CONTINUATION-frame infinite loop / DoS on SETTINGS_MAX_FRAME_SIZE=0. No GHSA assigned yet. https://pkg.go.dev/vuln/GO-2026-4918 - GO-2026-5026 / CVE-2026-39821 / GHSA-w2q5-6q6x-x959 (x/net/idna): privilege escalation via Punycode labels decoding to ASCII-only labels. https://pkg.go.dev/vuln/GO-2026-5026 - GO-2026-5028 / CVE-2026-25680 / GHSA-5cv4-jp36-h3mw (x/net/html): DoS / XSS via DOCTYPE character references. https://pkg.go.dev/vuln/GO-2026-5028 - GO-2026-5025 / CVE-2026-42506 / GHSA-cg87-vwwh-xvgj (x/net/html): XSS via Parse->Render tree mismatch (sanitizer bypass). https://pkg.go.dev/vuln/GO-2026-5025 - GO-2026-5027 / CVE-2026-42502 / GHSA-wrh2-89vg-4j9g (x/net/html): XSS via Parse->Render tree mismatch (sanitizer bypass). https://pkg.go.dev/vuln/GO-2026-5027 - GO-2026-5029 / CVE-2026-25681 / GHSA-w9p8-pvxh-rxpj (x/net/html): XSS via Parse->Render tree mismatch (sanitizer bypass). https://pkg.go.dev/vuln/GO-2026-5029 - GO-2026-5030 / CVE-2026-27136 / GHSA-m9x8-m34x-fj9q (x/net/html): XSS via Parse->Render tree mismatch (sanitizer bypass). https://pkg.go.dev/vuln/GO-2026-5030 x/net is a direct dependency only in the root module; in the other two it is indirect, so Dependabot version-updates never bumped it there. Ran go mod tidy in each module. govulncheck reports 0 vulnerabilities in the root module. Note: test/tools/project-cleaner has a pre-existing build failure at main.go:138 (cloud client API drift) unrelated to this dependency bump. Signed-off-by: Anthony Holten <anthony.holten1@gmail.com> * chore(deps): bump root toolchain to go1.26.4 Addresses review feedback on kubeflow#13489. The root module pinned `toolchain go1.26.3`, under which `govulncheck ./...` reports three reachable Go standard library vulnerabilities, all fixed in go1.26.4: - GO-2026-5037 (crypto/x509): https://pkg.go.dev/vuln/GO-2026-5037 - GO-2026-5038 (mime): https://pkg.go.dev/vuln/GO-2026-5038 - GO-2026-5039 (net/textproto): https://pkg.go.dev/vuln/GO-2026-5039 Bumping the pinned toolchain to go1.26.4 clears them and makes the PR's `govulncheck` result reproduce under the toolchain the module actually pins. Verified: `GOTOOLCHAIN=go1.26.4 govulncheck ./...` reports 0 vulnerabilities and `GOTOOLCHAIN=go1.26.4 go build ./...` passes. Signed-off-by: Anthony Holten <anthony.holten1@gmail.com> --------- Signed-off-by: Anthony Holten <anthony.holten1@gmail.com>
…tend-integration-test (kubeflow#13403) Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.15. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.15) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.6 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [qs](https://github.com/ljharb/qs) from 6.14.1 to 6.15.2. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.15.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…nd-integration-test (kubeflow#13304) Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.7 to 5.7.3. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.5.7...v5.7.3) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.7.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…low#13545) Bumps [ws](https://github.com/websockets/ws) from 8.19.0 to 8.21.0. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.19.0...8.21.0) --- updated-dependencies: - dependency-name: ws dependency-version: 8.21.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…3414) * test(frontend): flush PipelineDetails switch setup in act Signed-off-by: Jeff Spahr <spahrj@gmail.com> * style(frontend): format PipelineDetails test imports Signed-off-by: Jeff Spahr <spahrj@gmail.com> --------- Signed-off-by: Jeff Spahr <spahrj@gmail.com>
…ration-test (kubeflow#13539) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…erver (kubeflow#13541) Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) to 8.0.16 and updates ancestor dependencies [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). These dependencies need to be updated together. Updates `vite` from 7.3.2 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `@vitest/coverage-v8` from 4.0.18 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/coverage-v8) Updates `vitest` from 4.0.18 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.9/packages/vitest) --- updated-dependencies: - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.9 dependency-type: direct:development - dependency-name: vite dependency-version: 8.0.16 dependency-type: indirect - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…beflow#13544) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/commits) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…low#13428) Bumps [qs](https://github.com/ljharb/qs) from 6.15.0 to 6.15.2. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.15.0...v6.15.2) --- updated-dependencies: - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…13427) Bumps [qs](https://github.com/ljharb/qs) to 6.15.2 and updates ancestor dependency [express](https://github.com/expressjs/express). These dependencies need to be updated together. Updates `qs` from 6.13.0 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.13.0...v6.15.2) Updates `express` from 4.22.1 to 4.22.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/v4.22.2/History.md) - [Commits](expressjs/express@v4.22.1...v4.22.2) --- updated-dependencies: - dependency-name: express dependency-version: 4.22.2 dependency-type: direct:production - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ubeflow#13519) Bumps [esbuild](https://github.com/evanw/esbuild) and [tsx](https://github.com/privatenumber/tsx). These dependencies needed to be updated together. Updates `esbuild` from 0.27.3 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.28.1) Updates `tsx` from 4.21.0 to 4.22.4 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.22.4) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: indirect - dependency-name: tsx dependency-version: 4.22.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ubeflow#13540) Bumps [form-data](https://github.com/form-data/form-data) from 2.5.5 to 2.5.6. - [Release notes](https://github.com/form-data/form-data/releases) - [Changelog](https://github.com/form-data/form-data/blob/master/CHANGELOG.md) - [Commits](form-data/form-data@v2.5.5...v2.5.6) --- updated-dependencies: - dependency-name: form-data dependency-version: 2.5.6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix(frontend): support local proxy log and artifact reads Signed-off-by: Jeff Spahr <spahrj@gmail.com> * fix(frontend): skip invalid MinIO rewrite rules Signed-off-by: Jeff Spahr <spahrj@gmail.com> --------- Signed-off-by: Jeff Spahr <spahrj@gmail.com> Co-authored-by: Michael <m.zazula@gmail.com>
* feat: support argo workflows 4.x Signed-off-by: Jeff Spahr <spahrj@gmail.com> * test: validate compiled argo workflows Signed-off-by: Jeff Spahr <spahrj@gmail.com> * fix(backend): update MLflow test to Argo v4 Signed-off-by: Jeff Spahr <spahrj@gmail.com> * fix: address Argo workflow review feedback Signed-off-by: Jeff Spahr <spahrj@gmail.com> --------- Signed-off-by: Jeff Spahr <spahrj@gmail.com>
* chore(frontend): pin npm 11.17.0 Signed-off-by: Jeff Spahr <spahrj@gmail.com> * chore(frontend): clarify npm setup quoting Signed-off-by: Jeff Spahr <spahrj@gmail.com> --------- Signed-off-by: Jeff Spahr <spahrj@gmail.com>
…workflows (kubeflow#13563) * chore: update obsolete generated API and model files (kubeflow#13501) Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * chore: update MLflow deploy action to latest commit hash in e2e workflow Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * chore: add `concurrency` settings to GitHub Actions workflows to prevent duplicate runs Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * chore: remove `concurrency` settings from add-ci-passed-label workflow Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> --------- Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Signed-off-by: arpechenin <arpechenin@avito.ru> Co-authored-by: arpechenin <arpechenin@avito.ru>
…lPort (kubeflow#13504) Signed-off-by: kaikaila <lyk2772@126.com>
…ve the S3 namespace isolation test (kubeflow#13469) * Add list bucket to IAM policy Signed-off-by: Tarek Abouzeid <tarek.abouzeid91@gmail.com> * feat(seaweedfs): add namespace isolation tests and refine S3 bucket policies - Update SeaweedFS image version to 4.34 - Add namespace isolation test using s3_helper.py and namespace_isolation_test.sh - Refine AWS S3 bucket policies and permissions logic in pipelines profile controller sync.py - Implement unauthorized listing tests and refine list_prefix function to support delimiter constraints Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com> * deletion tests Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com> --------- Signed-off-by: Tarek Abouzeid <tarek.abouzeid91@gmail.com> Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com> Co-authored-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
…beflow#13551) Apply checksum settings for plain S3 and MinIO object store URLs, and for fromEnv session-based S3 clients when structured S3 settings are provided. Keep query-string based S3 and MinIO URLs on the existing gocloud URL parsing path. Signed-off-by: Yingdi-Zheng <yzheng1019@icloud.com>
* Add juliusvonkohout to test OWNERS list Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> * Update approvers in test/OWNERS file Added juliusvonkohout as an approver and removed duplicate entry. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> --------- Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>
) Fixes kubeflow#13380 Signed-off-by: MStokluska <mstoklus@redhat.com>
…eflow#13593) * chore(tests): refactor MLflow run status verification to improve polling and timeout handling - Replaced `VerifyMLflowRunStatus` with `WaitForMLflowRunStatus` for more robust status checks. - Introduced `WaitForAllMLflowRunsInStatus` to simplify and consolidate multi-run status polling logic in e2e tests. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Wait for the log viewer to finish loading and avoid overlapping log refresh retries before asserting helloworld node logs in frontend e2e. Signed-off-by: mprahl <mprahl@users.noreply.github.com>
…eflow#13586) * test(frontend): avoid duplicate Docker postinstall Signed-off-by: danish9039 <danishsiddiqui040@gmail.com> * test(frontend): preserve log viewer timeout errors Signed-off-by: danish9039 <danishsiddiqui040@gmail.com> --------- Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>
…oller for multi-user auth (kubeflow#13472) * fix(scheduled-workflow): inject user identity header for multi-user auth In multi-user mode, the scheduled-workflow-controller calls CreateRun via gRPC to the API server. Previously, only an Authorization: Bearer <token> header was attached (when a service-account token file was present). The API server's HTTPHeaderAuthenticator also requires a user identity header (e.g. kubeflow-userid), and rejects the request with 'Unauthenticated: Request header error: there is no user identity header' when the token volume is not mounted. This commit adds two new CLI flags to the controller: --userIdentityHeader: the header name (e.g. kubeflow-userid) --userIdentityValue: the value to set (e.g. the controller SA identity) When both are set, the controller injects the header into the gRPC outgoing metadata alongside the existing Bearer token. Both flags default to empty strings, making the feature fully opt-in -- existing single-user deployments are unaffected. The multi-user kustomize deployment patch is updated to pass these flags using the controller's own service account identity, derived from the pod namespace via the downward API. Signed-off-by: jaewak <jaewan.0907@gmail.com> * fix(scheduled-workflow): validate user identity gRPC metadata key Address review feedback on the user identity injection: - Normalize the configured userIdentityHeader to lowercase and validate it against gRPC metadata key rules in NewController, failing fast at startup instead of risking failed requests during reconciliation. - Clarify the --userIdentityHeader/--userIdentityValue flag help to state that the value is injected as outgoing gRPC metadata (not an HTTP header). - Add unit tests for the key normalization/validation helper and for NewController rejecting a malformed key. Signed-off-by: jaewak <jaewan.0907@gmail.com> * fix(scheduled-workflow): pass user identity via env vars, not pod args The multi-user deployment patch set the user identity flags via the pod spec 'args' field. The controller image has no ENTRYPOINT and invokes the binary through its CMD (a shell that maps env vars to flags), so setting 'args' replaced the entire CMD and the container tried to exec '--userIdentityHeader=...' as the binary, crash-looping with: exec: "--userIdentityHeader=kubeflow-userid": executable file not found in $PATH Follow the existing convention instead: expose the configuration as the USER_IDENTITY_HEADER / USER_IDENTITY_VALUE env vars and map them to the --userIdentityHeader / --userIdentityValue flags in the Dockerfile CMD. The multi-user patch now sets those env vars (defaulting to empty, so single-user deployments remain unaffected). Signed-off-by: jaewak <jaewan.0907@gmail.com> * fix(manifests): source multi-user auth params from shared ConfigMap Hardcoding USER_IDENTITY_HEADER, KUBEFLOW_USERID_HEADER, and KUBEFLOW_USERID_PREFIX directly in each deployment patch meant customized installs (different header name or renamed service account) would silently diverge after upgrade. - Add pipeline-multi-user-params ConfigMap with KUBEFLOW_USERID_HEADER and KUBEFLOW_USERID_PREFIX as the single source of truth - Source those values via configMapKeyRef in the api-service, pipelines-ui, and scheduled-workflow deployment patches so all three components always agree on the header name - Replace the hardcoded service account name in USER_IDENTITY_VALUE with spec.serviceAccountName via the downward API so renamed service accounts are handled automatically Signed-off-by: jaewak <jaewan.0907@gmail.com> * misc: use proper words as variable names and spelling fixes Signed-off-by: jaewak <jaewan.0907@gmail.com> * fix(scheduled-workflow): reject grpc- reserved prefix in metadata key validation Keys beginning with "grpc-" are reserved by the gRPC runtime and silently dropped at the transport layer, defeating the fail-fast guarantee of normalizeAndValidateMetadataKey. Add an explicit check and a corresponding test case. Signed-off-by: jaewak <jaewan.0907@gmail.com> * fix: use USERID_HEADER as variable name to stay consistent with central dashboard Signed-off-by: jaewak <jaewan.0907@gmail.com> * fix(manifests): centralize multi-user userid params in pipeline-install-config Move USERID_HEADER and USERID_PREFIX out of the dedicated pipeline-multi-user-parameters ConfigMap and into the global pipeline-install-config, so the multi-user identity contract has a single source of truth shared by the API server, UI, and scheduled-workflow controller. Make the KUBEFLOW_USERID_HEADER/KUBEFLOW_USERID_PREFIX and USER_IDENTITY_HEADER env var references optional so customized installs that omit these keys fall back to component defaults instead of failing to start. Signed-off-by: jaewak <jaewan.0907@gmail.com> * misc: update comment per copilot suggestion Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: jaewak <82007787+jaewak@users.noreply.github.com> --------- Signed-off-by: jaewak <jaewan.0907@gmail.com> Signed-off-by: jaewak <82007787+jaewak@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…beflow#13534, kubeflow#13535, kubeflow#13556) (kubeflow#13552) * fix: allow same-named pipeline versions under different pipelines (kubeflow#13534, kubeflow#13535) Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: handle namespace switching for pipelines and add tests for versioning edge cases - Updated logic to support namespace replacement during pipeline creation. - Added comprehensive tests for scenarios like same version names under different pipelines and namespace transitions. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix(test): add test for pipeline version ownership fallback on name collision - Introduced a new test to verify fallback logic when a pipeline version name collides with an existing composite name but belongs to a different pipeline. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: validate composite names and handle namespace switching for pipelines - Added DNS1123 validation for composite names in pipeline versions to prevent invalid Kubernetes resource names. - Improved logic to retry pipeline retrieval without namespace constraints in standalone mode. - Updated tests to reflect new namespace switching behavior. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: remove unnecessary query limit in pipeline version retrieval - Removed the `LIMIT 1` clause from pipeline version retrieval logic to ensure proper handling of queries without incorrect constraints. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: replace composite name validation logic with reusable PipelineVersionName abstraction - Refactored pipeline version name handling by introducing the `PipelineVersionName` abstraction. - Removed `compositeVersionName` function and updated all references to use the reusable `PipelineVersionName` utility. - Added tests to validate edge cases for Kubernetes naming constraints and compositional logic. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * refactor: update `GetPipelineVersionByName` to include pipeline name parameter - Added `pipelineName` to `GetPipelineVersionByName` for improved clarity and disambiguation. - Updated all references, logic, and tests to align with the new method signature. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: refine ownership validation in `GetPipelineVersionByName` and add test for label/OwnerReference mismatch - Updated logic in `GetPipelineVersionByName` to improve handling of pipeline ownership with conflicting labels and OwnerReferences. - Added a new test to cover scenarios where labels and OwnerReferences point to different pipelines. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: add logging for invalid composite names in pipeline version lookup - Added debug-level logging to identify cases where composite names fail DNS1123 validation during pipeline version retrieval. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: simplify ownership validation in `GetPipelineVersionByName` - Removed redundant label-based fallback check for pipeline version ownership when OwnerReferences are present. - Updated test description to reflect the streamlined ownership determination logic. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: add validation for pipeline version name length and pattern - Enforced Kubernetes naming constraints on `versionName`, including a maximum length of 253 characters and regex pattern validation. - Updated CRD and corresponding Go struct annotations to reflect the new constraints. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: add autogenerated deepcopy methods for `PipelineVersionName` - Added `DeepCopy` and `DeepCopyInto` implementations for `PipelineVersionName` to support safe object cloning. - Ensures compatibility with Kubernetes CRD code generation. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: improve error handling and messages in pipeline version creation - Added specific handling for `util.UserError` during pipeline version creation. - Enhanced error messages to include Kubernetes resource names for better context. - Updated tests to verify new error handling and message improvements. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: update namespace handling in `GetPipelineVersionByName` and add test for cross-namespace scenarios - Refactored `GetPipelineVersionByName` to fetch and use the pipeline's namespace dynamically. - Added a new test to validate behavior when the pipeline version exists in a different namespace than the default. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: add duplicate name validation for pipeline version creation - Implemented a check to prevent logical name collisions during pipeline version creation. - Added a test to verify rejection of duplicate names, covering legacy bare-name CRs and composite-name CRs. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * refactor: extract backward compatibility tests and pipeline version name validation logic into separate files - Moved backward compatibility tests for pipeline version handling into a dedicated test file. - Extracted and refactored `PipelineVersionName` logic into a standalone file for better modularization and reusability. - Updated related imports and tests to reflect the changes. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * docs: add description for `PipelineVersionName` struct - Added a comment to `PipelineVersionName` explaining its purpose and DNS-1123 validation for PipelineVersion CR names. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * retrigger CI Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * test: add multi-user sample pipeline tests and refactor namespace handling - Removed unused `Namespace` field in pipeline creation config. - Added tests to validate behavior of sample pipelines in multi-user mode: - Visibility without namespace. - Restart idempotency. - Creation of new versions on config updates during restarts. - Ensured test coverage for edge cases. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * refactor: restructure pipeline version retrieval and transient error injection logic - Extracted `getPipelineVersionByNameInNamespace` for modularized namespace-specific pipeline version lookup. - Updated transient error injection to target the initial `Get` call instead of the `List` call. - Improved error handling and test assertions for user-facing errors. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * refactor: simplify `GetPipelineVersionByName` by removing unused pipeline name argument - Removed the redundant `pipelineName` parameter from `GetPipelineVersionByName` across multiple layers (ResourceManager, PipelineStore, and Kubernetes implementations). - Updated associated methods, tests, and error messages to reflect the simplified API. - Ensured compatibility with both composite-name and bare-name lookups. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> * fix: handle pipeline version name collision when identical to pipeline name - Updated `FromPipelineVersionModel` to avoid composite names when the pipeline version name matches the pipeline name. - Added a test to validate bare-name formatting (`my-pipeline` instead of `my-pipeline-my-pipeline`) in such cases. - Ensured error-free behavior during name validation and metadata generation. Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com> --------- Signed-off-by: Helber Belmiro <helber.belmiro@gmail.com>
Fixes kubeflow#13582 by keeping the MLflow endpoint server-owned and limiting namespace kfp-launcher overrides to non-routing settings. This prevents a namespace ConfigMap from steering API-server MLflow requests while still allowing explicit multi-user override layering. Use the currently resolved MLflow endpoint for terminal sync and retries instead of reusing the value stored in plugin output. This is less surprising because the configured endpoint remains the source of truth, even if DNS names or service endpoints change while the logical MLflow server stays the same. Signed-off-by: mprahl <mprahl@users.noreply.github.com>
fix lint minor updates ci fix fix copilot feecback more copilot fixes more copilot more minor updates nit fixes minor fix more nits round 8 revert, scope creep lint further reductions dockerfile update apply jeff feedback fix jeff feedback 2 update loadProtos paths + move resolveArtifactCoordinates Signed-off-by: JerT33 <trestjeremiah@gmail.com>
…#13569) Bumps and [undici](https://github.com/nodejs/undici). These dependencies needed to be updated together. Updates `undici` from 7.24.2 to 7.28.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.2...v7.28.0) Updates `undici` from 6.24.1 to 6.27.0 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.24.2...v7.28.0) --- updated-dependencies: - dependency-name: undici dependency-version: 7.28.0 dependency-type: indirect - dependency-name: undici dependency-version: 6.27.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#13474) * feat(backend): enable create and schedule time placeholders Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * fix: address Copilot review feedback Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * fix: make schedule metadata lookup best-effort Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * test: refresh workflow compiler goldens Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * Address feedback Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> * fix(backend): use Argo v4 driver client Signed-off-by: droctothorpe <mythicalsunlight@gmail.com> --------- Signed-off-by: droctothorpe <mythicalsunlight@gmail.com>
…ubeflow#13512) Signed-off-by: Yunkai Li <yunli@redhat.com>
* chore(frontend): consolidate dependency updates Signed-off-by: Jeff Spahr <spahrj@gmail.com> * test(frontend): select loggable retry node Signed-off-by: Jeff Spahr <spahrj@gmail.com> --------- Signed-off-by: Jeff Spahr <spahrj@gmail.com>
…ge-20260630-134209 # Conflicts: # .github/actions/deploy/action.yml # .github/workflows/api-server-tests.yml # .github/workflows/docs-freshness.yml # .github/workflows/e2e-test.yml # .github/workflows/gcpc-modules-tests.yml # .github/workflows/sdk-component-yaml.yml # backend/Dockerfile # backend/Dockerfile.persistenceagent # backend/Dockerfile.scheduledworkflow # backend/api/Dockerfile # backend/api/v2beta1/python_http_client/README.md # backend/api/v2beta1/python_http_client/kfp_server_api/__init__.py # backend/api/v2beta1/python_http_client/kfp_server_api/models/__init__.py # backend/src/apiserver/config/config_test.go # backend/src/apiserver/plugins/mlflow/config.go # backend/src/apiserver/plugins/mlflow/config_test.go # backend/src/apiserver/plugins/mlflow/dispatcher.go # backend/src/apiserver/plugins/mlflow/handler.go # backend/src/apiserver/plugins/mlflow/handler_test.go # backend/src/apiserver/plugins/mlflow/run_start.go # backend/src/apiserver/resource/resource_manager_test.go # backend/src/v2/metadata/client_fake.go # backend/test/end2end/utils/mlflow_utils.go # components/OWNERS # go.mod # test/OWNERS # test_data/compiled-workflows/pipeline_with_string_machine_fields_task_output.yaml # third_party/ml-metadata/go.mod # third_party/ml-metadata/go.sum
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Important Review skippedToo many files! This PR contains 741 files, which is 591 over the limit of 150. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. ⚙️ Run configurationConfiguration used: Central YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (7)
📒 Files selected for processing (741)
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Author
Commit Checker results: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated sync from kubeflow/pipelines
masterbranch.Caution
This PR contains unresolved merge conflicts. The files listed below have
conflict markers (
<<<<<<<,=======,>>>>>>>) that must be resolvedbefore merging.
Files with conflicts:
.github/actions/deploy/action.yml.github/workflows/api-server-tests.yml.github/workflows/docs-freshness.yml.github/workflows/e2e-test.yml.github/workflows/gcpc-modules-tests.yml.github/workflows/sdk-component-yaml.ymlbackend/api/Dockerfilebackend/api/v2beta1/python_http_client/README.mdbackend/api/v2beta1/python_http_client/kfp_server_api/__init__.pybackend/api/v2beta1/python_http_client/kfp_server_api/models/__init__.pybackend/src/apiserver/config/config_test.gobackend/src/apiserver/plugins/mlflow/config.gobackend/src/apiserver/plugins/mlflow/config_test.gobackend/src/apiserver/plugins/mlflow/dispatcher.gobackend/src/apiserver/plugins/mlflow/handler.gobackend/src/apiserver/plugins/mlflow/handler_test.gobackend/src/apiserver/plugins/mlflow/run_start.gobackend/src/apiserver/resource/resource_manager_test.gobackend/src/v2/metadata/client_fake.gobackend/test/end2end/utils/mlflow_utils.gogo.modtest_data/compiled-workflows/pipeline_with_string_machine_fields_task_output.yamlthird_party/ml-metadata/go.modthird_party/ml-metadata/go.sumExcluded files (kept as downstream versions):
.tekton/*.github/renovate.json5backend/Dockerfile***/OWNERSOverwritten paths (always taken from upstream):
frontend/Created by the Upstream Sync workflow.