test: enforce PSS restricted for CI user namespace

.github/workflows/dex_oauth2-proxy_test.yaml

@@ -7,7 +7,8 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
     - common/dex/base/**
     - tests/istio*
     - tests/dex_login_test.py

.github/workflows/istio_validation.yaml

@@ -252,7 +252,41 @@
     - name: Test basic connectivity
       run: |
         kubectl expose deployment test-application --port=80 --target-port=8080 -n $KF_PROFILE
-        kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE -- \
+        CLIENT_OVERRIDES=$(cat <<EOF
+{
+  "spec": {
+    "securityContext": {
+      "runAsNonRoot": true,
+      "runAsUser": 1000,
+      "seccompProfile": {
+        "type": "RuntimeDefault"
+      }
+    },
+    "containers": [
+      {
+        "name": "test-client",
+        "image": "busybox",
+        "stdin": true,
+        "tty": true,
+        "securityContext": {
+          "allowPrivilegeEscalation": false,
+          "capabilities": {
+            "drop": ["ALL"]
+          },
+          "runAsNonRoot": true,
+          "runAsUser": 1000,
+          "seccompProfile": {
+            "type": "RuntimeDefault"
+          }
+        }
+      }
+    ]
+  }
+}
+EOF
+)
+        kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE \
+          --overrides="${CLIENT_OVERRIDES}" -- \
           wget -qO- --timeout=10 test-application.$KF_PROFILE.svc.cluster.local
 
     - name: Apply Pod Security Standards Restricted levels

.github/workflows/katib_test.yaml

@@ -3,7 +3,7 @@ on:
   pull_request:
     paths:
     - tests/install_KinD_create_KinD_cluster_install_kustomize.sh
-    - tests/katib_install.sh
+    - tests/katib*
     - .github/workflows/katib_test.yaml
     - applications/katib/upstream/**
     - common/istio*/**
@@ -12,7 +12,8 @@ on:
     - tests/profile_controller_install.sh
     - applications/dashboard/upstream/profile-controller/**
     - common/cert-manager/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

.github/workflows/pipeline_run_from_notebook.yaml

@@ -14,6 +14,9 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
+    - tests/pipeline*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
     - common/kubeflow-namespace/**
 
 permissions:

.github/workflows/pipeline_test.yaml

@@ -13,9 +13,9 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - tests/pipeline_v1_test.py
-    - tests/pipeline_v2_test.py
-    - experimental/security/PSS/*
+    - tests/pipeline*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

.github/workflows/trainer_test.yaml

@@ -14,7 +14,8 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

.github/workflows/training_operator_test.yaml

@@ -14,7 +14,8 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

README.md

@@ -79,7 +79,7 @@ This repository periodically synchronizes all official Kubeflow components from
 | Kubeflow Pipelines | applications/pipeline/upstream | [2.16.1](https://github.com/kubeflow/pipelines/tree/2.16.1/manifests/kustomize) | 970m | 3552Mi | 35GB |
 | Kubeflow Hub | applications/hub/upstream | [v0.3.9](https://github.com/kubeflow/hub/tree/v0.3.9/manifests/kustomize) | 510m | 2112Mi | 20GB |
 | Spark Operator	|	applications/spark/spark-operator	|	[2.5.0](https://github.com/kubeflow/spark-operator/tree/v2.5.0) | 9m | 41Mi | 0GB |
-| Istio | common/istio | [1.29.2](https://github.com/istio/istio/releases/tag/1.29.2) | 750m | 2364Mi | 0GB |
+| Istio | common/istio | [1.30.0-rc.0](https://github.com/istio/istio/releases/tag/1.30.0-rc.0) | 750m | 2364Mi | 0GB |
 | Knative | common/knative/knative-serving <br /> common/knative/knative-eventing | [v1.21.1](https://github.com/knative/serving/releases/tag/knative-v1.21.1) <br /> [v1.21.0](https://github.com/knative/eventing/releases/tag/knative-v1.21.0) | 1450m | 1038Mi | 0GB |
 | Cert Manager | common/cert-manager | [1.19.4](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.4) | 3m | 128Mi | 0GB |
 | Dex | common/dex | [2.45.0](https://github.com/dexidp/dex/releases/tag/v2.45.0) | 3m | 27Mi | 0GB |

applications/katib/overlays/katib-with-kubeflow/katib-config.yaml

@@ -0,0 +1,6 @@
+apiVersion: config.kubeflow.org/v1beta1
+kind: KatibConfig
+init:
+  controller:
+    webhookPort: 8443
+    injectSecurityContext: true

applications/katib/overlays/katib-with-kubeflow/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../upstream/installs/katib-with-kubeflow
+configMapGenerator:
+- behavior: merge
+  files:
+  - katib-config.yaml
+  name: katib-config
+  options:
+    disableNameSuffixHash: true

applications/trainer/overlays/runtimes/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../upstream/overlays/runtimes
+patches:
+- path: torch_distributed_patch.yaml

applications/trainer/overlays/runtimes/torch_distributed_patch.yaml

@@ -0,0 +1,30 @@
+apiVersion: trainer.kubeflow.org/v1alpha1
+kind: ClusterTrainingRuntime
+metadata:
+  name: torch-distributed
+spec:
+  template:
+    spec:
+      replicatedJobs:
+        - name: node
+          template:
+            spec:
+              template:
+                spec:
+                  securityContext:
+                    runAsNonRoot: true
+                    runAsUser: 1000
+                    seccompProfile:
+                      type: RuntimeDefault
+                  containers:
+                    - name: node
+                      workingDir: /tmp
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                          drop:
+                            - ALL
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                          type: RuntimeDefault

common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml

@@ -7,8 +7,8 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: istio-ingressgateway
     app.kubernetes.io/part-of: istio
-    app.kubernetes.io/version: 1.29.2
-    helm.sh/chart: istio-ingress-1.29.2
+    app.kubernetes.io/version: 1.30.0-rc.0
+    helm.sh/chart: istio-ingress-1.30.0-rc.0
     install.operator.istio.io/owning-resource: unknown
     istio: cluster-local-gateway
     istio.io/rev: default
@@ -26,8 +26,8 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: istio-ingressgateway
     app.kubernetes.io/part-of: istio
-    app.kubernetes.io/version: 1.29.2
-    helm.sh/chart: istio-ingress-1.29.2
+    app.kubernetes.io/version: 1.30.0-rc.0
+    helm.sh/chart: istio-ingress-1.30.0-rc.0
     install.operator.istio.io/owning-resource: unknown
     istio: cluster-local-gateway
     istio.io/dataplane-mode: none
@@ -59,9 +59,9 @@ spec:
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: istio-ingressgateway
         app.kubernetes.io/part-of: istio
-        app.kubernetes.io/version: 1.29.2
+        app.kubernetes.io/version: 1.30.0-rc.0
         chart: gateways
-        helm.sh/chart: istio-ingress-1.29.2
+        helm.sh/chart: istio-ingress-1.30.0-rc.0
         heritage: Tiller
         install.operator.istio.io/owning-resource: unknown
         istio: cluster-local-gateway
@@ -144,7 +144,7 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: spec.nodeName
-        image: registry.istio.io/release/proxyv2:1.29.2
+        image: registry.istio.io/release/proxyv2:1.30.0-rc.0
         name: istio-proxy
         ports:
         - containerPort: 15020
@@ -260,8 +260,8 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: istio-ingressgateway
     app.kubernetes.io/part-of: istio
-    app.kubernetes.io/version: 1.29.2
-    helm.sh/chart: istio-ingress-1.29.2
+    app.kubernetes.io/version: 1.30.0-rc.0
+    helm.sh/chart: istio-ingress-1.30.0-rc.0
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: IngressGateways
@@ -286,8 +286,8 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: istio-ingressgateway
     app.kubernetes.io/part-of: istio
-    app.kubernetes.io/version: 1.29.2
-    helm.sh/chart: istio-ingress-1.29.2
+    app.kubernetes.io/version: 1.30.0-rc.0
+    helm.sh/chart: istio-ingress-1.30.0-rc.0
     install.operator.istio.io/owning-resource: unknown
     istio.io/rev: default
     operator.istio.io/component: IngressGateways
@@ -311,8 +311,8 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: istio-ingressgateway
     app.kubernetes.io/part-of: istio
-    app.kubernetes.io/version: 1.29.2
-    helm.sh/chart: istio-ingress-1.29.2
+    app.kubernetes.io/version: 1.30.0-rc.0
+    helm.sh/chart: istio-ingress-1.30.0-rc.0
     install.operator.istio.io/owning-resource: unknown
     istio: cluster-local-gateway
     istio.io/rev: default
@@ -345,8 +345,8 @@ metadata:
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: istio-ingressgateway
     app.kubernetes.io/part-of: istio
-    app.kubernetes.io/version: 1.29.2
-    helm.sh/chart: istio-ingress-1.29.2
+    app.kubernetes.io/version: 1.30.0-rc.0
+    helm.sh/chart: istio-ingress-1.30.0-rc.0
     install.operator.istio.io/owning-resource: unknown
     istio: cluster-local-gateway
     istio.io/rev: default