test: enforce PSS restricted for CI user namespace

.github/workflows/dex_oauth2-proxy_test.yaml

@@ -7,7 +7,8 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
     - common/dex/base/**
     - tests/istio*
     - tests/dex_login_test.py

.github/workflows/istio_validation.yaml

@@ -252,7 +252,8 @@ jobs:
     - name: Test basic connectivity
       run: |
         kubectl expose deployment test-application --port=80 --target-port=8080 -n $KF_PROFILE
-        kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE -- \
+        kubectl run test-client --image=busybox:1.36.1 --rm -i --restart=Never -n $KF_PROFILE \
+          --overrides='{"spec": {"securityContext": {"runAsNonRoot": true, "runAsUser": 1000, "seccompProfile": {"type": "RuntimeDefault"}}, "containers": [{"name": "test-client", "image": "busybox:1.36.1", "stdin": true, "tty": true, "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsNonRoot": true, "runAsUser": 1000, "seccompProfile": {"type": "RuntimeDefault"}}}]}}' -- \
           wget -qO- --timeout=10 test-application.$KF_PROFILE.svc.cluster.local
 
     - name: Apply Pod Security Standards Restricted levels

.github/workflows/katib_test.yaml

@@ -3,7 +3,7 @@ on:
   pull_request:
     paths:
     - tests/install_KinD_create_KinD_cluster_install_kustomize.sh
-    - tests/katib_install.sh
+    - tests/katib*
     - .github/workflows/katib_test.yaml
     - applications/katib/upstream/**
     - common/istio*/**
@@ -12,7 +12,8 @@ on:
     - tests/profile_controller_install.sh
     - applications/dashboard/upstream/profile-controller/**
     - common/cert-manager/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

.github/workflows/pipeline_run_from_notebook.yaml

@@ -14,6 +14,9 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
+    - tests/pipeline*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
     - common/kubeflow-namespace/**
 
 permissions:

.github/workflows/pipeline_test.yaml

@@ -13,9 +13,9 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - tests/pipeline_v1_test.py
-    - tests/pipeline_v2_test.py
-    - experimental/security/PSS/*
+    - tests/pipeline*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

.github/workflows/trainer_test.yaml

@@ -14,7 +14,8 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

.github/workflows/training_operator_test.yaml

@@ -14,7 +14,8 @@ on:
     - common/cert-manager/**
     - common/oauth2-proxy/**
     - common/istio*/**
-    - experimental/security/PSS/*
+    - tests/kubeflow_profile_install.sh
+    - tests/PSS_enable.sh
 
 permissions:
   contents: read

applications/katib/overlays/katib-with-kubeflow/katib-config.yaml

@@ -0,0 +1,9 @@
+# Katib Config patch to enable PSS compliance.
+# injectSecurityContext: true clones securityContext properties from primary
+# trial containers to sidecar metrics-collectors, preventing admission blocks.
+apiVersion: config.kubeflow.org/v1beta1
+kind: KatibConfig
+init:
+  controller:
+    webhookPort: 8443
+    injectSecurityContext: true

applications/katib/overlays/katib-with-kubeflow/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../upstream/installs/katib-with-kubeflow
+configMapGenerator:
+- behavior: merge
+  files:
+  - katib-config.yaml
+  name: katib-config
+  options:
+    disableNameSuffixHash: true

applications/trainer/overlays/runtimes/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../upstream/overlays/runtimes
+patches:
+- path: torch_distributed_patch.yaml

applications/trainer/overlays/runtimes/torch_distributed_patch.yaml

@@ -0,0 +1,32 @@
+apiVersion: trainer.kubeflow.org/v1alpha1
+kind: ClusterTrainingRuntime
+metadata:
+  name: torch-distributed
+spec:
+  template:
+    spec:
+      replicatedJobs:
+        - name: node
+          template:
+            spec:
+              template:
+                spec:
+                  securityContext:
+                    runAsNonRoot: true
+                    runAsUser: 1000
+                    seccompProfile:
+                      type: RuntimeDefault
+                  containers:
+                    - name: node
+                      # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+                      # (read-only root fs in base image). Safe for short-running stateless test pods.
+                      workingDir: /tmp
+                      securityContext:
+                        allowPrivilegeEscalation: false
+                        capabilities:
+                          drop:
+                            - ALL
+                        runAsNonRoot: true
+                        runAsUser: 1000
+                        seccompProfile:
+                          type: RuntimeDefault

scripts/synchronize-istio-manifests.sh

@@ -5,8 +5,12 @@ source "${SCRIPT_DIRECTORY}/library.sh"
 setup_error_handling
 COMPONENT_NAME="istio"
 REPOSITORY_NAME="istio/istio"
-COMMIT="1.29.2"
-PREVIOUS_COMMIT="1.29.1"
+COMMIT="1.30.0"
+PREVIOUS_COMMIT="1.29.2"
+if [[ "${COMMIT}" =~ -(rc|beta|alpha)([.-]|$) ]]; then
+    echo "Refusing to synchronize pre-release Istio version: ${COMMIT}. Pin COMMIT to a stable GA release tag."
+    exit 1
+fi
 SOURCE_DIRECTORY=${SOURCE_DIRECTORY:=/tmp/kubeflow-${COMPONENT_NAME}}
 BRANCH_NAME=${BRANCH_NAME:=synchronize-${COMPONENT_NAME}-manifests-${COMMIT?}}
 MANIFESTS_DIRECTORY=$(dirname $SCRIPT_DIRECTORY)
@@ -15,7 +19,7 @@ create_branch "$BRANCH_NAME"
 mkdir -p "$SOURCE_DIRECTORY"
 cd "$SOURCE_DIRECTORY"
 if [ ! -d "istio-${COMMIT}" ]; then
-    wget "https://github.com/${REPOSITORY_NAME}/releases/download/${COMMIT}/istio-${COMMIT}-linux-amd64.tar.gz"
+    curl -L -O "https://github.com/${REPOSITORY_NAME}/releases/download/${COMMIT}/istio-${COMMIT}-linux-amd64.tar.gz"
     tar xvfz istio-${COMMIT}-linux-amd64.tar.gz
 fi
 ISTIOCTL="${SOURCE_DIRECTORY}/istio-${COMMIT}/bin/istioctl"

tests/katib_install.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -euxo pipefail
 
-cd applications/katib/upstream && kustomize build installs/katib-with-kubeflow | kubectl apply -f - && cd ../../../
+cd applications/katib && kustomize build overlays/katib-with-kubeflow | kubectl apply -f - && cd ../../
 
 kubectl wait --for=condition=Available deployment/katib-controller -n kubeflow --timeout=300s
 

tests/katib_test.yaml

@@ -44,9 +44,26 @@ spec:
             annotations:
               sidecar.istio.io/inject: "false"
           spec:
+            securityContext:
+              runAsNonRoot: true
+              runAsUser: 1000
+              seccompProfile:
+                type: RuntimeDefault
             containers:
             - name: training-container
               image: ghcr.io/kubeflow/katib/pytorch-mnist-cpu:v0.19.0
+              # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+              # (read-only root fs in base image). Safe for short-running stateless test pods.
+              workingDir: /tmp
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                  - ALL
+                runAsNonRoot: true
+                runAsUser: 1000
+                seccompProfile:
+                  type: RuntimeDefault
               command:
               - "python3"
               - "/opt/pytorch-mnist/mnist.py"

tests/kubeflow_profile_install.sh

@@ -6,4 +6,7 @@ PROFILE_CONTROLLER_POD=$(kubectl get pods -n kubeflow -o json | jq -r '.items[]
 kubectl logs -n kubeflow "$PROFILE_CONTROLLER_POD"
 KF_PROFILE=kubeflow-user-example-com
 kubectl -n $KF_PROFILE get pods,configmaps,secrets
-kubectl label namespace $KF_PROFILE pod-security.kubernetes.io/enforce=baseline --overwrite
+kubectl label namespace $KF_PROFILE \
+  pod-security.kubernetes.io/enforce=restricted \
+  pod-security.kubernetes.io/enforce-version=v1.29 \
+  --overwrite

tests/notebook.test.kubeflow-user-example.com.yaml

@@ -13,9 +13,20 @@ metadata:
 spec:
   template:
     spec:
+      securityContext:
+        fsGroup: 100
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       containers:
       - name: test
         image: ghcr.io/kubeflow/kubeflow/notebook-servers/jupyter-scipy:v1.10.0
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsNonRoot: true
         imagePullPolicy: IfNotPresent
         resources:
           limits:

tests/trainer_install.sh

@@ -12,7 +12,7 @@ kubectl wait --for=condition=Available deployment/kubeflow-trainer-controller-ma
 kubectl get crd jobsets.jobset.x-k8s.io
 kubectl wait --for=condition=Available deployment/jobset-controller-manager -n kubeflow-system --timeout=120s
 
-kustomize build upstream/overlays/runtimes | kubectl apply --server-side --force-conflicts -f -
+kustomize build overlays/runtimes | kubectl apply --server-side --force-conflicts -f -
 
 kubectl apply -f upstream/overlays/kubeflow-platform/kubeflow-trainer-roles.yaml
 

tests/training_operator_job.yaml

@@ -14,10 +14,27 @@ spec:
           labels:
             sidecar.istio.io/inject: "false"
         spec:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
           containers:
           - name: pytorch
             image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
             imagePullPolicy: Always
+            # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+            # (read-only root fs in base image). Safe for short-running stateless test pods.
+            workingDir: /tmp
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              runAsNonRoot: true
+              runAsUser: 1000
+              seccompProfile:
+                type: RuntimeDefault
             command:
             - "python3"
             - "/opt/pytorch-mnist/mnist.py"
@@ -53,10 +70,44 @@ spec:
           labels:
             sidecar.istio.io/inject: "false"
         spec:
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            seccompProfile:
+              type: RuntimeDefault
+          initContainers:
+          # Use reproducible, pinned stable busybox image for network probe
+          - name: init-pytorch
+            image: busybox:1.36.1
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              runAsNonRoot: true
+              runAsUser: 1000
+              seccompProfile:
+                type: RuntimeDefault
+            command:
+            - sh
+            - -c
+            - until nslookup pytorch-simple-master-0; do echo waiting for master; sleep 2; done;
           containers:
           - name: pytorch
             image: docker.io/kubeflowkatib/pytorch-mnist:v1beta1-45c5727
             imagePullPolicy: Always
+            # workingDir: /tmp is used as a writable directory workaround under PSS Restricted
+            # (read-only root fs in base image). Safe for short-running stateless test pods.
+            workingDir: /tmp
+            securityContext:
+              allowPrivilegeEscalation: false
+              capabilities:
+                drop:
+                - ALL
+              runAsNonRoot: true
+              runAsUser: 1000
+              seccompProfile:
+                type: RuntimeDefault
             command:
             - "python3"
             - "/opt/pytorch-mnist/mnist.py"

tests/workspaces-kustomization/jupyterlab_workspacekind_patch.yaml

@@ -0,0 +1,21 @@
+apiVersion: kubeflow.org/v1beta1
+kind: WorkspaceKind
+metadata:
+  name: jupyterlab
+spec:
+  podTemplate:
+    securityContext:
+      fsGroup: 100
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      runAsNonRoot: true
+      runAsUser: 1000
+      seccompProfile:
+        type: RuntimeDefault

tests/workspaces-kustomization/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ../../applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml
+patches:
+- path: jupyterlab_workspacekind_patch.yaml

tests/workspaces_pipeline_run_test.sh

@@ -3,7 +3,7 @@ set -euxo pipefail
 
 KF_PROFILE=${1:-kubeflow-user-example-com}
 
-kubectl apply -f applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml
+kustomize build --load-restrictor LoadRestrictionsNone tests/workspaces-kustomization | kubectl apply -f -
 kubectl apply -f tests/workspace.test.kubeflow-user-example-com.yaml
 kubectl wait --for=jsonpath='{.status.state}'=Running \
   workspace/test -n "${KF_PROFILE}" \