Skip to content

test: enforce PSS restricted for CI user namespace #3444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abdullahpathan22 wants to merge 8 commits into
base: master
Choose a base branch
from
Open

test: enforce PSS restricted for CI user namespace #3444

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
8f7f127
feat: enforce PSS restricted for CI and upgrade Istio to 1.30
abdullahpathan22 May 17, 2026
09bd010
fix: resolve PSS Restricted CI failures & address all 10 Copilot revi…
abdullahpathan22 May 17, 2026
8f11a58
fix: resolve all 15 Copilot review comments and format_YAML_files lin…
abdullahpathan22 May 17, 2026
a05f5e8
fix: restore Istio 1.30 to fix PSS CI violations and address label races
abdullahpathan22 May 19, 2026
831453e
fix: upgrade Istio to stable 1.30.0 and dynamically patch Profiles PS…
abdullahpathan22 May 19, 2026
186189f
fix: dynamically query ConfigMap name with Kustomize hash suffix in p…
abdullahpathan22 May 19, 2026
d227776
fix: resolve katib ca verification failure and insecure namespace lab…
abdullahpathan22 May 19, 2026
de09786
fix(trainer): restore torch-distributed runtime labels and image dyna…
abdullahpathan22 Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/dex_oauth2-proxy_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,8 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- experimental/security/PSS/*
- tests/kubeflow_profile_install.sh
- tests/PSS_enable.sh
Comment on lines +10 to +11
- common/dex/base/**
- tests/istio*
- tests/dex_login_test.py
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/istio_validation.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,8 @@ jobs:
- name: Test basic connectivity
run: |
kubectl expose deployment test-application --port=80 --target-port=8080 -n $KF_PROFILE
kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE -- \
kubectl run test-client --image=busybox --rm -i --restart=Never -n $KF_PROFILE \
--overrides='{"spec": {"securityContext": {"runAsNonRoot": true, "runAsUser": 1000, "seccompProfile": {"type": "RuntimeDefault"}}, "containers": [{"name": "test-client", "image": "busybox", "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsNonRoot": true, "runAsUser": 1000}}]}}' -- \
wget -qO- --timeout=10 test-application.$KF_PROFILE.svc.cluster.local

- name: Apply Pod Security Standards Restricted levels
Expand Down
5 changes: 3 additions & 2 deletions .github/workflows/katib_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ on:
pull_request:
paths:
- tests/install_KinD_create_KinD_cluster_install_kustomize.sh
- tests/katib_install.sh
- tests/katib*
- .github/workflows/katib_test.yaml
- applications/katib/upstream/**
- common/istio*/**
Expand All @@ -12,7 +12,8 @@ on:
- tests/profile_controller_install.sh
- applications/dashboard/upstream/profile-controller/**
- common/cert-manager/**
- experimental/security/PSS/*
- tests/kubeflow_profile_install.sh
- tests/PSS_enable.sh

permissions:
contents: read
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/pipeline_run_from_notebook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- tests/pipeline*
- tests/kubeflow_profile_install.sh
- tests/PSS_enable.sh
- common/kubeflow-namespace/**

permissions:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/pipeline_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- tests/pipeline_v1_test.py
- tests/pipeline_v2_test.py
- experimental/security/PSS/*
- tests/pipeline*
- tests/kubeflow_profile_install.sh
- tests/PSS_enable.sh

permissions:
contents: read
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/trainer_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- experimental/security/PSS/*
- tests/kubeflow_profile_install.sh
- tests/PSS_enable.sh

permissions:
contents: read
Expand Down
3 changes: 2 additions & 1 deletion .github/workflows/training_operator_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,8 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- experimental/security/PSS/*
- tests/kubeflow_profile_install.sh
- tests/PSS_enable.sh
Comment on lines +17 to +18

permissions:
contents: read
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ This repository periodically synchronizes all official Kubeflow components from
| Kubeflow Pipelines | applications/pipeline/upstream | [2.16.1](https://github.com/kubeflow/pipelines/tree/2.16.1/manifests/kustomize) | 970m | 3552Mi | 35GB |
| Kubeflow Hub | applications/hub/upstream | [v0.3.9](https://github.com/kubeflow/hub/tree/v0.3.9/manifests/kustomize) | 510m | 2112Mi | 20GB |
| Spark Operator | applications/spark/spark-operator | [2.5.0](https://github.com/kubeflow/spark-operator/tree/v2.5.0) | 9m | 41Mi | 0GB |
| Istio | common/istio | [1.29.2](https://github.com/istio/istio/releases/tag/1.29.2) | 750m | 2364Mi | 0GB |
| Istio | common/istio | [1.30.0-rc.0](https://github.com/istio/istio/releases/tag/1.30.0-rc.0) | 750m | 2364Mi | 0GB |
| Knative | common/knative/knative-serving <br /> common/knative/knative-eventing | [v1.21.1](https://github.com/knative/serving/releases/tag/knative-v1.21.1) <br /> [v1.21.0](https://github.com/knative/eventing/releases/tag/knative-v1.21.0) | 1450m | 1038Mi | 0GB |
| Cert Manager | common/cert-manager | [1.19.4](https://github.com/cert-manager/cert-manager/releases/tag/v1.19.4) | 3m | 128Mi | 0GB |
| Dex | common/dex | [2.45.0](https://github.com/dexidp/dex/releases/tag/v2.45.0) | 3m | 27Mi | 0GB |
Expand Down
13 changes: 13 additions & 0 deletions applications/trainer/upstream/base/runtimes/torch_distributed.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,19 @@ spec:
spec:
template:
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
containers:
- name: node
image: pytorch/pytorch:2.10.0-cuda12.8-cudnn9-runtime
workingDir: /tmp
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
add: []
runAsNonRoot: true
2 changes: 2 additions & 0 deletions applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,8 @@ spec:
##
securityContext:
fsGroup: 100
seccompProfile:
type: RuntimeDefault

## container SecurityContext for Workspace Pods (MUTABLE)
## - spec for SecurityContext:
Expand Down
30 changes: 15 additions & 15 deletions common/istio/cluster-local-gateway/base/cluster-local-gateway.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
app.kubernetes.io/version: 1.29.2
helm.sh/chart: istio-ingress-1.29.2
app.kubernetes.io/version: 1.30.0-rc.0
helm.sh/chart: istio-ingress-1.30.0-rc.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/rev: default
Expand All @@ -26,8 +26,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
app.kubernetes.io/version: 1.29.2
helm.sh/chart: istio-ingress-1.29.2
app.kubernetes.io/version: 1.30.0-rc.0
helm.sh/chart: istio-ingress-1.30.0-rc.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/dataplane-mode: none
Expand Down Expand Up @@ -59,9 +59,9 @@ spec:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
app.kubernetes.io/version: 1.29.2
app.kubernetes.io/version: 1.30.0-rc.0
chart: gateways
helm.sh/chart: istio-ingress-1.29.2
helm.sh/chart: istio-ingress-1.30.0-rc.0
heritage: Tiller
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
Expand Down Expand Up @@ -144,7 +144,7 @@ spec:
valueFrom:
fieldRef:
fieldPath: spec.nodeName
image: registry.istio.io/release/proxyv2:1.29.2
image: registry.istio.io/release/proxyv2:1.30.0-rc.0
name: istio-proxy
ports:
- containerPort: 15020
Expand Down Expand Up @@ -260,8 +260,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
app.kubernetes.io/version: 1.29.2
helm.sh/chart: istio-ingress-1.29.2
app.kubernetes.io/version: 1.30.0-rc.0
helm.sh/chart: istio-ingress-1.30.0-rc.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: IngressGateways
Expand All @@ -286,8 +286,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
app.kubernetes.io/version: 1.29.2
helm.sh/chart: istio-ingress-1.29.2
app.kubernetes.io/version: 1.30.0-rc.0
helm.sh/chart: istio-ingress-1.30.0-rc.0
install.operator.istio.io/owning-resource: unknown
istio.io/rev: default
operator.istio.io/component: IngressGateways
Expand All @@ -311,8 +311,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
app.kubernetes.io/version: 1.29.2
helm.sh/chart: istio-ingress-1.29.2
app.kubernetes.io/version: 1.30.0-rc.0
helm.sh/chart: istio-ingress-1.30.0-rc.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/rev: default
Expand Down Expand Up @@ -345,8 +345,8 @@ metadata:
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: istio-ingressgateway
app.kubernetes.io/part-of: istio
app.kubernetes.io/version: 1.29.2
helm.sh/chart: istio-ingress-1.29.2
app.kubernetes.io/version: 1.30.0-rc.0
helm.sh/chart: istio-ingress-1.30.0-rc.0
install.operator.istio.io/owning-resource: unknown
istio: cluster-local-gateway
istio.io/rev: default
Expand Down
Loading
Loading