Update kubeflow/pipelines manifests from 2.0.0-alpha.3

.github/workflows/pipeline_kind_test.yaml

@@ -27,8 +27,4 @@ jobs:
       run: ./tests/gh-actions/install_cert_manager.sh
 
     - name: Build & Apply manifests
-      run: |
-        cd apps/pipeline/upstream
-        kubectl create ns kubeflow
-        kustomize build env/cert-manager/platform-agnostic-multi-user | kubectl apply -f -
-        kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout 180s
+      run: ./tests/gh-actions/install_pipelines.sh

README.md

@@ -53,7 +53,7 @@ This repo periodically syncs all official Kubeflow components from their respect
 | Katib | apps/katib/upstream | [v0.14.0-rc.0](https://github.com/kubeflow/katib/tree/v0.14.0-rc.0/manifests/v1beta1) |
 | KServe | contrib/kserve/kserve | [release-0.8](https://github.com/kserve/kserve/tree/8079f375cbcedc4d45a1b4aade2e2308ea6f9ae8/install/v0.8.0) |
 | KServe Models Web App | contrib/kserve/models-web-app | [v0.8.0](https://github.com/kserve/models-web-app/tree/v0.8.0/config) |
-| Kubeflow Pipelines | apps/pipeline/upstream | [1.8.2](https://github.com/kubeflow/pipelines/tree/1.8.2/manifests/kustomize) |
+| Kubeflow Pipelines | apps/pipeline/upstream | [2.0.0-alpha.3](https://github.com/kubeflow/pipelines/tree/2.0.0-alpha.3/manifests/kustomize) |
 | Kubeflow Tekton Pipelines | apps/kfp-tekton/upstream | [v1.2.1](https://github.com/kubeflow/kfp-tekton/tree/v1.2.1/manifests/kustomize) |
 
 The following is also a matrix with versions from common components that are

apps/pipeline/upstream/OWNERS

@@ -1,5 +1,4 @@
 approvers:
   - zijianjoy
 reviewers:
-  - Bobgy
   - zijianjoy

apps/pipeline/upstream/base/cache-deployer/kustomization.yaml

@@ -8,4 +8,4 @@ commonLabels:
   app: cache-deployer
 images:
   - name: gcr.io/ml-pipeline/cache-deployer
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3

apps/pipeline/upstream/base/cache/kustomization.yaml

@@ -10,4 +10,4 @@ commonLabels:
   app: cache-server
 images:
   - name: gcr.io/ml-pipeline/cache-server
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3

apps/pipeline/upstream/base/installs/generic/pipeline-install-config.yaml

@@ -11,7 +11,7 @@ data:
     until the changes take effect. A quick way to restart all deployments in a
     namespace: `kubectl rollout restart deployment -n <your-namespace>`.
   appName: pipeline
-  appVersion: 1.8.2
+  appVersion: 2.0.0-alpha.3
   dbHost: mysql
   dbPort: "3306"
   mlmdDb: metadb

apps/pipeline/upstream/base/installs/multi-user/pipelines-profile-controller/sync.py

@@ -93,7 +93,7 @@ def get_settings_from_env(controller_port=None,
 def server_factory(visualization_server_image,
                    visualization_server_tag, frontend_image, frontend_tag,
                    disable_istio_sidecar, minio_access_key,
-                   minio_secret_key, kfp_default_pipeline_root=None, 
+                   minio_secret_key, kfp_default_pipeline_root=None,
                    url="", controller_port=8080):
     """
     Returns an HTTPServer populated with Handler with customized settings
@@ -360,8 +360,8 @@ def sync(self, parent, children):
                     }
                 },
             ]
-            print('Received request:\n', json.dumps(parent, indent=2, sort_keys=True))
-            print('Desired resources except secrets:\n', json.dumps(desired_resources, indent=2, sort_keys=True))
+            print('Received request:\n', json.dumps(parent, sort_keys=True))
+            print('Desired resources except secrets:\n', json.dumps(desired_resources, sort_keys=True))
             # Moved after the print argument because this is sensitive data.
             desired_resources.append({
                 "apiVersion": "v1",

apps/pipeline/upstream/base/installs/multi-user/pipelines-profile-controller/test_sync.py

@@ -202,7 +202,7 @@ def test_sync_server_with_pipeline_enabled(sync_server, data, expected_status,
     url = f"http://{server.server_address[0]}:{str(server.server_address[1])}"
     print("url: ", url)
     print("data")
-    print(json.dumps(data, indent=2))
+    print(json.dumps(data))
     x = requests.post(url, data=json.dumps(data))
     results = json.loads(x.text)
 
@@ -245,7 +245,7 @@ def test_sync_server_with_direct_passing_of_settings(
     url = f"http://{server.server_address[0]}:{str(server.server_address[1])}"
     print("url: ", url)
     print("data")
-    print(json.dumps(data, indent=2))
+    print(json.dumps(data))
     x = requests.post(url, data=json.dumps(data))
     results = json.loads(x.text)
 
@@ -271,7 +271,7 @@ def test_sync_server_without_pipeline_enabled(sync_server, data, expected_status
     """
     Nearly end-to-end test of how Controller serves .sync as a POST
 
-    Tests case where metadata.labels.pipelines.kubeflow.org/enabled does not 
+    Tests case where metadata.labels.pipelines.kubeflow.org/enabled does not
     exist and thus server returns an empty reply
     """
     server, environ = sync_server

apps/pipeline/upstream/base/metadata/base/kustomization.yaml

@@ -9,4 +9,4 @@ resources:
   - metadata-grpc-sa.yaml
 images:
   - name: gcr.io/ml-pipeline/metadata-envoy
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3

apps/pipeline/upstream/base/pipeline/kustomization.yaml

@@ -37,14 +37,14 @@ resources:
   - kfp-launcher-configmap.yaml
 images:
   - name: gcr.io/ml-pipeline/api-server
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3
   - name: gcr.io/ml-pipeline/persistenceagent
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3
   - name: gcr.io/ml-pipeline/scheduledworkflow
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3
   - name: gcr.io/ml-pipeline/frontend
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3
   - name: gcr.io/ml-pipeline/viewer-crd-controller
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3
   - name: gcr.io/ml-pipeline/visualization-server
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3

apps/pipeline/upstream/base/pipeline/metadata-writer/kustomization.yaml

@@ -7,4 +7,4 @@ resources:
   - metadata-writer-sa.yaml
 images:
   - name: gcr.io/ml-pipeline/metadata-writer
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3

apps/pipeline/upstream/base/pipeline/ml-pipeline-apiserver-deployment.yaml

@@ -105,6 +105,21 @@ spec:
           initialDelaySeconds: 3
           periodSeconds: 5
           timeoutSeconds: 2
+        # This startup probe provides up to a 60 second grace window before the
+        # liveness probe takes over to accomodate the occasional database
+        # migration.
+        startupProbe:
+          exec:
+            command:
+              - wget
+              - -q # quiet
+              - -S # show server response
+              - -O
+              - "-" # Redirect output to stdout
+              - http://localhost:8888/apis/v1beta1/healthz
+          failureThreshold: 12
+          periodSeconds: 5
+          timeoutSeconds: 2
         resources:
           requests:
             cpu: 250m

apps/pipeline/upstream/env/aws/README.md

@@ -30,7 +30,7 @@ aws s3 mb s3://$S3_BUCKET --region $AWS_REGION
 
 3. Prepare RDS
 
-Follow this [doc](https://www.kubeflow.org/docs/aws/rds/#deploy-amazon-rds-mysql-in-your-environment) to set up AWS RDS instance.
+Follow this [doc](https://awslabs.github.io/kubeflow-manifests/docs/deployment/rds-s3/guide/) to set up AWS RDS instance.
 
 4. Customize your values
 - Edit [params.env](params.env), [secret.env](secret.env) and [minio-artifact-secret-patch.env](minio-artifact-secret-patch.env)

apps/pipeline/upstream/env/gcp/inverse-proxy/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
   - name: gcr.io/ml-pipeline/inverse-proxy-agent
-    newTag: 1.8.2
+    newTag: 2.0.0-alpha.3
 resources:
   - proxy-configmap.yaml
   - proxy-deployment.yaml

apps/pipeline/upstream/env/platform-agnostic-multi-user-emissary/workflow-controller-configmap-patch.yaml

@@ -4,9 +4,9 @@ metadata:
   name: workflow-controller-configmap
 data:
   # References:
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/config/config.go
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.md
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.yaml
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/config/config.go
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.md
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.yaml
 
   # Emissary Executor: https://argoproj.github.io/argo-workflows/workflow-executors/#emissary-emissary
   containerRuntimeExecutor: emissary

apps/pipeline/upstream/env/platform-agnostic-multi-user-pns/workflow-controller-configmap-patch.yaml

@@ -4,9 +4,9 @@ metadata:
   name: workflow-controller-configmap
 data:
   # References:
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/config/config.go
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.md
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.yaml
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/config/config.go
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.md
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.yaml
 
   # pns executor is a more portable default, see https://github.com/kubeflow/pipelines/issues/1654.
   containerRuntimeExecutor: pns

apps/pipeline/upstream/env/platform-agnostic-pns/workflow-controller-configmap-patch.yaml

@@ -4,9 +4,9 @@ metadata:
   name: workflow-controller-configmap
 data:
   # References:
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/config/config.go
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.md
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.yaml
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/config/config.go
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.md
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.yaml
 
   # pns executor is a more portable default, see https://github.com/kubeflow/pipelines/issues/1654.
   # However, it is flaky for containers that run really fast, see https://github.com/kubeflow/pipelines/issues/5285.

apps/pipeline/upstream/third-party/argo/base/workflow-controller-configmap-patch.yaml

@@ -4,9 +4,9 @@ metadata:
   name: workflow-controller-configmap
 data:
   # References:
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/config/config.go
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.md
-  # * https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.yaml
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/config/config.go
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.md
+  # * https://github.com/argoproj/argo-workflows/blob/v3.3.8/docs/workflow-controller-configmap.yaml
 
   # emissary executor is a more portable default, see https://github.com/kubeflow/pipelines/issues/1654.
   containerRuntimeExecutor: emissary

apps/pipeline/upstream/third-party/argo/base/workflow-controller-deployment-patch.yaml

@@ -7,12 +7,12 @@ spec:
     spec:
       containers:
         - name: workflow-controller
-          image: gcr.io/ml-pipeline/workflow-controller:v3.2.3-license-compliance
+          image: gcr.io/ml-pipeline/workflow-controller:v3.3.8-license-compliance
           args:
             - --configmap
             - workflow-controller-configmap
             - --executor-image
-            - gcr.io/ml-pipeline/argoexec:v3.2.3-license-compliance
+            - gcr.io/ml-pipeline/argoexec:v3.3.8-license-compliance
           resources:
             requests:
               cpu: 100m

apps/pipeline/upstream/third-party/argo/upstream/manifests/Kptfile

@@ -7,12 +7,12 @@ upstream:
   git:
     repo: https://github.com/argoproj/argo-workflows
     directory: /manifests
-    ref: v3.2.3
+    ref: v3.3.8
   updateStrategy: resource-merge
 upstreamLock:
   type: git
   git:
     repo: https://github.com/argoproj/argo-workflows
     directory: /manifests
-    ref: v3.2.3
-    commit: e5dc961b7846efe0fe36ab3a0964180eaedd2672
+    ref: v3.3.8
+    commit: 621b0d1a8e09634666ebe403ee7b8fc29db1dc4e

apps/pipeline/upstream/third-party/argo/upstream/manifests/base/argo-server/argo-server-deployment.yaml

@@ -16,10 +16,14 @@ spec:
         - name: argo-server
           image: quay.io/argoproj/argocli:latest
           securityContext:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
             capabilities:
               drop:
                 - ALL
           args: [server]
+          env: []
           ports:
             - name: web
               containerPort: 2746