Integrate profiles with seaweedfs by pschoen-itsc · Pull Request #3051 · kubeflow/community-distribution

pschoen-itsc · 2025-03-14T15:56:33Z

Pull Request Template for Kubeflow Manifests

✏️ Summary of Changes

Use ACLs in seaweedfs to isolate access to artifacts by profile. When a new profile is created, credentials for this profile will be created by seaweedfs and put as secret into the new namespace. ACLs will be set to limited to access from this profile to his subdir in the bucket.

📦 Dependencies

🐛 Related Issues

Don't know if there is currently an open issue

✅ Contributor Checklist

I have tested these changes with kustomize. See Installation Prerequisites.
All commits are signed-off to satisfy the DCO check.

You can join the CNCF Slack and access our meetings at the Kubeflow Community website. Our channel on the CNCF Slack is here #kubeflow-platform.

pschoen-itsc · 2025-03-14T16:06:45Z

@juliusvonkohout I need to do a bit more testing (for example UI components), but the integration between seaweedfs and kf-pipelines works that way.

juliusvonkohout · 2025-03-14T18:31:43Z

/retest

juliusvonkohout · 2025-03-16T17:44:48Z

    - namespaceSelector:
        matchExpressions:
        - key: kubernetes.io/metadata.name
          operator: In
          values:
          - istio-system
-    - podSelector: {}


ml-pipeline-ui and maybe others need it as well without the artifact proxy

juliusvonkohout · 2025-03-16T18:14:14Z

@juliusvonkohout I need to do a bit more testing (for example UI components), but the integration between seaweedfs and kf-pipelines works that way.

Thank you very much for the PR. I have added a lot of comments and clarifications.

Now the question is why does the pipeline not stop running.

juliusvonkohout · 2025-04-12T11:32:20Z

Do you mind squashing and signing your commits (DCO) and rebasing to master?

juliusvonkohout · 2025-04-12T11:35:47Z

I think you can copy from our new pipeline install script. See also https://github.com/kubeflow/manifests/pull/3093/files and https://github.com/kubeflow/manifests/blob/master/.github/workflows/pipeline_test.yaml as reference.

juliusvonkohout · 2025-04-25T16:47:53Z

Thank you, i just re-enabled the tests

juliusvonkohout · 2025-04-25T16:49:43Z

Ah i broke the DCO, but you can just squash my test enabling commit and take ownership of it if needed. Otherwise i will fix it later myself

Signed-off-by: Patrick Schönthaler <patrick.schoenthaler@itsc.de>

juliusvonkohout · 2025-04-25T17:05:46Z

I think https://github.com/pschoen-itsc/kf-manifests/blob/integrate-profiles-with-seaweedfs/tests/gh-actions/pipeline_test.py or https://github.com/kubeflow/manifests/actions/runs/14669563838/job/41172716531?pr=3051 needs some debugging.

Signed-off-by: Patrick Schönthaler <patrick.schoenthaler@itsc.de>

pschoen-itsc · 2025-04-25T18:07:12Z

The End-to-End Integration test succeded before, now it fails without changing anything...
@juliusvonkohout can you just retrigger it?

milinddethe15 · 2025-04-25T18:09:55Z

/retest

juliusvonkohout · 2025-04-27T10:20:38Z

Amazing, thank you very much. It it such an improvement of the status quo.

In a follow up PR we should

check whether ubuntu-latest-16-cores is really needed instead of the smaller nodes
test it also in https://github.com/kubeflow/manifests/blob/master/.github/workflows/full_kubeflow_integration_test.yaml
Add security checks to fest for unauthorized access
Adjust the Argo Workflow-Controller configuration map to achieve the same for V1 pipelines (easy, did so before)
See how we can upstream that to KFP
@akagami-harsh this could be interesting for you.

Thank you everyone!
I am pushing this for 4 years or so and even had google and redhat employees involved, back then even Amazon. It is fundamental for CVEs, maintainabiliy (minio is now stuck for 5 years or so) and hard multi-tenancy as basic requirement for a sane platform. We also had approaches there for several years with minio. it started all in 2020 here kubeflow/pipelines#4649 and went via kubeflow/pipelines#7725 (2022) and #2826 (October 2024) to #3051 (2025). Without that experimental and extended tests it would have been very hard to pull of and coordinate. I want to especially highlight @pschoen-itsc who spent his effort here for the public health sector in Germany where many insurances need hard multi-tenancy to process data.

/lgtm
/approve

google-oss-prow · 2025-04-27T10:20:53Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: juliusvonkohout

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [juliusvonkohout]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

juliusvonkohout · 2025-04-28T15:04:55Z

Tracked in #3119

google-oss-prow Bot added the do-not-merge/work-in-progress label Mar 14, 2025

google-oss-prow Bot requested review from juliusvonkohout and kimwnasptd March 14, 2025 15:56

google-oss-prow Bot added the size/XL label Mar 14, 2025

pschoen-itsc commented Mar 14, 2025

View reviewed changes

Comment thread experimental/seaweedfs/base/seaweedfs/seaweedfs-admin-secret.yaml Outdated

pschoen-itsc commented Mar 14, 2025

View reviewed changes

Comment thread experimental/seaweedfs/base/pipeline-profile-controller/deployment.yaml Outdated