fix: update kserve models web application for PR #163 restructure

[danish9039]

Summary of Changes

Prepares kubeflow/manifests for the merged upstream change in kserve/models-web-app#163, which restructures the Kustomize manifests and renames the deployment.

Scope

This draft PR is intentionally limited to the synced application manifests and the downstream integration updates needed for that upstream change.

Deferred to a follow-up PR:

• experimental/helm/charts/kserve-models-web-app/**
• tests/helm_kustomize_compare.py
• tests/helm_kustomize_compare.sh

Changes

• Sync upstream manifests/kustomize/ structure into applications/kserve/models-web-app/
• Keep the new base/components/overlays layout from upstream
• Rename Kubernetes resources, labels, and selectors from kserve-models-web-app to kserve-models-web-application
• Update scripts/synchronize-kserve-web-application-manifests.sh
  • SOURCE_MANIFESTS_PATH=config -> manifests/kustomize
  • COMMIT=v0.16.1 -> c71ee4309f0335159d9fdfd4559a538b5c782c92
• Update the README sync reference for KServe Models Web Application to the upstream merged commit and new path
• Update downstream deployment wait references in:
  • .github/workflows/kserve_models_web_application_test.yaml
  • tests/kserve_install.sh
  • tests/kserve_test.sh

Notes

• The sync script now points to upstream merge commit c71ee4309f0335159d9fdfd4559a538b5c782c92 because release v0.16.1 was cut before kserve/models-web-app#163 merged.
• Once a release tag includes that upstream change, the sync script can be moved from the merge SHA to the release tag.

Validation

• kustomize build applications/kserve/models-web-app/base
• kustomize build applications/kserve/models-web-app/overlays/kubeflow
• bash -n scripts/synchronize-kserve-web-application-manifests.sh tests/kserve_install.sh tests/kserve_test.sh

Contributor Checklist

• All commits are signed-off to satisfy the DCO check.

[github-actions]

Welcome to the Kubeflow Manifests Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronizes from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/manifests to test the platform integration.

Community Resources:

• CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
• Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

[Copilot]

Pull request overview

This PR prepares kubeflow/manifests for a restructuring of KServe models web application manifests (kserve/models-web-app#163). It renames all Kubernetes resources from kserve-models-web-app to kserve-models-web-application, reorganizes Kustomize manifests into a base/components/overlays structure, and improves test reliability.

Changes:

• Renamed all Kubernetes resources, labels, and selectors from kserve-models-web-app to kserve-models-web-application across Kustomize manifests, Helm chart, CI workflows, and tests.
• Restructured Kustomize manifests: moved Istio resources (AuthorizationPolicy, VirtualService, sidecar injection) into a components/istio Kustomize component, added a components/common component, and removed the standalone istio.yaml from base.
• Improved Test 3 in kserve_test.sh with a dedicated port-forward, kubeflow-userid authentication headers, retry logic for bootstrap, and better error diagnostics.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/kserve_test.sh	Added auth headers, dedicated port-forward, retry bootstrap loop, better error handling for Test 3
tests/kserve_install.sh	Updated deployment wait name
tests/helm_kustomize_compare.py	Removed stale expected extra-resource allowance for base scenario
scripts/synchronize-kserve-web-application-manifests.sh	Updated source manifests path and commit placeholder
experimental/helm/charts/kserve-models-web-app/values.yaml	Updated imageTag to 0.16.0, disabled VirtualService by default, added useridPrefix
experimental/helm/charts/kserve-models-web-app/templates/istio/virtualservice.yaml	Render VirtualService when kubeflow is enabled
experimental/helm/charts/kserve-models-web-app/templates/deployment.yaml	Use fullname for container name, add GUNICORN_CMD_ARGS env var
experimental/helm/charts/kserve-models-web-app/templates/configmap.yaml	Added USERID_PREFIX config
experimental/helm/charts/kserve-models-web-app/templates/_helpers.tpl	Hardcoded kserve-models-web-application as default name, simplified fullname
experimental/helm/charts/kserve-models-web-app/Chart.yaml	Updated appVersion to v0.16.0
applications/kserve/models-web-app/base/*	Renamed resources, updated indentation
applications/kserve/models-web-app/components/istio/*	New Istio component with AuthorizationPolicy, VirtualService, sidecar
applications/kserve/models-web-app/components/common/kustomization.yaml	New common component with shared labels
applications/kserve/models-web-app/overlays/kubeflow/*	Updated to use components, renamed references
.github/workflows/kserve_models_web_application_test.yaml	Updated deployment name references

---

You can also share your feedback on Copilot code review. Take the survey.

[juliusvonkohout]

Please also do an automatic git diff style difference between the old rendered manifest and the new rendered manifests and post the differences here.

[danish9039]

Please also do an automatic git diff style difference between the old rendered manifest and the new rendered manifests and post the differences here.

diff --git a/home/danish/repos/kubeflow-manifests/cache/pr3393-render-diff/old-render.yaml b/home/danish/repos/kubeflow-manifests/cache/pr3393-render-diff/new-render.yaml
index 2480bbab..4aec3cc1 100644
--- a/repos/kubeflow-manifests/cache/pr3393-render-diff/old-render.yaml
+++ b/repos/kubeflow-manifests/cache/pr3393-render-diff/new-render.yaml
@@ -3,10 +3,10 @@ kind: ServiceAccount
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application
   namespace: kubeflow
 ---
 apiVersion: rbac.authorization.k8s.io/v1
@@ -14,10 +14,10 @@ kind: ClusterRole
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app-cluster-role
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application-cluster-role
 rules:
 - apiGroups:
   - authorization.k8s.io
@@ -71,17 +71,17 @@ kind: ClusterRoleBinding
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app-binding
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: kserve-models-web-app-cluster-role
+  name: kserve-models-web-application-cluster-role
 subjects:
 - kind: ServiceAccount
-  name: kserve-models-web-app
+  name: kserve-models-web-application
   namespace: kubeflow
 ---
 apiVersion: v1
@@ -96,10 +96,10 @@ kind: ConfigMap
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app-config
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application-config
   namespace: kubeflow
 ---
 apiVersion: v1
@@ -107,10 +107,10 @@ kind: Service
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application
   namespace: kubeflow
 spec:
   ports:
@@ -120,9 +120,9 @@ spec:
     targetPort: 5000
   selector:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
+    kustomize.component: kserve-models-web-application
   type: ClusterIP
 ---
 apiVersion: apps/v1
@@ -130,28 +130,28 @@ kind: Deployment
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application
   namespace: kubeflow
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: kserve
-      app.kubernetes.io/component: kserve-models-web-app
+      app.kubernetes.io/component: kserve-models-web-application
       app.kubernetes.io/name: kserve
-      kustomize.component: kserve-models-web-app
+      kustomize.component: kserve-models-web-application
   template:
     metadata:
       annotations:
         sidecar.istio.io/inject: "true"
       labels:
         app: kserve
-        app.kubernetes.io/component: kserve-models-web-app
+        app.kubernetes.io/component: kserve-models-web-application
         app.kubernetes.io/name: kserve
-        kustomize.component: kserve-models-web-app
+        kustomize.component: kserve-models-web-application
     spec:
       containers:
       - env:
@@ -159,7 +159,7 @@ spec:
           value: --limit-request-field_size 32000
         envFrom:
         - configMapRef:
-            name: kserve-models-web-app-config
+            name: kserve-models-web-application-config
         image: ghcr.io/kserve/models-web-app:0.16.1
         imagePullPolicy: Always
         livenessProbe:
@@ -171,7 +171,7 @@ spec:
           periodSeconds: 10
           successThreshold: 1
           timeoutSeconds: 1
-        name: kserve-models-web-app
+        name: kserve-models-web-application
         ports:
         - containerPort: 5000
           name: http
@@ -194,17 +194,17 @@ spec:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
-      serviceAccountName: kserve-models-web-app
+      serviceAccountName: kserve-models-web-application
 ---
 apiVersion: networking.istio.io/v1beta1
 kind: VirtualService
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application
   namespace: kubeflow
 spec:
   gateways:
@@ -219,7 +219,7 @@ spec:
       uri: /
     route:
     - destination:
-        host: kserve-models-web-app.kubeflow.svc.cluster.local
+        host: kserve-models-web-application.kubeflow.svc.cluster.local
         port:
           number: 80
 ---
@@ -228,10 +228,10 @@ kind: AuthorizationPolicy
 metadata:
   labels:
     app: kserve
-    app.kubernetes.io/component: kserve-models-web-app
+    app.kubernetes.io/component: kserve-models-web-application
     app.kubernetes.io/name: kserve
-    kustomize.component: kserve-models-web-app
-  name: kserve-models-web-app
+    kustomize.component: kserve-models-web-application
+  name: kserve-models-web-application
   namespace: kubeflow
 spec:
   action: ALLOW
@@ -243,6 +243,6 @@ spec:
   selector:
     matchLabels:
       app: kserve
-      app.kubernetes.io/component: kserve-models-web-app
+      app.kubernetes.io/component: kserve-models-web-application
       app.kubernetes.io/name: kserve
-      kustomize.component: kserve-models-web-app
+      kustomize.component: kserve-models-web-application

[juliusvonkohout]

Please revert all changes in tests/kserve_test.sh except for model-web-app -> models-web-application. Everything else must be justifies with strong arguments.

[Copilot]

Pull request overview

Updates the downstream KServe Models Web Application manifests and integration scripts to match the upstream restructure from kserve/models-web-app#163, including the new Kustomize base/components layout and the renamed deployment/resources.

Changes:

• Sync upstream manifests/kustomize into applications/kserve/models-web-app/ and introduce an Istio Kustomize component.
• Rename K8s resources/selectors from kserve-models-web-app to kserve-models-web-application.
• Update synchronization scripts, README upstream reference, and CI/test scripts to use the new names and paths.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/kserve_test.sh	Adjust web app API test to use new deployment/service name and add userid header + port-forward bootstrap flow.
tests/kserve_install.sh	Update readiness wait to the renamed deployment.
scripts/synchronize-kserve-web-application-manifests.sh	Sync script now tracks the upstream merge commit and new manifests path.
applications/kserve/models-web-app/overlays/kubeflow/kustomization.yaml	Wire in new component layout and renamed config/patch targets.
applications/kserve/models-web-app/overlays/kubeflow/patches/web-application-vsvc.yaml	Update VirtualService destination host for renamed service.
applications/kserve/models-web-app/components/istio/kustomization.yaml	New Kustomize component for Istio resources/patches.
applications/kserve/models-web-app/components/istio/authorization-policy.yaml	Reintroduce AuthorizationPolicy under the new component and naming.
applications/kserve/models-web-app/components/istio/virtual-service.yaml	Rename VirtualService and update destination host.
applications/kserve/models-web-app/components/istio/web-application-sidecar.yaml	Patch deployment name for sidecar injection.
applications/kserve/models-web-app/components/common/kustomization.yaml	Add common component labels (currently not referenced).
applications/kserve/models-web-app/base/{kustomization.yaml,deployment.yaml,service.yaml,rbac.yaml}	Rename core resources/selectors and configmap names to the new deployment/resource naming.
README.md	Update upstream sync reference to the merge commit and new path.
.github/workflows/kserve_models_web_application_test.yaml	Update workflow waits to the renamed deployment.

Comments suppressed due to low confidence (3)

tests/kserve_test.sh:213

• The cookie jar filename uses kserve_xcrf (likely a typo for XSRF). Renaming it to kserve_xsrf (and updating all references) would reduce confusion when debugging failures.

# Test unauthorized access to models web application
UNAUTHORIZED_TOKEN="$(kubectl -n default create token default)"
RESPONSE=$(curl -s -w "\n%{http_code}" "${BASE_URL}/api/namespaces/${NAMESPACE}/inferenceservices" -H "Authorization: Bearer ${UNAUTHORIZED_TOKEN}")

tests/kserve_test.sh:179

• This script now starts a background kubectl port-forward for the models web application and adds an EXIT trap to clean it up, but later it also starts another background kubectl port-forward (cluster-local-gateway) without cleanup. Consider centralizing cleanup in a single EXIT trap that reliably terminates both background port-forward processes to avoid leaving stray kubectl processes (and potential port conflicts) on test exit/failure.

  name: "sklearn-iris"
  namespace: ${NAMESPACE}
spec:
  predictor:
    sklearn:
      storageUri: "gs://kfserving-examples/models/sklearn/1.0/model"
      resources:
        requests:
          cpu: "50m"

applications/kserve/models-web-app/overlays/kubeflow/patches/web-application-vsvc.yaml:15

• This JSON6902 patch repeats the same replace operation for /spec/gateways twice. The second occurrence is redundant and makes the patch harder to reason about; please remove the duplicate operation so the patch has a single authoritative gateway replacement.

[juliusvonkohout]

@Raakshass can you help here ?

[danish9039]

@juliusvonkohout reverted tests/kserve_test.sh to have rename-only changes , and all 3
failing jobs now reproduce the same Test 3 bootstrap failure after deployment.apps/kserve-models-web-application condition met and inferences ervice.serving.kserve.io/sklearn-iris condition met

`curl -s
  http://localhost:8080/kserve-endpoints/ -H 'Authorization: Bearer ***' -v
  -c /tmp/kserve_xcrf.txt | grep -i set-cookie` -> `Process completed with
  exit code 1`.

the root cause is that the old gateway bootstrap path no longer returns the
Set-Cookie/XSRF cookie that Test 3 expects after the kserve-models- web-application restructure.

That missing-cookie failure is why I had added the extra Test 3 blocks
earlier , since we want the PR to have minimal changes , I'll add back only the smallest possible bootstrap/auth exception needed to restore CI.

[juliusvonkohout]

Could it be that there is an error in the manifests then? Why should we need the extra headers?

[Raakshass]

Could it be that there is an error in the manifests then? Why should we need the extra headers?

@juliusvonkohout all 9 checks are green now. Looking at kserve_install.sh I can replace the retry loop with explicit precondition checks if @danish9039 enables collaboration on the branch.

[juliusvonkohout]

Thank you. There are anyway open copilot comments that you need to take a look at. So we can also fix in the same PR #3393 (comment)

[danish9039]

Could it be that there is an error in the manifests then? Why should we need the extra headers?

Thank you. There are anyway open copilot comments that you need to take a look at. So we can also fix in the same PR [#3393 (comment)](#3393 (comment)

@juliusvonkohout My bad, the missing-cookie failure came from the stale NetworkPolicy selector under \common/..., not from missing headers, there was a mistake in diagnosing the problem , i have fixed that policy, removed the extra header changes, and CI is green now.

I have also addressed the comment regarding explicit precondition checks in kserve_install.sh as well

[danish9039]

@juliusvonkohout question : we still need to make changes in helm compare tooling as well .so, do you want that in a follow up PR ??

Also this PR use the commit SHA as the image tag is not cut yet

[juliusvonkohout]

Thank you
/lgtm
/approve

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: juliusvonkohout

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [juliusvonkohout]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[juliusvonkohout]

I think kubectl wait --for=condition=Ready pods --all --all-namespaces --timeout=600s \ is also a bit high timeout

[juliusvonkohout]

@juliusvonkohout question : we still need to make changes in helm compare tooling as well .so, do you want that in a follow up PR ??

Also this PR use the commit SHA as the image tag is not cut yet

Yes helm can also be done in a follow up PR please

[juliusvonkohout]

On the next realease of kserve models web application we will automatically get a proper tag. But you can also ping me on slack and I can cut a 1.16.2 release today