fix(hub): deploy model registry to user profile namespace instead of default

.github/workflows/full_kubeflow_integration_test.yaml

@@ -202,6 +202,23 @@ jobs:
     - name: Apply Pod Security Standards Restricted
       run: ./tests/PSS_enable.sh restricted
 
+    - name: Fail if there are resources in the "default" namespace
+      run: |
+        echo "==== Checking for resources in the default namespace ===="
+        DEFAULT_PODS=$(kubectl get pods -n default --no-headers --ignore-not-found 2>/dev/null | grep -v "^$" | wc -l)
+        if [ "${DEFAULT_PODS}" -gt 0 ]; then
+          echo "ERROR: Found ${DEFAULT_PODS} pods in the default namespace."
+          echo "No Kubeflow component should deploy to the default namespace."
+          echo ""
+          echo "==== Diagnostic dump ===="
+          kubectl get all -n default
+          echo ""
+          echo "==== Pod details ===="
+          kubectl get pods -n default -o wide
+          exit 1
+        fi
+        echo "PASSED: The default namespace does not contain pods."
+
     - name: Verify Components
       run: kubectl get pods --all-namespaces | grep -E '(Error|CrashLoopBackOff)' && exit 1 || true
 

.github/workflows/model_registry_test.yaml

@@ -6,7 +6,7 @@ on:
     paths:
     - tests/install_KinD_create_KinD_cluster_install_kustomize.sh
     - .github/workflows/model_registry_test.yaml
-    - applications/hub/upstream/**
+    - applications/hub/**
     - tests/istio*
     - tests/multi_tenancy_install.sh
     - tests/profile_controller_install.sh

applications/hub/overlays/kustomization.yaml

@@ -0,0 +1,61 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kubeflow-user-example-com
+
+resources:
+- ../upstream/overlays/postgres
+- ../upstream/options/istio
+- ../upstream/options/ui/overlays/istio
+- ../upstream/options/catalog/overlays/demo
+
+patches:
+# Gateway references: Istio resolves gateway names relative to the
+# VirtualService namespace. kubeflow-gateway lives in the kubeflow namespace,
+# so VirtualServices in kubeflow-user-example-com must use the fully-qualified
+# cross-namespace reference.
+- target:
+    group: networking.istio.io
+    version: v1alpha3
+    kind: VirtualService
+    name: model-registry
+  patch: |-
+    - op: replace
+      path: /spec/gateways/0
+      value: kubeflow/kubeflow-gateway
+    - op: replace
+      path: /spec/http/0/route/0/destination/host
+      value: model-registry-service.kubeflow-user-example-com.svc.cluster.local
+- target:
+    group: networking.istio.io
+    version: v1alpha3
+    kind: VirtualService
+    name: model-registry-ui
+  patch: |-
+    - op: replace
+      path: /spec/gateways/0
+      value: kubeflow/kubeflow-gateway
+    - op: replace
+      path: /spec/http/0/route/0/destination/host
+      value: model-registry-ui-service.kubeflow-user-example-com.svc.cluster.local
+
+# Destination host FQDNs: services move to kubeflow-user-example-com with the
+# namespace override. DestinationRule hosts must reference the correct namespace.
+- target:
+    group: networking.istio.io
+    version: v1alpha3
+    kind: DestinationRule
+    name: model-registry-service
+  patch: |-
+    - op: replace
+      path: /spec/host
+      value: model-registry-service.kubeflow-user-example-com.svc.cluster.local
+- target:
+    group: networking.istio.io
+    version: v1alpha3
+    kind: DestinationRule
+    name: model-registry-ui
+  patch: |-
+    - op: replace
+      path: /spec/host
+      value: model-registry-ui-service.kubeflow-user-example-com.svc.cluster.local

example/kustomization.yaml

@@ -86,14 +86,8 @@ resources:
 # Spark Operator
 - ../applications/spark/spark-operator/overlays/kubeflow
 
-# Model Registry
-- ../applications/hub/upstream/overlays/postgres
-# Model Registry Istio networking (VirtualService for /api/model_registry/)
-- ../applications/hub/upstream/options/istio
-# Model Registry UI
-- ../applications/hub/upstream/options/ui/overlays/istio
-# Model Catalog (demo)
-- ../applications/hub/upstream/options/catalog/overlays/demo
+# Hub (Model Registry + UI + Istio resources + Model Catalog)
+- ../applications/hub/overlays
 
 # Ray is an experimental integration
 # Here is the documentation for Ray: https://docs.ray.io/en/latest/

tests/model_catalog_install.sh

@@ -3,7 +3,7 @@ set -euxo pipefail
 
 (
     cd applications/hub/upstream/options/catalog/base
-    kustomize build . | kubectl apply -n kubeflow -f -
+    kustomize build . | kubectl apply -n kubeflow-user-example-com -f -
 )
 
-kubectl wait --for=condition=Available deployment/model-catalog-server -n kubeflow --timeout=120s
+kubectl wait --for=condition=Available deployment/model-catalog-server -n kubeflow-user-example-com --timeout=120s

tests/model_catalog_test.sh

@@ -2,19 +2,19 @@
 set -euxo pipefail
 
 
-if ! kubectl get deployment/model-catalog-server -n kubeflow; then
+if ! kubectl get deployment/model-catalog-server -n kubeflow-user-example-com; then
     echo "ERROR: Model Catalog deployment not found"
     exit 1
 fi
 
-if ! kubectl get svc/model-catalog -n kubeflow; then
+if ! kubectl get svc/model-catalog -n kubeflow-user-example-com; then
     echo "ERROR: Model Catalog service not found"
     exit 1
 fi
 
-kubectl get pods -n kubeflow -l app.kubernetes.io/name=model-catalog,app.kubernetes.io/component=server
+kubectl get pods -n kubeflow-user-example-com -l app.kubernetes.io/name=model-catalog,app.kubernetes.io/component=server
 
-nohup kubectl port-forward svc/model-catalog -n kubeflow 8082:8080 &
+nohup kubectl port-forward svc/model-catalog -n kubeflow-user-example-com 8082:8080 &
 PORT_FORWARD_PID=$!
 
 MAX_RETRIES=30

tests/model_registry_install.sh

@@ -3,84 +3,78 @@ set -euxo pipefail
 
 # Install Model Registry server, UI, database, and catalog components
 # This script can be used for local testing without GitHub Actions
-# Prerequisites: kubeflow namespace must exist, kustomize must be installed
+# Prerequisites: kubeflow-user-example-com namespace must exist (created by Profile controller),
+#                kustomize must be installed
 # Usage: ./tests/model_registry_install.sh
 
 echo "Installing Model Registry components..."
 
-# Build and apply Model Registry server with database
-echo "Deploying Model Registry server (with database)..."
-kustomize build applications/hub/upstream/overlays/postgres \
-  | kubectl apply -n kubeflow -f -
-
-# Build and apply Model Registry Istio networking
-echo "Deploying Model Registry Istio resources..."
-kustomize build applications/hub/upstream/options/istio \
-  | kubectl apply -n kubeflow -f -
-
-# Build and apply Model Registry UI with Istio integration
-echo "Deploying Model Registry UI..."
-kustomize build applications/hub/upstream/options/ui/overlays/istio \
-  | kubectl apply -n kubeflow -f -
+# Fail fast if the profile namespace has not been provisioned
+if ! kubectl get namespace kubeflow-user-example-com >/dev/null 2>&1; then
+    echo "ERROR: namespace kubeflow-user-example-com does not exist. Create a Kubeflow Profile first."
+    exit 1
+fi
 
-# Build and apply Model Catalog (demo overlay)
-echo "Deploying Model Catalog..."
-kustomize build applications/hub/upstream/options/catalog/overlays/demo \
-  | kubectl apply -n kubeflow -f -
+# Build and apply all Hub components (Model Registry + Istio + UI + Catalog)
+# The overlay sets namespace: kubeflow-user-example-com and patches Istio
+# gateway references and destination host FQDNs.
+echo "Deploying Hub components to kubeflow-user-example-com..."
+kustomize build applications/hub/overlays \
+  | kubectl apply -f -
 
 # Wait for Model Registry database deployment
 echo "Waiting for Model Registry database to become ready..."
-if ! kubectl wait --for=condition=available -n kubeflow deployment/model-registry-db --timeout=120s; then
+if ! kubectl wait --for=condition=available -n kubeflow-user-example-com deployment/model-registry-db --timeout=120s; then
     echo "ERROR: Model Registry database deployment failed"
-    kubectl get pods -n kubeflow -l component=db
-    kubectl describe deployment/model-registry-db -n kubeflow
-    kubectl logs deployment/model-registry-db -n kubeflow
+    kubectl get pods -n kubeflow-user-example-com -l component=db
+    kubectl describe deployment/model-registry-db -n kubeflow-user-example-com
+    kubectl logs deployment/model-registry-db -n kubeflow-user-example-com
     exit 1
 fi
 
 # Wait for Model Registry server deployment
 echo "Waiting for Model Registry server to become ready..."
-if ! kubectl wait --for=condition=available -n kubeflow deployment/model-registry-deployment --timeout=120s; then
+if ! kubectl wait --for=condition=available -n kubeflow-user-example-com deployment/model-registry-deployment --timeout=120s; then
     echo "ERROR: Model Registry server deployment failed"
-    kubectl get pods -n kubeflow -l component=model-registry-server
-    kubectl describe deployment/model-registry-deployment -n kubeflow
-    kubectl logs deployment/model-registry-deployment -n kubeflow --all-containers
+    kubectl get pods -n kubeflow-user-example-com -l component=model-registry-server
+    kubectl describe deployment/model-registry-deployment -n kubeflow-user-example-com
+    kubectl logs deployment/model-registry-deployment -n kubeflow-user-example-com --all-containers
     exit 1
 fi
 
 # Wait for Model Registry UI deployment
 echo "Waiting for Model Registry UI to become ready..."
-if ! kubectl wait --for=condition=available -n kubeflow deployment/model-registry-ui --timeout=120s; then
+if ! kubectl wait --for=condition=available -n kubeflow-user-example-com deployment/model-registry-ui --timeout=120s; then
     echo "ERROR: Model Registry UI deployment failed"
-    kubectl get pods -n kubeflow -l app=model-registry-ui
-    kubectl describe deployment/model-registry-ui -n kubeflow
-    kubectl logs deployment/model-registry-ui -n kubeflow --all-containers
+    kubectl get pods -n kubeflow-user-example-com -l app=model-registry-ui
+    kubectl describe deployment/model-registry-ui -n kubeflow-user-example-com
+    kubectl logs deployment/model-registry-ui -n kubeflow-user-example-com --all-containers
     exit 1
 fi
 
 # Wait for Model Catalog PostgreSQL StatefulSet
 echo "Waiting for Model Catalog database to become ready..."
-if ! kubectl wait --for=condition=ready -n kubeflow pod \
+if ! kubectl wait --for=condition=ready -n kubeflow-user-example-com pod \
   -l app.kubernetes.io/name=postgres,app.kubernetes.io/part-of=model-catalog \
   --timeout=120s; then
     echo "ERROR: Model Catalog database pod failed"
-    kubectl get pods -n kubeflow -l app.kubernetes.io/part-of=model-catalog
-    kubectl describe statefulset/model-catalog-postgres -n kubeflow
-    kubectl logs statefulset/model-catalog-postgres -n kubeflow
+    kubectl get pods -n kubeflow-user-example-com -l app.kubernetes.io/part-of=model-catalog
+    kubectl describe statefulset/model-catalog-postgres -n kubeflow-user-example-com
+    kubectl logs statefulset/model-catalog-postgres -n kubeflow-user-example-com
     exit 1
 fi
 
 # Wait for Model Catalog server deployment
 echo "Waiting for Model Catalog server to become ready..."
-if ! kubectl wait --for=condition=available -n kubeflow deployment/model-catalog-server --timeout=120s; then
+if ! kubectl wait --for=condition=available -n kubeflow-user-example-com deployment/model-catalog-server --timeout=120s; then
     echo "ERROR: Model Catalog server deployment failed"
-    kubectl get pods -n kubeflow -l app.kubernetes.io/part-of=model-catalog
-    kubectl describe deployment/model-catalog-server -n kubeflow
-    kubectl logs deployment/model-catalog-server -n kubeflow --all-containers
+    kubectl get pods -n kubeflow-user-example-com -l app.kubernetes.io/part-of=model-catalog
+    kubectl describe deployment/model-catalog-server -n kubeflow-user-example-com
+    kubectl logs deployment/model-catalog-server -n kubeflow-user-example-com --all-containers
     exit 1
 fi
 
 echo "Model Registry installation complete!"
-kubectl get pods -n kubeflow -l component=model-registry-server
-kubectl get pods -n kubeflow -l app=model-registry-ui
-kubectl get pods -n kubeflow -l app.kubernetes.io/part-of=model-catalog
+kubectl get pods -n kubeflow-user-example-com -l component=model-registry-server
+kubectl get pods -n kubeflow-user-example-com -l app=model-registry-ui
+kubectl get pods -n kubeflow-user-example-com -l app.kubernetes.io/part-of=model-catalog

tests/model_registry_test.sh

@@ -17,7 +17,16 @@ echo "=== Model Registry Integration Tests ==="
 # enforced here. These tests validate the Model Registry REST API functionality.
 # AuthorizationPolicy enforcement is validated through the gateway tests below.
 echo "Test 1: Direct Model Registry API access..."
-nohup kubectl port-forward svc/model-registry-service -n kubeflow 8081:8080 &
+nohup kubectl port-forward svc/model-registry-service -n kubeflow-user-example-com 8081:8080 >/dev/null 2>&1 &
+PORT_FORWARD_PID=$!
+
+cleanup_port_forward() {
+  if [ -n "$PORT_FORWARD_PID" ]; then
+    kill "$PORT_FORWARD_PID" 2>/dev/null
+  fi
+}
+trap cleanup_port_forward EXIT
+
 timeout 30s bash -c 'until curl -s localhost:8081 > /dev/null 2>&1; do sleep 1; done'
 
 # ---- Test 2: Create a RegisteredModel ----