Skip to content

Commit c19f18f

Browse files
tarilabstarilabs
authored
Merge branch 'master' into tarilabs-20251210
Signed-off-by: Matteo Mortari <matteo.mortari@gmail.com>
2 parents e8f22ae + 88eaba9 commit c19f18f

7 files changed

Lines changed: 187 additions & 20 deletions

File tree

‎.github/workflows/model_registry_test.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,12 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout
22-
uses: actions/checkout@v4
22+
uses: actions/checkout@v5
2323

2424
- name: Install KinD, Create KinD cluster and Install kustomize
2525
run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
2626

27+
# TODO it works well for KFP and other MySQL deployments and should be removed.
2728
- name: Remove AppArmor profile for mysql in KinD on GHA # https://github.com/kubeflow/manifests/issues/2507
2829
run: |
2930
set -x

‎README.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,10 +107,10 @@ The `example` directory contains an example kustomization for the single command
107107
:warning: In both options, we use a default email (`user@example.com`) and password (`12341234`). For any production Kubeflow deployment, you should change the default password by following [the relevant section](#change-default-user-password).
108108

109109
### Prerequisites
110-
- This is the master branch, which targets Kubernetes version 1.32.
110+
- This is the master branch, which targets Kubernetes version 1.34+.
111111
- For the specific Kubernetes version per release, consult the [release notes](https://github.com/kubeflow/manifests/releases).
112112
- Either our local Kind (installed below) or your own Kubernetes cluster with a default [StorageClass](https://kubernetes.io/docs/concepts/storage/storage-classes/).
113-
- Kustomize version [5.4.3+](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.4.3).
113+
- Kustomize version [5.7.1](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv5.7.1).
114114
- Kubectl version compatible with your Kubernetes cluster ([Version Skew Policy](https://kubernetes.io/releases/version-skew-policy/#kubectl)).
115115

116116
---
@@ -139,7 +139,7 @@ kind: Cluster
139139
apiVersion: kind.x-k8s.io/v1alpha4
140140
nodes:
141141
- role: control-plane
142-
image: kindest/node:v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027
142+
image: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
143143
kubeadmConfigPatches:
144144
- |
145145
kind: ClusterConfiguration
@@ -767,3 +767,5 @@ pre-commit run
767767

768768

769769

770+
771+

‎common/istio/istio-install/base/install.yaml‎

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2904,11 +2904,13 @@ data:
29042904
"memory": "1024Mi"
29052905
},
29062906
"requests": {
2907-
"cpu": "100m",
2908-
"memory": "128Mi"
2907+
"cpu": "10m",
2908+
"memory": "40Mi"
29092909
}
29102910
},
2911-
"seccompProfile": {},
2911+
"seccompProfile": {
2912+
"type": "RuntimeDefault"
2913+
},
29122914
"startupProbe": {
29132915
"enabled": true,
29142916
"failureThreshold": 600
@@ -2917,8 +2919,17 @@ data:
29172919
"tracer": "none"
29182920
},
29192921
"proxy_init": {
2920-
"forceApplyIptables": false,
2921-
"image": "proxyv2"
2922+
"image": "proxyv2",
2923+
"resources": {
2924+
"limits": {
2925+
"cpu": "2000m",
2926+
"memory": "1024Mi"
2927+
},
2928+
"requests": {
2929+
"cpu": "10m",
2930+
"memory": "10Mi"
2931+
}
2932+
}
29222933
},
29232934
"remotePilotAddress": "",
29242935
"resourceScope": "all",
@@ -2941,7 +2952,7 @@ data:
29412952
"memory": "1Gi"
29422953
},
29432954
"requests": {
2944-
"cpu": "100m",
2955+
"cpu": "10m",
29452956
"memory": "128Mi"
29462957
}
29472958
},

‎common/istio/istio-install/base/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ resources:
1313
patches:
1414
- path: patches/service.yaml
1515
- path: patches/istio-configmap-disable-tracing.yaml
16+
- path: patches/istio-sidecar-injector-patch.yaml
1617
- path: patches/disable-debugging.yaml
1718
- path: patches/seccomp-istio-ingressgateway.yaml
1819
- path: patches/seccomp-istiod.yaml

‎common/istio/istio-install/base/patches/istio-sidecar-injector-patch.yaml‎

Lines changed: 153 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,153 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: istio-sidecar-injector
5+
namespace: istio-system
6+
data:
7+
values: |-
8+
{
9+
"gateways": {
10+
"seccompProfile": {
11+
"type": "RuntimeDefault"
12+
},
13+
"securityContext": {}
14+
},
15+
"global": {
16+
"caAddress": "",
17+
"caName": "",
18+
"certSigners": [],
19+
"configCluster": false,
20+
"configValidation": true,
21+
"defaultPodDisruptionBudget": {
22+
"enabled": true
23+
},
24+
"defaultResources": {
25+
"requests": {
26+
"cpu": "10m"
27+
}
28+
},
29+
"externalIstiod": false,
30+
"hub": "gcr.io/istio-release",
31+
"imagePullPolicy": "",
32+
"imagePullSecrets": [],
33+
"istioNamespace": "istio-system",
34+
"istiod": {
35+
"enableAnalysis": false
36+
},
37+
"logAsJson": false,
38+
"logging": {
39+
"level": "default:info"
40+
},
41+
"meshID": "",
42+
"meshNetworks": {},
43+
"mountMtlsCerts": false,
44+
"multiCluster": {
45+
"clusterName": ""
46+
},
47+
"nativeNftables": false,
48+
"network": "",
49+
"networkPolicy": {
50+
"enabled": false
51+
},
52+
"omitSidecarInjectorConfigMap": false,
53+
"operatorManageWebhooks": false,
54+
"pilotCertProvider": "istiod",
55+
"priorityClassName": "",
56+
"proxy": {
57+
"autoInject": "enabled",
58+
"clusterDomain": "cluster.local",
59+
"componentLogLevel": "misc:error",
60+
"excludeIPRanges": "",
61+
"excludeInboundPorts": "",
62+
"excludeOutboundPorts": "",
63+
"image": "proxyv2",
64+
"includeIPRanges": "*",
65+
"includeInboundPorts": "*",
66+
"includeOutboundPorts": "",
67+
"logLevel": "warning",
68+
"outlierLogPath": "",
69+
"privileged": false,
70+
"readinessFailureThreshold": 4,
71+
"readinessInitialDelaySeconds": 0,
72+
"readinessPeriodSeconds": 15,
73+
"resources": {
74+
"limits": {
75+
"cpu": "2000m",
76+
"memory": "1024Mi"
77+
},
78+
"requests": {
79+
"cpu": "10m",
80+
"memory": "40Mi"
81+
}
82+
},
83+
"seccompProfile": {
84+
"type": "RuntimeDefault"
85+
},
86+
"startupProbe": {
87+
"enabled": true,
88+
"failureThreshold": 600
89+
},
90+
"statusPort": 15020,
91+
"tracer": "none"
92+
},
93+
"proxy_init": {
94+
"image": "proxyv2",
95+
"resources": {
96+
"limits": {
97+
"cpu": "2000m",
98+
"memory": "1024Mi"
99+
},
100+
"requests": {
101+
"cpu": "10m",
102+
"memory": "10Mi"
103+
}
104+
}
105+
},
106+
"remotePilotAddress": "",
107+
"resourceScope": "all",
108+
"sds": {
109+
"token": {
110+
"aud": "istio-ca"
111+
}
112+
},
113+
"sts": {
114+
"servicePort": 0
115+
},
116+
"tag": "1.28.0",
117+
"variant": "",
118+
"waypoint": {
119+
"affinity": {},
120+
"nodeSelector": {},
121+
"resources": {
122+
"limits": {
123+
"cpu": "2",
124+
"memory": "1Gi"
125+
},
126+
"requests": {
127+
"cpu": "10m",
128+
"memory": "128Mi"
129+
}
130+
},
131+
"tolerations": [],
132+
"topologySpreadConstraints": []
133+
}
134+
},
135+
"pilot": {
136+
"cni": {
137+
"enabled": true,
138+
"provider": "default"
139+
},
140+
"env": {}
141+
},
142+
"revision": "",
143+
"sidecarInjectorWebhook": {
144+
"alwaysInjectSelector": [],
145+
"defaultTemplates": [],
146+
"enableNamespacesByDefault": false,
147+
"injectedAnnotations": {},
148+
"neverInjectSelector": [],
149+
"reinvocationPolicy": "Never",
150+
"rewriteAppHTTPProbe": true,
151+
"templates": {}
152+
}
153+
}

‎scripts/synchronize-istio-manifests.sh‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,6 @@ mv $ISTIO_DIRECTORY/install.yaml $ISTIO_DIRECTORY/istio-install/base/
3838
mv $ISTIO_DIRECTORY/cluster-local-gateway.yaml $ISTIO_DIRECTORY/cluster-local-gateway/base/
3939
rm dump.yaml
4040

41-
echo "Generating non-CNI manifests (insecure overlay)..."
42-
$ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \
43-
--set components.cni.enabled=false > istio-install/overlays/insecure/install-insecure.yaml
44-
4541
echo "Generating ztunnel manifests (ambient mode)..."
4642
$ISTIOCTL manifest generate -f profile.yaml -f profile-overlay.yaml \
4743
--set components.cni.enabled=true \
@@ -52,6 +48,9 @@ rm dump-ztunnel.yaml crd.yaml install.yaml cluster-local-gateway.yaml
5248

5349
check_uncommitted_changes
5450

51+
echo "Updating tag in istio-sidecar-injector-patch.yaml..."
52+
sed -i "s/\"tag\": \".*\"/\"tag\": \"$COMMIT\"/" $ISTIO_DIRECTORY/istio-install/base/patches/istio-sidecar-injector-patch.yaml
53+
5554
SOURCE_TEXT="\[.*\](https://github.com/istio/istio/releases/tag/.*)"
5655
DESTINATION_TEXT="\[$COMMIT\](https://github.com/istio/istio/releases/tag/$COMMIT)"
5756

‎tests/install_KinD_create_KinD_cluster_install_kustomize.sh‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ if [ -e /swapfile ]; then
2020
fi
2121

2222
{
23-
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.29.0/kind-linux-amd64
23+
curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.30.0/kind-linux-amd64
2424
chmod +x ./kind
2525
sudo mv kind /usr/local/bin
2626
} || { echo "Failed to install KinD"; exit 1; }
@@ -49,19 +49,19 @@ kubeadmConfigPatches:
4949
\"service-account-signing-key-file\": \"/etc/kubernetes/pki/sa.key\"
5050
nodes:
5151
- role: control-plane
52-
image: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
52+
image: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
5353
- role: worker
54-
image: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
54+
image: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
5555
- role: worker
56-
image: kindest/node:v1.33.1@sha256:050072256b9a903bd914c0b2866828150cb229cea0efe5892e2b644d5dd3b34f
56+
image: kindest/node:v1.34.0@sha256:7416a61b42b1662ca6ca89f02028ac133a309a2a30ba309614e8ec94d976dc5a
5757
" | kind create cluster --config - --wait 120s
5858

5959
kubectl cluster-info
6060

6161
echo "Install Kustomize ..."
6262
{
63-
curl --silent --location --remote-name "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.4.3/kustomize_v5.4.3_linux_amd64.tar.gz"
64-
tar -xzvf kustomize_v5.4.3_linux_amd64.tar.gz
63+
curl --silent --location --remote-name "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv5.7.1/kustomize_v5.7.1_linux_amd64.tar.gz"
64+
tar -xzvf kustomize_v5.7.1_linux_amd64.tar.gz
6565
chmod a+x kustomize
6666
sudo mv kustomize /usr/local/bin/kustomize
6767
} || { echo "Failed to install Kustomize"; exit 1; }

0 commit comments

Comments
 (0)