Skip to content

feat: enforce PSS restricted for user namespaces in CI #3434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abdullahpathan22 wants to merge 17 commits into
base: master
Choose a base branch
from
Open

feat: enforce PSS restricted for user namespaces in CI #3434

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
f693043
fix: resolve Kustomize 5 deprecation warnings (#2991)
Mar 19, 2026
230480c
Revert "fix: resolve Kustomize 5 deprecation warnings (#2991)"
Mar 19, 2026
c3adca0
feat: enforce PSS restricted for user namespaces in CI
Apr 3, 2026
99b58e0
fix(ci): conditionalize user namespace in PSS script
Apr 3, 2026
8d0f6cf
fix(profiles): align duplicate PSS labels with restricted level
Apr 3, 2026
4c9bfa1
Change pod security enforcement to baseline
Apr 4, 2026
6b39804
Remove pod security labels from namespace
Apr 4, 2026
cd15375
Label KF_PROFILE namespace with restricted pod security
Apr 4, 2026
e8e134a
fix(ci): fix trainer CRD schema and update pytorch-mnist image
Apr 4, 2026
78f9e01
fix: robust wait logic and PSS hardening for training operator and katib
Apr 4, 2026
7872685
fix: resolve pod ContainerCreating and trial timeout CI failures
Apr 4, 2026
bd62d80
ci: update katib and pipeline workflow triggers
Apr 5, 2026
5c2cdc2
fix(ci): address Copilot AI review feedback
abdullahpathan22 Apr 5, 2026
19deee7
fix(ci): fix failing katib, pipeline, and trainer tests
abdullahpathan22 Apr 5, 2026
1c7c6d7
fix(tests): revert images to ghcr.io
abdullahpathan22 Apr 5, 2026
24e359f
fix(ci): Resolve PSS Restricted CI failures across components
abdullahpathan22 Apr 5, 2026
15ae2aa
fix(tests): Enhance katib_test.sh with extended timeouts and debug fa…
abdullahpathan22 Apr 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/dex_oauth2-proxy_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- experimental/security/PSS/*
- applications/profiles/pss/**
- common/dex/base/**
- tests/istio*
- tests/dex_login_test.py
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/katib_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,13 @@ on:
pull_request:
paths:
- tests/install_KinD_create_KinD_cluster_install_kustomize.sh
- tests/katib_install.sh
- tests/katib*
- .github/workflows/katib_test.yaml
- applications/katib/upstream/**
- common/istio*/**
Comment on lines 3 to 9
Copy link

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow references experimental/security/PSS/* as a trigger path, but this directory does not exist in the repository. The PSS configuration is located at applications/profiles/pss/. This path should be updated to ensure the workflow is triggered correctly when PSS configuration changes.

Copilot uses AI. Check for mistakes.
- tests/istio*
- common/cert-manager/**
- experimental/security/PSS/*
- applications/profiles/pss/**

permissions:
contents: read
Expand Down
1 change: 1 addition & 0 deletions .github/workflows/pipeline_run_from_notebook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ on:
paths:
- tests/install_KinD_create_KinD_cluster_install_kustomize.sh
- .github/workflows/pipeline_run_from_notebook.yaml
- tests/pipeline*
- applications/jupyter/notebook-controller/upstream/**
- applications/pipeline/upstream/**
- tests/istio*
Expand Down
5 changes: 2 additions & 3 deletions .github/workflows/pipeline_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,8 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- tests/pipeline_v1_test.py
- tests/pipeline_v2_test.py
- experimental/security/PSS/*
- tests/pipeline*
- applications/profiles/pss/**

permissions:
contents: read
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/trainer_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- experimental/security/PSS/*
- applications/profiles/pss/**

permissions:
contents: read
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/training_operator_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ on:
- common/cert-manager/**
- common/oauth2-proxy/**
- common/istio*/**
- experimental/security/PSS/*
- applications/profiles/pss/**

permissions:
contents: read
Expand Down
184 changes: 184 additions & 0 deletions applications/katib/upstream/installs/katib-standalone/katib-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ init:
enable: true
controller:
webhookPort: 8443
injectSecurityContext: true
trialResources:
- TrainJob.v1alpha1.trainer.kubeflow.org
- Job.v1.batch
Expand All @@ -16,39 +17,209 @@ runtime:
metricsCollectors:
- kind: StdOut
image: ghcr.io/kubeflow/katib/file-metrics-collector:v0.19.0
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- kind: File
image: ghcr.io/kubeflow/katib/file-metrics-collector:v0.19.0
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- kind: TensorFlowEvent
image: ghcr.io/kubeflow/katib/tfevent-metrics-collector:v0.19.0
resources:
limits:
memory: 1Gi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
suggestions:
- algorithmName: random
image: ghcr.io/kubeflow/katib/suggestion-hyperopt:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: tpe
image: ghcr.io/kubeflow/katib/suggestion-hyperopt:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: grid
image: ghcr.io/kubeflow/katib/suggestion-optuna:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: hyperband
image: ghcr.io/kubeflow/katib/suggestion-hyperband:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: bayesianoptimization
image: ghcr.io/kubeflow/katib/suggestion-skopt:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: cmaes
image: ghcr.io/kubeflow/katib/suggestion-goptuna:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: sobol
image: ghcr.io/kubeflow/katib/suggestion-goptuna:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: multivariate-tpe
image: ghcr.io/kubeflow/katib/suggestion-optuna:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: enas
image: ghcr.io/kubeflow/katib/suggestion-enas:v0.19.0
resources:
limits:
memory: 400Mi
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: darts
image: ghcr.io/kubeflow/katib/suggestion-darts:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
- algorithmName: pbt
image: ghcr.io/kubeflow/katib/suggestion-pbt:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
persistentVolumeClaimSpec:
accessModes:
- ReadWriteMany
Expand All @@ -58,3 +229,16 @@ runtime:
earlyStoppings:
- algorithmName: medianstop
image: ghcr.io/kubeflow/katib/earlystopping-medianstop:v0.19.0
podSecurityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
1 change: 1 addition & 0 deletions applications/katib/upstream/installs/katib-standalone/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,4 @@ secretGenerator:
- name: katib-webhook-cert
options:
disableNameSuffixHash: true
type: kubernetes.io/tls
10 changes: 10 additions & 0 deletions ...ications/pipeline/upstream/third-party/argo/base/workflow-controller-configmap-patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,3 +48,13 @@ data:
- ALL
seccompProfile:
type: RuntimeDefault
container: |
securityContext:
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
2 changes: 1 addition & 1 deletion applications/profiles/pss/namespace-labels.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,4 @@ katib.kubeflow.org/metrics-collector-injection: "enabled"
serving.kubeflow.org/inferenceservice: "enabled"
pipelines.kubeflow.org/enabled: "true"
app.kubernetes.io/part-of: "kubeflow-profile"
pod-security.kubernetes.io/enforce: "baseline"
pod-security.kubernetes.io/enforce: "restricted"
14 changes: 14 additions & 0 deletions applications/trainer/upstream/base/runtimes/torch_distributed.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,22 @@ spec:
labels:
trainer.kubeflow.org/trainjob-ancestor-step: trainer
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
template:
spec:
containers:
- name: node
image: pytorch/pytorch:2.10.0-cuda12.8-cudnn9-runtime
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
14 changes: 14 additions & 0 deletions applications/trainer/upstream/base/runtimes/xgboost_distributed.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,22 @@ spec:
labels:
trainer.kubeflow.org/trainjob-ancestor-step: trainer
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
template:
spec:
containers:
- name: node
image: ghcr.io/kubeflow/trainer/xgboost-runtime:latest
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
2 changes: 1 addition & 1 deletion applications/trainer/upstream/overlays/kubeflow-platform/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kubeflow
namespace: kubeflow-system
resources:
- ../../overlays/manager
- ../../overlays/runtimes
Expand Down
1 change: 0 additions & 1 deletion applications/trainer/upstream/overlays/manager/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,6 @@ images:
# Secret for the Kubeflow Training webhook.
secretGenerator:
- name: kubeflow-trainer-webhook-cert
namespace: kubeflow-system
options:
disableNameSuffixHash: true

Expand Down
4 changes: 3 additions & 1 deletion tests/PSS_enable.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,9 @@ PSS_LEVEL="${1:-restricted}"
}

NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow" "knative-serving" "kubeflow-system")
[[ "$PSS_LEVEL" == "baseline" ]] && NAMESPACES+=("kubeflow-user-example-com")
if [[ "$PSS_LEVEL" == "restricted" ]]; then
NAMESPACES+=("kubeflow-user-example-com")
fi

echo "Applying PSS $PSS_LEVEL to: ${NAMESPACES[*]}"

Expand Down
Loading
Loading