rebase: central-dashboard v1.6.0

.github/workflows/build-centraldashboard.yml

@@ -2,10 +2,12 @@ name: component/centraldashboard
 on:
   push:
     branches:
-      - stc-master
+      - rohan-test
     paths:
       - components/centraldashboard/**
-
+  pull_request:
+    types:
+      - 'opened'
 # Environment variables available to all jobs and steps in this workflow
 env:
   REGISTRY_NAME: k8scc01covidacr

README.md

@@ -24,4 +24,3 @@ The Kubeflow community is organized into working groups (WGs) with associated re
 
 ## Get Involved
 Please refer to the [Community](https://www.kubeflow.org/docs/about/community/) page.
-

ROADMAP.md

@@ -1,18 +1,21 @@
 # Kubeflow Roadmap
 
-## Kubeflow 1.6 Release, Due: July 2022
-* Kubeflow 1.6 [milestones and timelines](https://github.com/kubeflow/community/pull/558)
+## Kubeflow 1.7 Release - planning now in process 
+* Please join the Kubeflow Community Meetings on Tuesdays for updates and for opportunities to contribute.  
+
+## Kubeflow 1.6 Release, Delivered: September 2022
+* Kubeflow 1.6 [milestones and timelines](https://github.com/kubeflow/community/tree/master/releases/release-1.6)
 
 #### Themes
 * Kubernetes 1.22 support
+* Kubeflow Pipelines v2 (alpha)
 
 ### Major Features from each Working Group (note: Individual WG versions are independent of Kubeflow's)
 
 #### Kubeflow Pipelines
 * V2 Preview: Support running pipeline in Argo-agnostic approach
 * New DAG visualization based on Pipeline Template and MLMD
 * SDK to change from `kfp.v2` to `kfp`
-* KFP SDK CLI [design](https://docs.google.com/document/d/1Z79ebKaf3hjyadSRsme1Qo7F-Tqu4qM1cyKuLeu2PgA/edit#heading=h.x9snb54sjlu9)
 
 #### Katib
 * Support for Population based training

components/access-management/kfam/api_default.go

@@ -28,7 +28,7 @@ import (
 	"k8s.io/client-go/informers"
 	clientset "k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/kubernetes/scheme"
-	"k8s.io/client-go/plugin/pkg/client/auth/gcp"
+	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 	"k8s.io/client-go/rest"
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 )
@@ -68,7 +68,7 @@ func NewKfamClient(userIdHeader string, userIdPrefix string, clusterAdmin string
 		return nil, err
 	}
 
-	informerFactory := informers.NewSharedInformerFactory(kubeClient, time.Minute * 60)
+	informerFactory := informers.NewSharedInformerFactory(kubeClient, time.Minute*60)
 	roleBindingLister := informerFactory.Rbac().V1().RoleBindings().Lister()
 	stop := make(chan struct{})
 	informerFactory.Start(stop)

components/access-management/kfam/bindings.go

@@ -16,15 +16,10 @@ package kfam
 
 import (
 	"fmt"
-	"k8s.io/apimachinery/pkg/labels"
-	v1 "k8s.io/client-go/listers/rbac/v1"
 	"net/url"
 	"regexp"
 	"strings"
 
-	"k8s.io/apimachinery/pkg/labels"
-	v1 "k8s.io/client-go/listers/rbac/v1"
-
 	istioSecurity "istio.io/api/security/v1beta1"
 	istioSecurityClient "istio.io/client-go/pkg/apis/security/v1beta1"
 	rbacv1 "k8s.io/api/rbac/v1"

components/admission-webhook/Makefile

@@ -2,16 +2,46 @@
 IMG ?= admission-webhook
 TAG ?= $(shell git describe --tags --always --dirty)
 
+# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
+ifeq (,$(shell go env GOBIN))
+GOBIN=$(shell go env GOPATH)/bin
+else
+GOBIN=$(shell go env GOBIN)
+endif
+
+generate: controller-gen
+	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
+
+manifests: controller-gen
+	$(CONTROLLER_GEN) crd:crdVersions=v1,maxDescLen=0 output:crd:artifacts:config=manifests/base paths="./..."
+	mv manifests/base/kubeflow.org_poddefaults.yaml manifests/base/crd.yaml
+
 build:
 	go build -gcflags 'all=-N -l' -o bin/webhook .
 
 docker-build:
 	docker build -t ${IMG}:${TAG} -f Dockerfile .
 
-docker-push: 
+docker-push:
 	docker push ${IMG}:${TAG}
 
 image: docker-build docker-push
 
-docker-push:
-	docker push ${IMG}:${TAG}
+CONTROLLER_GEN = $(shell pwd)/bin/controller-gen
+.PHONY: controller-gen
+controller-gen: ## Download controller-gen locally if necessary.
+	$(call go-get-tool,$(CONTROLLER_GEN),sigs.k8s.io/controller-tools/cmd/controller-gen@v0.8.0)
+
+# go-get-tool will 'go get' any package $2 and install it to $1.
+PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
+define go-get-tool
+@[ -f $(1) ] || { \
+set -e ;\
+TMP_DIR=$$(mktemp -d) ;\
+cd $$TMP_DIR ;\
+go mod init tmp ;\
+echo "Downloading $(2)" ;\
+GOBIN=$(PROJECT_DIR)/bin go get $(2) ;\
+rm -rf $$TMP_DIR ;\
+}
+endef

components/admission-webhook/hack/boilerplate.go.txt

@@ -0,0 +1,14 @@
+/*
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/

components/admission-webhook/main.go

@@ -41,7 +41,8 @@ import (
 )
 
 const (
-	annotationPrefix = "poddefault.admission.kubeflow.org"
+	annotationPrefix        = "poddefault.admission.kubeflow.org"
+	istioProxyContainerName = "istio-proxy"
 )
 
 // Config contains the server (the webhook) cert and key.
@@ -108,6 +109,12 @@ func safeToApplyPodDefaultsOnPod(pod *corev1.Pod, podDefaults []*settingsapi.Pod
 		errs = append(errs, err)
 	}
 
+	// imagePullSecrets attribute is defined at the Pod level, so determine if volumes
+	// injection is causing any conflict.
+	if _, err := mergeImagePullSecrets(pod.Spec.ImagePullSecrets, podDefaults); err != nil {
+		errs = append(errs, err)
+	}
+
 	for _, ctr := range pod.Spec.Containers {
 		if err := safeToApplyPodDefaultsOnContainer(&ctr, podDefaults); err != nil {
 			errs = append(errs, err)
@@ -147,6 +154,53 @@ func safeToApplyPodDefaultsOnContainer(ctr *corev1.Container, podDefaults []*set
 	return utilerrors.NewAggregate(errs)
 }
 
+// mergeImagePullSecrets merges a list of imagePullSecrets with the imagePullSecrets injected by given list podDefaults.
+// It returns an error if it detects any conflict during the merge.
+func mergeImagePullSecrets(
+	imagePullSecrets []corev1.LocalObjectReference,
+	podDefaults []*settingsapi.PodDefault) ([]corev1.LocalObjectReference, error) {
+
+	var errs []error
+
+	origMap := map[string]corev1.LocalObjectReference{}
+	for _, ips := range imagePullSecrets {
+		origMap[ips.Name] = ips
+	}
+
+	merged := make([]corev1.LocalObjectReference, len(imagePullSecrets))
+	copy(merged, imagePullSecrets)
+
+	for _, pd := range podDefaults {
+		for _, ips := range pd.Spec.ImagePullSecrets {
+			found, ok := origMap[ips.Name]
+			if !ok {
+				// if we don't have it already, append it and continue
+				origMap[ips.Name] = ips
+				merged = append(merged, ips)
+				continue
+			}
+
+			// make sure they are identical or throw an error
+			if !reflect.DeepEqual(found, ips) {
+				errs = append(
+					errs,
+					fmt.Errorf(
+						"merging imagePullSecret for %s has a conflict on %s: \n%#v\ndoes not match\n%#v\n in container",
+						pd.GetName(), ips.Name, ips, found),
+				)
+			}
+		}
+	}
+
+	err := utilerrors.NewAggregate(errs)
+	if err != nil {
+		klog.Error(err)
+		return nil, err
+	}
+
+	return merged, err
+}
+
 // mergeEnv merges a list of env vars with the env vars injected by given list podDefaults.
 // It returns an error if it detects any conflict during the merge.
 func mergeEnv(envVars []corev1.EnvVar, podDefaults []*settingsapi.PodDefault) ([]corev1.EnvVar, error) {
@@ -384,6 +438,12 @@ func applyPodDefaultsOnPod(pod *corev1.Pod, podDefaults []*settingsapi.PodDefaul
 	}
 	pod.Spec.Tolerations = tolerations
 
+	imagePullSecrets, err := mergeImagePullSecrets(pod.Spec.ImagePullSecrets, podDefaults)
+	if err != nil {
+		klog.Error(err)
+	}
+	pod.Spec.ImagePullSecrets = imagePullSecrets
+
 	var (
 		defaultAnnotations = make([]*map[string]string, len(podDefaults))
 		defaultLabels      = make([]*map[string]string, len(podDefaults))
@@ -443,6 +503,27 @@ func applyPodDefaultsOnContainer(ctr *corev1.Container, podDefaults []*settingsa
 		klog.Error(err)
 	}
 	ctr.EnvFrom = envFrom
+
+	setCommandAndArgs(ctr, podDefaults)
+}
+
+//setCommandAndArgs adds command and args to the provided container. If the container already has a command or arguments set,
+// they won't be overwritten by PodDefault.
+func setCommandAndArgs(ctr *corev1.Container, podDefaults []*settingsapi.PodDefault) {
+	// ignore istio sidecar container
+	if ctr.Name == istioProxyContainerName {
+		return
+	}
+	for _, pd := range podDefaults {
+		if ctr.Command == nil && pd.Spec.Command != nil {
+			klog.Info(fmt.Sprintf("Updating container: %v, poddefault: %v, setting command: %v", ctr.Name, pd.GetName(), pd.Spec.Command))
+			ctr.Command = pd.Spec.Command
+		}
+		if ctr.Args == nil && pd.Spec.Args != nil {
+			klog.Info(fmt.Sprintf("Updating container: %v, poddefault: %v, setting args %v", ctr.Name, pd.GetName(), pd.Spec.Args))
+			ctr.Args = pd.Spec.Args
+		}
+	}
 }
 
 func mutatePods(ar v1.AdmissionReview) *v1.AdmissionResponse {
@@ -463,7 +544,7 @@ func mutatePods(ar v1.AdmissionReview) *v1.AdmissionResponse {
 	reviewResponse := v1.AdmissionResponse{}
 	reviewResponse.Allowed = true
 	if pod.Namespace == "" {
-		klog.Infof("Namespace was not set explicitly in Pod manifest, falling back to the namespace-'%s' coming from AdmissionReview request", ar.Request.Namespace)	
+		klog.Infof("Namespace was not set explicitly in Pod manifest, falling back to the namespace-'%s' coming from AdmissionReview request", ar.Request.Namespace)
 		pod.Namespace = ar.Request.Namespace
 	}
 
@@ -519,6 +600,7 @@ func mutatePods(ar v1.AdmissionReview) *v1.AdmissionResponse {
 	// detect merge conflict
 	err = safeToApplyPodDefaultsOnPod(&pod, matchingPDs)
 	if err != nil {
+		// This code doesn't ignore the error but rejects the Pod.
 		// conflict, ignore the error, but raise an event
 		msg := fmt.Errorf("conflict occurred while applying poddefaults: %s on pod: %v err: %v",
 			strings.Join(defaultNames, ","), pod.GetName(), err)

components/admission-webhook/main_test.go

@@ -94,8 +94,8 @@ func TestApplyPodDefaultsOnPod(t *testing.T) {
 			[]*settingsapi.PodDefault{
 				{
 					Spec: settingsapi.PodDefaultSpec{
-						Annotations: map[string]string{"baz": "bux"},
-						ServiceAccountName: "some-service-account",
+						Annotations:                  map[string]string{"baz": "bux"},
+						ServiceAccountName:           "some-service-account",
 						AutomountServiceAccountToken: newTrue(),
 					},
 				},
@@ -110,7 +110,7 @@ func TestApplyPodDefaultsOnPod(t *testing.T) {
 					Labels: map[string]string{},
 				},
 				Spec: corev1.PodSpec{
-					ServiceAccountName: "some-service-account",
+					ServiceAccountName:           "some-service-account",
 					AutomountServiceAccountToken: newTrue(),
 				},
 			},
@@ -201,3 +201,75 @@ func TestApplyPodDefaultsOnPod(t *testing.T) {
 	}
 
 }
+
+func TestSetCommandAndArgs(t *testing.T) {
+	commandOne := []string{
+		"cmd1",
+	}
+	argsOne := []string{
+		"arg1",
+		"arg2",
+	}
+	commandTwo := []string{
+		"cmd2",
+	}
+	argsTwo := []string{
+		"arg3",
+		"arg4",
+	}
+	for _, test := range []struct {
+		name        string
+		in          *corev1.Container
+		podDefaults []*settingsapi.PodDefault
+		out         *corev1.Container
+	}{
+		{
+			name: "Set command and args",
+			in:   &corev1.Container{},
+			podDefaults: []*settingsapi.PodDefault{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "test-pod-default",
+					},
+					Spec: settingsapi.PodDefaultSpec{
+						Command: commandOne,
+						Args:    argsOne,
+					},
+				},
+			},
+			out: &corev1.Container{
+				Command: commandOne,
+				Args:    argsOne,
+			},
+		},
+		{
+			name: "Do not overwrite command and args in case they are already set",
+			in: &corev1.Container{
+				Command: commandTwo,
+				Args:    argsTwo,
+			},
+			podDefaults: []*settingsapi.PodDefault{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "test-pod-default",
+					},
+					Spec: settingsapi.PodDefaultSpec{
+						Command: commandOne,
+						Args:    argsOne,
+					},
+				},
+			},
+			out: &corev1.Container{
+				Command: commandTwo,
+				Args:    argsTwo,
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			setCommandAndArgs(test.in, test.podDefaults)
+			if !reflect.DeepEqual(test.in, test.out) {
+				t.Fatalf("%#v\n  Not Equals:\n%#v", test.in, test.out)
+			}
+		})
+	}
+}