Improve Image Builder Jobs Label and Annotation (#380)

<!--  Thanks for sending a pull request!  Here are some tips for you:

1. Run unit tests and ensure that they are passing
2. If your change introduces any API changes, make sure to update the
e2e tests
3. Make sure documentation is updated for your PR!

-->

**What this PR does / why we need it**:
<!-- Explain here the context and why you're making the change. What is
the problem you're trying to solve. --->

1. The image-building jobs in Merlin are timing out. After some
investigation, we found that one of the root causes is the node pool got
scaled down resulting in the image building pods to be rescheduled. This
PR adds "cluster-autoscaler.kubernetes.io/safe-to-evict": "false" to
avoid the pod get killed and rescheduled.
2. In Refactor deployed model labels #346, we managed to propagate user
labels to models and batch prediction jobs, but not to image builder
jobs (here). This PR includes adding project + model version labels to
image builder job.
3. This PR also improve e2e test by:
a. Removing the duplicate of kserve-controller-manager statefulset as in
kserve 0.9.0 manifest has both of statefulset and deployment
  b. Removing kserve-controller-manager's cpu limits

**Does this PR introduce a user-facing change?**:
<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required. Enter your extended release note in
the block below.
If the PR requires additional action from users switching to the new
release, include the string "action required".

For more information about release notes, see kubernetes' guide here:
http://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
NONE
```

**Checklist**

- [x] Added unit test, integration, and/or e2e tests
- [x] Tested locally
- [x] Updated documentation
- [ ] Update Swagger spec if the PR introduce API changes
- [ ] Regenerated Golang and Python client if the PR introduce API
changes

.github/workflows/merlin.yml

@@ -10,7 +10,7 @@ on:
 env:
   ARTIFACT_RETENTION_DAYS: 7
   DOCKER_BUILDKIT: 1
-  GO_VERSION: '1.20'
+  GO_VERSION: "1.20"
 
 jobs:
   create-version:
@@ -477,7 +477,7 @@ jobs:
           echo "::endgroup::"
 
           echo "::group::KServe log"
-          kubectl logs statefulset/kserve-controller-manager -n kserve -c manager
+          kubectl logs deployment/kserve-controller-manager -n kserve -c manager
           echo "::endgroup::"
 
           echo "::group::KServe events"

api/cmd/api/setup.go

@@ -144,6 +144,7 @@ func initImageBuilder(cfg *config.Config) (webserviceBuilder imagebuilder.ImageB
 		Tolerations:          cfg.ImageBuilderConfig.Tolerations,
 		NodeSelectors:        cfg.ImageBuilderConfig.NodeSelectors,
 		MaximumRetry:         cfg.ImageBuilderConfig.MaximumRetry,
+		SafeToEvict:          cfg.ImageBuilderConfig.SafeToEvict,
 
 		ClusterName: cfg.ImageBuilderConfig.ClusterName,
 		GcpProject:  cfg.ImageBuilderConfig.GcpProject,
@@ -164,6 +165,7 @@ func initImageBuilder(cfg *config.Config) (webserviceBuilder imagebuilder.ImageB
 		Tolerations:          cfg.ImageBuilderConfig.Tolerations,
 		NodeSelectors:        cfg.ImageBuilderConfig.NodeSelectors,
 		MaximumRetry:         cfg.ImageBuilderConfig.MaximumRetry,
+		SafeToEvict:          cfg.ImageBuilderConfig.SafeToEvict,
 
 		ClusterName: cfg.ImageBuilderConfig.ClusterName,
 		GcpProject:  cfg.ImageBuilderConfig.GcpProject,

api/config/config.go

@@ -202,6 +202,7 @@ type ImageBuilderConfig struct {
 	NodeSelectors DictEnv              `envconfig:"IMG_BUILDER_NODE_SELECTORS"`
 	MaximumRetry  int32                `envconfig:"IMG_BUILDER_MAX_RETRY" default:"3"`
 	K8sConfig     mlpcluster.K8sConfig `envconfig:"IMG_BUILDER_K8S_CONFIG"`
+	SafeToEvict   bool                 `envconfig:"IMG_BUILDER_SAFE_TO_EVICT" default:"false"`
 }
 
 type Tolerations []v1.Toleration

api/pkg/imagebuilder/config.go

@@ -45,6 +45,8 @@ type Config struct {
 	NodeSelectors map[string]string
 	// Maximum number of retry of image builder job
 	MaximumRetry int32
+	// Value for cluster-autoscaler.kubernetes.io/safe-to-evict annotation
+	SafeToEvict bool
 
 	// Cluster Name
 	ClusterName string

api/pkg/imagebuilder/imagebuilder.go

@@ -336,6 +336,15 @@ func (c *imageBuilder) createKanikoJobSpec(project mlp.Project, model *models.Mo
 		Component: models.ComponentImageBuilder,
 		Stream:    project.Stream,
 		Team:      project.Team,
+		Labels:    models.MergeProjectVersionLabels(project.Labels, version.Labels),
+	}
+
+	annotations := make(map[string]string)
+	if !c.config.SafeToEvict {
+		// The image-building jobs are timing out. We found that one of the root causes is the node pool got scaled down resulting in the image building pods to be rescheduled.
+		// Adding "cluster-autoscaler.kubernetes.io/safe-to-evict": "false" to avoid the pod get killed and rescheduled.
+		// https://kubernetes.io/docs/reference/labels-annotations-taints/#cluster-autoscaler-kubernetes-io-safe-to-evict
+		annotations["cluster-autoscaler.kubernetes.io/safe-to-evict"] = "false"
 	}
 
 	baseImageTag, ok := c.config.BaseImages[version.PythonVersion]
@@ -411,9 +420,10 @@ func (c *imageBuilder) createKanikoJobSpec(project mlp.Project, model *models.Mo
 
 	job := &batchv1.Job{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      kanikoPodName,
-			Namespace: c.config.BuildNamespace,
-			Labels:    metadata.ToLabel(),
+			Name:        kanikoPodName,
+			Namespace:   c.config.BuildNamespace,
+			Labels:      metadata.ToLabel(),
+			Annotations: annotations,
 		},
 		Spec: batchv1.JobSpec{
 			Completions:             &jobCompletions,
@@ -422,7 +432,8 @@ func (c *imageBuilder) createKanikoJobSpec(project mlp.Project, model *models.Mo
 			ActiveDeadlineSeconds:   &activeDeadlineSeconds,
 			Template: v1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
-					Labels: metadata.ToLabel(),
+					Labels:      metadata.ToLabel(),
+					Annotations: annotations,
 				},
 				Spec: v1.PodSpec{
 					// https://stackoverflow.com/questions/54091659/kubernetes-pods-disappear-after-failed-jobs

api/pkg/imagebuilder/imagebuilder_test.go

@@ -76,6 +76,9 @@ var (
 		ID:            models.ID(1),
 		ArtifactURI:   testArtifactURI,
 		PythonVersion: "3.10.*",
+		Labels: models.KV{
+			"test": "true",
+		},
 	}
 
 	timeout, _      = time.ParseDuration("10s")
@@ -246,6 +249,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -262,6 +270,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -346,6 +359,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/team":         project.Team,
 						"gojek.com/environment":  config.Environment,
 						"gojek.com/component":    "image-builder",
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -362,6 +380,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/team":         project.Team,
 								"gojek.com/environment":  config.Environment,
 								"gojek.com/component":    "image-builder",
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -424,6 +447,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -440,6 +468,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -552,6 +585,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -568,6 +606,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -690,6 +733,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -706,6 +754,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -822,6 +875,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -838,6 +896,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -921,6 +984,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -937,6 +1005,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -1023,6 +1096,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -1039,6 +1117,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{
@@ -1113,6 +1196,11 @@ func TestBuildImage(t *testing.T) {
 						"gojek.com/orchestrator": testOrchestratorName,
 						"gojek.com/stream":       project.Stream,
 						"gojek.com/team":         project.Team,
+						"sample":                 "true",
+						"test":                   "true",
+					},
+					Annotations: map[string]string{
+						"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 					},
 				},
 				Spec: batchv1.JobSpec{
@@ -1129,6 +1217,11 @@ func TestBuildImage(t *testing.T) {
 								"gojek.com/orchestrator": testOrchestratorName,
 								"gojek.com/stream":       project.Stream,
 								"gojek.com/team":         project.Team,
+								"sample":                 "true",
+								"test":                   "true",
+							},
+							Annotations: map[string]string{
+								"cluster-autoscaler.kubernetes.io/safe-to-evict": "false",
 							},
 						},
 						Spec: v1.PodSpec{

charts/merlin/templates/merlin-deployment.yaml

@@ -289,6 +289,8 @@ spec:
           - name: GOOGLE_APPLICATION_CREDENTIALS
             value: /etc/gcp_service_account/service-account.json
           {{- end }}
+          - name: IMG_BUILDER_SAFE_TO_EVICT
+            value: "{{ .Values.merlin.imageBuilder.safeToEvict }}"
         volumeMounts:
         - mountPath: /opt/config
           name: config

charts/merlin/values.yaml

@@ -30,7 +30,7 @@ merlin:
 
   environment: dev
   deploymentLabelPrefix: "gojek.com/"
-  pyfuncGRPCOptions : "{}"
+  pyfuncGRPCOptions: "{}"
 
   loggerDestinationURL: "http://yourDestinationLogger"
 
@@ -82,6 +82,7 @@ merlin:
     nodeSelectors: {}
     maxRetry: 3
     k8sConfig: ""
+    safeToEvict: false
 
   gitlab:
     baseURL: https://gitlab.com/
@@ -172,7 +173,7 @@ merlin:
         keepAliveTime: 60s
         keepAliveTimeout: 5s
     kafka:
-      # brokers: 
+      # brokers:
       maxMessageSize: "1048588"
 
   # Google service account used to access GCP's resources.
@@ -425,7 +426,7 @@ swagger:
     externalPort: 8080
 
 mlp:
-  environmentConfigSecret: 
+  environmentConfigSecret:
     name: ""
     envKey: environment.yaml
     imageBuilderKey: imageBuilderK8sConfig