Merge pull request #2626 from rimolive/sync-kubeflow-kfp-tekton-manif…

…ests-2.0.5

Update kubeflow/kfp-tekton manifests from 2.0.5

README.md

@@ -58,7 +58,7 @@ This repo periodically syncs all official Kubeflow components from their respect
 | KServe | contrib/kserve/kserve | [v0.11.2](https://github.com/kserve/kserve/tree/v0.11.2/install/v0.11.2) |
 | KServe Models Web App | contrib/kserve/models-web-app | [v0.10.0](https://github.com/kserve/models-web-app/tree/v0.10.0/config) |
 | Kubeflow Pipelines | apps/pipeline/upstream | [2.0.3](https://github.com/kubeflow/pipelines/tree/2.0.3/manifests/kustomize) |
-| Kubeflow Tekton Pipelines | apps/kfp-tekton/upstream | [v2.0.3](https://github.com/kubeflow/kfp-tekton/tree/v2.0.3/manifests/kustomize) |
+| Kubeflow Tekton Pipelines | apps/kfp-tekton/upstream | [2.0.5](https://github.com/kubeflow/kfp-tekton/tree/2.0.5/manifests/kustomize) |
 =======
 
 The following is also a matrix with versions from common components that are

apps/kfp-tekton/upstream/OWNERS

@@ -1,6 +1,6 @@
 approvers:
-  - Tomcli
-  - yhwang
+ - Tomcli
+ - yhwang
 reviewers:
-  - Tomcli
-  - yhwang
+ - Tomcli
+ - yhwang

apps/kfp-tekton/upstream/README.md

@@ -12,23 +12,6 @@ To install Kubeflow Pipelines Standalone, follow [Kubeflow Pipelines Standalone
 
 There are environment specific installation instructions not covered in the official deployment documentation, they are listed below.
 
-## Kubeflow Pipelines on Tekton (KFP-Tekton)
-Project bringing Kubeflow Pipelines and Tekton together. The current code allows you run Kubeflow Pipelines with Tekton backend end to end.
-You can use the [Kubeflow Pipelines SDK v2](https://www.kubeflow.org/docs/components/pipelines/v2/introduction/) to compose a ML pipeline,
-generate the Intermediate Representation(IR), and run it on KFP-Tekton.
-
-To install the KFP-Tekton v2 on any Kubernetes cluster, please follow the instructions below:
-```bash
-cd manifests/kustomize
-KFP_ENV=platform-agnostic-tekton
-kubectl apply -k cluster-scoped-resources-tekton/
-kubectl wait crd/applications.app.k8s.io --for condition=established --timeout=60s
-kubectl apply -k "env/${KFP_ENV}/"
-kubectl wait pods -l application-crd-id=kubeflow-pipelines -n kubeflow --for condition=Ready --timeout=1800s
-kubectl port-forward -n kubeflow svc/ml-pipeline-ui 8080:80
-```
-Now you can access Kubeflow Pipelines UI in your browser by <http://localhost:8080>.
-
 ### (env/platform-agnostic) install on any Kubernetes cluster
 
 Install:

apps/kfp-tekton/upstream/base/cache-deployer/kustomization.yaml

@@ -8,4 +8,4 @@ commonLabels:
   app: cache-deployer
 images:
   - name: gcr.io/ml-pipeline/cache-deployer
-    newTag: 2.0.3
+    newTag: 2.0.5

apps/kfp-tekton/upstream/base/cache/kustomization.yaml

@@ -10,4 +10,4 @@ commonLabels:
   app: cache-server
 images:
   - name: gcr.io/ml-pipeline/cache-server
-    newTag: 2.0.3
+    newTag: 2.0.5

apps/kfp-tekton/upstream/base/installs/generic/pipeline-install-config.yaml

@@ -11,7 +11,7 @@ data:
     until the changes take effect. A quick way to restart all deployments in a
     namespace: `kubectl rollout restart deployment -n <your-namespace>`.
   appName: pipeline
-  appVersion: 2.0.3
+  appVersion: 2.0.5
   dbHost: mysql # relic to be removed after release
   dbPort: "3306" # relic to be removed after release
   dbType: mysql
@@ -93,3 +93,4 @@ data:
   ## If this value doesn't include a unit abbreviation, the units will be assumed
   ## to be nanoseconds.
   ConMaxLifeTime: "120s"
+  LOG_LEVEL: "info"

apps/kfp-tekton/upstream/base/installs/multi-user/persistence-agent/cluster-role.yaml

@@ -26,12 +26,6 @@ rules:
   - workflows
   verbs:
   - report
-- apiGroups:
-  - ''
-  resources:
-  - namespaces
-  verbs:
-  - get
 - apiGroups:
   - tekton.dev
   resources:

apps/kfp-tekton/upstream/base/metadata/base/kustomization.yaml

@@ -10,4 +10,4 @@ resources:
 namespace: kubeflow
 images:
   - name: gcr.io/ml-pipeline/metadata-envoy
-    newTag: 2.0.3
+    newTag: 2.0.5

apps/kfp-tekton/upstream/base/pipeline/kustomization.yaml

@@ -37,14 +37,14 @@ resources:
   - kfp-launcher-configmap.yaml
 images:
   - name: gcr.io/ml-pipeline/api-server
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: gcr.io/ml-pipeline/persistenceagent
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: gcr.io/ml-pipeline/scheduledworkflow
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: gcr.io/ml-pipeline/frontend
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: gcr.io/ml-pipeline/viewer-crd-controller
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: gcr.io/ml-pipeline/visualization-server
-    newTag: 2.0.3
+    newTag: 2.0.5

apps/kfp-tekton/upstream/base/pipeline/metadata-writer/kustomization.yaml

@@ -7,4 +7,4 @@ resources:
   - metadata-writer-sa.yaml
 images:
   - name: gcr.io/ml-pipeline/metadata-writer
-    newTag: 2.0.3
+    newTag: 2.0.5

apps/kfp-tekton/upstream/base/pipeline/ml-pipeline-apiserver-deployment.yaml

@@ -17,6 +17,8 @@ spec:
     spec:
       containers:
       - env:
+        - name: LOG_LEVEL
+          value: "info"
         - name: AUTO_UPDATE_PIPELINE_DEFAULT_VERSION
           valueFrom:
             configMapKeyRef:

apps/kfp-tekton/upstream/base/pipeline/ml-pipeline-persistenceagent-deployment.yaml

@@ -31,6 +31,8 @@ spec:
             value: ""
           - name: EXECUTIONTYPE
             value: Workflow
+          - name: LOG_LEVEL
+            value: "info"
         image: gcr.io/ml-pipeline/persistenceagent:dummy
         imagePullPolicy: IfNotPresent
         name: ml-pipeline-persistenceagent

apps/kfp-tekton/upstream/base/pipeline/ml-pipeline-persistenceagent-role.yaml

@@ -26,12 +26,6 @@ rules:
   - workflows
   verbs:
   - report
-- apiGroups:
-  - ''
-  resources:
-  - namespaces
-  verbs:
-  - get
 - apiGroups:
   - tekton.dev
   resources:
@@ -55,4 +49,4 @@ rules:
     - runs
   verbs:
     - reportMetrics
-    - readArtifact
+    - readArtifact

apps/kfp-tekton/upstream/base/pipeline/ml-pipeline-scheduledworkflow-deployment.yaml

@@ -20,6 +20,8 @@ spec:
         imagePullPolicy: IfNotPresent
         name: ml-pipeline-scheduledworkflow
         env:
+          - name: LOG_LEVEL
+            value: "info"
           - name: NAMESPACE
             valueFrom:
               fieldRef:

apps/kfp-tekton/upstream/cluster-scoped-resources-tekton/kustomization.yaml

@@ -0,0 +1,27 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: kubeflow
+
+resources:
+- namespace.yaml
+bases:
+- ../third-party/application/cluster-scoped
+# - ../third-party/argo/installs/namespace/cluster-scoped
+- ../base/pipeline/cluster-scoped
+- ../base/cache-deployer/cluster-scoped
+vars:
+# NOTE: var name must be unique globally to allow composition of multiple kustomize
+# packages. Therefore, we added prefix `kfp-cluster-scoped-` to distinguish it from
+# others.
+- name: kfp-cluster-scoped-namespace
+  objref:
+    # cache deployer sa's metadata.namespace will be first transformed by namespace field in kustomization.yaml
+    # so that we only need to change kustomization.yaml's namespace field for namespace customization.
+    kind: ServiceAccount
+    name: kubeflow-pipelines-cache-deployer-sa
+    apiVersion: v1
+  fieldref:
+    fieldpath: metadata.namespace
+configurations:
+- params.yaml

apps/kfp-tekton/upstream/cluster-scoped-resources-tekton/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: '$(kfp-cluster-scoped-namespace)'

apps/kfp-tekton/upstream/cluster-scoped-resources-tekton/params.yaml

@@ -0,0 +1,4 @@
+# Allow Kustomize var to replace following fields.
+varReference:
+- path: metadata/name
+  kind: Namespace

apps/kfp-tekton/upstream/env/gcp/inverse-proxy/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
   - name: gcr.io/ml-pipeline/inverse-proxy-agent
-    newTag: 2.0.3
+    newTag: 2.0.5
 resources:
   - proxy-configmap.yaml
   - proxy-deployment.yaml

apps/kfp-tekton/upstream/env/plain/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - ../../cluster-scoped-resources
+  - ../../cluster-scoped-resources-tekton
   - ../../base/installs/generic
   - ../../base/metadata/base
   - ../../third-party/minio/base

apps/kfp-tekton/upstream/env/platform-agnostic-tekton-multi-user/kustomization.yaml

@@ -15,13 +15,16 @@ commonLabels:
 images:
 - name: gcr.io/ml-pipeline/api-server
   newName: quay.io/aipipeline/apiserver
-  newTag: 2.0.3
+  newTag: 2.0.5
 - name: gcr.io/ml-pipeline/persistenceagent
   newName: quay.io/aipipeline/persistenceagent
-  newTag: 2.0.3
+  newTag: 2.0.5
 - name: gcr.io/ml-pipeline/scheduledworkflow
   newName: quay.io/aipipeline/scheduledworkflow
-  newTag: 2.0.3
+  newTag: 2.0.5
+
+patchesStrategicMerge:
+- tekton-config.yaml
 
 patches:
 - patch: |-

apps/kfp-tekton/upstream/env/platform-agnostic-tekton-multi-user/tekton-config.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: feature-flags
+  namespace: tekton-pipelines
+  labels:
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-pipelines
+data:
+  running-in-environment-with-injected-sidecars: "true"

apps/kfp-tekton/upstream/env/platform-agnostic-tekton/kustomization.yaml

@@ -13,13 +13,13 @@ resources:
 images:
 - name: gcr.io/ml-pipeline/api-server
   newName: quay.io/aipipeline/apiserver
-  newTag: 2.0.3
+  newTag: 2.0.5
 - name: gcr.io/ml-pipeline/persistenceagent
   newName: quay.io/aipipeline/persistenceagent
-  newTag: 2.0.3
+  newTag: 2.0.5
 - name: gcr.io/ml-pipeline/scheduledworkflow
   newName: quay.io/aipipeline/scheduledworkflow
-  newTag: 2.0.3
+  newTag: 2.0.5
 
 labels:
 - includeSelectors: true

apps/kfp-tekton/upstream/env/platform-openshift-pipelines/kustomization.yaml

@@ -64,13 +64,13 @@ patches:
 images:
 - name: gcr.io/ml-pipeline/api-server
   newName: quay.io/aipipeline/apiserver
-  newTag: 2.0.3
+  newTag: 2.0.0
 - name: gcr.io/ml-pipeline/persistenceagent
   newName: quay.io/aipipeline/persistenceagent
-  newTag: 2.0.3
+  newTag: 2.0.0
 - name: gcr.io/ml-pipeline/scheduledworkflow
   newName: quay.io/aipipeline/scheduledworkflow
-  newTag: 2.0.3
+  newTag: 2.0.0
 
 labels:
 - includeSelectors: true

apps/kfp-tekton/upstream/third-party/application/application-controller-deployment.yaml

@@ -18,14 +18,9 @@ spec:
     spec:
       containers:
         - command:
-          - /bin/sh
-          - -c
-          # See https://github.com/kubeflow/gcp-blueprints/issues/184.
-          - |
-            echo "logs are hidden because volume is too excessive" &&
-            /root/manager 2> /dev/null
-          # A customized image with https://github.com/kubernetes-sigs/application/pull/127
-          image: gcr.io/ml-pipeline/application-crd-controller:1.0-beta-non-cluster-role
+          - /kube-app-manager
+          # Built from https://github.com/kubernetes-sigs/application master branch on the date specified in the image tag.
+          image: gcr.io/ml-pipeline/application-crd-controller:20231101
           imagePullPolicy: IfNotPresent
           name: manager
           env:

apps/kfp-tekton/upstream/third-party/tekton-custom-task/kfptask/201-clusterrole.yaml

@@ -34,6 +34,19 @@ rules:
   - apiGroups: ["apps"]
     resources: ["deployments", "deployments/finalizers"]
     verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes", "persistentvolumeclaims"]
+    verbs: ["*"]
+
+  # Controller needs permission to emit events associated with Run CRs.
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "create", "update", "delete", "patch", "watch"]
+
+  # driver needs to access configmaps to get configuration
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "watch", "list"]
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1

apps/kfp-tekton/upstream/third-party/tekton-custom-task/kfptask/201-role.yaml

@@ -33,6 +33,34 @@ rules:
     resources: ["podsecuritypolicies"]
     resourceNames: ["tekton-pipelines", "openshift-pipelines"]
     verbs: ["use"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["persistentvolumes", persistentvolumeclaims]
+    verbs: ["*"]
+  - apiGroups: ["snapshot.storage.k8s.io"]
+    resources: ["volumesnapshots"]
+    verbs: ["create", "delete", "get"]
+  - apiGroups: [""]
+    resources: ["pods", "pods/exec", "pods/log", "services"]
+    verbs: ["*"]
+  - apiGroups: ["", "apps", "extensions"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["*"]
+  - apiGroups: ["kubeflow.org"]
+    resources: ["*"]
+    verbs: ["*"]
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["*"]
+  - apiGroups: ["machinelearning.seldon.io"]
+    resources: ["seldondeployments"]
+    verbs: ["*"]
+  - apiGroups: ["policy"]
+    resources: ["podsecuritypolicies"]
+    resourceNames: ["tekton-pipelines", "openshift-pipelines"]
+    verbs: ["use"]
 ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1

apps/kfp-tekton/upstream/third-party/tekton-custom-task/kustomization.yaml

@@ -3,29 +3,31 @@ kind: Kustomization
 
 resources:
 - pipeline-loops
-- driver-controller
 - exit-handler
 - kfptask
+# Deprecated controller
+# - driver-controller
 
 namespace: tekton-pipelines
 
 images:
   - name: quay.io/aipipeline/pipelineloop-controller
-    newTag: 1.7.1
+    newTag: 1.9.2
   - name: quay.io/aipipeline/pipelineloop-webhook
-    newTag: 1.7.1
-  - name: kfp-v2-dev-driver-controller
-    newName: quay.io/aipipeline/tekton-driver
-    newTag: 2.0.3
+    newTag: 1.9.2
   - name: tekton-exithandler-controller
     newName: quay.io/aipipeline/tekton-exithandler-controller
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: tekton-exithandler-webhook
     newName: quay.io/aipipeline/tekton-exithandler-webhook
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: tekton-kfptask-controller
     newName: quay.io/aipipeline/tekton-kfptask-controller
-    newTag: 2.0.3
+    newTag: 2.0.5
   - name: tekton-kfptask-webhook
     newName: quay.io/aipipeline/tekton-kfptask-webhook
-    newTag: 2.0.3
+    newTag: 2.0.5
+  # Deprecated controller
+  # - name: kfp-v2-dev-driver-controller
+  #   newName: quay.io/aipipeline/tekton-driver
+  #   newTag: 2.0.3