Skip to content

fix: upstream istio support #3021

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
juliusvonkohout wants to merge 6 commits into from
+26 −6
Closed

fix: upstream istio support #3021

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9a0850b
pss-restricted-fixes
juliusvonkohout Dec 5, 2025
dcd83f9
Enhance deployment.yaml with security context and annotations
juliusvonkohout Dec 5, 2025
9fdcccb
Update kustomization.yaml with new patches
juliusvonkohout Dec 5, 2025
db3fa5c
Remove seccomp profile from manager deployment
juliusvonkohout Dec 30, 2025
92513eb
Remove seccompProfile from security context
juliusvonkohout Dec 30, 2025
6ec7112
Remove seccompProfile from manager security context
juliusvonkohout Dec 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions charts/kubeflow-trainer/templates/manager/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ spec:
metadata:
labels:
{{- include "trainer.manager.selectorLabels" . | nindent 8 }}
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "9443"
spec:
containers:
- name: manager
Expand Down
2 changes: 2 additions & 0 deletions manifests/base/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,8 @@ spec:
app.kubernetes.io/name: trainer
app.kubernetes.io/component: manager
app.kubernetes.io/part-of: kubeflow
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "9443"
Comment on lines +22 to +23
Copy link
Member

@andreyvelich andreyvelich Feb 5, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the delay @juliusvonkohout!

We discussed about it with @kannon92 on JobSet issue: kubernetes-sigs/jobset#1052 (comment)

Since other platforms might not use Istio (e.g. Cilium, Linkerd, etc.), I would suggest to add custom patch to the kubeflow-platform overlay to append this annotation alongside JobSet change:

trainer/manifests/third-party/jobset/kustomization.yaml

Lines 20 to 30 in 6ec7112

patch: |-
apiVersion: apps/v1
kind: Deployment
metadata:
name: jobset-controller-manager
namespace: kubeflow-system
spec:
template:
metadata:
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "9443"

cc @kubeflow/kubeflow-trainer-team

Copy link
Member Author

@juliusvonkohout juliusvonkohout Feb 9, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From Slack:

I don't suggest you to do that in kubeflow/manifests
Similar to JobSet, just update kubeflow-platform Kustomize overlay in kubeflow/trainer repo to add patch for kubeflow-trainer-controller-manager deployment:

trainer/manifests/third-party/jobset/kustomization.yaml

Lines 15 to 30 in 6ec7112

- target:
group: apps
version: v1
kind: Deployment
name: jobset-controller-manager
patch: |-
apiVersion: apps/v1
kind: Deployment
metadata:
name: jobset-controller-manager
namespace: kubeflow-system
spec:
template:
metadata:
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "9443"

E.g. you can do that here: https://github.com/kubeflow/trainer/blob/6ec7112a3b397d0b160330f78f9b6bbcd4c59a0f/manifests/overlays/kubeflow-platform/kustomization.yaml
For the Helm Charts, simple use this Value to configure appropriate label when you do helm install
{{- include "trainer.manager.selectorLabels" . | nindent 8 }}

trainer/charts/kubeflow-trainer/templates/manager/deployment.yaml

Line 31 in 6ec7112

labels:

helm install kubeflow-trainer oci://ghcr.io/kubeflow/charts/kubeflow-trainer --version 2.1.0 --set trainer.manager.selectorLabels traffic.sidecar.istio.io/excludeInboundPorts=9443

Maybe a GSOC applicant can fork my branch and do the changes :-) and raise a PR against my the branch here. I will ask https://cloud-native.slack.com/archives/C0742LBR5BM/p1770634485333769

spec:
containers:
- name: manager
Expand Down
28 changes: 22 additions & 6 deletions manifests/third-party/jobset/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,25 @@ resources:

# Add required patches.
patches:
# Remove namespace from the JobSet release manifests.
- path: patches/jobset_remove_namespace.yaml
target:
group: ""
version: v1
kind: Namespace
# Remove namespace from the JobSet release manifests.
- path: patches/jobset_remove_namespace.yaml
target:
group: ""
version: v1
kind: Namespace
- target:
group: apps
version: v1
kind: Deployment
name: jobset-controller-manager
patch: |-
apiVersion: apps/v1
kind: Deployment
metadata:
name: jobset-controller-manager
namespace: kubeflow-system
spec:
template:
metadata:
annotations:
traffic.sidecar.istio.io/excludeInboundPorts: "9443"
Loading