chore: upstream istio support by sameerdattav · Pull Request #3189 · kubeflow/trainer

sameerdattav · 2026-02-09T11:24:24Z

This PR builds on #3021 and implements the suggested follow-up:

Adds configurable selector labels for the trainer controller manager via Helm values
Adds a Kustomize overlay patch for kubeflow-platform installs

Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Add security context and annotations for Istio traffic management. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Added a patch to modify the jobset-controller-manager deployment annotations and security context. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Removed security context seccomp profile from deployment. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Removed security context seccompProfile configuration. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Removed security context seccompProfile from spec. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

github-actions · 2026-02-09T11:24:36Z

🎉 Welcome to the Kubeflow Trainer! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
Our team will review your PR soon! cc @kubeflow/kubeflow-trainer-team

Join the community:

Slack: Join our #kubeflow-trainer Slack channel.
Meetings: Attend the Kubeflow AutoML and Training Working Group bi-weekly meetings.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

coveralls · 2026-02-09T11:29:21Z

Pull Request Test Coverage Report for Build 22163625294

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 51.217%

Totals
Change from base Build 22163621687:	0.0%
Covered Lines:	1241
Relevant Lines:	2423

💛 - Coveralls

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

juliusvonkohout · 2026-02-10T15:33:15Z

Please add the actual istio labels and what was in the previous PR in the new schema.

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

sameerdattav · 2026-02-13T23:24:37Z

@juliusvonkohout ,
I made the changes that you have asked for.
Kindly check again.

andreyvelich · 2026-02-17T19:12:59Z

charts/kubeflow-trainer/values.yaml

Please can you remove this label by default and update the README on how to set it:

Suggested change

podAnnotations:

traffic.sidecar.istio.io/excludeInboundPorts: "9443"

podAnnotations: {}

https://github.com/sameerdattav/trainer/blob/c0369539a34d98e61f2c584a54f39f33cba7c07a/charts/kubeflow-trainer/README.md.gotmpl#L50

andreyvelich · 2026-02-17T19:13:54Z

manifests/overlays/kubeflow-platform/kustomization.yaml


 patches:
  - path: patches/remove-namespace.yaml
+  - target:


Please can you also move the JobSet patch for Istio to this file?
https://github.com/sameerdattav/trainer/blob/c0369539a34d98e61f2c584a54f39f33cba7c07a/manifests/third-party/jobset/kustomization.yaml#L21-L30

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

andreyvelich

Thank you for this work @sameerdattav!
/lgtm
/approve

google-oss-prow · 2026-02-19T00:36:04Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: andreyvelich

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [andreyvelich]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

andreyvelich · 2026-02-19T00:36:07Z

/hold

andreyvelich · 2026-02-19T00:36:21Z

@sameerdattav You should change branch to master in your PR.
cc @juliusvonkohout

andreyvelich · 2026-02-19T00:37:45Z

/reopen

google-oss-prow · 2026-02-19T00:37:49Z

@andreyvelich: Reopened this PR.

Details

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sameerdattav · 2026-02-19T00:40:20Z

@andreyvelich , I think @juliusvonkohout wanted me to raise a pr against his branch, i.e pss-restricted-fixes?
Happy to change the branch to master, just say so.

andreyvelich · 2026-02-19T00:41:32Z

Yes, let's commit this feature directly to master branch please.

sameerdattav · 2026-02-19T00:45:23Z

/retest

google-oss-prow · 2026-02-19T00:45:39Z

@sameerdattav: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

Details

In response to this:

/retest

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sameerdattav · 2026-02-19T00:47:11Z

@andreyvelich could you please leave an ok-to-test or a retest comment?

andreyvelich · 2026-02-19T01:21:31Z

/ok-to-test

@sameerdattav Our E2Es are failing due to this: kubeflow/sdk#307
@XploY04 is working on it.

andreyvelich · 2026-02-19T02:38:32Z

manifests/base/manager/manager.yaml

+      annotations:
+        traffic.sidecar.istio.io/excludeInboundPorts: "9443"


You don't need this since you already have a patch, right ?

Suggested change

annotations:

traffic.sidecar.istio.io/excludeInboundPorts: "9443"

andreyvelich · 2026-02-19T02:39:44Z

manifests/overlays/kubeflow-platform/kustomization.yaml

+          matchLabels:
+            app: kubeflow-trainer
+        template:
+          metadata:
+            labels:
+              app: kubeflow-trainer


Why do you need these labels? Can we preserve the original one:

app.kubernetes.io/name: trainer app.kubernetes.io/component: manager app.kubernetes.io/part-of: kubeflow

Suggested change

matchLabels:

app: kubeflow-trainer

template:

metadata:

labels:

app: kubeflow-trainer

template:

metadata:

juliusvonkohout and others added 7 commits February 4, 2026 10:15

pss-restricted-fixes

9a0850b

Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Enhance deployment.yaml with security context and annotations

dcd83f9

Add security context and annotations for Istio traffic management. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Update kustomization.yaml with new patches

9fdcccb

Added a patch to modify the jobset-controller-manager deployment annotations and security context. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Remove seccomp profile from manager deployment

db3fa5c

Removed security context seccomp profile from deployment. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Remove seccompProfile from security context

92513eb

Removed security context seccompProfile configuration. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Remove seccompProfile from manager security context

6ec7112

Removed security context seccompProfile from spec. Signed-off-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com>

Add configurable selector labels for trainer manager (Helm + Kustomize)

6c14640

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

google-oss-prow bot requested review from akshaychitneni and kuizhiqing February 9, 2026 11:24

google-oss-prow bot added the size/S label Feb 9, 2026

Run1 make generate

91474da

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

juliusvonkohout changed the title ~~chore: Add configurable selector labels for trainer manager (Helm + Kustomize)~~ chore: upstream istio support Feb 12, 2026

juliusvonkohout mentioned this pull request Feb 12, 2026

fix: upstream istio support #3021

Closed

Addressing comments

0a28997

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

google-oss-prow bot added size/M and removed size/S labels Feb 13, 2026

run2 make generate

c036953

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

andreyvelich reviewed Feb 17, 2026

View reviewed changes

sameerdattav added 2 commits February 19, 2026 03:22

Stop hardcoding helm , doc , moving jobset

bce8c6c

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

Run3 make generate

dfc453f

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

google-oss-prow bot added size/L and removed size/M labels Feb 18, 2026

Fix EOF pre-commit

ae506f5

Signed-off-by: Surya Sameer Datta Vaddadi <f20220373@goa.bits-pilani.ac.in>

sameerdattav requested a review from andreyvelich February 19, 2026 00:32

andreyvelich reviewed Feb 19, 2026

View reviewed changes

google-oss-prow bot assigned andreyvelich Feb 19, 2026

google-oss-prow bot added the lgtm label Feb 19, 2026

google-oss-prow bot added the approved label Feb 19, 2026

google-oss-prow bot added the do-not-merge/hold label Feb 19, 2026

andreyvelich deleted the branch kubeflow:master February 19, 2026 00:37

andreyvelich closed this Feb 19, 2026

google-oss-prow bot reopened this Feb 19, 2026

sameerdattav changed the base branch from pss-restricted-fixes to master February 19, 2026 00:42

google-oss-prow bot added the ok-to-test label Feb 19, 2026

andreyvelich reviewed Feb 19, 2026

View reviewed changes

	podAnnotations:
	traffic.sidecar.istio.io/excludeInboundPorts: "9443"
	podAnnotations: {}

		annotations:
		traffic.sidecar.istio.io/excludeInboundPorts: "9443"

Conversation

sameerdattav commented Feb 9, 2026

Uh oh!

github-actions bot commented Feb 9, 2026

Uh oh!

coveralls commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 22163625294

Details

💛 - Coveralls

Uh oh!

juliusvonkohout commented Feb 10, 2026

Uh oh!

sameerdattav commented Feb 13, 2026

Uh oh!

andreyvelich Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

andreyvelich Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

andreyvelich left a comment

Choose a reason for hiding this comment

Uh oh!

google-oss-prow bot commented Feb 19, 2026

Uh oh!

andreyvelich commented Feb 19, 2026

Uh oh!

andreyvelich commented Feb 19, 2026

Uh oh!

andreyvelich commented Feb 19, 2026

Uh oh!

google-oss-prow bot commented Feb 19, 2026

Uh oh!

sameerdattav commented Feb 19, 2026

Uh oh!

andreyvelich commented Feb 19, 2026

Uh oh!

sameerdattav commented Feb 19, 2026

Uh oh!

google-oss-prow bot commented Feb 19, 2026

Uh oh!

sameerdattav commented Feb 19, 2026

Uh oh!

andreyvelich commented Feb 19, 2026

Uh oh!

andreyvelich Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

andreyvelich Feb 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

coveralls commented Feb 9, 2026 •

edited

Loading