Skip to content

Commit 06e4502

Browse files
pschoen-itscpschoen-itsc
committed
Add profiles to seaweedfs
Signed-off-by: Patrick Schönthaler <[email protected]>
1 parent abd68fc commit 06e4502

File tree

56 files changed

+872
-642
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+872
-642
lines changed

‎.github/workflows/admission_webhook_test.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88
- tests/gh-actions/install_istio.sh
99
- tests/gh-actions/install_cert_manager.sh
1010
- common/cert-manager/**
11+
- common/istio*/**
1112

1213
jobs:
1314
build:

‎.github/workflows/centraldashboard_test.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66
- .github/workflows/centraldashboard_test.yaml
77
- apps/centraldashboard/upstream/**
88
- tests/gh-actions/install_istio.sh
9+
- common/istio*/**
910

1011
jobs:
1112
build:

‎.github/workflows/jupyter_web_application_test.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66
- .github/workflows/jupyter_web_application_test.yaml
77
- apps/jupyter/jupyter-web-app/upstream/**
88
- tests/gh-actions/install_istio.sh
9+
- common/istio*/**
910

1011
jobs:
1112
build:

‎.github/workflows/katib_test.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66
- .github/workflows/katib_test.yaml
77
- apps/katib/upstream/**
88
- tests/gh-actions/install_istio.sh
9+
- common/istio*/**
910
- tests/gh-actions/install_cert_manager.sh
1011
- common/cert-manager/**
1112
- experimental/security/PSS/*

‎.github/workflows/kserve_cni_test.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,8 @@ on:
44
paths:
55
- tests/gh-actions/install_KinD_create_KinD_cluster_install_kustomize.sh
66
- .github/workflows/kserve_cni_test.yaml
7-
- common/istio-cni-1-24/**
7+
- tests/gh-actions/install_istio.sh
8+
- common/istio*/**
89
- tests/gh-actions/install_cert_manager.sh
910
- common/cert-manager/**
1011
- tests/gh-actions/install_knative-cni.sh

‎.github/workflows/kserve_m2m_test.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,16 @@ on:
55
- tests/gh-actions/install_KinD_create_KinD_cluster_install_kustomize.sh
66
- .github/workflows/kserve_m2m_test.yaml
77
- apps/kserve/**
8-
- common/oauth2-proxy/**
8+
- tests/gh-actions/install_kserve.sh
99
- common/istio*/**
1010
- tests/gh-actions/install_istio.sh
11+
- common/oauth2-proxy/**
1112
- tests/gh-actions/install_oauth2-proxy.sh
12-
- tests/gh-actions/install_cert_manager.sh
1313
- common/cert-manager/**
14-
- tests/gh-actions/install_knative.sh
14+
- tests/gh-actions/install_cert_manager.sh
1515
- common/knative/**
16-
- tests/gh-actions/install_kserve.sh
16+
- tests/gh-actions/install_knative.sh
17+
1718

1819
jobs:
1920
build:

‎.github/workflows/kserve_test.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
- common/knative/**
1212
- tests/gh-actions/install_kserve.sh
1313
- experimental/security/PSS/**
14+
- common/istio*/**
15+
- tests/gh-actions/install_istio.sh
1416

1517
jobs:
1618
build:

‎.github/workflows/pipeline_swfs_test.yaml‎

Lines changed: 28 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -38,14 +38,14 @@ jobs:
3838
- name: Create kubeflow namespace
3939
run: kustomize build common/kubeflow-namespace/base | kubectl apply -f -
4040

41-
- name: Install KF Pipelines
42-
run: ./tests/gh-actions/install_pipelines.sh
43-
4441
- name: Install KF Multi Tenancy
4542
run: ./tests/gh-actions/install_multi_tenancy.sh
4643

44+
- name: Install KF Pipelines
45+
run: ./tests/gh-actions/install_pipelines_swfs.sh
46+
4747
- name: Install kubeflow-istio-resources
48-
run: kustomize build common/istio-1-24/kubeflow-istio-resources/base | kubectl apply -f -
48+
run: kustomize build common/istio-cni-1-24/kubeflow-istio-resources/base | kubectl apply -f -
4949

5050
- name: Create KF Profile
5151
run: |
@@ -75,12 +75,6 @@ jobs:
7575
fi
7676
kubectl get secret mlpipeline-minio-artifact -n "$KF_PROFILE" -o json | jq -r '.data | keys[] as $k | "\($k): \(. | .[$k] | @base64d)"' | tr '\n' ' '
7777
78-
- name: Install seaweedfs
79-
run: |
80-
kustomize build experimental/seaweedfs/istio | kubectl apply -f -
81-
kubectl -n kubeflow wait --for=condition=available --timeout=600s deploy/seaweedfs
82-
kubectl -n kubeflow exec deploy/seaweedfs -c seaweedfs -- sh -c "echo \"s3.configure -user minio -access_key minio -secret_key minio123 -actions Read,Write,List -apply\" | /usr/bin/weed shell"
83-
8478
- name: port forward
8579
run: |
8680
ingress_gateway_service=$(kubectl get svc --namespace istio-system --selector="app=istio-ingressgateway" --output jsonpath='{.items[0].metadata.name}')
@@ -93,3 +87,27 @@ jobs:
9387
KF_PROFILE=kubeflow-user-example-com
9488
TOKEN="$(kubectl -n $KF_PROFILE create token default-editor)"
9589
python3 tests/gh-actions/pipeline_test.py run_pipeline "${TOKEN}" "${KF_PROFILE}"
90+
91+
- name: Fail to list pipelines with unauthorized ServiceAccount Token
92+
run: |
93+
pip3 install kfp==2.11.0
94+
KF_PROFILE=kubeflow-user-example-com
95+
TOKEN="$(kubectl -n default create token default)"
96+
python3 tests/gh-actions/pipeline_test.py test_unauthorized_access "${TOKEN}" "${KF_PROFILE}"
97+
echo "Test succeeded. Token from unauthorized ServiceAccount cannot list pipelines in $KF_PROFILE namespace."
98+
99+
100+
- name: Apply Pod Security Standards baseline levels for static namespaces
101+
run: ./tests/gh-actions/enable_baseline_PSS.sh
102+
103+
- name: Unapply applied baseline labels
104+
run: |
105+
NAMESPACES=("istio-system" "auth" "cert-manager" "oauth2-proxy" "kubeflow")
106+
for NAMESPACE in "${NAMESPACES[@]}"; do
107+
if kubectl get namespace "$NAMESPACE" >/dev/null 2>&1; then
108+
kubectl label namespace $NAMESPACE pod-security.kubernetes.io/enforce-
109+
fi
110+
done
111+
112+
- name: Applying Pod Security Standards restricted levels for static namespaces
113+
run: ./tests/gh-actions/enable_restricted_PSS.sh

‎.github/workflows/ray_test.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ on:
55
- tests/gh-actions/install_KinD_create_KinD_cluster_install_kustomize.sh
66
- .github/workflows/ray_test.yaml
77
- experimental/ray/**
8+
- tests/gh-actions/install_istio.sh
9+
- tests/gh-actions/install_cert_manager.sh
10+
- tests/gh-actions/install_oauth2-proxy.sh
11+
- common/cert-manager/**
12+
- common/oauth2-proxy/**
13+
- common/istio*/**
814

915
jobs:
1016
build:

‎.github/workflows/spark_test.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@ on:
55
- tests/gh-actions/install_KinD_create_KinD_cluster_install_kustomize.sh
66
- .github/workflows/spark_test.yaml
77
- apps/spark/**
8+
- tests/gh-actions/install_istio.sh
9+
- tests/gh-actions/install_cert_manager.sh
10+
- tests/gh-actions/install_oauth2-proxy.sh
11+
- common/cert-manager/**
12+
- common/oauth2-proxy/**
13+
- common/istio*/**
814

915
jobs:
1016
build:

0 commit comments

Comments
 (0)