Release 1.3.1

[yanniszark]

Problem Statement

The 1.3.0 release is out and KubeCon is over! This means we should start working on 1.3.1.

I would like to ask each WG to let me know of items you want to include in 1.3.1, by commenting on this issue. Please keep in mind that this is a point release, so we should include bugfixes, not new features.

1. Upstream WGs: resolve blocking PRs Deadline: June 21st
   • Manifests:
     • Upgrade cert-manager Tracking issue: Update cert-manager manifests #1838
     • Upgrade to latest Istio 1.9.x Reasons to update Istio: CVEs fixed since 1.9.0 #1893
     • Upgrade Knative Update Knative version #1754
   • WG-Pipelines:
     • Introduce token credential inferface: feat(sdk): Introduce the token credentials interface. Part of #4683 pipelines#5287
     • KFP Tekton: Upgrade to v0.8.0
   • WG-AutoML: No new changes (source: @johnugeorge)
   • WG-Notebooks:
     • Fix Jupyter Web App using workspace mountpath set in the configuration: [fix]: Make jupyter-web-app parse workspace volume MountPath kubeflow#5952
     • Fix GPU allocation for notebooks: FIX The number of gpu must be set as string in Kubernetes/Openshift kubeflow#5891
     • Fix KNative Istio permissions in profile controller: fix(profile-controller): KNative probes kubeflow#5848
     • Fix profile namespace labels for Istio: Allow user to add/delete labels to user namespace using ConfigMap. Fix #5712 kubeflow#5761
     • Remove resource quota from namespace if removed from profile: kf-resource-quota Can Resource Quota be removed from from namespace ? kubeflow#5950
     • Fix notebook-controller not filtering objects properly: Correct missing predicates in controller watches. Fixes #5326 kubeflow#5873
     • Fix missing parameter in central dashboard: Take [[disabled]] parameter into account on registration page namespace input kubeflow#5782
     • Fix email regex being too restrictive: Expand the email regex to allow more TLDs kubeflow#5679
     • Fix bug in kfam due to using an outdated version of the profile API: upgrade kfam profile api to fix bug to resource quota kubeflow#5941
     • Central Dashboard manifests doesn't use configmap: Central Dashboard and Jupyter Web App manifests don't use configmap dashboard#39
     • KFAM doesn't create Istio authorization policy for namespace contributors KFAM doesn't create Istio authorization policy for namespace contributors kubeflow#5984
2. Upstream WGs: release artifacts (images, manifests), give manifests-wg the desired git revisions
3. Manifests WG: sync manifests from upstream app releases to manifests repo
4. Manifests WG: Cut release candidate branch
5. Manifests WG: test and update instructions.
6. Distribution Owners: Use instructions from wg-manifests for how to use kustomizations and update their distributions.

cc @kubeflow/wg-automl-leads
cc @kubeflow/wg-deployment-leads
cc @kubeflow/wg-manifests-leads
cc @kubeflow/wg-notebooks-leads
cc @kubeflow/wg-pipeline-leads
cc @kubeflow/wg-serving-leads
cc @kubeflow/wg-training-leads

[thesuperzapper]

@kubeflow/wg-manifests-leads I think an important feature for 1.3.1 for Manifests WG would be to add the "supported version matrix" for external dependancies that kubeflow uses, like "cert-manager", and "knative"

See issue: #1842

[davidspek]

There are serious security vulnerabilities in Istio and Envoy that allowed for people to bypass authorization. The Istio manifests should be updated to at least the latest version of 1.9. Updating to 1.10 would also be a good option, as the only thing incompatible with Istio 1.10 seems to be an existing problem in the tensorboard-controller that is solved by adding the --bind_all flag to the startup command.

[yanniszark]

There are serious security vulnerabilities in Istio and Envoy that allowed for people to bypass authorization.

@davidspek could you please open an issue about this and elaborate / include link(s) to the vulnerability report(s)?

[davidspek]

@yanniszark I just created the issue #1893, although it isn't very difficult to find as it is all stated in the Istio release notes. There are 7 vulnerabilities that have been patched since 1.9.0, 6 of which have CVSS scores ranging from 7.5 to 10. I'd also to note that it should be the norm to update software dependencies, and not only updated out of absolute necessity or serious CVEs. Not keeping up with updates just causes more work in the long run, especially if transition periods are missed.

[davidspek]

PRs/issues for WG-Notebooks that should to be addressed for 1.3.1

Remove resource quota from namespace if removed from profile: kubeflow/kubeflow#5950

Fix Jupyter Web App using workspace mountpath set in the configuration: kubeflow/kubeflow#5952
Fix GPU allocation for notebooks: kubeflow/kubeflow#5891
Fix notebook-controller not filtering objects properly: kubeflow/kubeflow#5873
Fix KNative Istio permissions in profile controller: kubeflow/kubeflow#5848
Fix missing parameter in central dashboard: kubeflow/kubeflow#5782
Fix profile namespace labels for Istio: kubeflow/kubeflow#5761
Fix email regex being too restrictive: kubeflow/kubeflow#5679
Fix bug in kfam due to using an outdated version of the profile API: kubeflow/kubeflow#5941

[johnugeorge]

Also, kfp package in notebook images are outdated- 1.0.4. Can new package be added to image after client changes for kubeflow/pipelines#5138 are added to sdk ?

[davidspek]

@johnugeorge Thanks for reminding me, there are actually a lot more updates that need to happen to the notebook images. I'll create a PR to update them tomorrow.

[davidspek]

Another issue from the Notebook Working Group:
Central Dashboard manifests doesn't use configmap: kubeflow/dashboard#39

[andreyvelich]

As we discussed earlier, we will release Sobol and Restart Strategy support for Katib in Kubeflow 1.4

For Kubeflow 1.3.1 we will cut new Katib tag: v0.11.1 with the latest fixes for 0.11 branch.
cc @kubeflow/wg-automl-leads