Update kserve/kserve manifests from v0.18.0 by christian-heusel · Pull Request #3406 · kubeflow/manifests

christian-heusel · 2026-03-19T09:41:33Z

Pull Request Template for Kubeflow Manifests

✏️ Summary of Changes

Update the manifests for kserve from 0.16.0 to v0.18.0

🚧 Remaining ToDo's:

Had to run kubectl delete clusterrolebinding llmisvc-manager-rolebinding --ignore-not-found on pre-existing cluster ➡️ documentation(kserve): add upgrade notes for v0.16.x to v0.17.0 migration #3420

📦 Dependencies

none

🐛 Related Issues

Issue in KServe: No ./install/v0.17.0/ directory present in the v0.17.0 kserve release kserve/kserve#5255

✅ Contributor Checklist

I have tested these changes with kustomize. See Installation Prerequisites.
All commits are signed-off to satisfy the DCO check.
I have considered adding my company to the adopters page to support Kubeflow and help the community, since I expect help from the community for my issue (see 1. and 2.).

You can join the CNCF Slack and access our meetings at the Kubeflow Community website. Our channel on the CNCF Slack is here #kubeflow-platform.

Copilot

Pull request overview

Updates Kubeflow manifests tracking for KServe to v0.17.0, accounting for the fact that the original v0.17.0 tag did not include the required install artifacts.

Changes:

Bumps the KServe synchronization script reference from v0.16.0 to v0.17.0.
Updates the root README component table entry for KServe to v0.17.0 and links to the release branch path containing the install files.

Reviewed changes

Copilot reviewed 2 out of 6 changed files in this pull request and generated 3 comments.

File	Description
scripts/synchronize-kserve-kserve-manifests.sh	Updates the git ref used by the sync script to target KServe v0.17.0.
README.md	Updates the KServe row to reflect v0.17.0 and links to the install directory on the release branch.

You can also share your feedback on Copilot code review. Take the survey.

abdullahpathan22 · 2026-03-23T10:15:57Z

@christian-heusel/ @juliusvonkohout I noticed the llmisvc-manager-rolebinding deletion step in the ToDo list is currently undocumented. I opened a companion PR #3420 that adds upgrade notes covering this breaking change, the v0.17.0 tag issue, and the Certificate SAN fix. Happy to adjust based on your feedback.

juliusvonkohout · 2026-03-27T08:29:02Z

Please rebase to master

christian-heusel · 2026-03-27T19:49:22Z

/hold

Copilot

Pull request overview

Updates the Kubeflow Manifests KServe component to align with KServe v0.17.0 (synced from release-0.17 due to the upstream tag missing install artifacts), and applies Kubeflow-specific fixes to keep the deployment functional in the kubeflow namespace.

Changes:

Update the KServe synchronization script/version metadata for the v0.17.0 sync workflow.
Add/adjust Kustomize patches to fix cert-manager CA injection references and webhook certificate SANs for kubeflow namespace installs.
Refresh KServe cluster resources (runtime images, new runtimes, and updated LLM-related templates/configs).

Reviewed changes

Copilot reviewed 3 out of 7 changed files in this pull request and generated 8 comments.

File	Description
scripts/synchronize-kserve-kserve-manifests.sh	Updates sync inputs/versioning for the v0.17.0 KServe manifests sync.
applications/kserve/kserve/kustomization.yaml	Adds patches to fix cert-manager injection + certificate SAN issues and updates LLM-related patch targeting.
applications/kserve/kserve/kserve-cluster-resources.yaml	Updates runtime images/annotations and substantially revises LLM templates and related configs.
README.md	Updates the KServe “Upstream Revision” entry to v0.17.0.

tarekabouzeid · 2026-05-04T16:14:36Z

@christian-heusel @vrajjbhatt Got confirmation from Kserve to use 0.18.0 instead. Please create another PR for that version instead.

Copilot

Pull request overview

Copilot reviewed 9 out of 16 changed files in this pull request and generated 11 comments.

Copilot

Pull request overview

Copilot reviewed 9 out of 16 changed files in this pull request and generated 10 comments.

tarekabouzeid · 2026-05-09T21:14:10Z

@christian-heusel Thanks so much for this work, can you rebase and look into applications/kserve/kserve/kustomization.yaml

There are a few specialties regarding this release as the initial v0.17.0 tag did not contain the needed install files, see the linked issue for more details. This is also the reason that the manifests were synced from the `release-v0.17` branch manually instead of using the tag as we normally do. Additionally the sync came with a bunch of script which I did not include into the changes as they were only scripts: - `applications/kserve/kserve/keda-dependency-install.sh` - `applications/kserve/kserve/kserve-knative-mode-dependency-install.sh` - `applications/kserve/kserve/kserve-knative-mode-full-install-with-manifests.sh` - `applications/kserve/kserve/kserve-standard-mode-dependency-install.sh` - `applications/kserve/kserve/kserve-standard-mode-full-install-with-manifests.sh` - `applications/kserve/kserve/llmisvc-dependency-install.sh` - `applications/kserve/kserve/llmisvc-full-install-with-manifests.sh` Link: kserve/kserve#5255 Signed-off-by: Christian Heusel <christian@heusel.eu>

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Signed-off-by: Christian Heusel <christian@heusel.eu>

kserve_kubeflow.yaml v0.17.0 introduced a second set of Certificate resources that still reference the upstream kserve namespace instead of kubeflow. These duplicates override the correct kubeflow-scoped ones, causing cert-manager to issue certs with kserve.svc SANs, which results in TLS verification failures on the webhook server. Patch all three Certificates (serving-cert, llmisvc-serving-cert, localmodel-serving-cert) to use the correct kubeflow.svc SANs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

kserve_kubeflow.yaml v0.17.0 hardcodes cert-manager.io/inject-ca-from: kserve/<cert-name> on all webhook configurations and relevant CRDs, but the Certificate resources live in the kubeflow namespace. cert-manager's ca-injector uses this annotation to populate the webhook caBundle, so with the wrong namespace reference the caBundle is never set and TLS verification fails with "certificate signed by unknown authority". Patch all 12 affected resources (1 MutatingWebhookConfiguration, 3 CRDs, 8 ValidatingWebhookConfigurations) to use kubeflow/<cert-name> instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Signed-off-by: Christian Heusel <christian@heusel.eu>

Usually this works automatically, however due to the changes for kserve v0.17.0 this has to be done manually once. Signed-off-by: Christian Heusel <christian@heusel.eu>

… targets Replace 12 individual strategic merge patches with 3 JSON 6902 patches that use name regex targets, grouping resources by their cert name. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Signed-off-by: Christian Heusel <christian@heusel.eu>

tarekabouzeid · 2026-05-11T19:28:47Z

Thanks for your efforts
/lgtm

juliusvonkohout · 2026-05-12T12:03:18Z

Thank you
/lgtm
/approve

google-oss-prow · 2026-05-12T12:03:39Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: juliusvonkohout

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [juliusvonkohout]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

juliusvonkohout · 2026-05-12T12:05:28Z

/unhold

Copilot AI review requested due to automatic review settings March 19, 2026 09:41

google-oss-prow Bot added the do-not-merge/work-in-progress label Mar 19, 2026

google-oss-prow Bot requested review from juliusvonkohout and tarekabouzeid March 19, 2026 09:41

google-oss-prow Bot added the size/XXL label Mar 19, 2026

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread scripts/synchronize-kserve-kserve-manifests.sh

Comment thread README.md Outdated

Comment thread README.md Outdated

christian-heusel force-pushed the synchronize-kserve-manifests-release-0.17 branch from 75d9f0b to 8d493ea Compare March 19, 2026 10:34

abdullahpathan22 mentioned this pull request Mar 23, 2026

documentation(kserve): add upgrade notes for v0.16.x to v0.17.0 migration #3420

Merged

1 task

christian-heusel force-pushed the synchronize-kserve-manifests-release-0.17 branch from fa00f5a to 01b9dab Compare March 23, 2026 13:05

christian-heusel force-pushed the synchronize-kserve-manifests-release-0.17 branch 3 times, most recently from 49816e7 to 2d01eef Compare March 27, 2026 19:34

christian-heusel marked this pull request as ready for review March 27, 2026 19:49

google-oss-prow Bot added do-not-merge/hold and removed do-not-merge/work-in-progress labels Mar 27, 2026

juliusvonkohout requested a review from Copilot March 28, 2026 09:41

Copilot started reviewing on behalf of juliusvonkohout March 28, 2026 09:42 View session

Copilot AI reviewed Mar 28, 2026

View reviewed changes

christian-heusel commented Mar 28, 2026

View reviewed changes

Comment thread applications/kserve/kserve/kustomization.yaml Outdated

christian-heusel force-pushed the synchronize-kserve-manifests-release-0.17 branch from 2d01eef to a1c1edd Compare May 6, 2026 17:48

christian-heusel changed the title ~~Update kserve/kserve manifests from v0.17.0~~ Update kserve/kserve manifests from v0.18.0 May 6, 2026

christian-heusel marked this pull request as draft May 6, 2026 17:48

google-oss-prow Bot added the do-not-merge/work-in-progress label May 6, 2026

christian-heusel force-pushed the synchronize-kserve-manifests-release-0.17 branch from 9d29df1 to d7a542e Compare May 6, 2026 22:22

christian-heusel requested a review from Copilot May 6, 2026 23:13

Copilot started reviewing on behalf of christian-heusel May 6, 2026 23:13 View session

Copilot AI reviewed May 6, 2026

View reviewed changes

christian-heusel marked this pull request as ready for review May 6, 2026 23:23

google-oss-prow Bot removed the do-not-merge/work-in-progress label May 6, 2026

google-oss-prow Bot requested a review from kimwnasptd May 6, 2026 23:23

juliusvonkohout reviewed May 8, 2026

View reviewed changes

Comment thread applications/kserve/kserve/kustomization.yaml Outdated

juliusvonkohout requested a review from Copilot May 8, 2026 18:29

Copilot started reviewing on behalf of juliusvonkohout May 8, 2026 18:30 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

christian-heusel and others added 9 commits May 11, 2026 10:49

chore: Allow syncing manifests from a different ref

067d653

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

chore: Update the resource version in the delete patch

96392dc

Signed-off-by: Christian Heusel <christian@heusel.eu>

Update kserve/kserve manifests from v0.18.0

56372fb

Signed-off-by: Christian Heusel <christian@heusel.eu>

chore: Update readme for kserve v0.18.0

29cbec8

Usually this works automatically, however due to the changes for kserve v0.17.0 this has to be done manually once. Signed-off-by: Christian Heusel <christian@heusel.eu>

chore: Improve sync script to ignore scripts and fix readme replacement

aa67f78

Signed-off-by: Christian Heusel <christian@heusel.eu>

christian-heusel force-pushed the synchronize-kserve-manifests-release-0.17 branch from 9ec0153 to aa67f78 Compare May 11, 2026 09:25

google-oss-prow Bot assigned tarekabouzeid May 11, 2026

google-oss-prow Bot added the lgtm label May 11, 2026

google-oss-prow Bot assigned juliusvonkohout May 12, 2026

google-oss-prow Bot added the approved label May 12, 2026

google-oss-prow Bot removed the do-not-merge/hold label May 12, 2026

google-oss-prow Bot merged commit ff06e2d into kubeflow:master May 12, 2026
9 checks passed

Conversation

christian-heusel commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Template for Kubeflow Manifests

✏️ Summary of Changes

🚧 Remaining ToDo's:

📦 Dependencies

🐛 Related Issues

✅ Contributor Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

abdullahpathan22 commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

juliusvonkohout commented Mar 27, 2026

Uh oh!

christian-heusel commented Mar 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tarekabouzeid commented May 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tarekabouzeid commented May 9, 2026

Uh oh!

tarekabouzeid commented May 11, 2026

Uh oh!

juliusvonkohout commented May 12, 2026

Uh oh!

google-oss-prow Bot commented May 12, 2026

Uh oh!

juliusvonkohout commented May 12, 2026

Uh oh!

christian-heusel commented Mar 19, 2026 •

edited

Loading

abdullahpathan22 commented Mar 23, 2026 •

edited

Loading