knative: add eventing security overlay

[danish9039]

Summary

• add a merged common/knative/knative-eventing/overlays/security overlay
• add eventing NetworkPolicies and a restricted PSS namespace patch as an opt-in overlay
• patch request-reply in the overlay so restricted PSS works in-cluster

[github-actions]

Welcome to the Kubeflow Manifests Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronizes from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/manifests to test the platform integration.

Community Resources:

• CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
• Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

[Copilot]

Pull request overview

Adds an opt-in Knative Eventing “security” overlay to support restricted Pod Security Standards (PSS) installs and documents validation outcomes.

Changes:

• Added common/knative/knative-eventing/overlays/security with NetworkPolicies, a restricted-PSS namespace label patch, and a request-reply securityContext patch.
• Added validation documentation artifacts and a canonical validation log entry.
• Updated .gitignore to ignore repo-root .obsidian/ metadata.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docs/policy-validation-log.md	Adds a canonical validation log entry for the new overlay.
docs/artifacts/INDEX.md	Adds an index entry pointing to the new validation artifact and log anchor.
docs/artifacts/2026-03-23-knative-eventing-security-validation.md	Adds a detailed validation artifact explaining the PSS issue and overlay behavior.
common/knative/knative-eventing/overlays/security/patches/request-reply-security-context.yaml	Adds restricted-PSS-compatible securityContext patch for request-reply.
common/knative/knative-eventing/overlays/security/namespace-patch.yaml	Adds restricted PSS enforcement label to the knative-eventing namespace.
common/knative/knative-eventing/overlays/security/kustomization.yaml	Wires the overlay resources and patches together.
common/knative/knative-eventing/overlays/security/default-allow-same-namespace.yaml	Adds same-namespace-only default ingress policy for Eventing namespace.
common/knative/knative-eventing/overlays/security/allow-webhook-apiserver.yaml	Adds webhook ingress allowance (port-based) to keep admission webhooks reachable.
.gitignore	Ignores .obsidian/ directory at repo root and normalizes an ignore entry.

[danish9039]

@juliusvonkohout

[juliusvonkohout]

Do you have a basic test for knative-eventing ?

[danish9039]

Do you have a basic test for knative-eventing ?

@juliusvonkohout added tests

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[danish9039]

@juliusvonkohout the current test covers install verification (control-plane pods ready + NetworkPolicy/PSS assertions). Would you like me to extend it with a full functional flow test that has PingSource → Broker (MTChannelBasedBroker/IMC) → Trigger → event-display with actual CloudEvent delivery assertion ?? for that we need a separate test script similar to kserve_test.sh

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

[danish9039]

/retest

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated no new comments.

[juliusvonkohout]

Thank you
/lgtm
/approve

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: juliusvonkohout

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [juliusvonkohout]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment