synchronize kubeflow workspaces manifests v2.0.0 alpha.1 by christian-heusel · Pull Request #3430 · kubeflow/manifests

christian-heusel · 2026-03-31T01:24:49Z

Pull Request Template for Kubeflow Manifests

✏️ Summary of Changes

Do the initial sync for the experimental notebooks v2 manifests.

Update kubeflow/notebooks manifests from v2.0.0-alpha.0
chore: Setup plumbing needed for notebooks-v2
chore: Add sidebar link for notebooks-v2
Update kubeflow/notebooks manifests from v2.0.0-alpha.1

📦 Dependencies

🐛 Related Issues

none

✅ Contributor Checklist

I have tested these changes with kustomize. See Installation Prerequisites.
All commits are signed-off to satisfy the DCO check.
I have considered adding my company to the adopters page to support Kubeflow and help the community, since I expect help from the community for my issue (see 1. and 2.).

cc @andyatmiami @thesuperzapper

Copilot

Pull request overview

This PR introduces the initial synchronization of experimental Kubernetes Notebook v2 manifests from the upstream kubeflow/notebooks repository at version v2.0.0-alpha.0. The PR includes a synchronization script, comprehensive controller/backend/frontend manifests with Istio integration, sample configurations, and a patch to add a notebooks-v2 entry to the central dashboard sidebar (currently commented out with a pre-GA warning).

Changes:

Created a synchronization script (scripts/synchronize-notebooks-v2-manifests.sh) to automate future manifest updates
Added complete experimental notebooks-v2 manifests (backend, frontend, controller) with Istio networking integration
Included sample WorkspaceKind and Workspace resources demonstrating usage
Added centraldashboard configuration patch to expose notebooks-v2 in the UI
Updated example kustomization to document notebooks-v2 availability (with pre-GA warnings and commented out)

Reviewed changes

Copilot reviewed 76 out of 77 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`scripts/synchronize-notebooks-v2-manifests.sh`	Script to automate synchronization of upstream notebooks-v2 manifests
`experimental/notebooks-v2/kustomization.yaml`	Root kustomization composing backend, controller, and frontend with image tag fixes
`experimental/notebooks-v2/backend/`	Backend service manifests with Istio overlay and RBAC configuration
`experimental/notebooks-v2/controller/`	Workspaces controller with CRDs, webhooks, and cert-manager integration
`experimental/notebooks-v2/frontend/`	Frontend UI deployment with Istio ingress routing
`experimental/notebooks-v2/centraldashboard/`	ConfigMap patch adding notebooks-v2 menu items to central dashboard
`example/kustomization.yaml`	Documentation comments for optional notebooks-v2 deployment

thesuperzapper · 2026-03-31T17:11:30Z

@christian-heusel I think the best structure is to keep everything under applications, in a folder called workspaces.

Structure should be:

applications:
  - workspaces:
       - upstream:
           - controller:
               - base, overlays, components, etc
           - backend:
               - base, overlays, components, etc
           - frontend:
               - base, overlays, components, etc
      - overlays:
           - istio:
               - xyz_patch.yaml (if needed can be included).
               - kustomization.yaml (points to the `overlays/istio` of each upstream)

Then we have a single sync target under upstream.

christian-heusel · 2026-04-01T12:35:29Z

/hold

Link: kubeflow#3430 (comment) Link: kubeflow#3429 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

Link: kubeflow/manifests#3430 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

Link: kubeflow#3430 (comment) Link: kubeflow#3429 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

Link: kubeflow/manifests#3430 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

Without this we're running into `ImagePullBackOff` issues in the release manifests and need to manually fix the tags there. Link: kubeflow/manifests#3430 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

christian-heusel · 2026-04-28T15:29:12Z

@danish9039 can also raise a PR to delete some of the experimental helm charts here and fix the CI/CD. Then this PR here becomes smaller and easier to review.

What do you mean with that? 🤔 The current failures in the helm chart are unrelated to the changes made in this PR 🤗

juliusvonkohout · 2026-04-28T16:45:25Z

@danish9039 can also raise a PR to delete some of the experimental helm charts here and fix the CI/CD. Then this PR here becomes smaller and easier to review.

What do you mean with that? 🤔 The current failures in the helm chart are unrelated to the changes made in this PR 🤗

Yes so maybe @danish9039 can relief you of this problem and you just have to rebase and not worry.

danish9039 · 2026-04-30T02:34:15Z

@danish9039 can also raise a PR to delete some of the experimental helm charts here and fix the CI/CD. Then this PR here becomes smaller and easier to review.

What do you mean with that? 🤔 The current failures in the helm chart are unrelated to the changes made in this PR 🤗

Yes so maybe @danish9039 can relief you of this problem and you just have to rebase and not worry.

@juliusvonkohout I have raised a PR in which I have updated the image tags that were the cause of CI failiure. #3449 , @christian-heusel can rebase after PR #3449 get merged

juliusvonkohout · 2026-04-30T08:59:24Z

Please rebase and you can ignore Helm now.

Signed-off-by: Christian Heusel <christian@heusel.eu>

Adds a GitHub Actions workflow that deploys all three Workspaces components (controller, backend, frontend) and verifies the access permissions to the backend API through the Istio ingress gateway. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Link: kubeflow#3430 (comment) Suggested-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Adds a second integration test that spawns a Workspace and runs a pipeline inside it, mirroring `pipeline_run_from_notebook.yaml` for the Notebooks Workspaces. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: danish9039 <danishsiddiqui040@gmail.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Add `seccompProfile` and `runAsNonRoot` to comply with the `restricted` Pod Security Standard. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Wait for `notebook-controller-deployment` to be available directly after installation to prevent a race condition where the pod label selector returns no matching resources when the Notebook CR is created before the controller is ready. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Adds a default-allow-same-namespace baseline policy and per-component policies for workspaces-backend and workspaces-frontend, matching the network isolation pattern used in the kubeflow namespace. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Drop the redundant cert-manager wait (already handled by its own install script) and the per-component rollout checks, replacing them with a single pod readiness wait and a deployment availability wait across the whole namespace. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

Use the new script in both the dedicated workspaces deployment test and the full integration test. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

…e_run_test.sh Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

tarekabouzeid · 2026-05-04T19:36:40Z

super great work !
/lgtm

thesuperzapper · 2026-05-05T17:52:51Z

@juliusvonkohout @tarekabouzeid this should be ready to approve and merge now!

/unhold

We will follow up with a sync of the latest alpha before we cut the final 26.03.1 because 2.0.0-alpha.1 is quite old now and we have upstreamed the patches in our applications/workspace/overlays/istio so they no longer need to be applied in this repo.

juliusvonkohout · 2026-05-07T12:29:56Z

/approve
Thank you,
lets refine later.

google-oss-prow · 2026-05-07T12:30:07Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: juliusvonkohout

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [juliusvonkohout]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot AI review requested due to automatic review settings March 31, 2026 01:24

google-oss-prow Bot added the do-not-merge/work-in-progress label Mar 31, 2026

google-oss-prow Bot requested review from juliusvonkohout and tarekabouzeid March 31, 2026 01:24

google-oss-prow Bot added the size/XXL label Mar 31, 2026

Copilot started reviewing on behalf of christian-heusel March 31, 2026 01:25 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Comment thread scripts/synchronize-notebooks-v2-manifests.sh Outdated

christian-heusel commented Mar 31, 2026

View reviewed changes

Comment thread scripts/synchronize-notebooks-v2-manifests.sh Outdated

Comment thread applications/workspaces/overlays/istio/kustomization.yaml Outdated

christian-heusel force-pushed the synchronize-notebooks-v2-manifests-v2.0.0-alpha.0 branch from 16265d1 to fd04a9f Compare March 31, 2026 01:29

christian-heusel mentioned this pull request Mar 31, 2026

Hidden sidebar leads to space in kubeflow dashboard setup kubeflow/notebooks#999

Closed

2 tasks

christian-heusel force-pushed the synchronize-notebooks-v2-manifests-v2.0.0-alpha.0 branch 2 times, most recently from cab81d8 to e32edf7 Compare April 1, 2026 12:25

christian-heusel commented Apr 1, 2026

View reviewed changes

Comment thread applications/workspaces/components/centraldashboard/kustomization.yaml

Comment thread applications/workspaces/overlays/istio/kustomization.yaml Outdated

christian-heusel marked this pull request as ready for review April 1, 2026 12:35

google-oss-prow Bot removed the do-not-merge/work-in-progress label Apr 1, 2026

google-oss-prow Bot requested a review from kimwnasptd April 1, 2026 12:35

google-oss-prow Bot added the do-not-merge/hold label Apr 1, 2026

christian-heusel added a commit to christian-heusel/manifests that referenced this pull request Apr 1, 2026

Restructure the notebooks-v1 component manifests

e761115

Link: kubeflow#3430 (comment) Link: kubeflow#3429 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

christian-heusel force-pushed the synchronize-notebooks-v2-manifests-v2.0.0-alpha.0 branch from e32edf7 to d3d678c Compare April 1, 2026 17:04

christian-heusel added a commit to christian-heusel/notebooks that referenced this pull request Apr 1, 2026

chore: Drop the namespaces to resolve kustomize conflicts

74bef0b

Link: kubeflow/manifests#3430 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

christian-heusel mentioned this pull request Apr 1, 2026

chore: drop the namespaces to resolve kustomize conflicts kubeflow/notebooks#1005

Merged

1 task

christian-heusel added a commit to christian-heusel/manifests that referenced this pull request Apr 1, 2026

Restructure the notebooks-v1 component manifests

6cb668c

Link: kubeflow#3430 (comment) Link: kubeflow#3429 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

google-oss-prow Bot pushed a commit to kubeflow/notebooks that referenced this pull request Apr 2, 2026

chore: drop the namespaces to resolve kustomize conflicts (#1005)

e31f011

Link: kubeflow/manifests#3430 (comment) Signed-off-by: Christian Heusel <christian@heusel.eu>

thesuperzapper suggested changes Apr 2, 2026

View reviewed changes

Comment thread applications/workspaces/components/centraldashboard/centraldashboard-config.yaml Outdated

google-oss-prow Bot assigned thesuperzapper Apr 2, 2026

christian-heusel and others added 7 commits April 30, 2026 17:11

Update kubeflow/notebooks manifests from v2.0.0-alpha.0

b9c6e88

Signed-off-by: Christian Heusel <christian@heusel.eu>

chore: Add sidebar link for Workspaces

51df67b

Signed-off-by: Christian Heusel <christian@heusel.eu>

Update kubeflow/notebooks manifests from v2.0.0-alpha.1

63012de

Signed-off-by: Christian Heusel <christian@heusel.eu>

chore: Drop the helm charts for notebooks-v1

d8cf66c

Link: kubeflow#3430 (comment) Suggested-by: Julius von Kohout <45896133+juliusvonkohout@users.noreply.github.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

fix: Add clusterrole patch to fix auth issue

03d2cf7

Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

thesuperzapper reviewed Apr 30, 2026

View reviewed changes

Comment thread tests/workspaces_install.sh Outdated

christian-heusel added 6 commits April 30, 2026 21:41

fix: Add PSS restricted patches for Kubeflow Workspaces

8d2a4f9

Add `seccompProfile` and `runAsNonRoot` to comply with the `restricted` Pod Security Standard. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

ci: Extract Kubeflow Workspaces API tests into workspaces_test.sh

c905f07

Use the new script in both the dedicated workspaces deployment test and the full integration test. Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

ci: Extract Kubeflow Workspaces pipeline test into workspaces_pipelin…

dfdb494

…e_run_test.sh Assisted-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Christian Heusel <christian@heusel.eu>

christian-heusel force-pushed the synchronize-notebooks-v2-manifests-v2.0.0-alpha.0 branch from 490144d to dfdb494 Compare April 30, 2026 19:42

christian-heusel mentioned this pull request Apr 30, 2026

chore: manifest cleanups and improvements kubeflow/notebooks#1072

Merged

google-oss-prow Bot assigned tarekabouzeid May 4, 2026

google-oss-prow Bot added the lgtm label May 4, 2026

google-oss-prow Bot removed the do-not-merge/hold label May 5, 2026

google-oss-prow Bot added the approved label May 7, 2026

google-oss-prow Bot merged commit cf726fa into kubeflow:master May 7, 2026
10 checks passed

thesuperzapper mentioned this pull request May 12, 2026

Update kubeflow/notebooks manifests from v2.0.0-alpha.2 #3455

Merged

3 tasks

Conversation

christian-heusel commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Template for Kubeflow Manifests

✏️ Summary of Changes

📦 Dependencies

🐛 Related Issues

✅ Contributor Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thesuperzapper commented Mar 31, 2026

Uh oh!

Uh oh!

Uh oh!

christian-heusel commented Apr 1, 2026

Uh oh!

Uh oh!

christian-heusel commented Apr 28, 2026

Uh oh!

juliusvonkohout commented Apr 28, 2026

Uh oh!

danish9039 commented Apr 30, 2026

Uh oh!

juliusvonkohout commented Apr 30, 2026

Uh oh!

Uh oh!

tarekabouzeid commented May 4, 2026

Uh oh!

thesuperzapper commented May 5, 2026

Uh oh!

juliusvonkohout commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

google-oss-prow Bot commented May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

christian-heusel commented Mar 31, 2026 •

edited

Loading

juliusvonkohout commented May 7, 2026 •

edited

Loading