Update kubeflow/notebooks manifests from v2.0.0-alpha.2

[christian-heusel]

Pull Request Template for Kubeflow Manifests

✏️ Summary of Changes

• Update kubeflow/notebooks manifests from v2.0.0-alpha.2
• chore: Drop manual overlay patches superseded by upstream v2.0.0-alpha.2

📦 Dependencies

none

🐛 Related Issues

none

✅ Contributor Checklist

• I have tested these changes with kustomize. See Installation Prerequisites.
• All commits are signed-off to satisfy the DCO check.
• I have considered adding my company to the adopters page to support Kubeflow and help the community, since I expect help from the community for my issue (see 1. and 2.).

[Copilot]

Pull request overview

This pull request updates the Kubeflow Workspaces (Notebooks v2) manifests to track kubeflow/notebooks v2.0.0-alpha.2, and removes local overlay patches that are now provided upstream.

Changes:

• Bump synced upstream version from v2.0.0-alpha.1 to v2.0.0-alpha.2 (images + sync script).
• Align Workspaces RBAC/CRD/samples with upstream (including new WorkspaceKind ConfigMap image source fields).
• Restructure namespace + NetworkPolicy handling (introduce namespace-level default-deny and per-component NetworkPolicies) and drop superseded overlay patches.

Reviewed changes

Copilot reviewed 29 out of 29 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
scripts/synchronize-kubeflow-workspaces-manifests.sh	Updates the upstream git tag used for synchronization to v2.0.0-alpha.2.
applications/workspaces/upstream/frontend/components/istio/network-policy.yaml	Updates frontend NetworkPolicy selectors and ingress sources.
applications/workspaces/upstream/frontend/components/istio/kustomization.yaml	Ensures the frontend NetworkPolicy is included in the Istio component resources.
applications/workspaces/upstream/frontend/components/istio/authorization-policy.yaml	Updates AuthorizationPolicy workload selector labels.
applications/workspaces/upstream/frontend/base/kustomization.yaml	Bumps frontend image tag and adds app label injection.
applications/workspaces/upstream/frontend/base/deployment.yaml	Adds pod-level securityContext defaults (non-root + seccomp).
applications/workspaces/upstream/controller/samples/jupyterlab_v1beta1_workspacekind.yaml	Updates sample fields for ConfigMap-based icon/logo references.
applications/workspaces/upstream/controller/samples/common/workspacekind_imagesource_configmap.yaml	Adds a sample ConfigMap containing an SVG image source.
applications/workspaces/upstream/controller/samples/common/kustomization.yaml	Includes the new sample ConfigMap in the samples kustomization.
applications/workspaces/upstream/controller/base/namespace/network-policy-default-deny.yaml	Introduces a namespace-wide default-deny ingress NetworkPolicy.
applications/workspaces/upstream/controller/base/namespace/namespace.yaml	Keeps the Workspaces namespace definition (minor formatting change).
applications/workspaces/upstream/controller/base/namespace/kustomization.yaml	Adds a dedicated kustomization for namespace-scoped resources.
applications/workspaces/upstream/controller/base/namespace.yaml	Removes the old single-file namespace manifest in favor of the new folder layout.
applications/workspaces/upstream/controller/base/manager/user_cluster_roles.yaml	Refactors aggregated ClusterRoles for Workspaces admin/edit/view.
applications/workspaces/upstream/controller/base/manager/kustomization.yaml	Bumps controller image tag to v2.0.0-alpha.2.
applications/workspaces/upstream/controller/base/kustomization.yaml	Switches controller base to consume the new namespace/ sub-kustomization.
applications/workspaces/upstream/controller/base/crd/kubeflow.org_workspacekinds.yaml	Updates CRD schema for ConfigMap icon/logo references and status fields.
applications/workspaces/upstream/backend/components/istio/network-policy.yaml	Updates backend NetworkPolicy selectors and ingress sources.
applications/workspaces/upstream/backend/components/istio/kustomization.yaml	Adds backend NetworkPolicy and introduces an Istio-only deployment patch.
applications/workspaces/upstream/backend/components/istio/deployment_patch.yaml	Sets PROXY_URL_PREFIX for the backend deployment in the Istio overlay.
applications/workspaces/upstream/backend/components/istio/authorization-policy.yaml	Updates AuthorizationPolicy workload selector labels.
applications/workspaces/upstream/backend/base/rbac.yaml	Expands backend RBAC to include ConfigMaps.
applications/workspaces/upstream/backend/base/kustomization.yaml	Bumps backend image tag and adds app label injection.
applications/workspaces/upstream/backend/base/deployment.yaml	Sets pod-level seccomp profile to RuntimeDefault.
applications/workspaces/overlays/istio/workspaces-base-edit-clusterrole.yaml	Removes a manual ClusterRole overlay now handled upstream.
applications/workspaces/overlays/istio/patches/frontend-pss.yaml	Drops a manual Pod Security Standards patch superseded upstream.
applications/workspaces/overlays/istio/patches/backend-pss.yaml	Drops a manual Pod Security Standards patch superseded upstream.
applications/workspaces/overlays/istio/network-policies/default-allow-same-namespace.yaml	Removes the prior allow-same-namespace policy in favor of upstream policies.
applications/workspaces/overlays/istio/kustomization.yaml	Simplifies overlay now that upstream provides the needed resources/patches.

Comments suppressed due to low confidence (2)

applications/workspaces/upstream/backend/components/istio/network-policy.yaml:14

• This NetworkPolicy only allows ingress from the istio-system namespace. With the namespace-wide default-deny-ingress policy enabled, this will also block node-originated traffic such as kubelet HTTP liveness/readiness probes to the backend pods on NetworkPolicy-enforcing CNIs. If you want default-deny semantics, add an explicit allow rule for probe traffic (or move probes to exec) so the deployment can become Ready reliably.
  applications/workspaces/upstream/frontend/components/istio/network-policy.yaml:14
• This NetworkPolicy only allows ingress from the istio-system namespace. Combined with the namespace-wide default-deny-ingress policy, node-originated traffic (including kubelet HTTP liveness/readiness probes to port 8080) will be denied on clusters that enforce NetworkPolicy, which can prevent the frontend pod from ever becoming Ready. Add an explicit allow rule for probe traffic (or switch probes to exec) to avoid probe failures.

[thesuperzapper]

@juliusvonkohout this should be ready to review, it upstreams all the stuff we were doing in this repo that was introduced in #3430 and updates to the latest alpha of notebooks v2.

The only pending thing is to confirm that the Co-Pilot review in #3455 (comment) was wrong.

NOTE: we have a bug which prevents non-admin users from managing PVCs right now, which we will try fix in the next week and cut a quick alpha.3 which should be in time for the first 26.03.1-rc.0

[thesuperzapper]

@juliusvonkohout we should be good to merge this, we will do one more follow up PR with 2.0.0-alpha.3 which will fix a few bugs which prevent updating workspaces and creating pvcs, which needs to be in before we cut the first RC of 26.03.1.

/lgtm

[juliusvonkohout]

Thank you
/approve

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: juliusvonkohout

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [juliusvonkohout]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment