fix: infinite status reconciliation loop in notebook controller - #1342
Closed
juliusvonkohout wants to merge 499 commits into
Closed
fix: infinite status reconciliation loop in notebook controller#1342juliusvonkohout wants to merge 499 commits into
juliusvonkohout wants to merge 499 commits into
Conversation
* Fix #6528: Mirroring Pod conditions to Notebook * Added missing fields which are part of PodConditions into NotebookConditions * Added suggested changes
* Fix #6056: Update Notebook status properly Signed-off-by: Apostolos Gerakaris apoger@arrikto.com * Added suggested code changes Signed-off-by: Apostolos Gerakaris apoger@arrikto.com * notebook-controller: Add unit tests *Introduce basic unit tests for "createNotebookStatus" function *Add GH action for unit tests Signed-off-by: Apostolos Gerakaris apoger@arrikto.com * Fix PodCoditionsMirroringToNotebook & Unit-tests We encountered an error during testing. It seems that the pod.status.conditions.condition.LastProbeTime remains always null and so the controller ends up applying a Notebook CR instance with null condition values. Relevant Issues: *kubernetes/kubernetes#109958 *kubernetes/kubernetes#79402 *kubernetes/kubernetes#14393 Fix: Check if the Pod's condition.LastProbeTime and condition.LastTransitionTime timestamp fields are null. If so, initialize them so we dont end up applying a Notebook instance with null condition values. Other changes: *Fix basic unit tests *Introduced a unit test for the case where Notebook's Pod is unschedulable Signed-off-by: Apostolos Gerakaris apoger@arrikto.com Signed-off-by: Apostolos Gerakaris apoger@arrikto.com
The notebook controller writes the last-activity annotation before culling the Notebook, however, doesn't remove this annotation before start. This causes the Notebook to be culled again before is has a chance to start. Fix: * calculate correctly the podFound variable and ensure its value its true only if the Pod is actually found. This way the culling annotation will be removed when there is no Pod. Signed-off-by: Apostolos Gerakaris <apoger@arrikto.com> Signed-off-by: Apostolos Gerakaris <apoger@arrikto.com>
Docker is dead and superseeded by OCI on all common Platforms
…ps/jupyter/frontend (kubeflow/kubeflow#6654) Bumps [jose](https://github.com/panva/jose) from 2.0.5 to 2.0.6. - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/v2.0.6/CHANGELOG.md) - [Commits](panva/jose@v2.0.5...v2.0.6) --- updated-dependencies: - dependency-name: jose dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…apps/volumes/frontend (kubeflow/kubeflow#6640) Bumps [jszip](https://github.com/Stuk/jszip) from 3.6.0 to 3.10.1. - [Release notes](https://github.com/Stuk/jszip/releases) - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.6.0...v3.10.1) --- updated-dependencies: - dependency-name: jszip dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Fixes needed for Katib unit tests to run successfully. Signed-off-by: Elena Zioga <elena@arrikto.com> Signed-off-by: Elena Zioga <elena@arrikto.com>
…apps/jupyter/frontend (kubeflow/kubeflow#6641) Bumps [jszip](https://github.com/Stuk/jszip) from 3.6.0 to 3.10.1. - [Release notes](https://github.com/Stuk/jszip/releases) - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.6.0...v3.10.1) --- updated-dependencies: - dependency-name: jszip dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ps/tensorboards/frontend (kubeflow/kubeflow#6652) Bumps [jose](https://github.com/panva/jose) from 2.0.5 to 2.0.6. - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/v2.0.6/CHANGELOG.md) - [Commits](panva/jose@v2.0.5...v2.0.6) --- updated-dependencies: - dependency-name: jose dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…ps/volumes/frontend (kubeflow/kubeflow#6653) Bumps [jose](https://github.com/panva/jose) from 2.0.5 to 2.0.6. - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/v2.0.6/CHANGELOG.md) - [Commits](panva/jose@v2.0.5...v2.0.6) --- updated-dependencies: - dependency-name: jose dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
The Angular code for `<app-form-data-volumes>` was missing `.value`.
…kubeflow#6683) * vwa(back): Modify age column to be a timestamp * Modify the backend to send a timestamp as is without doing any formatting. Signed-off-by: Elena Zioga <elena@arrikto.com> * vwa(front): Use DateTimeValue class in age column * Use DateTimeValue class in TableConfig for age column instead of PropertyValue one. Signed-off-by: Elena Zioga <elena@arrikto.com> Signed-off-by: Elena Zioga <elena@arrikto.com>
…kubeflow/kubeflow#6694) * web-apps(front): Rename Age header in WAs * Rename Age header to Created at. Signed-off-by: Elena Zioga <elena@arrikto.com> * web-apps(front): Right-align date columns in WAs * Make date columns to be right-aligned. Signed-off-by: Elena Zioga <elena@arrikto.com> Signed-off-by: Elena Zioga <elena@arrikto.com>
…ds (kubeflow/kubeflow#6696) * jwa(front): Upgrade @kubernetes/client-node module * Upgrade @kubernetes/client-node module, so that to include quantityToScalar function directly from kubernetes js module. * Set allowSyntheticDefaultImports flag to true to allow 'import x from y' when a module doesn't have a default export. Signed-off-by: Elena Zioga <elena@arrikto.com> * vwa(front): Upgrade @kubernetes/client-node module * Upgrade @kubernetes/client-node module, so that to include quantityToScalar function directly from kubernetes js module. * Set allowSyntheticDefaultImports flag to true to allow 'import x from y' when a module doesn't have a default export. Signed-off-by: Elena Zioga <elena@arrikto.com> * twa(front): Upgrade @kubernetes/client-node module * Upgrade @kubernetes/client-node module, so that to include quantityToScalar function directly from kubernetes js module. * Set allowSyntheticDefaultImports flag to true to allow 'import x from y' when a module doesn't have a default export. Signed-off-by: Elena Zioga <elena@arrikto.com> Signed-off-by: Elena Zioga <elena@arrikto.com>
…apps/tensorboards/frontend (kubeflow/kubeflow#6639) Bumps [jszip](https://github.com/Stuk/jszip) from 3.6.0 to 3.10.1. - [Release notes](https://github.com/Stuk/jszip/releases) - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.6.0...v3.10.1) --- updated-dependencies: - dependency-name: jszip dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…apps/common/frontend/kubeflow-common-lib (kubeflow/kubeflow#6638) Bumps [jszip](https://github.com/Stuk/jszip) from 3.6.0 to 3.10.1. - [Release notes](https://github.com/Stuk/jszip/releases) - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.6.0...v3.10.1) --- updated-dependencies: - dependency-name: jszip dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Enabled web-app sidecars and added auth-policies * Configuring DestinationRules with tls.mode=ISTIO_MUTUAL for web-apps
…flow#6706) * jwa(back): Use gevent for gunicorn's workers Since the backend only serves simple HTTP requests that need some K8s data, instead of only have working processes we will also use greenlets. This way we can have multiple user-space threads that will handle the http requests. Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> * jwa(front): Use cli to continuously build the UI We extend the current package.json file to allow us to build and serve the UI via Angular's dev server. Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> * wa(front): Handle all-namespaces The common library will add an event handler to dashboard's lib when it is emitting all the namespaces. By extension, the common namespace service will be exposing a new observable that will be emitting the list of all the namespaces, when the user selects this from the dashboard. This way current apps won't break, since they will simply not handle this new observable. Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> * wa(front): Handle dynamic table colums The UIs will be showing a new column for the namespace only when the user selects all-namespaces from the dashboard. The common code should expose handlers for modifying the tables' config columns accordingly. Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> * jwa(front): Make requests for all-namespaces As a first iteration in order for the JWA to support showing Notebooks from all namespaces it will be polling with batch requests. After all the requests, for all the namespaces, succeed then the JWA will sort them based on their name and show them in the table. While this approach will be generating a significantly bigger amount of requests, we chose this approach because: 1. It was simple to implement, since we only need to modify the frontend 2. We don't add any extra abstractions on the backend and keep the 1-1 relationship with the k8s api endpoints 3. To further optimize we now only look on K8s concepts and won't have to adjust them to a custom backend implementation [2] Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com>
* fix TWA_APP_SECURE_COOKIES parameter in tensorboards-web-app * fix VWA_APP_SECURE_COOKIES parameter in volumes-web-app * fix JWA_APP_SECURE_COOKIES parameter in jupyter-web-app
* jwa(back): Fix volume unit tests Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> * gh-action: Add GH Action for JWA's backend unittests Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> * review: Use a more descriptive name for workflow file Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> * review: Better name for the workflow Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com> Signed-off-by: Kimonas Sotirchos <kimwnasptd@arrikto.com>
…d-web-apps/common/frontend/kubeflow-common-lib (kubeflow/kubeflow#6714) Bumps [loader-utils](https://github.com/webpack/loader-utils) from 1.4.0 to 1.4.1. - [Release notes](https://github.com/webpack/loader-utils/releases) - [Changelog](https://github.com/webpack/loader-utils/blob/v1.4.1/CHANGELOG.md) - [Commits](webpack/loader-utils@v1.4.0...v1.4.1) --- updated-dependencies: - dependency-name: loader-utils dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…d-web-apps/tensorboards/frontend (kubeflow/kubeflow#6715) Bumps [loader-utils](https://github.com/webpack/loader-utils) from 1.4.0 to 1.4.1. - [Release notes](https://github.com/webpack/loader-utils/releases) - [Changelog](https://github.com/webpack/loader-utils/blob/v1.4.1/CHANGELOG.md) - [Commits](webpack/loader-utils@v1.4.0...v1.4.1) --- updated-dependencies: - dependency-name: loader-utils dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Instead of parsing the date in the backend we should use our common UI date component, in order to show dates in a uniform way.
…6718) * vwa(front): Use ng serve for local dev Add proxy rules to connect the webpack dev server with the backend * twa(front): Use ng serve for local dev Refs arrikto/dev#1597 * vwa(back): Fix the install-deps make rule Use the new common code path when installing the common packages. * wa(front): Disable Angular analytics Edit the angular.json file of all our frontend components to not send Angular analytics. This way we won't be seeing a y/N input each time we try to build the frontend, which could also block a CI/CD system. * wa(front): Add exponential-backoff service Create an Angular Service that handles the polling. Specifically the polling function has as input an observable responsible for fetching the data. It will return a final observable, which will be using the fetch-observable, that will only be emitting the final data. This service will take care of: 1. Checking if the new data is new and reset the polling 2. Cancelling in-flight requests, if someone terminates the subscription * vwa(front): Use the new Polling Service The frontend code of VWA will now be using the new Poller Service which has a pure RxJS implementation underneath. This will make it simpler to cancel in-flight requests and also moves the reset logic into the common code. * jwa(front): Use the new Polling Service The frontend code of JWA will now be using the new Poller Service which has a pure RxJS implementation underneath. This will make it simpler to cancel in-flight requests and also moves the reset logic into the common code. * twa(front): Use the new Polling Service The frontend code of TWA will now be using the new Poller Service which has a pure RxJS implementation underneath. This will make it simpler to cancel in-flight requests and also moves the reset logic into the common code.
…/crud-web-apps/common/frontend/kubeflow-common-lib (kubeflow/kubeflow#6727) Bumps [socket.io-parser](https://github.com/socketio/socket.io-parser) from 4.0.4 to 4.0.5. - [Release notes](https://github.com/socketio/socket.io-parser/releases) - [Changelog](https://github.com/socketio/socket.io-parser/blob/main/CHANGELOG.md) - [Commits](socketio/socket.io-parser@4.0.4...4.0.5) --- updated-dependencies: - dependency-name: socket.io-parser dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Update golang.org/x/net from v0.24.0 to v0.47.0 in the pvcviewer-controller to fix security vulnerabilities and align with other components. CVEs Fixed: - CVE-2025-22870 - CVE-2025-22872 Updated dependencies: - golang.org/x/net v0.24.0 -> v0.47.0 - golang.org/x/sys v0.19.0 -> v0.38.0 - golang.org/x/term v0.19.0 -> v0.37.0 - golang.org/x/text v0.14.0 -> v0.31.0 - golang.org/x/tools v0.20.0 -> v0.38.0 Related Issue: Closes #782 (PR 1) Signed-off-by: Asaad Balum <asaad.balum@gmail.com>
Signed-off-by: Liav Weiss <lweiss@lweiss-thinkpadx1carbongen11.raanaii.csb> Co-authored-by: Liav Weiss <lweiss@lweiss-thinkpadx1carbongen11.raanaii.csb>
Signed-off-by: Liav Weiss <lweiss@lweiss-thinkpadx1carbongen11.raanaii.csb> Co-authored-by: Liav Weiss <lweiss@lweiss-thinkpadx1carbongen11.raanaii.csb>
Fixes CVE-2025-22868 Ref: #781 Signed-off-by: Yehudit Kerido <ykerido@ykerido-thinkpadp1gen7.raanaii.csb> Co-authored-by: Yehudit Kerido <ykerido@ykerido-thinkpadp1gen7.raanaii.csb>
Fixes CVE-2025-22868. Part of: #782 Signed-off-by: noalimoy <nlimoy@redhat.com>
) Update gopkg.in/yaml.v3 from v3.0.0-20210107192922-496545a6307b to v3.0.1 to fix: - CVE-2022-28948 Testing performed: - go mod tidy - completed successfully - go vet ./... - no issues found - make build - controller builds cleanly - make test - all tests pass Part of: #781 Signed-off-by: Asaad Balum <asaad.balum@gmail.com>
Signed-off-by: abdallahsamabd <abdallahsamabd@gmail.com>
Signed-off-by: Yehudit Kerido <ykerido@ykerido-thinkpadp1gen7.raanaii.csb> Co-authored-by: Yehudit Kerido <ykerido@ykerido-thinkpadp1gen7.raanaii.csb>
Fixes CVE-2025-22868 This PR updates golang.org/x/oauth2 from v0.0.0-20210819190943-2bc19b11175f to v0.27.0 to address security vulnerabilities identified in the v1.11 release scan. Changes: - Updated golang.org/x/oauth2 to v0.27.0 - Updated github.com/google/go-cmp to v0.5.9 (dependency of oauth2) - Removed google.golang.org/appengine (no longer required) - Ran go mod tidy to update dependencies - Verified build succeeds with go build Related: #780 (PR 3) Signed-off-by: Hen Schwartz <hschwart@hschwart-thinkpadp1gen7.raanaii.csb> Co-authored-by: Hen Schwartz <hschwart@hschwart-thinkpadp1gen7.raanaii.csb>
Signed-off-by: Christian Heusel <christian@heusel.eu>
* chore: fix releasing script Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com> * chore: fix releasing script Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com> * fix python linting Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com> * better names for unit test gha Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com> * pin and update envtest/controller-gen/kustomize Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com> * use retries for flakey hashicorp go downloads Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com> --------- Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com>
Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com>
The manifest repository had manually made changes in manifests that are
originating from the now `kubeflow/notebooks` repository, therefore
those changes were overriden on sync. Fix this by manually backporting
the changes into our upstream repository.
Fixes: a1d03687 ("Fix PSS restricted warnings for kubeflow components (#3050)")
Signed-off-by: Christian Heusel <christian@heusel.eu>
This way we're not so easy to be targeted by supply chain attacks such as the trivy incident that motivated this initially. The changes were generated via a script that I wrote to do this, see the second link below. Link: https://www.openwall.com/lists/oss-security/2026/03/21/1 Link: https://github.com/christian-heusel/dotfiles/blob/main/misc/scripts/pin-github-actions.sh Signed-off-by: Christian Heusel <christian@heusel.eu> Co-authored-by: Andy Stoneberg <andyatmiami@users.noreply.github.com>
So far the library has caused line wraps when the version used is (some version) greater than 18.11, which annoyed Mathew when doing releases. Fix this by setting a really high value for maximum line length. Signed-off-by: Christian Heusel <christian@heusel.eu>
Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com>
…987) Signed-off-by: Christian Heusel <christian@heusel.eu>
The idea behind this is that they could set the 'ok-to-test' label anyways via prow and it eases the burden of the maintainers having to do this manually for org members. The code is taken from the way that `kubeflow/sdk` does it for their equivalent job. Link: https://github.com/kubeflow/sdk/blob/main/.github/workflows/gh-workflow-approve.yaml Signed-off-by: Christian Heusel <christian@heusel.eu>
Signed-off-by: Mathew Wicks <5735406+thesuperzapper@users.noreply.github.com>
* chore: Update the `notebooks-v1` OWNERS file This removes Kimonas as approver and adds Andy in accordance to the governance changes in the Notebooks WG. Related-to: kubeflow/community#983 Signed-off-by: Christian Heusel <christian@heusel.eu> * chore: Also drop inactive approvers Signed-off-by: Christian Heusel <christian@heusel.eu> --------- Signed-off-by: Christian Heusel <christian@heusel.eu>
Signed-off-by: juliusvonkohout <45896133+juliusvonkohout@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
github-project-automation
Bot
moved this from Needs Triage
to Done
in Kubeflow Notebooks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Alternative to #1341