Kubeflow 1.10.0-rc.3

Open issues:
1.10.0 Milestone
1.10.1 Milestone

Changes since 1.10.0-rc.2

• Migrate Istio images from DockerHub to GCR by @akagami-harsh in #3022
• Delete experimental/security/PSS/patches/kubeflow-pipelines-profile-controller.yaml by @juliusvonkohout in #3036
• istio: generate istio-ingressgateway by @fraenkel in #3039
• PSS baseline / restricted also for Notebooks, Katib, Kserve and istio-ingressgateway by @akagami-harsh in #3042
• Cleanup istio by @juliusvonkohout in #3043
• fix(pipeline): minio filesystem permission access error by @milinddethe15 in #3045
• restructuring by @juliusvonkohout in #3046
• istio proxy version 1.24.3 by @juliusvonkohout in #3049
• Update kubeflow/model-registry manifests from v0.2.15 by @tarilabs in #3053
• Add synchronization script for Spark Operator manifests by @madmecodes in #3048
• Synchronize kubeflow kubeflow manifests v1.10.0 rc.2 by @juliusvonkohout in #3058
• Update Kind and test Kubernetes 1.29-1.32 by @juliusvonkohout in #3059
• streamline kserve tests by @juliusvonkohout in #3062
• Update README.md with air gap hints by @juliusvonkohout in #3060
• Update trivy_scan.py by @juliusvonkohout in #3064
• Update kubeflow/model-registry manifests from v0.2.15.3 by @tarilabs in #3066
• Formatted code block to the experimental/ray README by @shaikmoeed in #3063
• test: fix name, debug hooks by @tarilabs in #3067
• Synchronize kubeflow training operator manifests v1.9.1 by @juliusvonkohout in #3068
• Synchronize kubeflow katib manifests v0.18.0 by @juliusvonkohout in #3069
• Part 1 of Document secure Kserve authentication via automated tests by @madmecodes in #3056
• Update README.md for the 1.10 release by @juliusvonkohout in #3074

New Contributors

• @milinddethe15 made his first contribution in #3045
• @madmecodes made his first contribution in #3048
• @shaikmoeed made his first contribution in #3063

Full Changelog: v1.10.0-rc.2...v1.10.0-rc.3

Note: We support Kubernetes 1.31-1.33 directly. It should also work on Kubernetes 1.29+, but on some 1.29-1.30 clusters you might have to either enable the native sidecars feature gate on your Kubernetes cluster or you need to disable NATIVE_SIDECARS here https://github.com/kubeflow/manifests/blob/421ffcd46899d4916972d39949a6ea0c8fe97ff2/common/istio-1-24/istio-install/base/install.yaml#L3006-L3007 or here https://github.com/kubeflow/manifests/blob/421ffcd46899d4916972d39949a6ea0c8fe97ff2/common/istio-cni-1-24/istio-install/base/install.yaml#L3318-L3319.
But Kubernetes 1.30 is already End of Life by 2025-06-28, so we strongly recommend to upgrade to 1.31+. We also tested that native sidecars work on AKS and GKE 1.31+. Kubernetes 1.33 is planned for release on April 23 2025, so we plan to support 1.31-1.33 and down to 1.29 depending on your cluster with native sidecars workarounds.

Kubeflow 1.10.0-rc.2

Open issues:
1.10.0 Milestone
1.10.1 Milestone

What has Changed since 1.10.0-rc.1

• feat: Add pre-commit hooks for automated code quality checks by @akagami-harsh in #3001
• Synchronize kubeflow kubeflow manifests v1.10.0 rc.1 by @juliusvonkohout in #3008
• Add Model Registry UI Integration Test by @lucferbux in #3000
• chore: Removing PSS patches by @biswassri in #2986
• Add a section for pre-commit in README.md by @akagami-harsh in #3009
• Upgrading metacontroller to v4.11.22 by @tarekabouzeid in #2988
• docs: Add guide for Dex and Keycloak by @wooyoung85 in #3012
• Update common/knative manifests to v1.16.2/v1.16.4. by @jbronn in #3021
• Pipelines MySQL volume permissions fix by @jbronn in #3019
• Update knative README.md by @juliusvonkohout in #3024
• docs: Add information about KEP process by @anishasthana in #2994
• Refactoring by @juliusvonkohout in #3025
• Update kubeflow/pipelines manifests from 2.4.1 by @varodrig in #3029
• Test PSS baseline/restricted for Notebooks, Katib and Kserve by @akagami-harsh in #3026
• Update README.md by @juliusvonkohout in #3030

New Contributors

• @lucferbux made his first contribution in #3000
• @wooyoung85 made his first contribution in #3012
• @jbronn made his first contribution in #3021
• @anishasthana made his first contribution in #2994

Full Changelog: v1.10.0-rc.1...V1.10.0-rc.2

Kubeflow v1.10.0-rc.1

Open issues: 1.10, 1.10.1

What's Changed since 1.10.0-rc0

• fix: update kind config by @warjiang in #2971
• Refactor: Extract pipeline_test.py into a shared file for reuse across workflows by @akagami-harsh in #2972
• Update oauth2-proxy README.md by @juliusvonkohout in #2977
• Synchronize kubeflow training operator manifests 778cd72 by @juliusvonkohout in #2979
• Fix raycluster Readme by @akagami-harsh in #2976
• Update kubeflow/model-registry manifests from 5d8ed91 by @tarilabs in #2973
• Improve documentation and CI/CD by @juliusvonkohout in #2987
• Add model registry ui network policy by @ederign in #2989
• fix warnings after kustomize build in contrib by @mahdikhashan in #2992
• Synchronize kubeflow katib manifests v0.18.0 rc.0 by @juliusvonkohout in #2993
• Synchronize kubeflow kubeflow manifests v1.10.0 rc.0 by @juliusvonkohout in #2995
• Synchronize kubeflow model registry manifests v0.2.14 by @tarilabs in #2998
• Synchronize kserve web app manifests v0.14.0 rc.0 by @juliusvonkohout in #3003

New Contributors

• @warjiang made their first contribution in #2971
• @akagami-harsh made their first contribution in #2972
• @ederign made their first contribution in #2989

Full Changelog: v1.10.0-rc.0...v1.10.0-rc.1

Kubeflow v1.10.0-rc.0

The release includes the following platform/manifests/security changes:

Core Components:

• Kubeflow Training Operator manifests upgraded to v1.9.0
• Kubeflow Pipelines manifests upgraded to 2.4.0
• Kubeflow Model Registry manifests upgraded to v0.2.12
• Spark Operator manifests upgraded to 2.1.0
• KServe manifests upgraded to v0.14.1

Platform components:

• Kubernetes 1.32 and kind 0.26 support
• Kustomize 5.4.3 support and documentation updates
• Cert-manager upgraded to 1.16.1
• Dex and oauth2-proxy upgraded to 2.41.1 and 7.7.1
• KNative manifests upgraded to v1.16.0
• Istio upgraded to v1.24.2
• OIDC-AUthservice has been removed

Other changes:

• Rootless containers improvements
• Oauth2-proxy and Dex documentation for external OIDC authentication.
• Check out #2763 for more detailed information #2763

Full Changelog: v1.9.1...v1.10.0-rc.0

Kubeflow 1.9.1

The release includes the following platform/manifests/security changes:

• Kubernetes 1.31 support
• The Documentation has been overhauled
• The automatic CVE scanning with Trivy on the master branch workflow now lets you download the scanning results
• Rootless efforts in contrib/security continue
• Spark operator in /contrib
• Revised authentication and further fixes for oauth2-proxy #2895

We also updated the following components:

• Kubeflow Pipelines 2.3.0, which includes Argo Workflows 3.4
• Training Operator v1.8.1
• KServe 0.13.1
• model registry v0.2.9 alpha

v1.9.1-rc.3

The release includes the following platform/manifests/security changes:

• Kubernetes 1.31 support
• The Documentation has been overhauled
• The automatic CVE scanning with Trivy on the master branch workflow now lets you download the scanning results
• Rootless efforts in contrib/security continue
• Spark operator in /contrib
• Revised authentication and further fixes for oauth2-proxy #2895

We also updated the following components:

• Kubeflow Pipelines 2.3.0, which includes Argo Workflows 3.4
• Training Operator v1.8.1
• KServe 0.13.1
• model registry v0.2.5 alpha

Kubeflow 1.9.1 Release Candidate 2

The release includes the following platform/manifests/security changes:

• Kubernetes 1.31 support
• The Documentation has been overhauled
• The automatic CVE scanning with Trivy on the master branch workflow now lets you download the scanning results
• Rootless efforts in contrib/security continue
• Revised authentication

We also updated the following components:

• Kubeflow Pipelines 2.3.0, which includes Argo Workflows 3.4
• Training Operator v1.8.1
• KServe 0.13.1
• model registry v0.2.5 alpha

Known issues / TODO :

• #2895

Kubeflow 1.9.1 Release Candidate 1

The release includes the following platform/manifests/security changes:

• Kubernetes 1.31 support
• The Documentation has been overhauled
• The automatic CVE scanning with Trivy on the master branch workflow now lets you download the scanning results
• Rootless efforts in contrib/security continue

We also updated the following components:

• Kubeflow Pipelines 2.3.0, which includes Argo Workflows 3.4
• Training Operator v1.8.1
• KServe 0.13.1

TODO for RC 2:

• #2864
• #2880

Kubeflow 1.9.0

Important

Please use the latest 1.9.1 release, because it improves authentication, security and is an easier upgrade target from 1.8.1.

The release includes the following platform/manifests/security changes:

• Kubernetes 1.27 - 1.29 support, but 1.30+ should work as well. So administrators can run it on supported and secure Kubernetes clusters.
• Kustomize 5.2.1+ support with way less warnings, since we modernized most manifests. So platform engineers have a modern and supported installation tool chain.
• Oauth2-proxy replaces oidc-authservice, which brings improved token based authentication. ML engineers can now use tokens instead of insecure passwords for automation of Kubeflow from e.g. GitHub actions.
• Network policies are enabled for the Kubeflow core services as a second layer of defense before Istio authorization policies. This gives administrators a better network overview and segmentation while also enforcing common enterprise security guidelines.
• The Documentation has been overhauled. It now contains guidelines for upgrading and extending the Kubeflow Platform for administrators and enables new users to have a basic installation in a few minutes on their Laptop.
• Automatic CVE scanning with Trivy on the master branch is relevant for DevSecOps and enterprise security guidelines
• We have updated the third-party components to provide integration with the larger ML ecosystem. E.g. ray is heavily used to train LLMs
  • Bentoml 1.2.28 and 1.1.21
  • Seldon 1.18.1
  • Ray 2.23 and Kuberay 1.1.1
• Update of the common components such that we support the latest Kubernetes versions and security patches for platform engineers.
  • Istio 1.22.1
  • Dex 2.39.1
  • Cert-manager 1.14.5
  • Knative 1.12.4

We also updated the following components:

• Kubeflow Pipelines 2.2.0, which includes Argo Workflows and Tekton integration
• Katib v0.17.0
• Training Operator v1.8.0
• KServe 0.13.0
• Workspaces(Notebooks) + Centraldashboard 1.9.0
• New component: Model Registry v0.2.1-alpha

You can find each components release notes here:

• Model Registry
• Pipelines
• Katib
• Training Operator
• KServe
• Manifests/Platform
• Security
• Workspaces(Notebooks) + Centraldashboard

Known issues:

• #2804
• #2815
• kubeflow/pipelines#10988
• kubeflow/pipelines#10397

Kubeflow 1.9.0-rc.2

Third RC of the KF 1.9 release 🎉

The release includes the following platform/manifests/security changes:

• Kubernetes 1.27 - 1.29 support, but 1.30+ should work as well. So administrators can run it on supported and secure Kubernetes clusters.
• Kustomize 5.2.1+ support with way less warnings, since we modernized most manifests. So platform engineers have a modern and supported installation tool chain.
• Oauth2-proxy replaces oidc-authservice, which brings improved token based authentication. ML engineers can now use tokens instead of insecure passwords for automation of Kubeflow from e.g. GitHub actions.
• Network policies are enabled for the Kubeflow core services as a second layer of defense before Istio authorization policies. This gives administrators a better network overview and segmentation while also enforcing common enterprise security guidelines.
• The Documentation has been overhauled. It now contains guidelines for upgrading and extending the Kubeflow Platform for administrators and enables new users to have a basic installation in a few minutes on their Laptop.
• Automatic CVE scanning with Trivy on the master branch is relevant for DevSecOps and enterprise security guidelines
• We have updated the third-party components to provide integration with the larger ML ecosystem. E.g. ray is heavily used to train LLMs
  • Bentoml 1.2.28 and 1.1.21
  • Seldon 1.18.1
  • Ray 2.23 and Kuberay 1.1.1
• Update of the common components such that we support the latest Kubernetes versions and security patches for platform engineers.
  • Istio 1.22.1
  • Dex 2.39.1
  • Cert-manager 1.14.5
  • Knative 1.12.4

We also updated the following components:

• Kubeflow Pipelines 2.2.0, which includes Argo Workflows and Tekton integration
• Katib v0.17.0-rc.1
• Training Operator v1.8.0-rc.1
• KServe 0.13.0
• Notebooks and platform / multi-tenancy components 1.9.0-rc.0
• New component: Model Registry v0.2.1-alpha

You can see each component release notes in the following URLs:

• Model Registry
• Pipelines
• Katib
• Training Operator
• KServe
• Manifests/Platform
• Security
• TODO 1.9.0-rc.0 kubeflow/kubeflow does not have a change log yet

TODO rebuild kserve models web application, kserve/models-web-app#81, kubeflow/kubeflow 1.9.0-rc.1