Tracking for /contrib components evaluation and clean up

[annajung]

To enable new components to integrate with Kubeflow, a contrib component guidelines have been added with a list of requirements.

To enforce the requirements for existing components, each component will be evaluated to determine its status. In this process, any components that do not meet the requirements will be marked as UNMAINTAINED/OUT-OF-DATE and eventually removed from the manifest repo as stated in the deprecation plan.

In discussion with Manifest WG @kimwnasptd, this issue will be used to track progress for each component.

Component	Evaluation Status	Meets Requirement	Missing Requirements	PR to label as unmaintained	PR to remove (After 1.7 release)
application	Completed	No	All	#2313 (merged)	#2430
basic-auth	Completed	No	All	#2313 (merged)	#2430
dex-auth	Completed	No	- README.md is outdated - Component does not work with the latest version of Kubeflow - Missing UPGRADE.md - No test - Outdated (2 years)	#2316 (merged)	#2430
experimental	Completed	No	All	#2313 (merged)	#2430
feast	Completed	No	- README.md lacks content required - Component does not work with the latest version of Kubeflow - Missing UPGRADE.md - No test - Outdated (2 years)	#2318 (merged)	#2430
flink	Completed	No	All	#2319 (merged)	#2430
gatekeeper	Completed	No	All (Not a kustomize package)	#2313 (merged)	#2430
kserve	Completed	No	- Missing README.md - Missing UPGRADE.md - No test	#2355 (merged)	Not Applicable
metacontroller	Completed	No	- README.md lacks content required - Missing UPGRADE.md (Upgrade available via README) - No test	Not Applicable Update accepted #2341	Not Applicable
modeldb	Completed	No	All	#2313 (merged)	#2430
networkpolicies	Not Applicable				Not Applicable Tracked in separate issue #2385
seldon	Completed	No	- README.md lacks content required - Component does not work with the latest version of Kubeflow - Missing UPGRADE.md (Upgrade available via README) - No test - Outdated (14 months)	#2322 (closed) Update accepted #2326	Not Applicable
spark	Completed	No	- Missing README.md - Missing UPGRADE.md - No test - Outdated (2 years)	#2320 (merged)	#2430
spartakus	Completed	No	All	#2313 (merged)	#2430
tektoncd	Completed	No	- Missing README.md - Component does not work with the latest version of Kubeflow - Missing UPGRADE.md - No test - Outdated (2 years)	#2321 (merged)	#2430

More details about changes to /contrib directory can be found in the recent Manifest roadmap presentation

/assign @annajung
/cc @kimwnasptd @kubeflow/wg-manifests-leads

[kimwnasptd]

Thanks for driving this @annajung!

Let's start with application. This is something that is both unmaintained and deprecated in Kubeflow. The Application CRD was introduced to work with kfctl (design doc). But since now in manifests we decided to use plain Kustomize the above CRD is not used.

Also I don't think kfctl is being developed anymore https://github.com/kubeflow/kfctl

@annajung could you send a PR to deprecate the application?

[kimwnasptd]

And on a similar note, I believe we should be able to also remove the experimental, spartakus and gatekeeper folders since

1. they have no OWNERS files
2. they haven't been updated for almost 2 years

Let's have some dedicated PRs for the deprecation though, in case anyone would like to chime in and express an interest/opinion in maintaining.

[annajung]

@kimwnasptd @juliusvonkohout Do you have any thoughts on how to handle networkpolicies based on the contrib component guidelines?

Would it make sense to move network policies out of contrib?

[annajung]

Progress update

• Evaluation for most of the contrib components have been completed except networkpolicies
• For the components with no updates for the last 12 months, multiple PRs have been created to label them as unmaintained (list of PRs can be found in the table). If the OWNERS file was present, owners listed in the file were tagged in the PR to raise awareness

[annajung]

For the component with updates in the last 12 months (KServe and Metacontroller), tagging the owners here to raise awareness of missing requirements

• KServe owners @ellistarn @yuzisun @cliveseldon @animeshsingh @deadeyegoodwin
• metacontroller owners @zijianjoy @gkcalat

Could you all review the contrib requirements and take action to make sure that your component meets all the requirements listed in the guidelines?

[juliusvonkohout]

@kimwnasptd @juliusvonkohout Do you have any thoughts on how to handle networkpolicies based on the contrib component guidelines?

Would it make sense to move network policies out of contrib?

@kimwnasptd
Yes we can definitely move the network policies into upstream Kubeflow. There is no reason to not use them. Actually they helped very much as a second layer of defence against some of the latest missing istio sidecar issues. I can also still maintain them.

In general I would like to ask you to extend my permissions in GitHub to maintainer. I think I have over 30 accepted Prs in Kubeflow over the last few years and definitely shaped the roadmap. I am one of the most active community members and shaped a dozen more PRs and did mentorship for @annajung colleague Diana at VMware and Tobias Goerke from viadee consulting and others. The kuberay integration in manifests/contrib and all the other security stuff we talked about is also something where maintainer rights might be useful for kubeflow/manifests and maybe kubeflow/kubeflow.

[juliusvonkohout]

#2329 is also related

[annajung]

tagging @sukumargaonkar who volunteered to assist with kserve updates

Noting that during kserve community meeting, It was also identified that existing tests can be reused for this purpose.

I am not sure if creating a new issue specifically for kserve is necessary, but feel free to do so if needed. Recently, seldon component completed the updates with us and if needed, you can reference their PR #2326.

[annajung]

Hi @sukumargaonkar, do you have any updates on the Kserve component update? We are hoping to get this in by the feature freeze Jan.25 to allow component deprecation to happen after the latest release is out. cc @yuzisun

[annajung]

Kserve changes are in progress: #2355

[annajung]

Still tracking other issues

/reopen

[google-oss-prow]

@annajung: Reopened this issue.

In response to this:

Still tracking other issues

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[annajung]

Thanks to all the contrib owners for helping to keep their components up to date! As of today, all components except network policies have been updated to deprecated or to meet the requirements

Next steps:

• After the 1.7 release, components that have been deprecated will be removed from the /contrib directory
• Discuss how to proceed with network policies (cc @kimwnasptd @juliusvonkohout)
  • Do we want to keep it as part of contrib and follow the same contrib component guidelines or would it be appropriate to move to respective upstream Kubeflow repos / components?
  • I'll add this as a topic to discuss in the next Manifest WG meeting. In the meantime, if you have a proposal, feel free to comment

[kimwnasptd]

Sounds good! I also agree we need to have this discussion around the NetworkPolicies.

My main question is if we could achieve the same networking isolation via Istio's authnz model, or if there are edge cases we are missing. This will help us better understand whether this is something extra that adopters would like to have (to have a second wall of protection from Istio) or something that is there to fix an issue that Istio can't address.

@juliusvonkohout could you start a separate issue to track this discussion?

[juliusvonkohout]

/close

There has been no activity for a long time. Please reopen if necessary.

[google-oss-prow]

@juliusvonkohout: Closing this issue.

In response to this:

/close

There has been no activity for a long time. Please reopen if necessary.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.