kubeflow · google-oss-prow · Jan 27, 2022 · Jan 27, 2022
diff --git a/apps/admission-webhook/upstream/base/kustomization.yaml b/apps/admission-webhook/upstream/base/kustomization.yaml
@@ -16,7 +16,7 @@ commonLabels:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/admission-webhook
   newName: public.ecr.aws/j1r0q0g6/notebooks/admission-webhook
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
 namespace: kubeflow
 generatorOptions:
   disableNameSuffixHash: true

diff --git a/apps/admission-webhook/upstream/overlays/cert-manager/certificate.yaml b/apps/admission-webhook/upstream/overlays/cert-manager/certificate.yaml
@@ -1,4 +1,4 @@
-apiVersion: cert-manager.io/v1alpha2
+apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: cert
@@ -15,7 +15,7 @@ spec:
 
 ---
 
-apiVersion: cert-manager.io/v1alpha2
+apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   name: selfsigned-issuer

diff --git a/apps/admission-webhook/upstream/overlays/cert-manager/kustomization.yaml b/apps/admission-webhook/upstream/overlays/cert-manager/kustomization.yaml
@@ -38,10 +38,10 @@ vars:
   objref:
       kind: Certificate
       group: cert-manager.io
-      version: v1alpha2
+      version: v1
       name: cert
   fieldref:
     fieldpath: metadata.name
 
 configurations:
-- params.yaml
+- params.yaml
diff --git a/apps/centraldashboard/upstream/base/deployment.yaml b/apps/centraldashboard/upstream/base/deployment.yaml
@@ -14,7 +14,7 @@ spec:
       labels:
         app: centraldashboard
       annotations:
-        sidecar.istio.io/inject: "false"
+        sidecar.istio.io/inject: "true"
     spec:
       containers:
       - name: centraldashboard

diff --git a/apps/centraldashboard/upstream/base/kustomization.yaml b/apps/centraldashboard/upstream/base/kustomization.yaml
@@ -18,7 +18,7 @@ commonLabels:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/central-dashboard
   newName: public.ecr.aws/j1r0q0g6/notebooks/central-dashboard
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
 configMapGenerator:
 - envs:
   - params.env

diff --git a/apps/centraldashboard/upstream/overlays/istio/authorizationpolicy.yaml b/apps/centraldashboard/upstream/overlays/istio/authorizationpolicy.yaml
@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: central-dashboard
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
+  selector:
+    matchLabels:
+      app: centraldashboard
diff --git a/apps/centraldashboard/upstream/overlays/istio/kustomization.yaml b/apps/centraldashboard/upstream/overlays/istio/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
 - ../../base
 - virtual-service.yaml
+- authorizationpolicy.yaml
 
 namespace: kubeflow
 

diff --git a/apps/jupyter/jupyter-web-app/upstream/base/configs/spawner_ui_config.yaml b/apps/jupyter/jupyter-web-app/upstream/base/configs/spawner_ui_config.yaml
@@ -17,23 +17,23 @@
 spawnerFormDefaults:
   image:
     # The container Image for the user's Jupyter Notebook
-    value: public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-scipy:v1.4
+    value: public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-scipy:v1.5.0-rc.0
     # The list of available standard container Images
     options:
-    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-scipy:v1.4
-    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-full:v1.4
-    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda-full:v1.4
-    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-tensorflow-full:v1.4
-    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-tensorflow-cuda-full:v1.4
+    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-scipy:v1.5.0-rc.0
+    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-full:v1.5.0-rc.0
+    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda-full:v1.5.0-rc.0
+    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-tensorflow-full:v1.5.0-rc.0
+    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-tensorflow-cuda-full:v1.5.0-rc.0
   imageGroupOne:
     # The container Image for the user's Group One Server
     # The annotation `notebooks.kubeflow.org/http-rewrite-uri: /`
     # is applied to notebook in this group, configuring
     # the Istio rewrite for containers that host their web UI at `/`
-    value: public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/codeserver-python:v1.4
+    value: public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/codeserver-python:v1.5.0-rc.0
     # The list of available standard container Images
     options:
-    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/codeserver-python:v1.4
+    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/codeserver-python:v1.5.0-rc.0
   imageGroupTwo:
     # The container Image for the user's Group Two Server
     # The annotation `notebooks.kubeflow.org/http-rewrite-uri: /`
@@ -42,10 +42,10 @@ spawnerFormDefaults:
     # The annotation `notebooks.kubeflow.org/http-headers-request-set`
     # is applied to notebook in this group, configuring Istio
     # to add the `X-RStudio-Root-Path` header to requests
-    value: public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/rstudio-tidyverse:v1.4
+    value: public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/rstudio-tidyverse:v1.5.0-rc.0
     # The list of available standard container Images
     options:
-    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/rstudio-tidyverse:v1.4
+    - public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/rstudio-tidyverse:v1.5.0-rc.0
   # If true, hide registry and/or tag name in the image selection dropdown
   hideRegistry: true
   hideTag: false

diff --git a/apps/jupyter/jupyter-web-app/upstream/base/kustomization.yaml b/apps/jupyter/jupyter-web-app/upstream/base/kustomization.yaml
@@ -23,7 +23,7 @@ commonLabels:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/jupyter-web-app
   newName: public.ecr.aws/j1r0q0g6/notebooks/jupyter-web-app
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
 # We need the name to be unique without the suffix because the original name is what
 # gets used with patches
 configMapGenerator:

diff --git a/apps/jupyter/notebook-controller/upstream/base/kustomization.yaml b/apps/jupyter/notebook-controller/upstream/base/kustomization.yaml
@@ -5,4 +5,4 @@ resources:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/notebook-controller
   newName: public.ecr.aws/j1r0q0g6/notebooks/notebook-controller
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
diff --git a/apps/jupyter/notebook-controller/upstream/manager/manager.yaml b/apps/jupyter/notebook-controller/upstream/manager/manager.yaml
@@ -15,8 +15,6 @@ spec:
       labels:
         app: notebook-controller
         kustomize.component: notebook-controller
-      annotations:
-        sidecar.istio.io/inject: "false"
     spec:
       containers:
       - name: manager

diff --git a/apps/profiles/upstream/base/kustomization.yaml b/apps/profiles/upstream/base/kustomization.yaml
@@ -12,7 +12,7 @@ patchesStrategicMerge:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/profile-controller
   newName: public.ecr.aws/j1r0q0g6/notebooks/profile-controller
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
 
 configMapGenerator:
 - name: namespace-labels-data

diff --git a/apps/profiles/upstream/base/namespace-labels.yaml b/apps/profiles/upstream/base/namespace-labels.yaml
@@ -12,7 +12,7 @@
 # 1. Remove the label by using `key: ''` and deploy.
 # 2. Add the label by using `key: 'value'` and deploy.
 #
-katib-metricscollector-injection:      'enabled'
-serving.kubeflow.org/inferenceservice: 'enabled'
-pipelines.kubeflow.org/enabled:        'true'
-app.kubernetes.io/part-of:             'kubeflow-profile'
+katib.kubeflow.org/metrics-collector-injection: "enabled"
+serving.kubeflow.org/inferenceservice: "enabled"
+pipelines.kubeflow.org/enabled: "true"
+app.kubernetes.io/part-of: "kubeflow-profile"
diff --git a/apps/profiles/upstream/overlays/kubeflow/authorizationpolicy.yaml b/apps/profiles/upstream/overlays/kubeflow/authorizationpolicy.yaml
@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: profiles-kfam
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/kubeflow/sa/centraldashboard
+  selector:
+    matchLabels:
+      kustomize.component: profiles
diff --git a/apps/profiles/upstream/overlays/kubeflow/kustomization.yaml b/apps/profiles/upstream/overlays/kubeflow/kustomization.yaml
@@ -5,6 +5,7 @@ resources:
 - ../../base
 - service.yaml
 - virtual-service.yaml
+- authorizationpolicy.yaml
 
 commonLabels:
   kustomize.component: profiles
@@ -28,4 +29,4 @@ vars:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/access-management
   newName: public.ecr.aws/j1r0q0g6/notebooks/access-management
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
diff --git a/apps/profiles/upstream/overlays/kubeflow/patches/kfam.yaml b/apps/profiles/upstream/overlays/kubeflow/patches/kfam.yaml
@@ -4,6 +4,9 @@ metadata:
   name: deployment
 spec:
   template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "true"
     spec:
       containers:
       - command:

diff --git a/apps/tensorboard/tensorboard-controller/upstream/base/kustomization.yaml b/apps/tensorboard/tensorboard-controller/upstream/base/kustomization.yaml
@@ -36,4 +36,4 @@ patches:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/tensorboard-controller
   newName: public.ecr.aws/j1r0q0g6/notebooks/tensorboard-controller
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
diff --git a/apps/tensorboard/tensorboard-controller/upstream/manager/manager.yaml b/apps/tensorboard/tensorboard-controller/upstream/manager/manager.yaml
@@ -32,8 +32,8 @@ spec:
         resources:
           limits:
             cpu: 100m
-            memory: 30Mi
+            memory: 50Mi
           requests:
             cpu: 100m
-            memory: 20Mi
+            memory: 30Mi
       terminationGracePeriodSeconds: 10
diff --git a/apps/tensorboard/tensorboard-controller/upstream/rbac/role.yaml b/apps/tensorboard/tensorboard-controller/upstream/rbac/role.yaml
@@ -56,6 +56,7 @@ rules:
   - tensorboard.kubeflow.org
   resources:
   - tensorboards
+  - tensorboards/finalizers
   verbs:
   - create
   - delete

diff --git a/apps/tensorboard/tensorboards-web-app/upstream/base/kustomization.yaml b/apps/tensorboard/tensorboards-web-app/upstream/base/kustomization.yaml
@@ -14,7 +14,7 @@ commonLabels:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/tensorboards-web-app
   newName: public.ecr.aws/j1r0q0g6/notebooks/tensorboards-web-app
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
 # We need the name to be unique without the suffix because the original name is what
 # gets used with patches
 configMapGenerator:

diff --git a/apps/volumes-web-app/upstream/base/kustomization.yaml b/apps/volumes-web-app/upstream/base/kustomization.yaml
@@ -14,7 +14,7 @@ commonLabels:
 images:
 - name: public.ecr.aws/j1r0q0g6/notebooks/volumes-web-app
   newName: public.ecr.aws/j1r0q0g6/notebooks/volumes-web-app
-  newTag: v1.4
+  newTag: v1.5.0-rc.0
 # We need the name to be unique without the suffix because the original name is what
 # gets used with patches
 configMapGenerator: