feat(charts): add Helm chart for Kubeflow Pipelines#12787
feat(charts): add Helm chart for Kubeflow Pipelines#12787jsonmp-k8 wants to merge 5 commits intokubeflow:masterfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
🎉 Welcome to the Kubeflow Pipelines repo! 🎉 Thanks for opening your first PR! We're excited to have you onboard 🚀 Next steps:
Feel free to ask questions in the comments. |
|
Hi @jsonmp-k8. Thanks for your PR. I'm waiting for a kubeflow member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
google-oss-prow
bot
requested review from
HumairAK,
droctothorpe and
james-jwu
Add a comprehensive Helm chart that provides full functional parity with the existing Kustomize manifests. Supports all 4 deployment combinations: single/multi-user x MySQL/PostgreSQL x SeaweedFS/MinIO. Signed-off-by: Jaison Paul <paul.jaison@gmail.com>
Code Review: Helm Chart for Kubeflow PipelinesOverview+4,780 lines, 93 templates, covering all 4 deployment combinations (single/multi-user × MySQL/PostgreSQL × SeaweedFS/MinIO). This is a significant contribution that aims for full functional parity with the existing Kustomize manifests. I compared each finding against the existing Kustomize manifests to separate genuinely new issues from inherited behavior. Issues that already exist in the Kustomize manifests are noted as such and should not block this PR. Issues Inherited from Kustomize (Not Blocking)The following issues exist identically in the Kustomize manifests under
New Issues Introduced by the Helm ChartP1 — Should fix before merge1. Unquoted secret values in templates
# Current (broken for special chars)
{{ .Values.objectStoreSecret.accessKeyKey }}: {{ .Values.objectStoreSecret.accessKey }}
# Should be
{{ .Values.objectStoreSecret.accessKeyKey }}: {{ .Values.objectStoreSecret.accessKey | quote }}Same issue in 2. Argo
3. Dead
P2 — Should fix (Helm-specific best practices)4. No 5. Missing standard Kubernetes labels — 6. Committed 7. Loose dependency version ranges — 8. No 9. No Helm tests — No 10. No 11. 12. No 13. No PodDisruptionBudgets — Critical-path components (api-server, metadata-grpc) should have PDB support for production HA. 14. No |
KEP Alignment ReviewI compared this PR against the KEP: Helm Charts for Kubeflow Pipelines to assess how well it aligns with the agreed-upon direction. Where the PR aligns with the KEP
Where the PR diverges from the KEP1. Minimalism — "Start with only the core components" (High gap)The KEP explicitly calls for a minimal initial scope:
The PR takes the opposite approach — 93 templates covering all 4 deployment combinations (single/multi-user × MySQL/PostgreSQL × SeaweedFS/MinIO) with a compat layer for legacy MySQL deployments. This is comprehensive, not minimal. A KEP-aligned V1 might look like:
2. Maintainability — "Avoid direct one-to-one templating of all existing manifests" (High gap)The KEP explicitly warns against 1:1 porting:
The PR appears to be a fairly direct port of each Kustomize manifest into a Helm template. Evidence:
A more maintainable approach would consolidate — e.g., pick one DB deployment strategy rather than supporting both compat MySQL and the Bitnami subchart simultaneously. 3. Standardization — "Follow established Kubernetes and Kubeflow best practices" (Medium gap)Several standard Helm patterns are missing:
These are established patterns in the Helm ecosystem and in other Kubeflow components. 4. Testing and Validation (Medium gap)The KEP states:
The PR includes no Helm tests ( 5. "This KEP does not assume any existing pull request as the final solution" (Note)The KEP's Relationship to Existing Helm Work section says:
This means the PR should be evaluated against the KEP's principles, not just on whether it achieves functional parity with Kustomize. Summary
The PR delivers on the KEP's structural goals (location, ownership, versioning) but diverges from its design philosophy. The KEP envisions a minimal, well-structured starting point that grows incrementally, while the PR delivers a comprehensive 1:1 port of all Kustomize variants. The PR could be brought into alignment by either:
Either path should include |
|
/ok-to-test |
P1 fixes: - Quote all user-provided secret values in object-store-secret and db-secret - Replace hardcoded kubeflow namespace in Argo workflowNamespaces with empty list (defaults to release namespace via singleNamespace: true) - Remove dead seaweedfs.enabled knob (templates use objectStore.type) P2 Helm best-practice improvements: - Add fullnameOverride/nameOverride support in _helpers.tpl - Add standard K8s labels (app.kubernetes.io/name, version, selectorLabels) - Add .gitignore for chart archives - Tighten dependency versions to ~X.Y.0 ranges - Add global.imagePullSecrets with helper included in all deployments - Add Helm test for API server health endpoint - Add values.schema.json for config validation - Default publicConfig version to .Chart.AppVersion instead of "dev" - Add per-component replicas parameter in values and deployments - Add PodDisruptionBudgets for apiServer, metadataGrpc, cacheServer - Add global nodeSelector/tolerations/affinity with component-level fallback Signed-off-by: Jaison Paul <paul.jaison@gmail.com>
There was a problem hiding this comment.
Pull request overview
Adds a new Helm chart (charts/kubeflow-pipelines/) intended to provide a Helm-based installation path for Kubeflow Pipelines with parity across single-/multi-user modes and different DB/object-store backends.
Changes:
- Introduces chart metadata, default values, and a values JSON schema.
- Adds Helm templates for core KFP components (API server, UI, cache, metadata/MLMD, persistence, scheduled workflow, viewer controller) plus multi-user Istio/RBAC/metacontroller resources.
- Vendors/locks Helm dependencies (Argo Workflows, Bitnami MySQL/PostgreSQL, MinIO, Metacontroller) and adds KFP CRDs.
Reviewed changes
Copilot reviewed 109 out of 115 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| charts/kubeflow-pipelines/Chart.yaml | Defines the new Helm chart and its dependencies. |
| charts/kubeflow-pipelines/Chart.lock | Locks dependency versions/digest for reproducible builds. |
| charts/kubeflow-pipelines/README.md | Documents intent and known differences vs Kustomize. |
| charts/kubeflow-pipelines/values.yaml | Adds default configuration for all components and subcharts. |
| charts/kubeflow-pipelines/values.schema.json | Adds a JSON schema for chart values validation. |
| charts/kubeflow-pipelines/.gitignore | Ignores packaged dependency archives under charts/*.tgz. |
| charts/kubeflow-pipelines/templates/_helpers.tpl | Centralizes naming/labels and endpoint/secret helper logic. |
| charts/kubeflow-pipelines/templates/NOTES.txt | Provides post-install guidance for single- vs multi-user. |
| charts/kubeflow-pipelines/templates/apiserver/deployment.yaml | Deploys the KFP API server. |
| charts/kubeflow-pipelines/templates/apiserver/pdb.yaml | Optional PDB for the API server. |
| charts/kubeflow-pipelines/templates/apiserver/role.yaml | Namespaced RBAC Role for API server. |
| charts/kubeflow-pipelines/templates/apiserver/rolebinding.yaml | Binds API server Role to its ServiceAccount. |
| charts/kubeflow-pipelines/templates/apiserver/sa.yaml | ServiceAccount for API server. |
| charts/kubeflow-pipelines/templates/apiserver/service.yaml | Service for API server HTTP/gRPC endpoints. |
| charts/kubeflow-pipelines/templates/cache/deployment.yaml | Deploys the cache server webhook component. |
| charts/kubeflow-pipelines/templates/cache/pdb.yaml | Optional PDB for cache server. |
| charts/kubeflow-pipelines/templates/cache/role.yaml | Namespaced RBAC Role for cache server. |
| charts/kubeflow-pipelines/templates/cache/rolebinding.yaml | Binds cache Role to cache ServiceAccount. |
| charts/kubeflow-pipelines/templates/cache/sa.yaml | ServiceAccount for cache server. |
| charts/kubeflow-pipelines/templates/cache/service.yaml | Service exposing cache server webhook port. |
| charts/kubeflow-pipelines/templates/cache-deployer/clusterrole.yaml | ClusterRole for cache-deployer to manage webhooks/CSRs. |
| charts/kubeflow-pipelines/templates/cache-deployer/clusterrolebinding.yaml | Binds cache-deployer ClusterRole to its SA. |
| charts/kubeflow-pipelines/templates/cache-deployer/deployment.yaml | Deploys cache-deployer controller. |
| charts/kubeflow-pipelines/templates/cache-deployer/role.yaml | Namespaced Role for cache-deployer. |
| charts/kubeflow-pipelines/templates/cache-deployer/rolebinding.yaml | Binds cache-deployer Role to its SA. |
| charts/kubeflow-pipelines/templates/cache-deployer/sa.yaml | ServiceAccount for cache-deployer. |
| charts/kubeflow-pipelines/templates/compat/argo-binding.yaml | Adds Argo RoleBinding compatibility resources. |
| charts/kubeflow-pipelines/templates/compat/argo-priorityclass.yaml | Adds Argo PriorityClass compatibility resource. |
| charts/kubeflow-pipelines/templates/compat/argo-role.yaml | Adds Argo Role compatibility resource. |
| charts/kubeflow-pipelines/templates/container-builder-sa.yaml | Adds ServiceAccount for container-builder. |
| charts/kubeflow-pipelines/templates/kfp-launcher-configmap.yaml | ConfigMap for launcher default pipeline root. |
| charts/kubeflow-pipelines/templates/kubeflow-pipelines-public-configmap.yaml | Public config ConfigMap for version reporting. |
| charts/kubeflow-pipelines/templates/metadata/envoy-configmap.yaml | Envoy config for MLMD gRPC-web proxy. |
| charts/kubeflow-pipelines/templates/metadata/envoy-deployment.yaml | Deploys Envoy proxy in front of MLMD gRPC. |
| charts/kubeflow-pipelines/templates/metadata/envoy-service.yaml | Service for Envoy proxy. |
| charts/kubeflow-pipelines/templates/metadata/grpc-configmap.yaml | ConfigMap exposing MLMD gRPC service host/port. |
| charts/kubeflow-pipelines/templates/metadata/grpc-deployment.yaml | Deploys MLMD gRPC server. |
| charts/kubeflow-pipelines/templates/metadata/grpc-pdb.yaml | Optional PDB for MLMD gRPC server. |
| charts/kubeflow-pipelines/templates/metadata/grpc-sa.yaml | ServiceAccount for MLMD gRPC server. |
| charts/kubeflow-pipelines/templates/metadata/grpc-service.yaml | Service for MLMD gRPC server. |
| charts/kubeflow-pipelines/templates/metadata-writer/deployment.yaml | Deploys metadata-writer controller. |
| charts/kubeflow-pipelines/templates/metadata-writer/role.yaml | Namespaced RBAC Role for metadata-writer. |
| charts/kubeflow-pipelines/templates/metadata-writer/rolebinding.yaml | Binds metadata-writer Role to its SA. |
| charts/kubeflow-pipelines/templates/metadata-writer/sa.yaml | ServiceAccount for metadata-writer. |
| charts/kubeflow-pipelines/templates/multi-user/api-server-config-configmap.yaml | Multi-user API server config (authz, runner SA, etc.). |
| charts/kubeflow-pipelines/templates/multi-user/apiserver-clusterrole.yaml | Multi-user cluster-scoped RBAC for API server. |
| charts/kubeflow-pipelines/templates/multi-user/cache-clusterrole.yaml | Multi-user cluster-scoped RBAC for cache components. |
| charts/kubeflow-pipelines/templates/multi-user/decorator-controller.yaml | Metacontroller DecoratorController for per-namespace installs. |
| charts/kubeflow-pipelines/templates/multi-user/istio-authorization-policies.yaml | Istio AuthorizationPolicies for multi-user isolation. |
| charts/kubeflow-pipelines/templates/multi-user/istio-destination-rules.yaml | Istio DestinationRules for mTLS in multi-user mode. |
| charts/kubeflow-pipelines/templates/multi-user/metadata-virtual-service.yaml | Istio VirtualService routing for metadata endpoints. |
| charts/kubeflow-pipelines/templates/multi-user/metadata-writer-clusterrole.yaml | Cluster RBAC for metadata-writer in multi-user mode. |
| charts/kubeflow-pipelines/templates/multi-user/persistence-agent-clusterrole.yaml | Cluster RBAC for persistence-agent in multi-user mode. |
| charts/kubeflow-pipelines/templates/multi-user/profile-controller-code-configmap.yaml | ConfigMap embedding sync.py for the profile controller. |
| charts/kubeflow-pipelines/templates/multi-user/profile-controller-deployment.yaml | Deploys the multi-user profile controller. |
| charts/kubeflow-pipelines/templates/multi-user/profile-controller-env-configmap.yaml | Env ConfigMap for profile controller behavior. |
| charts/kubeflow-pipelines/templates/multi-user/profile-controller-service.yaml | Service for profile controller webhook. |
| charts/kubeflow-pipelines/templates/multi-user/scheduled-workflow-clusterrole.yaml | Cluster RBAC for scheduled workflow controller in multi-user. |
| charts/kubeflow-pipelines/templates/multi-user/ui-clusterrole.yaml | Cluster RBAC for UI in multi-user. |
| charts/kubeflow-pipelines/templates/multi-user/view-edit-clusterroles.yaml | Aggregated ClusterRoles for Kubeflow Pipelines view/edit. |
| charts/kubeflow-pipelines/templates/multi-user/viewer-controller-clusterrole.yaml | Cluster RBAC for viewer controller in multi-user. |
| charts/kubeflow-pipelines/templates/multi-user/virtual-service.yaml | Istio VirtualService routing for UI in multi-user mode. |
| charts/kubeflow-pipelines/templates/mysql/db-secret.yaml | Creates DB Secret for MySQL/PostgreSQL based on values. |
| charts/kubeflow-pipelines/templates/mysql/mysql-deployment.yaml | Optional compatibility MySQL Deployment (when not using subchart). |
| charts/kubeflow-pipelines/templates/mysql/mysql-pvc.yaml | Optional compatibility PVC for MySQL parity with Kustomize. |
| charts/kubeflow-pipelines/templates/mysql/mysql-sa.yaml | Optional compatibility MySQL ServiceAccount. |
| charts/kubeflow-pipelines/templates/mysql/mysql-service.yaml | Optional compatibility MySQL Service. |
| charts/kubeflow-pipelines/templates/object-store-secret.yaml | Creates object store Secret (unless existingSecret is provided). |
| charts/kubeflow-pipelines/templates/persistence-agent/deployment.yaml | Deploys persistence-agent controller. |
| charts/kubeflow-pipelines/templates/persistence-agent/role.yaml | Namespaced RBAC Role for persistence-agent. |
| charts/kubeflow-pipelines/templates/persistence-agent/rolebinding.yaml | Binds persistence-agent Role to its SA. |
| charts/kubeflow-pipelines/templates/persistence-agent/sa.yaml | ServiceAccount for persistence-agent. |
| charts/kubeflow-pipelines/templates/pipeline-install-config.yaml | ConfigMap wiring DB/object-store/app settings for components. |
| charts/kubeflow-pipelines/templates/pipeline-runner/role.yaml | Namespaced RBAC Role for pipeline-runner. |
| charts/kubeflow-pipelines/templates/pipeline-runner/rolebinding.yaml | Binds pipeline-runner Role to its SA. |
| charts/kubeflow-pipelines/templates/pipeline-runner/sa.yaml | ServiceAccount for pipeline-runner. |
| charts/kubeflow-pipelines/templates/public-configmap-role.yaml | Role granting read access to the public configmap. |
| charts/kubeflow-pipelines/templates/public-configmap-rolebinding.yaml | RoleBinding granting authenticated users access to public config. |
| charts/kubeflow-pipelines/templates/scheduled-workflow/deployment.yaml | Deploys scheduled workflow controller. |
| charts/kubeflow-pipelines/templates/scheduled-workflow/role.yaml | Namespaced RBAC Role for scheduled workflow controller. |
| charts/kubeflow-pipelines/templates/scheduled-workflow/rolebinding.yaml | Binds scheduled workflow Role to its SA. |
| charts/kubeflow-pipelines/templates/scheduled-workflow/sa.yaml | ServiceAccount for scheduled workflow controller. |
| charts/kubeflow-pipelines/templates/seaweedfs/deployment.yaml | Deploys in-chart SeaweedFS (when selected). |
| charts/kubeflow-pipelines/templates/seaweedfs/minio-compat-service.yaml | Provides minio-service compat endpoint for SeaweedFS S3 gateway. |
| charts/kubeflow-pipelines/templates/seaweedfs/networkpolicy.yaml | NetworkPolicy for SeaweedFS ingress restrictions. |
| charts/kubeflow-pipelines/templates/seaweedfs/pvc.yaml | PVC for SeaweedFS storage. |
| charts/kubeflow-pipelines/templates/seaweedfs/sa.yaml | ServiceAccount for SeaweedFS. |
| charts/kubeflow-pipelines/templates/seaweedfs/service.yaml | Service exposing SeaweedFS endpoints. |
| charts/kubeflow-pipelines/templates/tests/test-api-connection.yaml | Adds a Helm test pod for API server health check. |
| charts/kubeflow-pipelines/templates/ui/configmap.yaml | UI config (viewer pod template) differing by multi-user mode. |
| charts/kubeflow-pipelines/templates/ui/deployment.yaml | Deploys the KFP UI and configures object-store credentials/env. |
| charts/kubeflow-pipelines/templates/ui/role.yaml | Namespaced RBAC Role for UI. |
| charts/kubeflow-pipelines/templates/ui/rolebinding.yaml | Binds UI Role to UI ServiceAccount. |
| charts/kubeflow-pipelines/templates/ui/sa.yaml | ServiceAccount for UI. |
| charts/kubeflow-pipelines/templates/ui/service.yaml | Service exposing UI. |
| charts/kubeflow-pipelines/templates/visualization/deployment.yaml | Deploys visualization server. |
| charts/kubeflow-pipelines/templates/visualization/sa.yaml | ServiceAccount for visualization server. |
| charts/kubeflow-pipelines/templates/visualization/service.yaml | Service for visualization server. |
| charts/kubeflow-pipelines/templates/viewer-crd/deployment.yaml | Deploys viewer CRD controller. |
| charts/kubeflow-pipelines/templates/viewer-crd/role.yaml | Namespaced RBAC Role for viewer CRD controller. |
| charts/kubeflow-pipelines/templates/viewer-crd/rolebinding.yaml | Binds viewer CRD Role to its SA. |
| charts/kubeflow-pipelines/templates/viewer-crd/sa.yaml | ServiceAccount for viewer CRD controller. |
| charts/kubeflow-pipelines/templates/viewer-sa.yaml | ServiceAccount for viewer workloads in single-user mode. |
| charts/kubeflow-pipelines/templates/webhooks/mutating-webhook.yaml | Adds PipelineVersion mutating admission webhook configuration. |
| charts/kubeflow-pipelines/templates/webhooks/validating-webhook.yaml | Adds PipelineVersion validating admission webhook configuration. |
| charts/kubeflow-pipelines/files/sync.py | Adds profile controller sync logic (SeaweedFS-oriented). |
| charts/kubeflow-pipelines/crds/pipelines.yaml | Adds Pipelines CRD. |
| charts/kubeflow-pipelines/crds/pipelineversions.yaml | Adds PipelineVersions CRD. |
| charts/kubeflow-pipelines/crds/scheduledworkflows.yaml | Adds ScheduledWorkflows CRD. |
| charts/kubeflow-pipelines/crds/viewers.yaml | Adds Viewers CRD. |
| charts/kubeflow-pipelines/charts/minio-5.4.0.tgz | Vendored MinIO dependency chart archive. |
| charts/kubeflow-pipelines/charts/metacontroller-helm-4.12.5.tgz | Vendored Metacontroller dependency chart archive. |
| - name: grpc | ||
| port: 8887 | ||
| protocol: TCP | ||
| targetPort: 8887 |
There was a problem hiding this comment.
The webhook configurations in this chart target ml-pipeline on port 8443, but the ml-pipeline Service only exposes ports 8888 and 8887. With failurePolicy: Fail, PipelineVersion CREATE/UPDATE requests will fail because the webhook endpoint is unreachable. Either add the webhook port (8443) to this Service (and ensure the backing pod listens on it), or gate rendering of these webhook configs behind a values flag that defaults to disabled (to match platform-agnostic Kustomize which doesn’t install the webhook resources by default).
| targetPort: 8887 | |
| targetPort: 8887 | |
| - name: webhook | |
| port: 8443 | |
| protocol: TCP | |
| targetPort: 8443 |
| - name: http | ||
| containerPort: 8888 | ||
| - name: grpc | ||
| containerPort: 8887 |
There was a problem hiding this comment.
Related to the webhook configs: the API server Deployment doesn’t declare/expose a container port for 8443 (only 8888/8887). If the API server is expected to serve the admission webhooks, ensure it is configured to listen on 8443 and that the port is exposed so the Service can route traffic.
| containerPort: 8887 | |
| containerPort: 8887 | |
| - name: https-webhook | |
| containerPort: 8443 |
| metadata: | ||
| name: pipelineversions.pipelines.kubeflow.org | ||
| labels: | ||
| {{- include "kubeflow-pipelines.labels" . | nindent 4 }} | ||
| webhooks: |
There was a problem hiding this comment.
The webhook configurations are missing the cert-manager CA injection annotation used by the Kustomize cert-manager overlays (e.g., cert-manager.io/inject-ca-from: <ns>/kfp-api-webhook-cert). Without either caBundle or CA injection, the apiserver won’t trust the webhook server cert and admissions will fail. Consider adding an optional annotation/caBundle mechanism (and documenting the expected secret/certificate source) when webhooks are enabled.
| - name: AWS_ENDPOINT_URL | ||
| value: http://seaweedfs.{{ .Release.Namespace }}:8111 | ||
| - name: S3_ENDPOINT_URL | ||
| value: http://seaweedfs.{{ .Release.Namespace }}:8333 | ||
| - name: AWS_REGION | ||
| value: us-east-1 |
There was a problem hiding this comment.
In multi-user mode, the profile-controller Deployment hardcodes SeaweedFS endpoints for AWS_ENDPOINT_URL / S3_ENDPOINT_URL. This breaks the advertised multi-user + MinIO combination (Kustomize uses different env values and even swaps in a different sync.py implementation for MinIO). These endpoints (and possibly the controller script) need to be conditional on .Values.objectStore.type.
| Object store endpoint host | ||
| */}} | ||
| {{- define "kubeflow-pipelines.objectStoreHost" -}} | ||
| minio-service.{{ .Release.Namespace }} |
There was a problem hiding this comment.
kubeflow-pipelines.objectStoreHost always returns minio-service.<namespace>, but when .Values.objectStore.type=minio the chart relies on the MinIO subchart, which typically does not create a Service named minio-service unless explicitly overridden. To avoid a broken defaultPipelineRoot/artifact repository config, either (1) configure the minio subchart to use fullnameOverride: minio-service, or (2) compute the endpoint host based on the actual subchart service name and/or create a compatibility Service named minio-service when MinIO is enabled.
| minio-service.{{ .Release.Namespace }} | |
| {{- default (printf "minio-service.%s" .Release.Namespace) .Values.objectStore.host -}} |
| - name: MINIO_ACCESS_KEY | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: {{ include "kubeflow-pipelines.objectStoreSecretName" . }} | ||
| key: accesskey | ||
| - name: MINIO_SECRET_KEY | ||
| valueFrom: | ||
| secretKeyRef: | ||
| name: {{ include "kubeflow-pipelines.objectStoreSecretName" . }} | ||
| key: secretkey |
There was a problem hiding this comment.
The chart exposes objectStoreSecret.accessKeyKey / secretKeyKey in values, but consumers still reference hard-coded secret keys (accesskey / secretkey). If a user changes the key names, the UI pod will fail to start due to missing keys. Use the configured key names consistently everywhere you reference the secret data.
| }, | ||
| }) |
There was a problem hiding this comment.
The profile controller script has a Python syntax error: the Secret object inserted into desired_resources is missing closing braces for the data map and the outer dict. As-is, sync.py will fail to start, breaking multi-user mode.
| }, | |
| }) | |
| }, | |
| }, | |
| ) |
P1 fixes: - Quote all user-provided secret values in object-store-secret and db-secret - Replace hardcoded kubeflow namespace in Argo workflowNamespaces with empty list (defaults to release namespace via singleNamespace: true) - Remove dead seaweedfs.enabled knob (templates use objectStore.type) P2 Helm best-practice improvements: - Add fullnameOverride/nameOverride support in _helpers.tpl - Add standard K8s labels (app.kubernetes.io/name, version, selectorLabels) - Add .gitignore for chart archives - Tighten dependency versions to ~X.Y.0 ranges - Add global.imagePullSecrets with helper included in all deployments - Add Helm test for API server health endpoint - Add values.schema.json for config validation - Default publicConfig version to .Chart.AppVersion instead of "dev" - Add per-component replicas parameter in values and deployments - Add PodDisruptionBudgets for apiServer, metadataGrpc, cacheServer - Add global nodeSelector/tolerations/affinity with component-level fallback Signed-off-by: Jaison Paul <paul.jaison@gmail.com>
jsonmp-k8
force-pushed
the
helm-chart
branch
from
f609090 to
abafd7a
Compare
- Use kindIs "invalid" + ternary instead of | default for global
scheduling fallback so explicit empty {} / [] overrides work
- Remove per-component nodeSelector/tolerations/affinity defaults
from values.yaml (nil by default inherits global)
- Regenerate Chart.lock after dependency version range tightening
- Remove no-op nameOverride/fullnameOverride (resource names are
hardcoded for Kustomize compatibility)
Signed-off-by: Jaison Paul <paul.jaison@gmail.com>
|
Hello, I see multiple ones. 1. the general one kubeflow/community#832 2. KFP specific ones #12842 #12787 #12723 and some requirements from GSOC https://www.kubeflow.org/events/upcoming-events/gsoc-2026/#project-5-helm-charts " This project will touch most components and continue the helm chart initiative started by Kunal Dugar who also helped a lot with the testing infrastructure. This will therefore also include working with maintainers of other components such as KFP maintainersfor the KFP helm charts, security and scalability topic or Katib maintainers for Katib helm charts. Some have already open PRs and there was a formal vote by the KSC (Kubeflow steering Committee) that we are moving forward with offering Kubeflow platform and standalone components as helm charts. Therefore it is not just the technical part, but also the coordination effort. The goal is to make minimalistic helm charts that are easy to maintain next to kustomize and only expose sensible settings relevant to most users. For the time being the rendered chart default values must replicate kustomize 1:1. The testing infrastructure has already been set up in the GSOC 2025 efforts in kubeflow/manifests where we already have a few helm charts. |
Summary
charts/kubeflow-pipelines/) that provides full functional parity with the existing Kustomize manifestsTest plan
helm lintpasses for all 4 mode combinationshelm templaterenders correct resources for single-user MySQL+SeaweedFShelm templaterenders correct resources for single-user PostgreSQL+MinIOhelm templaterenders correct resources for multi-user MySQL+SeaweedFShelm templaterenders correct resources for multi-user PostgreSQL+MinIOSigned-off-by: Jaison Paul paul.jaison@gmail.com