Update kubeflow/kfp-tekton manifests from v1.2.1 (kubeflow#2222)

Signed-off-by: Yihong Wang <yh.wang@ibm.com>

README.md

@@ -54,7 +54,7 @@ This repo periodically syncs all official Kubeflow components from their respect
 | KFServing | apps/kfserving/upstream | [v0.6.1](/~https://github.com/kubeflow/kfserving/releases/tag/v0.6.1) |
 | KServe | contrib/kserve/upstream | [v0.7.0](/~https://github.com/kserve/kserve/tree/v0.7.0) |
 | Kubeflow Pipelines | apps/pipeline/upstream | [1.8.2](/~https://github.com/kubeflow/pipelines/tree/1.8.2/manifests/kustomize) |
-| Kubeflow Tekton Pipelines | apps/kfp-tekton/upstream | [v1.1.1](/~https://github.com/kubeflow/kfp-tekton/tree/v1.1.1/manifests/kustomize) |
+| Kubeflow Tekton Pipelines | apps/kfp-tekton/upstream | [v1.2.1](/~https://github.com/kubeflow/kfp-tekton/tree/v1.2.1/manifests/kustomize) |
 
 The following is also a matrix with versions from common components that are
 used from the different projects of Kubeflow:

apps/kfp-tekton/upstream/Makefile

@@ -18,12 +18,12 @@ platform-agnostic: FORCE
 	kubectl kustomize env/platform-agnostic
 
 platform-agnostic-multi-user: FORCE
-	kustomize build --load_restrictor none env/platform-agnostic-multi-user
+	kustomize build --load-restrictor LoadRestrictionsNone env/platform-agnostic-multi-user
 
 plain: FORCE
 	kubectl kustomize env/plain
 
 plain-multi-user: FORCE
-	kustomize build --load_restrictor none env/plain-multi-user
+	kustomize build --load-restrictor LoadRestrictionsNone env/plain-multi-user
 
 FORCE: ;

apps/kfp-tekton/upstream/base/cache-deployer/kustomization.yaml

@@ -10,4 +10,4 @@ commonLabels:
   app: cache-deployer
 images:
   - name: gcr.io/ml-pipeline/cache-deployer
-    newTag: 1.8.0-rc.3
+    newTag: 1.8.1

apps/kfp-tekton/upstream/base/cache/kustomization.yaml

@@ -11,4 +11,4 @@ commonLabels:
 images:
   - name: gcr.io/ml-pipeline/cache-server
     newName: docker.io/aipipeline/cache-server
-    newTag: 1.1.1
+    newTag: 1.2.1

apps/kfp-tekton/upstream/base/installs/generic/pipeline-install-config.yaml

@@ -11,7 +11,7 @@ data:
     until the changes take effect. A quick way to restart all deployments in a
     namespace: `kubectl rollout restart deployment -n <your-namespace>`.
   appName: pipeline
-  appVersion: 1.7.0
+  appVersion: 1.8.1
   dbHost: mysql
   dbPort: "3306"
   mlmdDb: metadb
@@ -68,7 +68,10 @@ data:
   ## any node and avoid defaulting to specific nodes. Allowed values are:
   ## 'false' and 'true'.
   cacheNodeRestrictions: "false"
-  ## ConMaxLifeTimeSec will set the connection max lifetime for MySQL
+  ## ConMaxLifeTime will set the connection max lifetime for MySQL
   ## this is very important to setup when using external databases.
   ## See this issue for more details: /~https://github.com/kubeflow/pipelines/issues/5329
-  ConMaxLifeTimeSec: "120"
+  ## Note: this value should be a string that can be parsed by `time.ParseDuration`.
+  ## If this value doesn't include a unit abbreviation, the units will be assumed
+  ## to be nanoseconds.
+  ConMaxLifeTime: "120s"

apps/kfp-tekton/upstream/base/installs/multi-user/pipelines-profile-controller/composite-controller.yaml

@@ -1,10 +1,12 @@
+# Change resyncPeriodSeconds to 1 hour from insane 20 seconds
+# Only  sync namespaces with pipelines.kubeflow.org/enabled = "true"
 apiVersion: metacontroller.k8s.io/v1alpha1
 kind: CompositeController
 metadata:
   name: kubeflow-pipelines-profile-controller
 spec:
   generateSelector: true
-  resyncPeriodSeconds: 10
+  resyncPeriodSeconds: 3600
   parentResource:
     apiVersion: v1
     resource: namespaces

apps/kfp-tekton/upstream/base/installs/multi-user/pipelines-profile-controller/sync.py

@@ -299,6 +299,26 @@ def sync(self, parent, children):
                                     "ports": [{
                                         "containerPort": 3000
                                     }],
+                                    "env": [
+                                        {
+                                            "name": "MINIO_ACCESS_KEY",
+                                            "valueFrom": {
+                                                "secretKeyRef": {
+                                                    "key": "accesskey",
+                                                    "name": "mlpipeline-minio-artifact"
+                                                }
+                                            }
+                                        },
+                                        {
+                                            "name": "MINIO_SECRET_KEY",
+                                            "valueFrom": {
+                                                "secretKeyRef": {
+                                                    "key": "secretkey",
+                                                    "name": "mlpipeline-minio-artifact"
+                                                }
+                                            }
+                                        }
+                                    ],
                                     "resources": {
                                         "requests": {
                                             "cpu": "10m",

apps/kfp-tekton/upstream/base/installs/multi-user/view-edit-cluster-roles.yaml

@@ -78,6 +78,23 @@ rules:
   - delete
   - disable
   - enable
+- apiGroups:
+  - kubeflow.org
+  verbs:
+  - '*'
+  resources:
+  - scheduledworkflows
+- apiGroups:
+  - argoproj.io
+  verbs:
+  - '*'
+  resources:
+  - cronworkflows
+  - cronworkflows/finalizers
+  - workflows
+  - workflows/finalizers
+  - workfloweventbindings
+  - workflowtemplates
 
 ---
 

apps/kfp-tekton/upstream/base/installs/multi-user/viewer-controller/cluster-role.yaml

@@ -20,6 +20,7 @@ rules:
   - kubeflow.org
   resources:
   - viewers
+  - viewers/finalizers
   verbs:
   - create
   - get

apps/kfp-tekton/upstream/base/metadata/base/kustomization.yaml

@@ -9,4 +9,4 @@ resources:
   - metadata-grpc-sa.yaml
 images:
   - name: gcr.io/ml-pipeline/metadata-envoy
-    newTag: 1.7.0
+    newTag: 1.8.1

apps/kfp-tekton/upstream/base/metadata/base/metadata-grpc-deployment.yaml

@@ -22,7 +22,7 @@ spec:
         # * .cloudbuild.yaml and .release.cloudbuild.yaml
         # * manifests/kustomize/base/metadata/base/metadata-grpc-deployment.yaml
         # * test/tag_for_hosted.sh
-        image: gcr.io/tfx-oss-public/ml_metadata_store_server:1.0.0
+        image: gcr.io/tfx-oss-public/ml_metadata_store_server:1.5.0
         env:
         - name: DBCONFIG_USER
           valueFrom:

apps/kfp-tekton/upstream/base/pipeline/kustomization.yaml

@@ -43,20 +43,20 @@ patchesStrategicMerge:
 images:
   - name: gcr.io/ml-pipeline/api-server
     newName: docker.io/aipipeline/api-server
-    newTag: 1.1.1
+    newTag: 1.2.1
   - name: gcr.io/ml-pipeline/persistenceagent
     newName: docker.io/aipipeline/persistenceagent
-    newTag: 1.1.1
+    newTag: 1.2.1
   - name: gcr.io/ml-pipeline/scheduledworkflow
     newName: docker.io/aipipeline/scheduledworkflow
-    newTag: 1.1.1
+    newTag: 1.2.1
   - name: gcr.io/ml-pipeline/frontend
     newName: docker.io/aipipeline/frontend
-    newTag: 1.1.1
+    newTag: 1.2.1
   - name: gcr.io/ml-pipeline/viewer-crd-controller
-    newTag: 1.7.0
+    newTag: 1.8.1
   - name: gcr.io/ml-pipeline/visualization-server
-    newTag: 1.7.0
+    newTag: 1.8.1
   - name: gcr.io/ml-pipeline/metadata-writer
     newName: docker.io/aipipeline/metadata-writer
-    newTag: 1.1.1
+    newTag: 1.2.1

apps/kfp-tekton/upstream/base/pipeline/metadata-writer/kustomization.yaml

@@ -7,4 +7,4 @@ resources:
   - metadata-writer-sa.yaml
 images:
   - name: gcr.io/ml-pipeline/metadata-writer
-    newTag: 1.7.0
+    newTag: 1.8.1

apps/kfp-tekton/upstream/base/pipeline/ml-pipeline-apiserver-deployment.yaml

@@ -58,11 +58,11 @@ spec:
             configMapKeyRef:
               name: pipeline-install-config
               key: dbPort
-        - name: DBCONFIG_CONMAXLIFETIMESEC
+        - name: DBCONFIG_CONMAXLIFETIME
           valueFrom:
             configMapKeyRef:
               name: pipeline-install-config
-              key: ConMaxLifeTimeSec
+              key: ConMaxLifeTime
         - name: OBJECTSTORECONFIG_ACCESSKEY
           valueFrom:
             secretKeyRef:

apps/kfp-tekton/upstream/base/pipeline/ml-pipeline-apiserver-service.yaml

@@ -2,6 +2,10 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ml-pipeline
+  annotations:
+    prometheus.io/port: "8888"
+    prometheus.io/scheme: http
+    prometheus.io/scrape: "true"
 spec:
   ports:
   - name: http

apps/kfp-tekton/upstream/base/pipeline/ml-pipeline-viewer-crd-role.yaml

@@ -20,6 +20,7 @@ rules:
   - kubeflow.org
   resources:
   - viewers
+  - viewers/finalizers
   verbs:
   - create
   - get

apps/kfp-tekton/upstream/env/gcp/cloudsql-proxy/cloudsql-proxy-deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       serviceAccountName: kubeflow-pipelines-cloudsql-proxy
       containers:
-        - image: gcr.io/cloudsql-docker/gce-proxy:1.14
+        - image: gcr.io/cloudsql-docker/gce-proxy:1.25.0
           name: cloudsqlproxy
           env:            
             - name: GCP_CLOUDSQL_INSTANCE_NAME
@@ -27,6 +27,7 @@ spec:
           command: ["/cloud_sql_proxy",
                     "-dir=/cloudsql",                    
                     "-instances=$(GCP_CLOUDSQL_INSTANCE_NAME)=tcp:0.0.0.0:3306",
+                    "-use_http_health_check",
                     "term_timeout=10s"]
           # set term_timeout if require graceful handling of shutdown
           # NOTE: proxy will stop accepting new connections; only wait on existing connections
@@ -36,6 +37,47 @@ spec:
                 # (optional) add a preStop hook so that termination is delayed
                 # this is required if your server still require new connections (e.g., connection pools)
                 command: ['sleep', '10']
+          # Liveness probe configuration is adviced by Cloud SQL Proxy examples:
+          # /~https://github.com/GoogleCloudPlatform/cloudsql-proxy/tree/main/examples/k8s-health-check
+          # For details, see https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
+          livenessProbe:
+            httpGet:
+              path: /liveness
+              port: 8090
+            # Number of seconds after the container has started before the first probe is scheduled. Defaults to 0.
+            # Not necessary when the startup probe is in use.
+            initialDelaySeconds: 0
+            # Frequency of the probe.
+            periodSeconds: 60
+            # Number of seconds after which the probe times out.
+            timeoutSeconds: 30
+            # Number of times the probe is allowed to fail before the transition
+            # from healthy to failure state.
+            #
+            # If periodSeconds = 60, 5 tries will result in five minutes of
+            # checks. The proxy starts to refresh a certificate five minutes
+            # before its expiration. If those five minutes lapse without a
+            # successful refresh, the liveness probe will fail and the pod will be
+            # restarted.
+            failureThreshold: 5
+          readinessProbe:
+            httpGet:
+              path: /readiness
+              port: 8090
+            initialDelaySeconds: 0
+            periodSeconds: 10
+            timeoutSeconds: 5
+            # Number of times the probe must report success to transition from failure to healthy state.
+            # Defaults to 1 for readiness probe.
+            successThreshold: 1
+            failureThreshold: 1
+          startupProbe:
+            httpGet:
+              path: /startup
+              port: 8090
+            periodSeconds: 1
+            timeoutSeconds: 5
+            failureThreshold: 20
           ports:
             - name: mysql
               containerPort: 3306

apps/kfp-tekton/upstream/env/gcp/inverse-proxy/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
   - name: gcr.io/ml-pipeline/inverse-proxy-agent
-    newTag: 1.7.0
+    newTag: 1.8.1
 resources:
   - proxy-configmap.yaml
   - proxy-deployment.yaml

apps/kfp-tekton/upstream/env/plain-multi-user/kustomization.yaml

@@ -10,6 +10,7 @@ bases:
   - ../../third-party/minio/base
   - ../../third-party/minio/options/istio
   - ../../third-party/metacontroller/base
+  - ../../third-party/kfp-csi-s3
 
 # Identifier for application manager to apply ownerReference.
 # The ownerReference ensures the resources get garbage collected

apps/kfp-tekton/upstream/env/platform-agnostic-multi-user-emissary/workflow-controller-configmap-patch.yaml

@@ -4,9 +4,9 @@ metadata:
   name: workflow-controller-configmap
 data:
   # References:
-  # * /~https://github.com/argoproj/argo-workflows/blob/v3.1.6/config/config.go
-  # * /~https://github.com/argoproj/argo-workflows/blob/v3.1.6/docs/workflow-controller-configmap.md
-  # * /~https://github.com/argoproj/argo-workflows/blob/v3.1.6/docs/workflow-controller-configmap.yaml
+  # * /~https://github.com/argoproj/argo-workflows/blob/v3.2.3/config/config.go
+  # * /~https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.md
+  # * /~https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.yaml
 
   # Emissary Executor: https://argoproj.github.io/argo-workflows/workflow-executors/#emissary-emissary
   containerRuntimeExecutor: emissary

apps/kfp-tekton/upstream/third-party/application/cluster-scoped/kustomization.yaml

@@ -2,3 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - application-crd.yaml
+
+# Update application CRD:
+# Copy the upstream file to application-crd.yaml of the current folder.
+# Upstream file: /~https://github.com/kubernetes-sigs/application/blob/master/config/crd/bases/app.k8s.io_applications.yaml
+# Keep label controller-tools.k8s.io.

apps/kfp-tekton/upstream/third-party/argo/.krmignore

@@ -0,0 +1 @@
+upstream

apps/kfp-tekton/upstream/third-party/argo/Kptfile

@@ -0,0 +1,6 @@
+apiVersion: kpt.dev/v1
+kind: Kptfile
+metadata:
+  name: argo
+info:
+  description: argo Kptfile in order to ignore upstream/ folder.

apps/kfp-tekton/upstream/third-party/argo/README.md

@@ -20,6 +20,10 @@ Refer to [third_party/argo/README.md](../../../../third_party/argo/README.md).
 
 ### Upgrade argo manifests
 
+Requirement:
+
+Use kpt version above 1.0.0-beta.6, refer to [kpt installation](https://kpt.dev/installation/) for downloading kpt.
+
 As one step of above, we need to upgrade argo manifests in this folder.
 
 1. Run:
@@ -29,5 +33,3 @@ As one step of above, we need to upgrade argo manifests in this folder.
     ```
 
     Note, argo version is pulled from [third_party/argo/VERSION](../../../../third_party/argo/VERSION). Edit the VERSION file first.
-
-2. Manually edit [YAML patches](upstream/manifests/namespace-install/overlays) to JSON patches, because YAML patches confuses kpt, refer to [#5368](/~https://github.com/kubeflow/pipelines/issues/5368).

apps/kfp-tekton/upstream/third-party/argo/base/workflow-controller-configmap-patch.yaml

@@ -4,12 +4,12 @@ metadata:
   name: workflow-controller-configmap
 data:
   # References:
-  # * /~https://github.com/argoproj/argo-workflows/blob/v3.1.6/config/config.go
-  # * /~https://github.com/argoproj/argo-workflows/blob/v3.1.6/docs/workflow-controller-configmap.md
-  # * /~https://github.com/argoproj/argo-workflows/blob/v3.1.6/docs/workflow-controller-configmap.yaml
+  # * /~https://github.com/argoproj/argo-workflows/blob/v3.2.3/config/config.go
+  # * /~https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.md
+  # * /~https://github.com/argoproj/argo-workflows/blob/v3.2.3/docs/workflow-controller-configmap.yaml
 
   # emissary executor is a more portable default, see /~https://github.com/kubeflow/pipelines/issues/1654.
-  containerRuntimeExecutor: docker
+  containerRuntimeExecutor: emissary
 
   # In artifactRepository.s3.endpoint, $(kfp-namespace) is needed, because in multi-user mode, pipelines may run in other namespaces.
   artifactRepository: |

apps/kfp-tekton/upstream/third-party/argo/base/workflow-controller-deployment-patch.yaml

@@ -7,12 +7,12 @@ spec:
     spec:
       containers:
         - name: workflow-controller
-          image: gcr.io/ml-pipeline/workflow-controller:v3.1.6-patch-license-compliance
+          image: gcr.io/ml-pipeline/workflow-controller:v3.2.3-license-compliance
           args:
             - --configmap
             - workflow-controller-configmap
             - --executor-image
-            - gcr.io/ml-pipeline/argoexec:v3.1.6-patch-license-compliance
+            - gcr.io/ml-pipeline/argoexec:v3.2.3-license-compliance
           resources:
             requests:
               cpu: 100m

apps/kfp-tekton/upstream/third-party/argo/upstream/manifests/Kptfile

@@ -1,11 +1,18 @@
-apiVersion: kpt.dev/v1alpha1
+apiVersion: kpt.dev/v1
 kind: Kptfile
 metadata:
   name: manifests
 upstream:
   type: git
   git:
-    commit: a245fe67db56d2808fb78c6079d08404cbee91aa
     repo: /~https://github.com/argoproj/argo-workflows
     directory: /manifests
-    ref: v3.1.1
+    ref: v3.2.3
+  updateStrategy: resource-merge
+upstreamLock:
+  type: git
+  git:
+    repo: /~https://github.com/argoproj/argo-workflows
+    directory: /manifests
+    ref: v3.2.3
+    commit: e5dc961b7846efe0fe36ab3a0964180eaedd2672