[kubeflow 1.8] Update kubeflow/katib manifests from v0.16.0-rc.1

.github/workflows/katib_kind_test.yaml

@@ -56,3 +56,21 @@ jobs:
 
         echo "Waiting for the Experiment to become Succeeded..."
         kubectl wait --for=condition=Succeeded experiments.kubeflow.org -n kubeflow-user --all --timeout 300s
+
+    - name: Save relevant debug artifacts
+      if: failure()
+      run: |
+        mkdir ~/katib-debug-logs
+        bash -c "df -h | tee ~/katib-debug-logs/df.log"
+        bash -c "free -h | tee ~/katib-debug-logs/free.log"
+        kubectl describe deployments -A | tee ~/katib-debug-logs/deployments.log
+        kubectl describe nodes | tee ~/katib-debug-logs/nodes.log
+        kubectl describe pods -A | tee ~/katib-debug-logs/describe-pods.log
+        kubectl get pods -A | tee ~/katib-debug-logs/get-pods.log
+
+    - name: Upload debug artifacts
+      if: failure()
+      uses: actions/upload-artifact@v3
+      with:
+        name: katib-debug-logs
+        path: ~/katib-debug-logs

README.md

@@ -53,7 +53,7 @@ This repo periodically syncs all official Kubeflow components from their respect
 | Jupyter Web App | apps/jupyter/jupyter-web-app/upstream | [v1.7.0-rc.0](https://github.com/kubeflow/kubeflow/tree/v1.7.0-rc.0/components/crud-web-apps/jupyter/manifests) |
 | Tensorboards Web App | apps/tensorboard/tensorboards-web-app/upstream | [v1.7.0-rc.0](https://github.com/kubeflow/kubeflow/tree/v1.7.0-rc.0/components/crud-web-apps/tensorboards/manifests) |
 | Volumes Web App | apps/volumes-web-app/upstream | [v1.7.0-rc.0](https://github.com/kubeflow/kubeflow/tree/v1.7.0-rc.0/components/crud-web-apps/volumes/manifests) |
-| Katib | apps/katib/upstream | [v0.15.0-rc.0](https://github.com/kubeflow/katib/tree/v0.15.0-rc.0/manifests/v1beta1) |
+| Katib | apps/katib/upstream | [v0.16.0-rc.1](https://github.com/kubeflow/katib/tree/v0.16.0-rc.1/manifests/v1beta1) |
 | KServe | contrib/kserve/kserve | [v0.10.0](https://github.com/kserve/kserve/tree/v0.10.0/install/v0.10.0) |
 | KServe Models Web App | contrib/kserve/models-web-app | [v0.10.0](https://github.com/kserve/models-web-app/tree/v0.10.0/config) |
 | Kubeflow Pipelines | apps/pipeline/upstream | [2.0.0-alpha.7](https://github.com/kubeflow/pipelines/tree/2.0.0-alpha.7/manifests/kustomize) |

apps/katib/upstream/components/controller/controller.yaml

@@ -15,6 +15,7 @@ spec:
     metadata:
       labels:
         katib.kubeflow.org/component: controller
+        katib.kubeflow.org/metrics-collector-injection: disabled
       annotations:
         prometheus.io/scrape: "true"
         prometheus.io/port: "8080"
@@ -26,13 +27,7 @@ spec:
           image: docker.io/kubeflowkatib/katib-controller
           command: ["./katib-controller"]
           args:
-            - "--webhook-port=8443"
-            - "--trial-resources=Job.v1.batch"
-            - "--trial-resources=TFJob.v1.kubeflow.org"
-            - "--trial-resources=PyTorchJob.v1.kubeflow.org"
-            - "--trial-resources=MPIJob.v1.kubeflow.org"
-            - "--trial-resources=XGBoostJob.v1.kubeflow.org"
-            - "--trial-resources=MXJob.v1.kubeflow.org"
+            - --katib-config=/katib-config.yaml
           ports:
             - containerPort: 8443
               name: webhook
@@ -60,8 +55,15 @@ spec:
             - mountPath: /tmp/cert
               name: cert
               readOnly: true
+            - mountPath: /katib-config.yaml
+              name: katib-config
+              subPath: katib-config.yaml
+              readOnly: true
       volumes:
         - name: cert
           secret:
             defaultMode: 420
             secretName: katib-webhook-cert
+        - name: katib-config
+          configMap:
+            name: katib-config

apps/katib/upstream/components/controller/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 
 resources:
   - controller.yaml
-  - katib-config.yaml
   - rbac.yaml
   - service.yaml
   - trial-templates.yaml

apps/katib/upstream/components/controller/rbac.yaml

@@ -49,6 +49,15 @@ rules:
       - pods/status
     verbs:
       - "get"
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - "get"
+      - "list"
+      - "watch"
+      - "patch"
   - apiGroups:
       - apps
     resources:
@@ -108,6 +117,16 @@ rules:
       - suggestions/finalizers
     verbs:
       - "*"
+  - apiGroups:
+      - admissionregistration.k8s.io
+    resources:
+      - validatingwebhookconfigurations
+      - mutatingwebhookconfigurations
+    verbs:
+      - "get"
+      - "watch"
+      - "list"
+      - "patch"
 ---
 apiVersion: v1
 kind: ServiceAccount

apps/katib/upstream/components/controller/trial-templates.yaml

@@ -15,7 +15,7 @@ data:
         spec:
           containers:
             - name: training-container
-              image: docker.io/kubeflowkatib/mxnet-mnist:v0.15.0-rc.0
+              image: docker.io/kubeflowkatib/mxnet-mnist:v0.16.0-rc.1
               command:
                 - "python3"
                 - "/opt/mxnet-mnist/mnist.py"
@@ -33,7 +33,7 @@ data:
         spec:
           containers:
             - name: training-container
-              image: docker.io/kubeflowkatib/enas-cnn-cifar10-cpu:v0.15.0-rc.0
+              image: docker.io/kubeflowkatib/enas-cnn-cifar10-cpu:v0.16.0-rc.1
               command:
                 - python3
                 - -u
@@ -54,7 +54,7 @@ data:
             spec:
               containers:
                 - name: pytorch
-                  image: docker.io/kubeflowkatib/pytorch-mnist-cpu:v0.15.0-rc.0
+                  image: docker.io/kubeflowkatib/pytorch-mnist-cpu:v0.16.0-rc.1
                   command:
                     - "python3"
                     - "/opt/pytorch-mnist/mnist.py"
@@ -68,7 +68,7 @@ data:
             spec:
               containers:
                 - name: pytorch
-                  image: docker.io/kubeflowkatib/pytorch-mnist-cpu:v0.15.0-rc.0
+                  image: docker.io/kubeflowkatib/pytorch-mnist-cpu:v0.16.0-rc.1
                   command:
                     - "python3"
                     - "/opt/pytorch-mnist/mnist.py"

apps/katib/upstream/components/db-manager/db-manager.yaml

@@ -35,8 +35,8 @@ spec:
             - name: api
               containerPort: 6789
           livenessProbe:
-            exec:
-              command: ["/bin/grpc_health_probe", "-addr=:6789"]
+            grpc:
+              port: 6789
             initialDelaySeconds: 10
             periodSeconds: 60
             failureThreshold: 5

apps/katib/upstream/components/webhook/webhooks.yaml

@@ -6,7 +6,6 @@ metadata:
 webhooks:
   - name: validator.experiment.katib.kubeflow.org
     sideEffects: None
-    failurePolicy: Ignore
     admissionReviewVersions:
       - v1
     clientConfig:
@@ -33,7 +32,6 @@ metadata:
 webhooks:
   - name: defaulter.experiment.katib.kubeflow.org
     sideEffects: None
-    failurePolicy: Ignore
     admissionReviewVersions:
       - v1
     clientConfig:
@@ -54,7 +52,6 @@ webhooks:
           - experiments
   - name: mutator.pod.katib.kubeflow.org
     sideEffects: None
-    failurePolicy: Ignore
     admissionReviewVersions:
       - v1
     clientConfig:
@@ -66,6 +63,16 @@ webhooks:
     namespaceSelector:
       matchLabels:
         katib.kubeflow.org/metrics-collector-injection: enabled
+    # Once the AdmissionWebhookMatchConditions feature gate is enabled by default, we should switch to control based on userInfo.
+    # REF:
+    # - AdmissionWebhookMatchConditions: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchconditions
+    # - Tracking issue: https://github.com/kubeflow/katib/issues/2206
+    objectSelector:
+      matchExpressions:
+        - key: katib.kubeflow.org/metrics-collector-injection
+          operator: NotIn
+          values:
+            - disabled
     rules:
       - apiGroups:
           - ""