helm: add Kubeflow foundation charts by danish9039 · Pull Request #3468 · kubeflow/community-distribution

danish9039 · 2026-05-17T22:37:36Z

Summary

Adds the first two Project 5 foundation Helm charts under experimental/helm/charts:

kubeflow-namespaces
kubeflow-platform

kubeflow-namespaces owns the bootstrap namespace layer for the platform install. It renders the Kubeflow namespaces, platform dependency namespaces, and namespace-scoped NetworkPolicies that currently come from common/kubeflow-namespace/base plus the dependency namespace baselines.

kubeflow-platform owns the shared Kubeflow platform RBAC from common/kubeflow-roles/base.

Scope

Add experimental/helm/charts/kubeflow-namespaces.
Add experimental/helm/charts/kubeflow-platform.
Add Helm/Kustomize comparison scenarios for both charts.
Add a namespace-union comparison scenario for the platform namespaces used by the first wrapper charts.

Namespace behavior

kubeflow-namespaces is the bootstrap chart. Its Helm release is installed in default because it creates kubeflow-system.

Namespaces created by this chart are kept on helm uninstall, since later platform and component charts may create resources inside them.

If a namespace already exists, for example a company-managed cert-manager namespace, the chart skips adopting it and prints a note. Helm does not patch labels on unmanaged pre-existing namespaces, so missing labels must be applied separately.

Install shape

helm install kubeflow-namespaces ./experimental/helm/charts/kubeflow-namespaces --namespace default
helm install kubeflow-platform ./experimental/helm/charts/kubeflow-platform --namespace kubeflow-system

Validation

helm lint experimental/helm/charts/kubeflow-namespaces
helm lint experimental/helm/charts/kubeflow-platform
./tests/helm_kustomize_compare.sh kubeflow-namespaces base
./tests/helm_kustomize_compare.sh kubeflow-namespaces platform-namespaces
./tests/helm_kustomize_compare.sh kubeflow-platform base
./tests/helm_kustomize_compare_all.sh kubeflow-namespaces
./tests/helm_kustomize_compare_all.sh kubeflow-platform

Also validated the namespace lifecycle in kind for:

fresh install and upgrade
pre-existing unmanaged cert-manager namespace
retained namespaces after Helm ownership checks

github-actions · 2026-05-17T22:37:43Z

Welcome to the Kubeflow Manifests Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronizes from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/manifests to test the platform integration.

Community Resources:

CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

juliusvonkohout · 2026-05-25T18:12:07Z

+# Default values for kubeflow-namespaces.
+
+global:
+  # -- Primary Kubeflow namespace.


what is the purpose of such comments?

Removed the redundant values comments in values.yaml.

juliusvonkohout · 2026-05-25T18:12:20Z

+  systemNamespace: kubeflow-system
+
+networkPolicies:
+  # -- Keep namespace NetworkPolicies aligned with common/kubeflow-namespace/base.


what is the purpose of such comments ?

Removed the redundant values comments in values.yaml.

danish9039 · 2026-06-01T14:52:51Z

Chart type	Example chart	Release namespace	Workload namespace	Reason
Bootstrap foundation	kubeflow-namespaces	default or maintainer-chosen bootstrap namespace	creates kubeflow, kubeflow-system	kubeflow-system does not exist yet
Platform foundation	kubeflow-platform	kubeflow-system after namespace chart	mostly cluster-scoped	platform-owned shared policy
External wrapper	cert-manager	cert-manager	cert-manager, kube-system	mentor direction: release metadata stays with main workload namespace
External wrapper	istio	istio-system	istio-system, kube-system, kubeflow	release metadata stays with Istio workload namespace
External wrapper	oauth2-proxy	oauth2-proxy	oauth2-proxy, istio-system	release metadata stays with auth proxy workload namespace
External wrapper	dex	auth	auth	release metadata stays with Dex workload namespace
External wrapper	knative-serving	knative-serving	knative-serving, istio-system	release metadata stays with Knative workload namespace
Component chart	kubeflow-pipelines	kubeflow	kubeflow	component runs in Kubeflow namespace
Component chart	kubeflow-katib	kubeflow	kubeflow	component runs in Kubeflow namespace
Component chart	kubeflow-dashboard	kubeflow	kubeflow	component runs in Kubeflow namespace
Component chart	kubeflow-notebooks	kubeflow	kubeflow	component runs in Kubeflow namespace
Component chart	kserve	kubeflow	kubeflow	current Kubeflow KServe path uses kubeflow
Component chart	kubeflow-trainer	kubeflow-system	kubeflow-system	current trainer overlay runs in kubeflow-system
Optional component	workspaces	kubeflow-system or kubeflow-workspaces	kubeflow-workspaces	decide when Workspaces scope is active

dhanishaphadate · 2026-06-07T21:56:01Z

I am assuming you have captured all the netpol from https://github.com/kubeflow/manifests/tree/master/common/kubeflow-namespace/base/kubeflow kustomize

Yes, these NetworkPolicies are copied from common/kubeflow-namespace/base/kubeflow and covered by the Helm/Kustomize comparison.

dhanishaphadate · 2026-06-07T22:04:20Z

+- `Namespace/auth`
+- namespace-scoped NetworkPolicies required by the platform baseline
+
+If one of these namespaces already exists, for example a company-managed `cert-manager` namespace, the chart does not recreate or adopt it. Helm does not patch labels on unmanaged pre-existing resources; apply the required labels to that namespace separately if they are missing.


Should we also mention in the README that namespaces created by kubeflow-namespaces chart are not deleted when the chart is uninstalled via Helm?

helm uninstall kubeflow-namespaces
This would help clarify the expected behavior for users and prevent accidental assumptions about namespace cleanup during uninstallation.

Added this to the README; namespaces created by this bootstrap chart are kept on helm uninstall.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow · 2026-06-07T23:30:28Z

@dhanishaphadate: changing LGTM is restricted to collaborators

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copilot

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 2 comments.

+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: metatada-envoy


+        declare -A KUSTOMIZE_PATHS=(
+            ["base"]="$MANIFESTS_DIR/base"
+            ["platform-namespaces"]="$ROOT_DIR/common/kubeflow-namespace/base"$'\n'"$ROOT_DIR/common/cert-manager/base"$'\n'"$ROOT_DIR/common/istio/istio-namespace/base"$'\n'"$ROOT_DIR/common/oauth2-proxy/base"$'\n'"$ROOT_DIR/common/dex/base"
+        )


dhanishaphadate

LGTM

google-oss-prow · 2026-06-07T23:54:50Z

@dhanishaphadate: changing LGTM is restricted to collaborators

Details

In response to this:

LGTM

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

google-oss-prow · 2026-06-27T08:21:21Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign juliusvonkohout for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Copilot AI review requested due to automatic review settings May 17, 2026 22:37

google-oss-prow Bot added the do-not-merge/work-in-progress label May 17, 2026

google-oss-prow Bot requested review from juliusvonkohout and kimwnasptd May 17, 2026 22:37

google-oss-prow Bot added the size/XXL label May 17, 2026

Copilot started reviewing on behalf of danish9039 May 17, 2026 22:38 View session

Copilot AI reviewed May 17, 2026

danish9039 mentioned this pull request May 18, 2026

helm: add cert-manager wrapper chart #3470

Open

danish9039 force-pushed the gsoc/platform-foundation-charts branch 2 times, most recently from d0658e5 to 58e2aa5 Compare May 19, 2026 19:37

This was referenced May 25, 2026

helm: add Istio wrapper chart #3478

Open

helm: add oauth2-proxy wrapper chart #3479

Open

helm: add Dex wrapper chart #3480

Open

danish9039 force-pushed the gsoc/platform-foundation-charts branch from 58e2aa5 to 518a7c4 Compare May 25, 2026 16:00

juliusvonkohout reviewed May 25, 2026

View reviewed changes

danish9039 force-pushed the gsoc/platform-foundation-charts branch 2 times, most recently from 45a0c78 to b7f645f Compare May 30, 2026 21:21

danish9039 marked this pull request as ready for review June 1, 2026 13:34

google-oss-prow Bot removed the do-not-merge/work-in-progress label Jun 1, 2026

google-oss-prow Bot requested review from juliusvonkohout and tarekabouzeid June 1, 2026 13:35

dhanishaphadate reviewed Jun 7, 2026

View reviewed changes

danish9039 added 4 commits June 8, 2026 04:36

helm: add kubeflow foundation charts

8c012d0

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: rerun foundation ci

99db5eb

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: align model catalog network policy

a3f9976

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: remove redundant foundation values comments

b03056e

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 added 2 commits June 8, 2026 04:36

helm: centralize platform namespace ownership

7e6c003

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: document foundation namespace retention

d9d83c1

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 force-pushed the gsoc/platform-foundation-charts branch from 7aec9b1 to d9d83c1 Compare June 7, 2026 23:18

dhanishaphadate suggested changes Jun 7, 2026

View reviewed changes

danish9039 requested a review from Copilot June 7, 2026 23:42

Copilot AI reviewed Jun 7, 2026

View reviewed changes

dhanishaphadate approved these changes Jun 7, 2026

View reviewed changes

danish9039 added 3 commits June 9, 2026 15:40

helm: fix kubeflow namespace names

37363ec

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: document namespace lookup behavior

f7cabfd

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

test: clean foundation helm comparison style

d60e915

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

danish9039 added 3 commits June 27, 2026 14:00

chore: keep local ignores out of gitignore

776ab5a

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: align hub image tags with kustomize

27f2493

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

helm: inherit hub component image tags

782a54c

Signed-off-by: danish9039 <danishsiddiqui040@gmail.com>

Uh oh!

Conversation

danish9039 commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope

Namespace behavior

Install shape

Validation

Uh oh!

github-actions Bot commented May 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danish9039 commented Jun 1, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

google-oss-prow Bot commented Jun 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

dhanishaphadate left a comment

Choose a reason for hiding this comment

Uh oh!

google-oss-prow Bot commented Jun 7, 2026

Uh oh!

google-oss-prow Bot commented Jun 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

danish9039 commented May 17, 2026 •

edited

Loading