test(kfp): upgrade to 1.7.1 (kubeflow#968)

* test(kfp): upgrade to 1.7.1

* make hydrate-kfp-manifests

test-infra/kfp/Makefile

@@ -16,7 +16,7 @@ KFP_STANDALONE_1_DIR=$(ACM_REPOS)/kfp-standalone-1
 
 # Please edit the following version before running:
 # make kfp-update
-PIPELINES_VERSION=1.7.0
+PIPELINES_VERSION=1.7.1
 PIPELINES_SRC_REPO=https://github.com/kubeflow/pipelines.git
 
 all: hydrate hydrate-kfp-manifests vet-kfp-manifests

test-infra/kfp/README.md

@@ -10,4 +10,12 @@
     make kfp-update
     ```
 
+1. Run:
+
+    ```bash
+    make hydrate-kfp-manifests
+    ```
+
+    It generates raw k8s resources in acm-repos folder which is source of truth for the cluster via gitops.
+
 1. Commit the changes and send a PR.

test-infra/kfp/kfp-standalone-1/kustomize/upstream/Kptfile

@@ -1,11 +1,18 @@
-apiVersion: kpt.dev/v1alpha1
+apiVersion: kpt.dev/v1
 kind: Kptfile
 metadata:
   name: upstream
 upstream:
   type: git
   git:
-    commit: 6ccf5bcd0b9db955c91caab85fa130714527f414
     repo: https://github.com/kubeflow/pipelines
     directory: /manifests/kustomize
-    ref: 1.7.0
+    ref: 1.7.1
+  updateStrategy: resource-merge
+upstreamLock:
+  type: git
+  git:
+    repo: https://github.com/kubeflow/pipelines
+    directory: /manifests/kustomize
+    ref: 1.7.1
+    commit: d8e2f0d557c1cf233730ba8ee69d9aed8e0c6e19

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/application/application.yaml

@@ -2,7 +2,7 @@
 
 apiVersion: app.k8s.io/v1beta1
 kind: Application
-metadata:
+metadata: # kpt-merge: /$(kfp-app-name)
   name: $(kfp-app-name)
   annotations:
     kubernetes-engine.cloud.google.com/icon: >-
@@ -28,7 +28,6 @@ spec:
         url: https://www.kubeflow.org/docs/pipelines/
     notes: |-
       Please go to [Hosted Kubeflow Pipelines Console](https://console.cloud.google.com/ai-platform/pipelines/clusters).
-
   info:
     - name: Console
       value: 'https://console.cloud.google.com/ai-platform/pipelines/clusters'

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/cache-deployer-deployment.yaml

@@ -1,6 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
-metadata:
+metadata: # kpt-merge: /cache-deployer-deployment
   name: cache-deployer-deployment
   labels:
     app: cache-deployer

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/cache-deployer-role.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-deployer-role
   labels:
     app: kubeflow-pipelines-cache-deployer-role
   name: kubeflow-pipelines-cache-deployer-role

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/cache-deployer-rolebinding.yaml

@@ -1,11 +1,11 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-deployer-rolebinding
   name: kubeflow-pipelines-cache-deployer-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: kubeflow-pipelines-cache-deployer-role
 subjects:
 - kind: ServiceAccount
-  name: kubeflow-pipelines-cache-deployer-sa
+  name: kubeflow-pipelines-cache-deployer-sa

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/cluster-scoped/cache-deployer-clusterrole.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-deployer-clusterrole
   labels:
     app: kubeflow-pipelines-cache-deployer-clusterrole
   name: kubeflow-pipelines-cache-deployer-clusterrole
@@ -32,4 +32,4 @@ rules:
   resourceNames:
   - kubernetes.io/*
   verbs:
-  - approve  
+  - approve

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/cluster-scoped/cache-deployer-clusterrolebinding.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-deployer-clusterrolebinding
   name: kubeflow-pipelines-cache-deployer-clusterrolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/cluster-scoped/cache-deployer-sa.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: ServiceAccount
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-deployer-sa
   name: kubeflow-pipelines-cache-deployer-sa

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/cluster-scoped/kustomization.yaml

@@ -1,11 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-
 resources:
   - cache-deployer-clusterrole.yaml
   - cache-deployer-clusterrolebinding.yaml
   # HACK: although a service account(SA) is not a cluster-scoped resource.
   # Presence of a SA referred by a clusterrolebinding allows kustomize to auto-add
   # namespace for the clusterrolebinding's SA ref.
   - cache-deployer-sa.yaml
-

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache-deployer/kustomization.yaml

@@ -8,4 +8,4 @@ commonLabels:
   app: cache-deployer
 images:
   - name: gcr.io/ml-pipeline/cache-deployer
-    newTag: 1.7.0
+    newTag: 1.7.1

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache/cache-deployment.yaml

@@ -1,6 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
-metadata:
+metadata: # kpt-merge: /cache-server
   name: cache-server
   labels:
     app: cache-server
@@ -18,55 +18,48 @@ spec:
       - name: server
         image: gcr.io/ml-pipeline/cache-server:dummy
         env:
-          - name: CACHE_IMAGE
-            valueFrom:
-              configMapKeyRef:
-                name: pipeline-install-config
-                key: cacheImage
-          - name: CACHE_NODE_RESTRICTIONS
-            valueFrom:
-              configMapKeyRef:
-                name: pipeline-install-config
-                key: cacheNodeRestrictions
-          - name: DBCONFIG_DRIVER
-            value: mysql
-          - name: DBCONFIG_DB_NAME
-            valueFrom:
-              configMapKeyRef:
-                name: pipeline-install-config
-                key: cacheDb
-          - name: DBCONFIG_HOST_NAME
-            valueFrom:
-              configMapKeyRef:
-                name: pipeline-install-config
-                key: dbHost
-          - name: DBCONFIG_PORT
-            valueFrom:
-              configMapKeyRef:
-                name: pipeline-install-config
-                key: dbPort
-          - name: DBCONFIG_USER
-            valueFrom:
-              secretKeyRef:
-                name: mysql-secret
-                key: username
-          - name: DBCONFIG_PASSWORD
-            valueFrom:
-              secretKeyRef:
-                name: mysql-secret
-                key: password
-          - name: NAMESPACE_TO_WATCH
-            valueFrom:
-              fieldRef:
-                fieldPath: metadata.namespace
-        args: ["--db_driver=$(DBCONFIG_DRIVER)",
-               "--db_host=$(DBCONFIG_HOST_NAME)",
-               "--db_port=$(DBCONFIG_PORT)",
-               "--db_name=$(DBCONFIG_DB_NAME)",
-               "--db_user=$(DBCONFIG_USER)",
-               "--db_password=$(DBCONFIG_PASSWORD)",
-               "--namespace_to_watch=$(NAMESPACE_TO_WATCH)",
-              ]
+        - name: CACHE_IMAGE
+          valueFrom:
+            configMapKeyRef:
+              name: pipeline-install-config
+              key: cacheImage
+        - name: CACHE_NODE_RESTRICTIONS
+          valueFrom:
+            configMapKeyRef:
+              name: pipeline-install-config
+              key: cacheNodeRestrictions
+        - name: DBCONFIG_DRIVER
+          value: mysql
+        - name: DBCONFIG_DB_NAME
+          valueFrom:
+            configMapKeyRef:
+              name: pipeline-install-config
+              key: cacheDb
+        - name: DBCONFIG_HOST_NAME
+          valueFrom:
+            configMapKeyRef:
+              name: pipeline-install-config
+              key: dbHost
+        - name: DBCONFIG_PORT
+          valueFrom:
+            configMapKeyRef:
+              name: pipeline-install-config
+              key: dbPort
+        - name: DBCONFIG_USER
+          valueFrom:
+            secretKeyRef:
+              name: mysql-secret
+              key: username
+        - name: DBCONFIG_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: mysql-secret
+              key: password
+        - name: NAMESPACE_TO_WATCH
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        args: ["--db_driver=$(DBCONFIG_DRIVER)", "--db_host=$(DBCONFIG_HOST_NAME)", "--db_port=$(DBCONFIG_PORT)", "--db_name=$(DBCONFIG_DB_NAME)", "--db_user=$(DBCONFIG_USER)", "--db_password=$(DBCONFIG_PASSWORD)", "--namespace_to_watch=$(NAMESPACE_TO_WATCH)"]
         imagePullPolicy: Always
         ports:
         - containerPort: 8443

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache/cache-role.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-role
   labels:
     app: kubeflow-pipelines-cache-role
   name: kubeflow-pipelines-cache-role

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache/cache-rolebinding.yaml

@@ -1,11 +1,11 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-binding
   name: kubeflow-pipelines-cache-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: kubeflow-pipelines-cache-role
 subjects:
 - kind: ServiceAccount
-  name: kubeflow-pipelines-cache
+  name: kubeflow-pipelines-cache

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache/cache-sa.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: ServiceAccount
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache
   name: kubeflow-pipelines-cache

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache/cache-service.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: Service
-metadata:
+metadata: # kpt-merge: /cache-server
   name: cache-server
 spec:
   selector:
     app: cache-server
   ports:
     - port: 443
-      targetPort: webhook-api
+      targetPort: webhook-api

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/cache/kustomization.yaml

@@ -10,4 +10,4 @@ commonLabels:
   app: cache-server
 images:
   - name: gcr.io/ml-pipeline/cache-server
-    newTag: 1.7.0
+    newTag: 1.7.1

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/generic/mysql-secret.yaml

@@ -1,6 +1,6 @@
 kind: Secret
 apiVersion: v1
-metadata:
+metadata: # kpt-merge: /mysql-secret
   name: mysql-secret
 stringData:
   username: root

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/generic/pipeline-install-config.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 kind: ConfigMap
-metadata:
+metadata: # kpt-merge: /pipeline-install-config
   name: pipeline-install-config
 data:
   warning: |
@@ -11,7 +11,7 @@ data:
     until the changes take effect. A quick way to restart all deployments in a
     namespace: `kubectl rollout restart deployment -n <your-namespace>`.
   appName: pipeline
-  appVersion: 1.7.0
+  appVersion: 1.7.1
   dbHost: mysql
   dbPort: "3306"
   mlmdDb: metadb
@@ -68,7 +68,10 @@ data:
   ## any node and avoid defaulting to specific nodes. Allowed values are:
   ## 'false' and 'true'.
   cacheNodeRestrictions: "false"
-  ## ConMaxLifeTimeSec will set the connection max lifetime for MySQL
+  ## ConMaxLifeTime will set the connection max lifetime for MySQL
   ## this is very important to setup when using external databases.
   ## See this issue for more details: https://github.com/kubeflow/pipelines/issues/5329
-  ConMaxLifeTimeSec: "120"
+  ## Note: this value should be a string that can be parsed by `time.ParseDuration`.
+  ## If this value doesn't include a unit abbreviation, the units will be assumed
+  ## to be nanoseconds.
+  ConMaxLifeTime: "120s"

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/multi-user/api-service/cluster-role-binding.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding
-metadata:
+metadata: # kpt-merge: /ml-pipeline
   name: ml-pipeline
 roleRef:
   apiGroup: rbac.authorization.k8s.io

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/multi-user/api-service/cluster-role.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
-metadata:
+metadata: # kpt-merge: /ml-pipeline
   name: ml-pipeline
 rules:
 - apiGroups:

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/multi-user/api-service/deployment-patch.yaml

@@ -1,6 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
-metadata:
+metadata: # kpt-merge: /ml-pipeline
   name: ml-pipeline
 spec:
   template:

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/multi-user/api-service/kustomization.yaml

@@ -5,5 +5,5 @@ resources:
 - cluster-role.yaml
 configMapGenerator:
 - name: pipeline-api-server-config
-  envs: 
+  envs:
   - params.env

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/multi-user/cache/cluster-role-binding.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-binding
   name: kubeflow-pipelines-cache-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/multi-user/cache/cluster-role.yaml

@@ -1,6 +1,6 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
-metadata:
+metadata: # kpt-merge: /kubeflow-pipelines-cache-role
   name: kubeflow-pipelines-cache-role
 rules:
 - apiGroups:

test-infra/kfp/kfp-standalone-1/kustomize/upstream/base/installs/multi-user/cache/deployment-patch.yaml

@@ -1,13 +1,13 @@
 apiVersion: apps/v1
 kind: Deployment
-metadata:
+metadata: # kpt-merge: /cache-server
   name: cache-server
 spec:
   template:
     spec:
       containers:
       - name: server
         env:
-          - name: NAMESPACE_TO_WATCH
-            value: ''
-            valueFrom: null
+        - name: NAMESPACE_TO_WATCH
+          value: ''
+          valueFrom: null