feat: Add CI pipeline to validate manifests and helm chart by juyterman1000 · Pull Request #3101 · kubeflow/trainer

juyterman1000 · 2026-01-18T05:46:59Z

Added a new GitHub Actions workflow to automatically validate Kubernetes manifests and Helm charts using kube-linter. This ensures that all changes to the deployment configurations adhere to best practices for production readiness and security.

Scans manifests/base directory.
Scans charts directory.
Excludes manifests/overlays to avoid false positives on unpatched.

github-actions · 2026-01-18T05:47:07Z

🎉 Welcome to the Kubeflow Trainer! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
Our team will review your PR soon! cc @kubeflow/kubeflow-trainer-team

Join the community:

Slack: Join our #kubeflow-trainer Slack channel.
Meetings: Attend the Kubeflow AutoML and Training Working Group bi-weekly meetings.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

google-oss-prow · 2026-01-18T05:47:17Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign electronic-waste for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

juyterman1000 · 2026-01-18T05:52:11Z

Hi @jinchihe/ @kuizhiqing,
Please review and approve.
Thanks!

coveralls · 2026-01-19T17:54:25Z

Pull Request Test Coverage Report for Build 21117199641

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

For more information on this, see Tracking coverage changes with pull request builds.
To avoid this issue with future PRs, see these Recommended CI Configurations.
For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 51.264%

Totals
Change from base Build 21036734925:	0.0%
Covered Lines:	1237
Relevant Lines:	2413

💛 - Coveralls

robert-bell · 2026-01-21T09:46:05Z

Hi @juyterman1000, thanks for creating this PR.

I think there's a few extra details that need working out to make sure this extra check is going to be robust - I don't suppose you have bandwidth to look into them?

We need a way of running the linter locally so we can debug any failing checks. We could maybe update the Makefile with an extra target (or update an existing target) to run the linter, and a target to download the linter to the local bin directory. We can follow the existing pattern we use for golangci-lint. Alternatively, we migth be able to add the check to the pre-commit hooks. Afaik kube-linter doesn't publish a hook, but we could make a local hook that runs a script to download the tool if needed and run it. Could you look into one of those app
Can you check which files/kustomizations we should pass to the linter? At the minute you're linting the base/manager manifests but does it make sense to lint any of the overlays too/instead? Does this help remove any of the linting errors (e.g. missing service account)? For the helm chart, does it run using the default values? Does that check enough of the manifests or do we need to specify some custom values to enable bits that aren't enabled by default? Do the kube-linter docs have any guidance for us?
Are the checks you're excluding the ones that are currently failing? As I mentioned in Add CI pipeline to validate manifests and helm chart with kube-linter #3096 some of these probably ought to be fixed rather than ignored (e.g. no-read-only-root-fs), and the liveness and readiness port checks should be fixed by refactor(manifests): use named container ports for better maintainability #3061. Could you check if any of the failing checks can be fixed and if it makes sense to fix them?

Goku2099 · 2026-01-22T09:00:06Z

Hi @robert-bell.
I’ve opened PR #3119 to fix the no-read-only-root-fs kube-linter finding by enabling a read-only root filesystem for the trainer manager container. Together with PR #3100 (named container ports for liveness/readiness probes), this reduces the kube-linter findings from 8 to 4 when checked locally.
The remaining findings relate to image tagging policy, cross-file service account resolution, and resource requests/limits, which I’ve left for discussion rather than guessing values.

Happy to adjust based on your preference.

juyterman1000 · 2026-01-23T04:56:11Z

Hi @robert-bell, I've addressed your first point by adding Makefile targets for local kube-linter:

make kube-linter - downloads the binary to bin/
- make lint-manifests - runs linter on manifests/base and charts/kubeflow-trainer
  For points 2 and 3, @Goku2099 has opened PRs chore: use named ports for manager deployment and service #3100 (named ports) and fix: enable read-only root filesystem for trainer manager #3119 (readOnlyRootFilesystem) which reduce the kube-linter findings from 8 to 5. The remaining exclusions are for cpu/memory requirements, anti-affinity, service account resolution (kustomize false positive), and image tagging - which can be discussed separately.

…linter (Fixes kubeflow#3096) Signed-off-by: juyterman1000 <fastrunner10090@gmail.com>

Signed-off-by: juyterman1000 <fastrunner10090@gmail.com>

Adds "make kube-linter" to download the binary and "make lint-manifests" to run kube-linter on manifests and helm charts locally. Signed-off-by: juyterman1000 <fastrunner10090@gmail.com>

juyterman1000 · 2026-01-25T00:41:54Z

Hi @andreyvelich
This has been open for quite some time. When you get a chance, could you please take a look?

andreyvelich · 2026-02-02T20:52:46Z

.github/workflows/kube-linter.yaml

@@ -0,0 +1,24 @@
+name: KubeLinter


@juyterman1000 @robert-bell Did we change the scope of this PR?
I thought we plan to run make helm-lint and helm-unittest as part of this PR?

Just to clarify, I’ve added the helm lint and helm unit test checks in a separate PR (#3166) to keep the scope focused.
Happy to combine or adjust if that’s preferred.

Sure, thanks for doing this!

andreyvelich

Thanks @juyterman1000!

andreyvelich · 2026-02-05T20:03:21Z

.github/workflows/kube-linter.yaml

@@ -0,0 +1,24 @@
+name: KubeLinter


Let's rename this action to something like:

Suggested change

name: KubeLinter

name: Code Quality Checks

I would love all our Lints & Static checks go to this action eventually (Helm, KubeLinter, Go, Py, etc.), that will allow trigger unit tests even if lint fails.
Does it sound good @kubeflow/kubeflow-trainer-team @Goku2099 ?

Yes, that sounds good to me.
I agree with grouping kube-linter, helm lint, and helm unit tests under a single “Code Quality Checks” workflow going forward.
For now I kept helm checks in a separate PR to keep scope small, but I’m happy to follow this structure and align my PR accordingly.

Sure, let's make changes in the followup PRs!

andreyvelich · 2026-02-05T20:05:22Z

.github/workflows/kube-linter.yaml

Rename this file to: code-quality-check.yaml

andreyvelich · 2026-02-05T20:05:54Z

.github/workflows/kube-linter.yaml

+on:
+  push:
+    branches: [ master, main ]
+  pull_request:


Suggested change

on:

push:

branches: [ master, main ]

pull_request:

on:

- push

- pull_request

andreyvelich · 2026-02-05T20:07:02Z

.github/workflows/kube-linter.yaml

+  pull_request:
+
+jobs:
+  scan:


Suggested change

scan:

check-kubelinter:

andreyvelich · 2026-02-05T20:09:00Z

.kube-linter.yaml

@@ -0,0 +1,24 @@
+# KubeLinter configuration file
+# For more information, see https://docs.kubelinter.io/#/usage/configuration


Suggested change

# For more information, see https://docs.kubelinter.io/#/usage/configuration

# For more information, see https://docs.kubelinter.io/#/configuring-kubelinter

andreyvelich · 2026-02-05T20:10:00Z

.kube-linter.yaml

+    - "no-read-only-root-fs"
+    - "no-anti-affinity"


Do we need to exclude these?

andreyvelich · 2026-02-05T20:10:52Z

.github/workflows/kube-linter.yaml

+      - name: Scan manifests (base)
+        uses: stackrox/kube-linter-action@v1
+        with:
+          directory: manifests/base
+          config: .kube-linter.yaml
+
+      - name: Scan charts
+        uses: stackrox/kube-linter-action@v1
+        with:
+          directory: charts/kubeflow-trainer
+          config: .kube-linter.yaml


Instead of using their github actions, can we just simple run in a single step:

make lint-manifests

andreyvelich · 2026-02-05T20:12:21Z

.kube-linter.yaml

+    - "latest-tag"
+    - "liveness-port"
+    - "readiness-port"


Also, what about liveness and readiness ports?

andreyvelich · 2026-02-05T20:15:28Z

/ok-to-test

andreyvelich · 2026-02-08T22:43:31Z

@juyterman1000 Please also rebase your PR, it should fix the pre-commits.

andreyvelich · 2026-02-11T14:50:04Z

@Goku2099 @juyterman1000 Please can some of you finalize this PR, so we can move forward?

juyterman1000 · 2026-02-11T15:31:11Z

Sorry @andreyvelich @Goku2099 got occupied due to personal stuff,will push this today.

Goku2099 · 2026-02-11T15:36:31Z

No worries
I started working on the related changes assuming you were offline. Now that you're back, please rebase your PR and we can move forward from there.

andreyvelich · 2026-02-11T15:51:22Z

Thank you, folks!

Goku2099 · 2026-02-11T15:52:45Z

@andreyvelich Once this PR is finalized, we can gradually align with the proposed “Code Quality Checks” structure in follow-up changes. Also, if there’s anything I can help with here or in other areas feel free to let me know.

Goku2099 · 2026-02-13T15:26:16Z

Hi @juyterman1000 just checking in so we can keep this moving. Let me know if you'd like any help with the rebase.

juyterman1000 · 2026-02-13T15:59:07Z

Hi @Goku2099 ,seeing lot of issues on code quality check after rebase,fixing those.

google-oss-prow bot added the size/S label Jan 18, 2026

google-oss-prow bot requested review from jinchihe and kuizhiqing January 18, 2026 05:47

juyterman1000 changed the title ~~Add CI pipeline to validate manifests and helm chart~~ feat: Add CI pipeline to validate manifests and helm chart Jan 18, 2026

juyterman1000 force-pushed the feature/kube-linter-3096 branch from 1711d44 to b2e789d Compare January 18, 2026 19:17

google-oss-prow bot added size/M and removed size/S labels Jan 20, 2026

juyterman1000 force-pushed the feature/kube-linter-3096 branch from 13d6f11 to 9194a5e Compare January 20, 2026 04:26

juyterman1000 added 3 commits January 22, 2026 21:18

feat: Add CI pipeline to validate manifests and helm chart with kube-…

8b08ad4

…linter (Fixes kubeflow#3096) Signed-off-by: juyterman1000 <fastrunner10090@gmail.com>

chore: Refine kube-linter CI and add configuration file

a87c77e

Signed-off-by: juyterman1000 <fastrunner10090@gmail.com>

feat: add Makefile targets for local kube-linter

f915a1d

Adds "make kube-linter" to download the binary and "make lint-manifests" to run kube-linter on manifests and helm charts locally. Signed-off-by: juyterman1000 <fastrunner10090@gmail.com>

juyterman1000 force-pushed the feature/kube-linter-3096 branch from 56c4f92 to f915a1d Compare January 23, 2026 05:18

andreyvelich reviewed Feb 2, 2026

View reviewed changes

Goku2099 mentioned this pull request Feb 3, 2026

feat: add helm lint and helm unit tests to CI #3166

Open

andreyvelich reviewed Feb 5, 2026

View reviewed changes

google-oss-prow bot added the ok-to-test label Feb 5, 2026

		@@ -0,0 +1,24 @@
		# KubeLinter configuration file
		# For more information, see https://docs.kubelinter.io/#/usage/configuration

Conversation

juyterman1000 commented Jan 18, 2026

Uh oh!

github-actions bot commented Jan 18, 2026

Uh oh!

google-oss-prow bot commented Jan 18, 2026

Uh oh!

juyterman1000 commented Jan 18, 2026

Uh oh!

coveralls commented Jan 19, 2026

Pull Request Test Coverage Report for Build 21117199641

Warning: This coverage report may be inaccurate.

Details

💛 - Coveralls

Uh oh!

robert-bell commented Jan 21, 2026

Uh oh!

Goku2099 commented Jan 22, 2026

Uh oh!

juyterman1000 commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

juyterman1000 commented Jan 25, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andreyvelich left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

andreyvelich commented Feb 5, 2026

Uh oh!

andreyvelich commented Feb 8, 2026

Uh oh!

andreyvelich commented Feb 11, 2026

Uh oh!

juyterman1000 commented Feb 11, 2026

Uh oh!

Goku2099 commented Feb 11, 2026

Uh oh!

andreyvelich commented Feb 11, 2026

Uh oh!

Goku2099 commented Feb 11, 2026

Uh oh!

Goku2099 commented Feb 13, 2026

Uh oh!

juyterman1000 commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

juyterman1000 commented Jan 23, 2026 •

edited

Loading