Kubeflow AI reference platform 1.11.0

This release supports Kubernetes 1.33+ and transparently switches from MinIO to Seaweedfs as S3 storage. Please backup and restore any data that you have on MinIO if needed. Please be aware of the tested and recommended Kustomize version 5.7.1.

Video: https://www.youtube.com/watch?v=OV1RurEBISA
Blogpost: https://blog.kubeflow.org/kubeflow-1.11-release/

Highlights:

• Massive scalability improvements that should allow you to scale to 1000+ users/profiles/namespaces
• By default namespaces/profiles have zero pod overhead now, so you save 2x number of namespaces pods.
• By default the Istio service mesh is pruned to save Terabytes of Istio sidecar memory and network traffic on very large clusters #3206
• S3 storage with hard multi-tenancy and per namespace credentials. Limitations of kubeflow/pipelines#12373 and kubeflow/pipelines#9889 still apply. See also https://blog.kubeflow.org/gsoc/community/kubeflow/2025/09/06/kubeflow-and-gsoc2025.html#project-1-kubeflow-platform-enhancements for more information.
• PodSecurityStandards restricted is enforced for all system namespaces. PodSecurityStandards baseline is enforced for user namespaces https://kubernetes.io/docs/concepts/security/pod-security-standards/
• Automatic tests/documentation for exposing Kserve inference services with authentication inside and outside of the cluster https://github.com/kubeflow/manifests/blob/v1.11-branch/.github/workflows/katib_test.yaml
• Experimental helm charts development has started https://github.com/kubeflow/manifests/tree/v1.11-branch/experimental/helm/charts
• Typical resource consumption per component https://github.com/kubeflow/manifests/tree/v1.11-branch#kubeflow-version-master
• KFP 2.15.0 (still supports V1 pipelines and the 1.8.23 SDK), Trainer 2.1.0, Training Operator 1.9.2, Katib 0.19.0, KServe 0.15.2, Kserve models web application 0.15.0, Spark operator 2.4.0, Model Registry 0.3.4, Istio 1.28.0, DEX 2.44, OAuth2-Proxy 7.13
• Network Policies for the namespaces knative-serving oauth2-proxy cert-manager istio-system auth by @kunal-511 in #3228
• Massive test improvements across repositories which should lead to significantly higher quality releases.
• So far this release has been tested on Kind, AKS and GKE (with GKE specific istio overlay), but should also work on EKS, Rancher and many other Kubernetes clusters.

Candidates for 1.11.1 / 1.12.0:

• enable model-registry by default
• kubeflow/dashboard update after repository migration kubeflow/dashboard#125
• kubeflow/notebooks update for v1 kubeflow/notebooks#572 or v2 preview
• Kserve 0.16.0 https://github.com/kserve/kserve/releases/tag/v0.16.0, #3290
• Potential Katib regression kubeflow/katib#2597

Changes

• Fix PSS restricted warnings for kubeflow components by @akagami-harsh in #3050
• Helm Charts Katib by @kunal-511 in #3168
• Switch to large oracle runners by @juliusvonkohout in #3189
• Update dex manifests v2.43.1 by @kunal-511 in #3193
• Update oauth2 proxy manifests v7.10.0 by @kunal-511 in #3194
• add architecture by @juliusvonkohout in #3192
• kserve enforce authentication by @madmecodes in #3180
• Update kubeflow/spark-operator manifests to 2.3.0 by @juliusvonkohout in #3201
• PSS restricted for static namespaces by @juliusvonkohout in #3190
• Update test.sh by @juliusvonkohout in #3202
• dynamic PSS baseline by @juliusvonkohout in #3204
• Update kubeflow/model-registry manifests from v0.2.21 by @tarilabs in #3195
• kfp 1.8.23 by @juliusvonkohout in #3210
• Synchronize kubeflow pipelines manifests 2.14.0 by @juliusvonkohout in #3211
• Helm charts Kserve Models Web App by @kunal-511 in #3183
• Synchronize trainer manifests 2.0 by @kunal-511 in #3181
• Update trivy_scan.py by @juliusvonkohout in #3218
• Add missing resource constraint for training operator by @kunal-511 in #3222
• Update kubeflow/model-registry manifests from v0.2.22 by @tarilabs in #3216
• TrainJob support to Katib Trial Templates by @ram4444 in #3199
• Limit Istio Sidecar Scope to reduce memory usage by @madmecodes in #3206
• Update kserve_test.yaml by @juliusvonkohout in #3221
• Add documentation for Kubeflow Pipelines Kubernetes Native API mode by @VaniHaripriya in #3209
• doc: fix ordering of individual install steps by @andyatmiami in #3226
• Merge PSS_baseline and PSS_restricted by @kunal-511 in #3220
• Update cluster-roles.yaml by @juliusvonkohout in #3229
• Deny All Network Policies for the namespaces knative-serving oauth2-proxy cert-manager istio-system auth by @kunal-511 in #3228
• Update istio to 1.27.0 by @kunal-511 in #3230
• Update kubeflow/model-registry manifests from v0.3.0 by @tarilabs in #3231
• Make Helm Comparision Tests Non Blocking by @kunal-511 in #3234
• bitnami deprecation by @juliusvonkohout in #3235
• Default to SeaweedFS instead of MinIO by @akagami-harsh in #3240
• fix-ml-pipeline-ui-mtls by @jholt96 in #3236
• Update kubeflow/pipelines manifests from 2.14.0 to 2.14.3 by @akagami-harsh in #3242
• Add Katib Test File by @kunal-511 in #3243
• Remove the unnecessary step from end to end test by @kunal-511 in #3249
• Notebook Controller Helm Charts by @kunal-511 in #3219
• Synchronize kserve models web app manifests v0.15.0 by @juliusvonkohout in #3250
• Add VirtualService conflict troubleshooting for KServe path-based Routing by @madmecodes in #3247
• kserve models web app helm charts v0.15.0 by @kunal-511 in #3252
• feat: GitHub Actions workflow to test the KServe Models Web Application by @LogicalGuy77 in #3253
• Update doc for Dex Known Issues by @NJ3rsey in #3256
• Tests for Model Catalog by @kunal-511 in #3262
• Update kubeflow/model-registry manifests from v0.3.2 by @tarilabs in #3259
• Modify version options in issue-report.yml by @juliusvonkohout in #3267
• update troubleshooting for kserve path based routing by @hahahannes in #3264
• Update deprecated MinIO Image by @juliusvonkohout in #3271
• Update kubeflow/model-registry manifests from v0.3.3 by @Al-Pragliola in #3273
• Feature: Add Istio Ambient Mode Support via Overlay Method by @madmecodes in #3246
• Fix: consolidate multiple kserve test workflows into a single job by @madmecodes in #3254
• Update synchronize istio to include ztunnel support by @kunal-511 in #3274
• Update Dex Login Test by @kunal-511 in #3277
• Upgrade istio to v.1.28.0 by @juliusvonkohout in #3276
• Add fsGroup to seaweedfs by @juliusvonkohout in #3279
• Synchronize kubeflow pipelines manifests 2.15.0 by @juliusvonkohout in #3283
• Synchronize trainer manifests v2.1.0 by @juliusvonkohout in #3282
• update kfp sdk to 2.15.1 by @juliusvonkohout in #3285
• Add fsGroup and fsGroupChangePolicy to deployment by @juliusvonkohout in #3286
• Update kubeflow/spark-operator manifests to 2.4.0 by @juliusvonkohout in #3289
• Synchronize katib manifests v0.19.0 by @juliusvonkohout in #3288
• Update kserve/kserve manifests from v0.15.2 by @juliusvonkohout in #3291
• update dex and oauth2-proxy by @juliusvonkohout in #3292
• KFP SDK 2.15.2 by @juliusvonkohout in #3295
• kustomize fixes by @juliusvonkohout in #3300
• Enhance security context for cache-deployer by @juliusvonkohout in #3301
• date-based-releases by @juliusvonkohout in #3302
• seccompprofile for the istio sidecar proxy and kind/kustomize updates by @juliusvonkohout in #3303
• fix(trainer): Fix the RBAC for Kubeflow SDK by @andreyvelich in #3309
• TEST - Allow pod communication on port 8333 in SeaweedFS network policy. by @hbelmiro in #3306
• Update kubeflow/model-registry manifests from v0.3.4 by @Al-Pragliola in #3308
• align GHA tests to KF/MR by @tarilabs in #3307
• fix(trainer): Fix the RBAC for Kubeflow SDK by @andreyvelich in #3309
• Update mysql.yaml by @juliusvonkohout in #3310

Full Changelog: v1.10.2...v1.11.0

New Contributors

• @ram4444 made his first contribution in #3199
• @VaniHaripriya made her first contribution in #3209
• @andyatmiami made his first contribution in #3226
• @jholt96 made his first contribution in #3236
• @LogicalGuy77 made his first contribution in #3253
• @NJ3rsey made their his contribution in #3256
• @hahahannes made his first contribution in #3264