fix: pss-restricted-with-istio

[juliusvonkohout]

@andreyvelich may you also patch it in helm for the jobset ?

[github-actions]

🎉 Welcome to the Kubeflow Trainer! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

• If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
• Our team will review your PR soon! cc @kubeflow/kubeflow-trainer-team

Join the community:

• Slack: Join our #kubeflow-trainer Slack channel.
• Meetings: Attend the Kubeflow AutoML and Training Working Group bi-weekly meetings.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

[coveralls]

Pull Request Test Coverage Report for Build 20599754766

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 51.435%

---

Totals
Change from base Build 19935327740:	0.0%
Covered Lines:	1237
Relevant Lines:	2405

---

💛 - Coveralls

[juliusvonkohout]

/retest

[Copilot]

Pull request overview

This PR adds Istio sidecar exclusion configuration and seccomp security profiles to improve compatibility with Pod Security Standards (PSS) restricted policies when using Istio service mesh. The changes ensure that webhook traffic on port 9443 bypasses the Istio sidecar and adds RuntimeDefault seccomp profiles for enhanced security.

Key Changes:

• Added Istio traffic exclusion annotation for inbound port 9443 to prevent sidecar interference with webhook communication
• Configured RuntimeDefault seccomp profiles at the pod security context level for compliance with restricted PSS

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
manifests/third-party/jobset/kustomization.yaml	Adds kustomize patch for jobset-controller-manager deployment with Istio annotation and seccomp profile
manifests/base/manager/manager.yaml	Updates trainer manager deployment with Istio exclusion annotation and seccomp security context
charts/kubeflow-trainer/templates/manager/deployment.yaml	Adds Istio traffic exclusion annotation to Helm chart template for trainer manager

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: juliusvonkohout
Once this PR has been reviewed and has the lgtm label, please ask for approval from andreyvelich. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[juliusvonkohout]

@andreyvelich i am waiting for this to merge kubeflow/manifests#3314
/lgtm from my side if the tests are green.
Maybe you have to rebase the branch.

[andreyvelich]

/lgtm
@juliusvonkohout Can you rebase this PR to fix CI please ?
/cc @tenzen-y @astefanutti