29257982296
66%
master: 67%

Ran 13 Jul 2026 02:41PM UTC

Jobs 1

Files 40

Run time 1min

Badge

Embed ▾

Committed 13 Jul 2026 02:23PM UTC coverage: 66.309%. Remained the same

Build # 29257982296

Build Type

Pull #3719

github

Committed by

vcrll

Commit Message

Add Pod Security Admission label to the Helm chart namespace (GHSA-2v88-3c5j-xcjq)

The Helm chart deploys every resource into .Release.Namespace but never created the namespace itself, so unlike the kustomize overlay it had no Namespace object to carry Pod Security Admission labels. Add a Namespace template, gated by namespace.create (default true), that creates the release namespace from a configurable labels and annotations map. The default labels carry pod-security.kubernetes.io/enforce: baseline, matching manifests/overlays/manager/namespace.yaml, so a default install enforces PSA on the namespace where TrainJobs run. Operators who create the namespace out of band can set namespace.create=false and label it themselves.

Add helm-unittest coverage for the default label, custom labels and annotations, and the create=false case.

Signed-off-by: Vito Carolillo <vito@carolillo.it>

Pull Request Pull Request #3719: fix(manifests): enforce Pod Security Admission baseline on the Trainer namespace

Coverage Stats

2409 of 3633 relevant lines covered (66.31%)

0.77 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	29257982296.1	13 Jul 2026 02:41PM UTC	40	66.31	GitHub Action Run

kubeflow / trainer / 29257982296
66%
master: 67%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 29257982296

kubeflow / trainer / 29257982296 66% master: 67%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 29257982296

kubeflow / trainer / 29257982296
66%
master: 67%

README BADGES
x