Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[feature] Add support for model artifacts in the "modelcar" format #11584

Closed
mprahl opened this issue Feb 4, 2025 · 3 comments
Closed

[feature] Add support for model artifacts in the "modelcar" format #11584

mprahl opened this issue Feb 4, 2025 · 3 comments

Comments

@mprahl
Copy link
Contributor

mprahl commented Feb 4, 2025

Feature Area

/area backend

What feature would you like to see?

Currently, a user may import a model as an artifact with the KFP SDK like the following example, but it's limited to S3.

model_source_s3_task = dsl.importer(artifact_uri=model_in_s3, artifact_class=dsl.Model)

It'd be nice to add support for the modelcar format that is supported in KServe.

The suggestion is for the artifact URI passed to dsl.importer to have a prefix of oci://. No changes to the SDK should be needed for this.

The KFP driver would see this and add an init container to the launcher pod which launches the modelcar container image and copies the model to an emptyDir volume. The artifact output would be the local path to this emptyDir volume in the launcher container. The benefit of doing it this way allows for the global image pull secret or image pull secrets assigned to the KFP pipeline runner service account to pull it without specifying additional credentials.

Once OCI Volume Source has been GA for several Kubernetes releases, we may consider leverage that instead of the init container.

What is the use case or pain point?

In order to support fine tuning a model stored in an OCI registry in the modelcar format without first copying to S3, it'd be nice to have native support for a model artifact stored in OCI.

Is there a workaround currently?

The user must copy it to S3 outside of the pipeline or manually pull down the image.


Love this idea? Give it a 👍.

@mprahl
Copy link
Contributor Author

mprahl commented Feb 4, 2025

/assign @mprahl

@HumairAK HumairAK added this to the KFP 2.5.0 milestone Feb 5, 2025
@HumairAK
Copy link
Collaborator

HumairAK commented Feb 5, 2025

I think this is a great proposal @mprahl, thank you. There are various benefits to this approach beyond pull secrets. The linked Kserve page outlines some of these, but I'll paste them here for clarity:

Reduced Startup Times: By avoiding repetitive downloads of large models, startup delays are significantly minimized.

Lower Disk Space Usage: The feature decreases the need for duplicated local storage, conserving disk space.

Enhanced Performance: Modelcars allows for advanced techniques like pre-fetching images and lazy-loading, improving efficiency.

As kserve is an addon component to KF, aligning here just makes sense as well.

cc @franciscojavierarceo fyi

@HumairAK HumairAK moved this to In Progress in KFP 2.x Release Feb 5, 2025
@franciscojavierarceo
Copy link

Nice, this is great @mprahl !

mprahl added a commit to mprahl/pipelines that referenced this issue Feb 5, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 5, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 5, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 5, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 5, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 5, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 5, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an empty dir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an emptyDir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an emptyDir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an emptyDir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an emptyDir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an emptyDir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an emptyDir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 6, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having any component container have an init
container with the image set to the Modelcar container image and the
/models directory contents copied to an emptyDir volume that is
accessible in the component container.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 8, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar container
images.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 8, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar container
images.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 8, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar container
images.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 8, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar container
images.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 8, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar container
images.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 8, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar container
images.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 8, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar container
images.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 10, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 10, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 11, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 11, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 12, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 12, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 12, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 12, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 12, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 12, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 12, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 19, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 19, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 19, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 19, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 19, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all Pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 19, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all Pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
mprahl added a commit to mprahl/pipelines that referenced this issue Feb 19, 2025
This allows dsl.import to leverage Modelcar container images in an OCI
repository. This works by having an init container prepull the image and
then adding a sidecar container when the launcher container is running.
The Modelcar container adds a symlink to its /models directory in an
emptyDir volume that is accessible by the launcher container. Once the
launcher is done running the user code, it stops the Modelcar
containers.

This approach has the benefit of leveraging image pull secrets
configured on the Kubernetes cluster rather than require separate
credentials for importing the artifact. Additionally, no data is copied
to the emptyDir volume, so the storage cost is just pulling the Modelcar
container image on the Kubernetes worker node.

Note that once Kubernetes supports OCI images as volume mounts for
several releases, consider replacing the init container with that
approach.

This also adds a new environment variable of PIPELINE_RUN_AS_USER to
set the runAsUser on all Pods created by Argo Workflows.

Resolves:
kubeflow#11584

Signed-off-by: mprahl <[email protected]>
@github-project-automation github-project-automation bot moved this from In Progress to Done in KFP 2.x Release Feb 19, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Done
Development

No branches or pull requests

3 participants