fix(manifests): add namespace: kubeflow to kustomization overlays and add namespace regression check

[Raakshass]

Summary

Three of the four kustomization overlays consumed by kubeflow/manifests example/kustomization.yaml were missing the namespace: kubeflow directive. This causes all model-registry, istio networking, and catalog resources to deploy into the default namespace instead of kubeflow when using kustomize build.

This pull request adds namespace: kubeflow to the three affected overlays and introduces a namespace regression check script to prevent recurrence.

Fixes kubeflow/manifests#3457
Supersedes kubeflow/manifests#3458 (closed per maintainer direction to fix upstream)

Root Cause

The CI install script (model_registry_install.sh) passes -n kubeflow to kubectl apply, which overrides the namespace at apply-time. This masked the fact that the kustomization overlays themselves had no namespace directive. When users follow the documented deployment path (kustomize build example/ | kubectl apply -f -), there is no namespace override — all resources land in the default namespace.

This was confirmed by istioctl analyze output showing VirtualService and DestinationRule reference errors in the default namespace.

Changes

File	Change
manifests/kustomize/overlays/postgres/kustomization.yaml	Add namespace: kubeflow
manifests/kustomize/options/istio/kustomization.yaml	Add namespace: kubeflow
manifests/kustomize/options/catalog/overlays/demo/kustomization.yaml	Add namespace: kubeflow
manifests/kustomize/check-namespace.sh	New — namespace regression check script

No change needed for options/ui/overlays/istio/kustomization.yaml — it already has namespace: kubeflow.

Design Decisions

• Placement: The namespace: kubeflow directive is placed at the bottom of each file, consistent with the existing pattern in options/ui/overlays/istio/kustomization.yaml.
• Regression check: check-namespace.sh iterates over all four overlays, verifies each kustomization.yaml contains namespace: kubeflow, and checks that kustomize build output does not produce resources with namespace: default. This was explicitly requested by @jonburdo and @juliusvonkohout in fix(model-registry): add namespace to kustomization overlays to prevent deployment to default namespace manifests#3458.
• Upstream-first: This fix is raised here in kubeflow/hub (the source of truth) rather than in kubeflow/manifests, where the upstream/ folder is overwritten on every sync. Precedent: chore: bring up downstream changes from the manifests #2706.

Dependencies and Related Issues

• Hub / Model Registry is being deployed to the namespace default manifests#3457 — original issue report
• fix(model-registry): add namespace to kustomization overlays to prevent deployment to default namespace manifests#3458 — closed downstream pull request (maintainers directed upstream fix)
• Rename kubeflow/model-registry to kubeflow/hub manifests#3450 — renamed applications/model-registry to applications/hub and synced v0.3.9
• chore: bring up downstream changes from the manifests #2706 — precedent for upstream-first fix pattern

Contributor Checklist

• DCO sign-off included
• AI assistance disclosed (Assisted-by: Antigravity AI in commit message)
• Matches existing codebase pattern (options/ui/overlays/istio/kustomization.yaml)
• Minimal scope — only the 3 files that need the fix plus 1 regression check
• Root cause identified and stated in one sentence
• Namespace regression check added per maintainer request

cc @tarilabs @pboyd

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rareddy for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• manifests/kustomize/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pboyd]

Hi @Raakshass, thanks for looking at this. Unfortunately, I don't think we can simply add the namespace because model-registry needs to actually be in the user namespace for the dashboard to work (kubeflow-user-example-com by default in the manifests).

The manifests actually did deploy to kubeflow at one time, but we removed it to address #1045. The installation docs provide instructions to set the namespace before applying them, which is how we've been able to get away without setting the manifest.

I'm not sure a good way to solve this, but I'll spend some time today and try to find something. Let me know if you have any ideas.

[Raakshass]

youre right, i missed the user-namespace dependency and the #1045 history. hub should stay namespace-agnostic since model-registry needs to live in the profile namespace for dashboard integration
the overlay approach you proposed on the issue is the right fix set the namespace at the manifests layer instead of here. i can pick that up and raise the manifests-side overlay PR based on your diff. would be great to have your input on it given you know the deployment topology best
should i close this PR?

[Raakshass]

closing this per pboyd's feedback. the hub repo should stay namespace-agnostic since model-registry needs to live in the profile namespace for dashboard integration. the fix belongs at the manifests layer via an overlay as discussed in kubeflow/manifests#3457.

[pboyd]

Sorry for the delay, @Raakshass. I know we need to close this, but thank you for tackling this problem. It's been an issue for a while now.