Missing user namespace label user.kubeflow.org/enabled

[phoevos]

Namespaces corresponding to Kubeflow users don't get the user.kubeflow.org/enabled label required by default by the Resource Dispatcher to detect the namespaces to inject resources into.

More specifically, the Resource Dispatcher watches for newly created namespaces. If these carry a specific label (configured by the user), it injects the resources required for its related apps to work into the new namespaces. If the Resource Dispatcher is related with MLFlow, for instance, it will have to create PodDefaults and Secrets in the target namespaces to allow workloads running in them to access external services (e.g. MinIO). This label is essentially used to distinguish namespaces belonging to Kubeflow users and is set by default to user.kubeflow.org/enabled: "true".

The Profiles Operator, on the other hand, is the one that controls the labels that will end up on a new namespace, whenever a Kubeflow user Profile is created, through a YAML file pushed to the controller container. The labels currently propagated to the namespace are configured here:

kubeflow-profiles-operator/src/templates/namespace-labels.yaml

Lines 15 to 19 in e46577a

	katib-metricscollector-injection: "enabled"
	katib.kubeflow.org/metrics-collector-injection: "enabled"
	serving.kubeflow.org/inferenceservice: "enabled"
	pipelines.kubeflow.org/enabled: "true"
	app.kubernetes.io/part-of: "kubeflow-profile"

It looks like the Profiles Operator should also set the user.kubeflow.org/enabled: "true" here, for our services to properly work.

[ca-scribner]

For context, the resource-dispatcher can watch for any label, so we could use an existing one (maybe pipelines.kubeflow.org/enabled). But adding a new label feels cleaner as its purpose is more clear

[NohaIhab]

re-opening this because it was not fixed in track/1.7