[jeffspahr]

Problem

Cluster operators need a concrete 2.18 upgrade contract: what happens automatically, which users are affected, and what they must configure or sequence. The release notes, operator guide and agent assessment now describe the behavior that ships with the runtime prerequisites below.

Changes

• Explain automatic schedule adoption and writer discovery, bounded schedule-write retries, and the exceptions for inconsistent records, CR-only schedules and external/shared-database writers.

• Describe default auto artifact authorization: supported managed storage automatically uses verified namespace identities, preserving isolated existing roots; legacy managed artifacts/ retains ownership checks. Administrator-approved external S3 brokers using rotating credentials in a named file are also supported; unapproved custom configurations retain prefix checks; explicit key-prefix and reviewed storage remain available. SeaweedFS stays central.

• Document reusable external adoption policies, protected UID/principal inventories and receiver templates, existing/new enrollment, cutoff semantics, missing-source recovery and denied tenant self-approval. Explicit per-namespace approvals remain available for exceptions. Distinguish artifact-read enrollment from provisioning pipeline roots/write grants. Preserve the credential-file contract, renewal without receiver restart, revocation limits and external IAM responsibilities; this is not universal IRSA discovery or independent policy certification.

• Explain automatic proxy creation, readiness gating, namespace/credential binding, rotation and old/new receiver compatibility. No UI/controller ordering or storage opt-in is required for supported upstream installations. Document automatic recovery of missing stock bucket-policy statements without credential replacement/Secret deletion, transient retries, custom-service exceptions and per-namespace pod capacity (10m CPU/70 MiB requests, 100m CPU/500 MiB limits, plus sidecars/surge). Standard NetworkPolicy must be enforced.

• Keep HTTP artifacts, archived logs, endpoint trust, the 2.18 environment/workload-identity credential adaptation, and temporary artifact audit separate. Enforced storage mode remains relevant to 3.0; removal of audit does not mandate moving every historical object.

• Cover merged online JobUUID preparation and automatic retention indexes, prepare-only staging, recovery and later catch-up without describing all startup database work as nonblocking. Retain Python, size-limit, RBAC, pagination, reporting and TensorBoard impacts.

• Make missing-record namespace routing, malformed shared-configuration scope and automatic provisional-record recovery explicit. Previously adopted/revoked and ambiguous older records remain fail-closed.

• Warn that switching a namespace from bundled MinIO to external S3 replaces the receiver: old run history requires migration of both objects and persisted references, or postponing cutover. Same-store historical roots remain supported.

• Provide the agent assessment guide for read-only evidence collection and explicitly authorized live checks, with unknowns recorded rather than inferred compatibility.

• Identify pre-SeaweedFS V1 tenant outputs under artifacts/<workflow>/.... Managed auto retains ownership/prefix checks for that broadly granted legacy root; historical object/reference migration may still be required. Do not mistake the stock shared grant for public data.

• Document persistent HTTP 503 on custom stores without the controller's IAM API despite pre-created Secrets. Select key-prefix before rollout or review genuinely isolated storage delegation; retain working receiver configuration and the custom namespace provisioner.

• Document approved dotted-bucket support and require agent acceptance to distinguish direct storage access from authenticated UI ownership enforcement on real old-layout objects.

• Require pre-upgrade review of effective storage grants and namespace viewers. ready does not certify least privilege; shared/ is tenant-writable, and retained broad administrator grants can expand viewer access. Narrow unintended grants or select key-prefix before rollout; verify using a read-only viewer.

• Distinguish plain retryable receiver-upgrade/pending/transient errors from malformed readiness records and authentication/RBAC failures requiring correction, without a misleading retry header.

• Explain managed IAM verification failure recovery: the controller requests a 10-second resync and retains credentials; pending remains fail-closed and timing is not an outage guarantee. Name the external receiver configuration setting in startup troubleshooting.

Merge dependency

Merge master #14883, then its 2.18 backport #14884, then this guide. The backport includes automatic authorization selection, protected receivers and order-independent component rollout documented here.

Managed writer discovery #14868, online JobUUID #14874, retention automation #14877, artifact audit standardization #14866, size diagnostics #14867, scheduling retries #14869/#14870, sub-DAG #14864 and the Python minimum #14865 are already merged. Master retention PR #14876 remains separate from its delivered 2.18 adaptation.

Validation

Single DCO-signed commit d62977187 rebased on release-2.18 cd1832663. Standalone master/release/guide and combined runtime/guide Sphinx builds pass with warnings treated as errors and zero warnings; scoped documentation hooks pass without source changes. Exact combined tree: f850b5d591a425e004df220dfa0a193efb841d65.

Runtime candidate acceptance passed on master 0d891201e (44 managed checks, one expected old-UI/V1-API skip, 25 external checks) and 2.18 da4b84c66 (45 managed, 25 external, no skips). Both suites verify current source/runtime image identities and clean cleanup. Current-head hosted frontend CI also passed on both branches. Earlier failed fixture revisions are not relabeled as successes.

No runtime changes in this PR. Required checks, approvals and merges remain; final merged-release acceptance and advisory approval are tracked in #14421, delivery in #14409, and the separate 3.0 migration in #14029.

[github-actions]

Contributor Report for @jeffspahr

Metric	Value
Kubeflow org member	Yes
Issues opened in kubeflow/pipelines	360
Merged PRs in kubeflow/pipelines	300
GitHub account age	3470 days (created 2017-04-21)
PR comments in kubeflow/pipelines	1520

[Copilot]

🟡 Changes recommended

The guide omits the retained TaskService authorization limitation required by the PR description.

1 open finding

• Operator guidance omits deferred TaskService authorization limitation · New

What changed in this PR

Adds centralized KFP 2.18 upgrade guidance covering schedule adoption, RBAC, pipeline lookup compatibility, and UI signing-key setup.

Changes:

• Adds the 2.18 operator checklist and navigation links.
• Clarifies client/RBAC migration requirements.
• Expands signing-key configuration and recovery guidance.

File	Description
docs/​user-guides/​migration.md	Links SDK migration readers to the operator checklist.
docs/​operator-guides/​upgrade-2.18.md	Adds the central upgrade checklist.
docs/​operator-guides/​server-config.md	Clarifies signing-key setup and recovery.
docs/​operator-guides/​rbac-migration-2.18.md	Adds rollout and private-pipeline guidance.
docs/​operator-guides/​installation.md	Warns upgrading operators to consult the checklist.
docs/​operator-guides/​index.md	Adds the checklist to navigation.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from jeffspahr. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[droctothorpe]

AA review summary for #14703: docs: make 2.18 upgrade requirements explicit

• Reviewed head SHA: 32a25586ebffd443ed8fa1e9e959de969271dd67
• Eyeballs verdict: eyeballs required (ER)
• AA review result: passed
• Correctness / risk: Full static review found no blocker; earlier automatic-adoption finding is stale. Nonblocking correction: docs/operator-guides/rbac-migration-2.18.md:158-159 adds system:authenticated groups to the example SAR, while resource_manager.go:3919-3925 sends only User and ResourceAttributes; omit groups to reproduce KFP accurately. Real SDK/UI probes remain required.
• Standards / tests: All 12 changed files inspected; adoption and TaskService disclosure findings addressed. Exact-head docs/backend/manifest/cache checks passed. Preserve explicit dependencies fix(backend): discover managed schedule writers automatically #14868, fix(backend): preserve JobUUID and create its index online on 2.18 #14874, fix(backend): automate retention index preparation on 2.18 #14877 after feat(backend): prepare retention indexes online before collection #14876, and feat(frontend): backport automatic artifact authorization to 2.18 #14884 after feat(frontend): authorize managed and approved external artifact storage #14883; verify final combined release before presenting guarantees as shipped. No local upgrade acceptance.
• Blocking findings: 0
• Human review still required: yes