kserve: move control plane to kserve namespace

[danish9039]

✏️ Summary of Changes

This follow-up moves KServe-owned control-plane resources out of the kubeflow namespace and into the upstream kserve namespace.

• Install KServe from kserve.yaml, add a managed Namespace/kserve, and keep local Kubeflow-specific patches outside the generated upstream bundle.
• Preserve Kubeflow-facing behavior by keeping the Models Web Application in kubeflow, keeping aggregate kubeflow-kserve-* user roles, and keeping inferenceservice-config pointed at kubeflow/kubeflow-gateway with the existing path template.
• Move KServe webhook NetworkPolicy coverage to kserve, update install waits and Pod Security Standards coverage, and include kserve diagnostics in CI logs.
• Document upgrade cleanup for old KServe control-plane resources left behind in kubeflow by kubectl apply.

📦 Dependencies

None.

🐛 Related Issues

Follow-up to #3505.

✅ Contributor Checklist

• I have tested these changes with kustomize. See Installation Prerequisites.
• All commits are signed-off to satisfy the DCO check.
• I have considered adding my company to the adopters page to support Kubeflow and help the community, since I expect help from the community for my issue (see 1. and 2.).

Verification

• git diff --check
• bash -n tests/kserve_install.sh tests/kserve_test.sh tests/PSS_enable.sh scripts/synchronize-kserve-kserve-manifests.sh
• kustomize build applications/kserve/kserve
• kustomize build applications/kserve/models-web-app/overlays/kubeflow
• kustomize build common/kubeflow-namespace/base
• kustomize build example
• structured render assertions for Namespace/kserve, inferenceservice-config, webhook CA/cert references, localmodel DaemonSet removal, LLM config cleanup, and Models Web Application namespace preservation
• ./tests/helm_kustomize_compare.sh kserve-models-web-app base
• ./tests/helm_kustomize_compare.sh kserve-models-web-app kubeflow

Not run locally: cluster runtime tests, because there was no active kubectl current context in this workspace.

[github-actions]

Welcome to the Kubeflow Community Distribution Repository

Thanks for opening your first PR. Your contribution means a lot to the Kubeflow community.

Before making more PRs:
Please ensure your PR follows our Contributing Guide.
Please also be aware that many components are synchronized from upstream via the scripts in /scripts.
So in some cases you have to fix the problem in the upstream repositories first, but you can use a PR against kubeflow/community-distribution to test the platform integration.

Community Resources:

• CNCF Slack channels: https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels
• Community meetings: https://www.kubeflow.org/docs/about/community/

Thanks again for helping to improve Kubeflow.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kimwnasptd for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This pull request moves KServe control-plane resources from the kubeflow namespace to the upstream kserve namespace while preserving Kubeflow-facing behavior (notably keeping the KServe Models Web Application in kubeflow).

Changes:

• Add and manage Namespace/kserve, and update the KServe installation kustomization to install control-plane resources there (including webhook NetworkPolicy coverage).
• Update installation and continuous integration scripts to wait for and collect diagnostics from the kserve namespace.
• Document upgrade cleanup steps to remove legacy kubeflow-scoped KServe control-plane resources.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/PSS_enable.sh	Includes kserve in Pod Security Standards enforcement labeling.
tests/kserve_install.sh	Updates waits and diagnostics to reflect KServe control-plane deployment in kserve.
README.md	Documents the new namespace split and adds upgrade cleanup instructions.
common/kubeflow-namespace/base/kubeflow/kustomization.yaml	Stops applying the old kubeflow-scoped KServe NetworkPolicy.
common/kubeflow-namespace/base/kubeflow/kserve.yaml	Removes the old kubeflow-scoped KServe webhook NetworkPolicy manifest.
applications/kserve/UPGRADE.md	Adds upgrade guidance for cleaning up legacy kubeflow-scoped KServe control-plane resources.
applications/kserve/kserve/namespace.yaml	Introduces managed Namespace/kserve with labels for control-plane and Pod Security Standards.
applications/kserve/kserve/kustomization.yaml	Installs upstream KServe resources into kserve, adds aggregated roles and kserve-scoped webhook NetworkPolicy, and updates local patches accordingly.
applications/kserve/kserve/kserve-networkpolicy.yaml	Adds kserve-scoped NetworkPolicy allowing admission webhook ingress on port 9443.
applications/kserve/kserve/aggregated-roles.yaml	Expands aggregated Kubeflow KServe roles to include additional KServe resources.
.github/workflows/kserve_test.yaml	Adds common/kubeflow-namespace/** trigger and includes kserve namespace in diagnostics capture.
.github/workflows/kserve_models_web_application_test.yaml	Adds common/kubeflow-namespace/** trigger.
.github/workflows/full_kubeflow_integration_test.yaml	Includes kserve namespace in diagnostics capture.