feat: add Kind integration tests

[kramaranya]

What this PR does / why we need it:

Adds a Kind integration lane that installs the Helm chart from the PR image and runs the MLflow SDK from pods with projected ServiceAccount tokens. This catches chart-owned RBAC, workspace isolation, and artifact failures that unit tests and Helm render checks cannot.

Related Issues/PRs:

Relates to #34

How is this PR tested?

• Existing unit tests
• New unit tests
• Manual testing

make python-test (321 passed, integration tests deselected) and make kind-e2e (live Kind suite passed).

Does this PR require documentation update?

• No
• Yes (updated docs/ or README)

Documented make kind-e2e in AGENTS.md and added tests/integration/README.md.

Checklist:

• Commits are signed off (DCO)
• Pre-commit hooks pass (pre-commit run --all-files)
• Tests pass (make python-test)

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from kramaranya. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

Adds a Kind-based integration lane for validating MLflow Helm deployment, Kubernetes RBAC, workspace isolation, and artifacts.

Changes:

• Adds in-cluster SDK scenarios and Kubernetes test resources.
• Adds a reusable Kind/Helm runner and GitHub Actions workflow.
• Documents and configures the opt-in integration suite.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.dockerignore	Excludes build artifacts from images.
.github/workflows/integration.yml	Runs Kind integration tests in CI.
.gitignore	Ignores integration results.
AGENTS.md	Documents the integration command.
Makefile	Adds the kind-e2e target.
hack/kind-e2e.sh	Creates the test deployment and runs pytest.
pyproject.toml	Registers and excludes integration tests by default.
tests/integration/__init__.py	Defines the integration test package.
tests/integration/README.md	Documents scope and execution.
tests/integration/pod_client.py	Implements in-pod MLflow scenarios.
tests/integration/test_kind.py	Provisions RBAC and orchestrates test pods.
tests/kind/Dockerfile	Builds the local MLflow test image.
tests/kind/values-e2e.yaml	Configures the Kind Helm deployment.

Suppressed comments (1)

hack/kind-e2e.sh:42

• When KIND_CLUSTER_NAME already exists, repeated runs use the same image tag and Helm sees no Pod-template change, so this availability wait can pass against the previously running server instead of the image just built and loaded. Force a restart and wait for that rollout (or use a unique tag per run) to ensure the PR image is exercised.

kubectl wait --for=condition=available deployment/mlflow --namespace mlflow --timeout=180s

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

tests/integration/test_kind.py:28

• The manual test default does not match either tests/kind/values-e2e.yaml or the runner default, which both use mlflow-integration:integration. Running the documented test module with only MLFLOW_INTEGRATION=1 after installing that profile therefore creates client pods with the nonexistent mlflow-integration:test image and times out in Pending.

IMAGE = os.environ.get("MLFLOW_TEST_IMAGE", "mlflow-integration:test")

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

.github/workflows/integration.yml:10

• The Kind build consumes the repository-level .dockerignore, but changes to that file do not trigger this workflow. An exclusion change can therefore alter or break the integration image without running this lane; include .dockerignore in the path filter.

      - "hack/kind-e2e.sh"

tests/integration/test_kind.py:28

• The fallback client image does not match this PR's Kind profile (mlflow-integration:integration). As a result, running the module directly with the advertised MLFLOW_INTEGRATION=1 opt-in creates client pods for mlflow-integration:test, which is not the image loaded by the default profile and will time out in ImagePullBackOff. Align the fallback; custom deployments can still override MLFLOW_TEST_IMAGE.

IMAGE = os.environ.get("MLFLOW_TEST_IMAGE", "mlflow-integration:test")