feat: GitHub Actions workflow to test the KServe Models Web Application

[LogicalGuy77]

Pull Request Template for Kubeflow Manifests

✏️ Summary of Changes

This PR adds a new GitHub Actions workflow to test the KServe Models Web Application functionality. The test validates that the models-web-app can correctly list and manage InferenceServices deployed via kubectl.

Key Changes:

• New CI Workflow: Added .github/workflows/kserve_models_web_app_test.yaml to test KServe models-web-app integration
• Test Script: Created tests/kserve_models_web_app_test.sh that:
  • Configures models-web-app with disabled auth for testing
  • Sets up RBAC permissions for InferenceService access
  • Deploys a test InferenceService (sklearn-iris) via kubectl
  • Verifies the InferenceService appears in the models-web-app API
  • Validates cluster state consistency
  • Cleans up test resources

Test Coverage:

• InferenceService deployment and readiness
• Models-web-app API endpoints for listing InferenceServices
• RBAC permissions for service account access
• Authentication handling (Bearer token + XSRF token)
• Integration with Istio, Knative, and OAuth2-Proxy

Workflow Triggers:

The test runs on pull requests that modify:

• KServe models-web-app components
• Istio, Knative, or OAuth2-Proxy configurations
• Related test scripts and workflows

📦 Dependencies

• Requires Istio CNI, Knative, OAuth2-Proxy, and KServe to be installed
• Depends on existing test infrastructure scripts (KinD, kubectl, kustomize)

🐛 Related Issues

This PR adds automated testing for KServe models-web-app to improve CI coverage and catch regressions early.

✅ Contributor Checklist

• I have tested these changes with kustomize. See Installation Prerequisites.
• All commits are signed-off to satisfy the DCO check.
• I have considered adding my company to the adopters page to support Kubeflow and help the community, since I expect help from the community for my issue (see 1. and 2.).

---

You can join the CNCF Slack and access our meetings at the Kubeflow Community website. Our channel on the CNCF Slack is here #kubeflow-platform.

[juliusvonkohout]

The default-editor from the same namespace should be able to do it see

manifests/applications/kserve/kserve/aggregated-roles.yaml

Line 28 in 66aa578

- inferenceservices

[juliusvonkohout]

• RESPONSE='{"log":"User '''systemserviceaccountkubeflow-user-example-comdefault-editor''' is not authorized to list serving.kserve.io/v1beta1/inferenceservices in namespace '''kubeflow-user-example-com'''","status":403,"success":false,"user":"systemserviceaccountkubeflow-user-example-comdefault-editor"}'

seems to be the problem. There is something wrong with the proper authentication.

[juliusvonkohout]

Thank you

/lgtm
/approve

[google-oss-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: juliusvonkohout

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [juliusvonkohout]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment