Summary

Remove the following obsolete constraints from collections/llama-stack/cpu-ubi9/constraints.txt in the RHAI pipeline:

• kfp-kubernetes==2.14.6 (line 16)
• kubernetes==35.0.0a1 (line 21)
• urllib3==2.6.3 (line 38)

These three pins were added to work around a dependency resolution chain caused by kfp shipping with restrictive version pins on its runtime dependencies. Specifically:

1. kfp's requirements.in pinned kubernetes to a narrow version range
2. The only stable kubernetes satisfying that range (34.1.0) required urllib3<2.4.0, which was too restrictive for the rest of the dependency tree
3. To escape this, the RHAI pipeline pinned kubernetes==35.0.0a1 (an alpha pre-release) which relaxed the urllib3 upper bound, and force-pinned {
   Unknown macro: {urllib3==2.6.3}

   }

4. kfp-kubernetes==2.14.6 was also pinned to keep the resolver stable

Why it is now safe to remove

Two things have changed:

1. Builder MR !2016 restores a kfp plugin that strips version pins

Builder MR !2016 (AIPCC-11353) restores the kfp package plugin in the builder, but with a smarter approach: instead of stripping all dependencies (as the old plugin did), it strips only the version constraints while keeping the package names. After this MR lands, kfp will no longer impose restrictive version bounds on kubernetes or any other transitive dependency during resolution.

2. kubernetes 35.0.0 stable has been released

kubernetes 35.0.0 (stable, Production/Stable status) was released on PyPI on January 16, 2026. Its urllib3 requirement is now urllib3!=2.6.0,>=1.24.2 — essentially unbounded on the upper end (only excluding the buggy 2.6.0 release). This means:

• The resolver will naturally pick kubernetes 35.0.0 (latest stable) without any constraint needed
• The urllib3 conflict is completely eliminated — no pin required
• kfp-kubernetes can resolve freely without a forced version

Prerequisite

IMPORTANT:{color} Builder MR !2016 must be merged first before these constraints are removed from the RHAI pipeline. Without the builder plugin stripping kfp's version pins, kfp would still constrain kubernetes to a narrow range, and removing the RHAI constraints would cause a dependency resolution failure.

Constraints to remove

# Fixes: https://issues.redhat.com/browse/RHAIENG-1451
# TODO: Remove this constraint once the issue is resolved
kfp-kubernetes==2.14.6
# Fixes: https://issues.redhat.com/browse/RHAIENG-2711
# Upgrade kubernetes to 35.0.0a1 to resolve urllib3 conflict
# kubernetes 34.1.0 required urllib3<2.4.0 (too restrictive)
# kubernetes 35.0.0a1 relaxes this constraint
kubernetes==35.0.0a1
# Fixes: https://issues.redhat.com/browse/RHAIENG-2699
urllib3==2.6.3

Constraints that must stay (for now)

The remaining constraints in the file are related to llama_stack_provider_ragas[remote]==0.5.1 pinning ragas==0.3.0, which has unversioned langchain dependencies and causes a cascade of conflicts (langchain, fsspec, s3fs, aiobotocore/boto3/botocore). These are unrelated to kfp and require separate upstream fixes.

Acceptance criteria

1. Confirm [Builder MR !2016|https://gitlab.com/redhat/rhel-ai/wheels/builder