mlrun 1.10.0rc13__py3-none-any.whl → 1.10.0rc42__py3-none-any.whl

mlrun/runtimes/nuclio/application/application.py

@@ -22,19 +22,23 @@ import mlrun.errors
 import mlrun.run
 from mlrun.common.runtimes.constants import NuclioIngressAddTemplatedIngressModes
 from mlrun.runtimes import RemoteRuntime
-from mlrun.runtimes.nuclio import min_nuclio_versions
+from mlrun.runtimes.nuclio import (
+    min_nuclio_versions,
+    multiple_port_sidecar_is_supported,
+)
 from mlrun.runtimes.nuclio.api_gateway import (
     APIGateway,
     APIGatewayMetadata,
     APIGatewaySpec,
 )
 from mlrun.runtimes.nuclio.function import NuclioSpec, NuclioStatus
-from mlrun.utils import logger, update_in
+from mlrun.utils import is_valid_port, logger, update_in
 
 
 class ApplicationSpec(NuclioSpec):
     _dict_fields = NuclioSpec._dict_fields + [
         "internal_application_port",
+        "application_ports",
     ]
 
     def __init__(
@@ -78,7 +82,12 @@ class ApplicationSpec(NuclioSpec):
         add_templated_ingress_host_mode=None,
         state_thresholds=None,
         disable_default_http_trigger=None,
+        serving_spec=None,
+        graph=None,
+        parameters=None,
+        track_models=None,
         internal_application_port=None,
+        application_ports=None,
     ):
         super().__init__(
             command=command,
@@ -118,6 +127,10 @@ class ApplicationSpec(NuclioSpec):
             security_context=security_context,
             service_type=service_type,
             add_templated_ingress_host_mode=add_templated_ingress_host_mode,
+            serving_spec=serving_spec,
+            graph=graph,
+            parameters=parameters,
+            track_models=track_models,
             state_thresholds=state_thresholds,
             disable_default_http_trigger=disable_default_http_trigger,
         )
@@ -126,11 +139,60 @@ class ApplicationSpec(NuclioSpec):
         self.min_replicas = min_replicas or 1
         self.max_replicas = max_replicas or 1
 
+        # initializing internal application port and application ports
+        self._internal_application_port = None
+        self._application_ports = []
+
+        application_ports = application_ports or []
+
+        # if internal_application_port is not provided, use the first application port
+        if not internal_application_port and len(application_ports) > 0:
+            internal_application_port = application_ports[0]
+
+        # the port of application sidecar to which traffic will be routed from a nuclio function
         self.internal_application_port = (
             internal_application_port
             or mlrun.mlconf.function.application.default_sidecar_internal_port
         )
 
+        # all exposed ports by the application sidecar
+        self.application_ports = application_ports
+
+    @property
+    def application_ports(self):
+        return self._application_ports
+
+    @application_ports.setter
+    def application_ports(self, ports):
+        """
+        Set the application ports for the application sidecar.
+        The internal application port is always included and always first.
+        """
+        # Handle None / single int
+        if ports is None:
+            ports = []
+        elif isinstance(ports, int):
+            ports = [ports]
+        elif not isinstance(ports, list):
+            raise mlrun.errors.MLRunInvalidArgumentError(
+                "Application ports must be a list of integers"
+            )
+
+        # Validate and normalize
+        cleaned_ports = []
+        for port in ports:
+            is_valid_port(port, raise_on_error=True)
+            if port != self.internal_application_port:
+                cleaned_ports.append(port)
+
+        application_ports = [self.internal_application_port] + cleaned_ports
+
+        # ensure multiple ports are supported in Nuclio
+        if len(application_ports) > 1:
+            multiple_port_sidecar_is_supported()
+
+        self._application_ports = application_ports
+
     @property
     def internal_application_port(self):
         return self._internal_application_port
@@ -138,10 +200,20 @@ class ApplicationSpec(NuclioSpec):
     @internal_application_port.setter
     def internal_application_port(self, port):
         port = int(port)
-        if port < 0 or port > 65535:
-            raise ValueError("Port must be in the range 0-65535")
+        is_valid_port(port, raise_on_error=True)
         self._internal_application_port = port
 
+        # If when internal application port is being set, length of self._application_ports is 1,
+        # it means that it consist of [old_port] only
+        # so in this case, we rewrite the list completely, by setting value to [new_value]
+        if len(self.application_ports) == 1:
+            self._application_ports = [port]
+            return
+
+        # when setting new internal application port, ensure that it is included in the application ports
+        # it just triggers setter logic, so setting to the same value is a no-op
+        self.application_ports = self._application_ports
+
 
 class ApplicationStatus(NuclioStatus):
     def __init__(
@@ -222,6 +294,32 @@ class ApplicationRuntime(RemoteRuntime):
     def set_internal_application_port(self, port: int):
         self.spec.internal_application_port = port
 
+    def with_sidecar(
+        self,
+        name: typing.Optional[str] = None,
+        image: typing.Optional[str] = None,
+        ports: typing.Optional[typing.Union[int, list[int]]] = None,
+        command: typing.Optional[str] = None,
+        args: typing.Optional[list[str]] = None,
+    ):
+        # wraps with_sidecar just to set the application ports
+        super().with_sidecar(
+            name=name,
+            image=image,
+            ports=ports,
+            command=command,
+            args=args,
+        )
+
+        if ports:
+            if self.spec.internal_application_port != ports[0]:
+                logger.info(
+                    f"Setting internal application port to the first port from the sidecar: {ports[0]}. "
+                    f"If this is not intended, please set the internal_application_port explicitly."
+                )
+                self.spec.internal_application_port = ports[0]
+            self.spec.application_ports = ports
+
     def pre_deploy_validation(self):
         super().pre_deploy_validation()
         if not self.spec.config.get("spec.sidecars"):
@@ -302,6 +400,7 @@ class ApplicationRuntime(RemoteRuntime):
 
         :return: The default API gateway URL if created or True if the function is ready (deployed)
         """
+
         if (self.requires_build() and not self.spec.image) or force_build:
             self._fill_credentials()
             self._build_application_image(
@@ -315,8 +414,7 @@ class ApplicationRuntime(RemoteRuntime):
                 show_on_failure=show_on_failure,
             )
 
-        # This is a class method that accepts a function instance, so we pass self as the function instance
-        self._ensure_reverse_proxy_configurations(self)
+        self._ensure_reverse_proxy_configurations()
         self._configure_application_sidecar()
 
         # We only allow accessing the application via the API Gateway
@@ -400,8 +498,10 @@ class ApplicationRuntime(RemoteRuntime):
         # nuclio implementation detail - when providing the image and emptying out the source code and build source,
         # nuclio skips rebuilding the image and simply takes the prebuilt image
         self.spec.build.functionSourceCode = ""
+        self.spec.config.pop("spec.build.functionSourceCode", None)
         self.status.application_source = self.spec.build.source
         self.spec.build.source = ""
+        self.spec.config.pop("spec.build.source", None)
 
         # save the image in the status, so we won't repopulate the function source code
         self.status.container_image = image
@@ -429,6 +529,7 @@ class ApplicationRuntime(RemoteRuntime):
         ssl_redirect: typing.Optional[bool] = None,
         set_as_default: bool = False,
         gateway_timeout: typing.Optional[int] = None,
+        port: typing.Optional[int] = None,
     ):
         """
         Create the application API gateway. Once the application is deployed, the API gateway can be created.
@@ -445,6 +546,8 @@ class ApplicationRuntime(RemoteRuntime):
         :param set_as_default:          Set the API gateway as the default for the application (`status.api_gateway`)
         :param gateway_timeout:         nginx ingress timeout in sec (request timeout, when will the gateway return an
                                         error)
+        :param port:                    The API gateway port, used only when direct_port_access=True
+
         :return:                        The API gateway URL
         """
         if not name:
@@ -465,7 +568,15 @@ class ApplicationRuntime(RemoteRuntime):
                 "Authentication credentials not provided"
             )
 
-        ports = self.spec.internal_application_port if direct_port_access else []
+        if direct_port_access and port:
+            logger.warning(
+                "Ignoring 'port' because 'direct_port_access' is enabled. "
+                "The 'port' setting is only applicable when 'direct_port_access' is disabled."
+            )
+
+        ports = (
+            port or self.spec.internal_application_port if direct_port_access else []
+        )
 
         api_gateway = APIGateway(
             APIGatewayMetadata(
@@ -593,6 +704,12 @@ class ApplicationRuntime(RemoteRuntime):
         """
         # create a function that includes only the reverse proxy, without the application
 
+        if not mlrun.get_current_project(silent=True):
+            raise mlrun.errors.MLRunMissingProjectError(
+                "An active project is required to run deploy_reverse_proxy_image(). "
+                "Use `mlrun.get_or_create_project()` or set an active project first."
+            )
+
         reverse_proxy_func = mlrun.run.new_function(
             name="reverse-proxy-temp", kind="remote"
         )
@@ -682,27 +799,42 @@ class ApplicationRuntime(RemoteRuntime):
             with_mlrun=with_mlrun,
         )
 
-    @staticmethod
-    def _ensure_reverse_proxy_configurations(function: RemoteRuntime):
-        if function.spec.build.functionSourceCode or function.status.container_image:
+    def _ensure_reverse_proxy_configurations(self):
+        # If an HTTP trigger already exists in the spec,
+        # it means the user explicitly defined a custom configuration,
+        # so, skip automatic creation.
+        skip_http_trigger_creation = False
+        for key, value in self.spec.config.items():
+            if key.startswith("spec.triggers"):
+                if isinstance(value, dict):
+                    if value.get("kind") == "http":
+                        skip_http_trigger_creation = True
+                        break
+        if not skip_http_trigger_creation:
+            self.with_http(
+                workers=mlrun.mlconf.function.application.default_worker_number,
+                trigger_name="application-http",
+            )
+
+        if self.spec.build.functionSourceCode or self.status.container_image:
             return
 
         filename, handler = ApplicationRuntime.get_filename_and_handler()
         name, spec, code = nuclio.build_file(
             filename,
-            name=function.metadata.name,
+            name=self.metadata.name,
             handler=handler,
         )
-        function.spec.function_handler = mlrun.utils.get_in(spec, "spec.handler")
-        function.spec.build.functionSourceCode = mlrun.utils.get_in(
+        self.spec.function_handler = mlrun.utils.get_in(spec, "spec.handler")
+        self.spec.build.functionSourceCode = mlrun.utils.get_in(
             spec, "spec.build.functionSourceCode"
         )
-        function.spec.nuclio_runtime = mlrun.utils.get_in(spec, "spec.runtime")
+        self.spec.nuclio_runtime = mlrun.utils.get_in(spec, "spec.runtime")
 
         # default the reverse proxy logger level to info
         logger_sinks_key = "spec.loggerSinks"
-        if not function.spec.config.get(logger_sinks_key):
-            function.set_config(
+        if not self.spec.config.get(logger_sinks_key):
+            self.set_config(
                 logger_sinks_key, [{"level": "info", "sink": "myStdoutLoggerSink"}]
             )
 
@@ -726,7 +858,7 @@ class ApplicationRuntime(RemoteRuntime):
         self.with_sidecar(
             name=self.status.sidecar_name,
             image=self.status.application_image,
-            ports=self.spec.internal_application_port,
+            ports=self.spec.application_ports,
             command=self.spec.command,
             args=self.spec.args,
         )

mlrun/runtimes/nuclio/function.py

@@ -16,6 +16,7 @@ import asyncio
 import copy
 import json
 import typing
+import warnings
 from datetime import datetime
 from time import sleep
 
@@ -29,6 +30,7 @@ from kubernetes import client
 from nuclio.deploy import find_dashboard_url, get_deploy_status
 from nuclio.triggers import V3IOStreamTrigger
 
+import mlrun.common.constants
 import mlrun.db
 import mlrun.errors
 import mlrun.k8s_utils
@@ -155,6 +157,9 @@ class NuclioSpec(KubeResourceSpec):
         state_thresholds=None,
         disable_default_http_trigger=None,
         serving_spec=None,
+        graph=None,
+        parameters=None,
+        track_models=None,
     ):
         super().__init__(
             command=command,
@@ -185,6 +190,9 @@ class NuclioSpec(KubeResourceSpec):
             security_context=security_context,
             state_thresholds=state_thresholds,
             serving_spec=serving_spec,
+            graph=graph,
+            parameters=parameters,
+            track_models=track_models,
         )
 
         self.base_spec = base_spec or {}
@@ -416,6 +424,18 @@ class RemoteRuntime(KubeResource):
                 )
         """
         self.spec.build.source = source
+
+        code = (
+            self.spec.build.functionSourceCode if hasattr(self.spec, "build") else None
+        )
+        if code:
+            # Warn and clear any inline code so the archive is actually used
+            logger.warning(
+                "Cannot specify both code and source archive. Removing the code so the provided "
+                "source archive will be used instead."
+            )
+            self.spec.build.functionSourceCode = None
+
         # update handler in function_handler if needed
         if handler:
             self.spec.function_handler = handler
@@ -824,7 +844,8 @@ class RemoteRuntime(KubeResource):
     def _get_runtime_env(self):
         # for runtime specific env var enrichment (before deploy)
         runtime_env = {
-            "MLRUN_ACTIVE_PROJECT": self.metadata.project or mlconf.active_project,
+            mlrun.common.constants.MLRUN_ACTIVE_PROJECT: self.metadata.project
+            or mlconf.active_project,
         }
         if mlconf.httpdb.api_url:
             runtime_env["MLRUN_DBPATH"] = mlconf.httpdb.api_url
@@ -960,24 +981,6 @@ class RemoteRuntime(KubeResource):
         self._mock_server = None
 
         if "://" not in path:
-            if not self.status.address:
-                # here we check that if default http trigger is disabled, function contains a custom http trigger
-                # Otherwise, the function is not invokable, so we raise an error
-                if (
-                    not self._trigger_of_kind_exists(kind="http")
-                    and self.spec.disable_default_http_trigger
-                ):
-                    raise mlrun.errors.MLRunPreconditionFailedError(
-                        "Default http trigger creation is disabled and there is no any other custom http trigger, "
-                        "so function can not be invoked via http. Either enable default http trigger creation or "
-                        "create custom http trigger"
-                    )
-                state, _, _ = self._get_state()
-                if state not in ["ready", "scaledToZero"]:
-                    logger.warning(f"Function is in the {state} state")
-                if not self.status.address:
-                    raise ValueError("no function address first run .deploy()")
-
             path = self._resolve_invocation_url(path, force_external_address)
 
         if headers is None:
@@ -1037,6 +1040,9 @@ class RemoteRuntime(KubeResource):
             sidecar["image"] = image
 
         ports = mlrun.utils.helpers.as_list(ports)
+        if len(ports) > 1:
+            mlrun.runtimes.nuclio.multiple_port_sidecar_is_supported()
+
         # according to RFC-6335, port name should be less than 15 characters,
         # so we truncate it if needed and leave room for the index
         port_name = name[:13].rstrip("-_") if len(name) > 13 else name
@@ -1217,19 +1223,54 @@ class RemoteRuntime(KubeResource):
         # internal / external invocation urls is a nuclio >= 1.6.x feature
         # try to infer the invocation url from the internal and if not exists, use external.
         # $$$$ we do not want to use the external invocation url (e.g.: ingress, nodePort, etc.)
+
+        # if none of urls is set, function was deployed with watch=False
+        # and status wasn't fetched with Nuclio
+        # _get_state fetches the state and updates url
+        if (
+            not self.status.address
+            and not self.status.internal_invocation_urls
+            and not self.status.external_invocation_urls
+        ):
+            state, _, _ = self._get_state()
+            if state not in ["ready", "scaledToZero"]:
+                logger.warning(f"Function is in the {state} state")
+
+        # prefer internal invocation url if running inside k8s cluster
         if (
             not force_external_address
             and self.status.internal_invocation_urls
             and mlrun.k8s_utils.is_running_inside_kubernetes_cluster()
         ):
-            return mlrun.utils.helpers.join_urls(
+            url = mlrun.utils.helpers.join_urls(
                 f"http://{self.status.internal_invocation_urls[0]}", path
             )
+            logger.debug(
+                f"Using internal invocation url {url}. Make sure you have network access to the k8s cluster. "
+                f"Otherwise, set force_external_address to True"
+            )
+            return url
 
         if self.status.external_invocation_urls:
             return mlrun.utils.helpers.join_urls(
                 f"http://{self.status.external_invocation_urls[0]}", path
             )
+
+        if not self.status.address:
+            # if there is no address
+            # here we check that if default http trigger is disabled, function contains a custom http trigger
+            # Otherwise, the function is not invokable, so we raise an error
+            if (
+                not self._trigger_of_kind_exists(kind="http")
+                and self.spec.disable_default_http_trigger
+            ):
+                raise mlrun.errors.MLRunPreconditionFailedError(
+                    "Default http trigger creation is disabled and there is no any other custom http trigger, "
+                    "so function can not be invoked via http. Either enable default http trigger creation or "
+                    "create custom http trigger"
+                )
+            else:
+                raise ValueError("no function address first run .deploy()")
         else:
             return mlrun.utils.helpers.join_urls(f"http://{self.status.address}", path)
 
@@ -1283,6 +1324,8 @@ class RemoteRuntime(KubeResource):
     def get_url(
         self,
         force_external_address: bool = False,
+        # leaving auth_info for BC
+        # TODO: remove in 1.12.0
         auth_info: AuthInfo = None,
     ):
         """
@@ -1293,13 +1336,12 @@ class RemoteRuntime(KubeResource):
 
         :return: returns function's url
         """
-        if not self.status.address:
-            state, _, _ = self._get_state(auth_info=auth_info)
-            if state != "ready" or not self.status.address:
-                raise ValueError(
-                    "no function address or not ready, first run .deploy()"
-                )
-
+        if auth_info:
+            warnings.warn(
+                "'auth_info' is deprecated in 1.10.0 and will be removed in 1.12.0.",
+                # TODO: Remove this in 1.12.0
+                FutureWarning,
+            )
         return self._resolve_invocation_url("", force_external_address)
 
     @staticmethod
@@ -1450,3 +1492,10 @@ def enrich_nuclio_function_from_headers(
         else []
     )
     func.status.container_image = headers.get("x-mlrun-container-image", "")
+
+
+@min_nuclio_versions("1.14.14")
+def multiple_port_sidecar_is_supported():
+    # multiple ports are supported from nuclio version 1.14.14
+    # this method exists only for running the min_nuclio_versions decorator
+    return True

mlrun/runtimes/nuclio/serving.py

@@ -14,6 +14,7 @@
 import json
 import os
 import warnings
+from base64 import b64decode
 from copy import deepcopy
 from typing import Optional, Union
 
@@ -22,6 +23,8 @@ from nuclio import KafkaTrigger
 
 import mlrun
 import mlrun.common.schemas as schemas
+import mlrun.common.secrets
+import mlrun.datastore.datastore_profile as ds_profile
 from mlrun.datastore import get_kafka_brokers_from_dict, parse_kafka_url
 from mlrun.model import ObjectList
 from mlrun.runtimes.function_reference import FunctionReference
@@ -633,7 +636,12 @@ class ServingRuntime(RemoteRuntime):
 
         :returns: The Runtime (function) object
         """
-
+        if kind == "azure_vault" and isinstance(source, dict):
+            candidate_secret_name = (source.get("k8s_secret") or "").strip()
+            if candidate_secret_name:
+                mlrun.common.secrets.validate_not_forbidden_secret(
+                    candidate_secret_name
+                )
         if kind == "vault" and isinstance(source, list):
             source = {"project": self.metadata.project, "secrets": source}
 
@@ -657,6 +665,7 @@ class ServingRuntime(RemoteRuntime):
         :param builder_env: env vars dict for source archive config/credentials e.g. builder_env={"GIT_TOKEN": token}
         :param force_build: set True for force building the image
         """
+
         load_mode = self.spec.load_mode
         if load_mode and load_mode not in ["sync", "async"]:
             raise ValueError(f"illegal model loading mode {load_mode}")
@@ -677,6 +686,21 @@ class ServingRuntime(RemoteRuntime):
                         f"function {function} is used in steps and is not defined, "
                         "use the .add_child_function() to specify child function attributes"
                     )
+        if (
+            isinstance(self.spec.graph, RootFlowStep)
+            and any(
+                isinstance(step_type, mlrun.serving.states.ModelRunnerStep)
+                for step_type in self.spec.graph.steps.values()
+            )
+            and self.spec.build.functionSourceCode
+        ):
+            # Add import for LLModel
+            decoded_code = b64decode(self.spec.build.functionSourceCode).decode("utf-8")
+            import_llmodel_code = "\nfrom mlrun.serving.states import LLModel\n"
+            if import_llmodel_code not in decoded_code:
+                decoded_code += import_llmodel_code
+            encoded_code = mlrun.utils.helpers.encode_user_code(decoded_code)
+            self.spec.build.functionSourceCode = encoded_code
 
         # Handle secret processing before handling child functions, since secrets are transferred to them
         if self.spec.secret_sources:
@@ -720,6 +744,7 @@ class ServingRuntime(RemoteRuntime):
             "track_models": self.spec.track_models,
             "default_content_type": self.spec.default_content_type,
             "model_endpoint_creation_task_name": self.spec.model_endpoint_creation_task_name,
+            # TODO: find another way to pass this (needed for local run)
             "filename": getattr(self.spec, "filename", None),
         }
 
@@ -739,6 +764,7 @@ class ServingRuntime(RemoteRuntime):
         current_function="*",
         track_models=False,
         workdir=None,
+        stream_profile: Optional[ds_profile.DatastoreProfile] = None,
         **kwargs,
     ) -> GraphServer:
         """create mock server object for local testing/emulation
@@ -747,6 +773,7 @@ class ServingRuntime(RemoteRuntime):
         :param current_function: specify if you want to simulate a child function, * for all functions
         :param track_models: allow model tracking (disabled by default in the mock server)
         :param workdir:   working directory to locate the source code (if not the current one)
+        :param stream_profile:   stream profile to use for the mock server output stream.
         """
 
         # set the namespaces/modules to look for the steps code in
@@ -786,19 +813,16 @@ class ServingRuntime(RemoteRuntime):
             logger=logger,
             is_mock=True,
             monitoring_mock=self.spec.track_models,
+            stream_profile=stream_profile,
         )
 
-        if (
-            isinstance(self.spec.graph, RootFlowStep)
-            and self.spec.graph.include_monitored_step()
-        ):
-            server.graph = add_system_steps_to_graph(
-                server.project,
-                server.graph,
-                self.spec.track_models,
-                server.context,
-                self.spec,
-            )
+        server.graph = add_system_steps_to_graph(
+            server.project,
+            server.graph,
+            self.spec.track_models,
+            server.context,
+            self.spec,
+        )
 
         if workdir:
             os.chdir(old_workdir)
@@ -838,8 +862,20 @@ class ServingRuntime(RemoteRuntime):
         )
         self._mock_server = self.to_mock_server()
 
-    def to_job(self) -> KubejobRuntime:
-        """Convert this ServingRuntime to a KubejobRuntime, so that the graph can be run as a standalone job."""
+    def to_job(self, func_name: Optional[str] = None) -> KubejobRuntime:
+        """Convert this ServingRuntime to a KubejobRuntime, so that the graph can be run as a standalone job.
+
+        Args:
+            func_name: Optional custom name for the job function. If not provided, automatically
+                      appends '-batch' suffix to the serving function name to prevent database collision.
+
+        Returns:
+            KubejobRuntime configured to execute the serving graph as a batch job.
+
+        Note:
+            The job will have a different name than the serving function to prevent database collision.
+            The original serving function remains unchanged and can still be invoked after running the job.
+        """
         if self.spec.function_refs:
             raise mlrun.errors.MLRunInvalidArgumentError(
                 f"Cannot convert function '{self.metadata.name}' to a job because it has child functions"
@@ -858,6 +894,7 @@ class ServingRuntime(RemoteRuntime):
             description=self.spec.description,
             workdir=self.spec.workdir,
             image_pull_secret=self.spec.image_pull_secret,
+            build=self.spec.build,
             node_name=self.spec.node_name,
             node_selector=self.spec.node_selector,
             affinity=self.spec.affinity,
@@ -868,9 +905,54 @@ class ServingRuntime(RemoteRuntime):
             security_context=self.spec.security_context,
             state_thresholds=self.spec.state_thresholds,
             serving_spec=self._get_serving_spec(),
+            track_models=self.spec.track_models,
+            parameters=self.spec.parameters,
+            graph=self.spec.graph,
         )
+
+        job_metadata = deepcopy(self.metadata)
+        original_name = job_metadata.name
+
+        if func_name:
+            # User provided explicit job name
+            job_metadata.name = func_name
+            logger.debug(
+                "Creating job from serving function with custom name",
+                new_name=func_name,
+            )
+        else:
+            job_metadata.name, was_renamed, suffix = (
+                mlrun.utils.helpers.ensure_batch_job_suffix(job_metadata.name)
+            )
+
+            # Check if the resulting name exceeds Kubernetes length limit
+            if (
+                len(job_metadata.name)
+                > mlrun.common.constants.K8S_DNS_1123_LABEL_MAX_LENGTH
+            ):
+                raise mlrun.errors.MLRunInvalidArgumentError(
+                    f"Cannot convert serving function '{original_name}' to batch job: "
+                    f"the resulting name '{job_metadata.name}' ({len(job_metadata.name)} characters) "
+                    f"exceeds Kubernetes limit of {mlrun.common.constants.K8S_DNS_1123_LABEL_MAX_LENGTH} characters. "
+                    f"Please provide a custom name via the func_name parameter, "
+                    f"with at most {mlrun.common.constants.K8S_DNS_1123_LABEL_MAX_LENGTH} characters."
+                )
+
+            if was_renamed:
+                logger.info(
+                    "Creating job from serving function (auto-appended suffix to prevent collision)",
+                    new_name=job_metadata.name,
+                    suffix=suffix,
+                )
+            else:
+                logger.debug(
+                    "Creating job from serving function (name already has suffix)",
+                    name=original_name,
+                    suffix=suffix,
+                )
+
         job = KubejobRuntime(
             spec=spec,
-            metadata=self.metadata,
+            metadata=job_metadata,
         )
         return job