Securing a Managed Jupyter Notebook Platform Using Istio & OPA
summary
Managed Jupyter access uses OIDC SSO for authentication, an Istio Gateway + Envoy WASM plugin to extract user and resource headers, and an Envoy filter that delegates authorization to an external OPA server; policies come from a custom policy store and an OPA bundler that expands LDAP groups into a JSON bundle evaluated by Rego. Egress is enforced at L4 with Calico network policies (default-deny allowing only object storage on 443). System runs on a dedicated notebook cluster in production and is reused across other DSP UIs.
AI-written summary · about
chapters (7)
- 0:00Bloomberg’s data science platform
- 1:04Jupyter Notebook security challenges
- 3:35Authentication with Istio & OIDC
- 6:47Authorization with OPA & Istio
- 15:05Egress control with Calico
- 18:43Summary & future plans
- 19:03Q&A
related talks
36mDynamic and Context-Aware Security Policies for the Cloud Using...
05mLightning Talk: How We Use Istio and OPA for Authorization
36mAdvanced Authentication patterns at the Edge
26mFine-Grained User Authorization for Kubernetes with OPA and LDAP
56mDistributed Authorization for Microservices Powered by Kubernetes, Istio and Open Policy Agent
17mKubernetes Security and Governance made easy using Otomi
32mSecuring our clusters with gatekeeper and OPA
32mIstio: Sailing to a Secure Services Mesh