Enabling Kubeflow with Enterprise-Grade Auth for On-Prem Deployments
Talkat KubeCon + CloudNativeCon North America 2019 · on Tuesday, 2019-11-19· at 11:50· Room 16AB - San Diego Convention Center, Mezzanine Level·
summary
Kubeflow deploys ML services as CRDs like TFJob and uses namespaces for per-user isolation; the demo shows notebook access blocked with 403 when headers don’t match. The solution ties web UIs and kube-apiserver identity via OIDC plugin, uses Dex to bridge LDAP/AD/GitHub, and leverages Istio external auth (Envoy) filter for network-level authz. Role aggregation maps service roles to per-namespace service accounts; project stats: 40+ companies, ~500 pods created in 28 days, 100+ contributors; Kubeflow 1.0 targets Jan 2020.
AI-written summary · about
chapters (16)
- 0:00Start
- 1:40An Overview of Kubeflow
- 2:30Kubeflow Services
- 4:09Multi-User Isolation
- 9:01Design Decision : Authentication using OIDC Protocol
- 9:28Design Decision Il: Istio Mesh
- 10:49Design Decision II: Istio Mesh
- 11:38Design Decision Ill: Identity Provider
- 15:58Part : High Level Services Solution
- 16:20Part II: Low Level Services Solution
- 18:41Low Level Service Authorization through RBACI
- 19:55Low Level Service RBAC Usage
- 24:27Low Level Service Authentication - OIDC Proxy
- 25:33Low Level Service Authentication - Service Account
- 27:14Next Steps
- 28:15Thank you! Questions?
related talks
14mKubeflow: Where ML Meets Kubernetes
37mTowards Kubeflow 1.0, Bringing a Cloud Native Platform For ML to Kubernetes
31mKubeflow - Data Science on Steroids
40mKubeflow: ML on OpenShift
39mDeploy your ML Workloads on Kubernetes with Kubeflow
44mEngaging the Kubeflow Community: Building an Enterprise-Ready AI/ML Platform
31mIntroduction to Using and Use Cases of KubeFlow
30mKubeflow, Your ML Tools on Kubernetes