Manage Multi-tenant ML Workloads Using Istio
summary
Shows an implementation of Istio + Kubeflow that enforces namespace-per-tenant isolation, issues workload identities and short-lived mTLS certificates, and uses JWT end-user auth at ingress to restrict notebook and serving access. Demonstrates role-based Istio AuthorizationPolicies tied to email claims, per-tenant telemetry routed to Stackdriver/Prometheus, and traffic-splitting mirroring for safe model rollouts. Demo verifies access-denied for cross-tenant notebooks and creating isolated user workspaces.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:04What does Istio do?
- 2:15Istio Architectural Components
- 3:28Multi-tenant ML Workloads
- 4:32Challenges on Multi-Tenancy
- 6:57Case Study: Kubeflow
- 10:57User Access Isolation: End User Authentication
- 12:40User Access Isolation: Authorization
- 14:34Istio Traffic Management
- 16:04Demo
- 20:45Come Participatel
related talks
28mEnabling Kubeflow with Enterprise-Grade Auth for On-Prem Deployments
26mRunning Machine Learning Workloads on a Service Mesh
30mEmbracing Multi-Tenancy While Scaling MLOps
34mKubeflow: Multi-Tenant, Self-Serve, Accelerated Platform for Practitioners
26mEmbracing Multi-Tenancy While Scaling MLOps
31mKubernetes for Machine Learning: Managing and Scaling AI Workloads
32mE2E ML Platform on Kubernetes with just a few clicks
46mDeploying scalable Machine Learning models with Kubernetes