Skip to content

feat: KFP multi user mode PR2 - secure KFP with istio mTLS and authz #1368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
k8s-ci-robot merged 61 commits into from
Jul 10, 2020
Merged

feat: KFP multi user mode PR2 - secure KFP with istio mTLS and authz #1368

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
61 commits
Select commit Hold shift + click to select a range
1c43da3
Add argo to stacks/generic
Bobgy Jun 11, 2020
9e9c725
Pull pipelines manifest from upstream
Bobgy Jun 11, 2020
3fa9d21
Updated kfp
Bobgy Jun 11, 2020
50f2ff5
Minio v3 manifests
Bobgy Jun 11, 2020
b2cc166
Rename minio configmap
Bobgy Jun 11, 2020
f33ea93
Add generic minio install
Bobgy Jun 12, 2020
6151fe9
Generate new test data
Bobgy Jun 12, 2020
d396143
Mysql kustomize v3 manifest - generic install
Bobgy Jun 12, 2020
2544716
Add mysql gcp pd install
Bobgy Jun 12, 2020
0a259a1
Generate test data
Bobgy Jun 12, 2020
b364e06
Pipelines kustomize v3 manifests
Bobgy Jun 12, 2020
2f59319
Add kfp ui virtual service
Bobgy Jun 12, 2020
569c640
Add metadata deployment to stacks/generic
Bobgy Jun 12, 2020
a3e5c3a
Use common cluster domain
Bobgy Jun 12, 2020
cfda2d9
Deploy metadata writer
Bobgy Jun 12, 2020
0a4770b
Add kfp cache server
Bobgy Jun 12, 2020
7907d06
Update test data
Bobgy Jun 12, 2020
400aa0b
Merge remote-tracking branch 'upstream/master' into v3_kfp
Bobgy Jun 15, 2020
d4b33b6
Enable KFP multi user mode without istio security
Bobgy Jun 15, 2020
5530b2a
Fix persistence agent watch namespace
Bobgy Jun 15, 2020
97424f1
Fix namespace env for some deployments
Bobgy Jun 16, 2020
805d6da
Fix cluster roles and bindings
Bobgy Jun 16, 2020
7c32e6f
fix rename
Bobgy Jun 16, 2020
7bddf40
Fix pipelines ui role
Bobgy Jun 16, 2020
88cc01b
Updated kfp to rc2
Bobgy Jun 17, 2020
5f92c94
simplify pipeline v3 manifest using updated kfp rc2 manifest
Bobgy Jun 17, 2020
59b8ff9
Fix pipeline-install-config
Bobgy Jun 17, 2020
72e598d
remove redundant configmap
Bobgy Jun 17, 2020
66658b9
update tests
Bobgy Jun 17, 2020
7358da0
Merge branch 'v3_kfp' into kfp_multi_user_without_istio
Bobgy Jun 17, 2020
1eb4d56
updated to kfp 1.0.0-rc.3
Bobgy Jul 3, 2020
9bc841b
Adapt to kfp 1.0rc3 refactoring
Bobgy Jul 3, 2020
e73382b
update test snapshots
Bobgy Jul 3, 2020
b7c6795
Merge branch 'kfp_rc3' into kfp_multi_user_without_istio
Bobgy Jul 3, 2020
03a63d8
fix pull kfp script to detect empty dir
Bobgy Jul 3, 2020
0df67aa
fix example ref
Bobgy Jul 3, 2020
28452a3
update snapshot
Bobgy Jul 3, 2020
4faf673
fix gcp pd manifest
Bobgy Jul 3, 2020
2b35d9e
Update stacks ref
Bobgy Jul 3, 2020
6df2abc
revert alice example to gcp stack
Bobgy Jul 3, 2020
0230d0c
update snapshot
Bobgy Jul 3, 2020
5b3d882
fix profile controller iam binding
Bobgy Jul 3, 2020
2c5f8d0
Merge remote-tracking branch 'upstream/master' into kfp_multi_user_wi…
Bobgy Jul 6, 2020
30552d1
Update kfp profile controller can be configured to different images and
Bobgy Jul 6, 2020
604e8b2
Merge remote-tracking branch 'upstream/master' into kfp_multi_user_wi…
Bobgy Jul 7, 2020
c71bf14
add missing viewer controller cluster roles
Bobgy Jul 7, 2020
4f2f96c
Use python3 for sync.py
Bobgy Jul 7, 2020
78b3eea
Revert gcp stack back to use non multi user kfp
Bobgy Jul 7, 2020
09cdd13
revert unintended changes
Bobgy Jul 7, 2020
e0baea1
revert upstream changes
Bobgy Jul 7, 2020
3f6d7d8
Secure kfp multi user mode with istio authorization
Bobgy Jul 7, 2020
b4e2ba5
patch minio to disable istio sidecar injection
Bobgy Jul 7, 2020
c3cbc60
Merge remote-tracking branch 'upstream/master' into kfp_multi_user_wi…
Bobgy Jul 8, 2020
54d9ade
fix cache server istio authz
Bobgy Jul 8, 2020
ed2f9d0
enable istio sidecar for profiles deploy
Bobgy Jul 8, 2020
d3938b8
enable istio sidecar for centraldashboard
Bobgy Jul 9, 2020
b00c0e1
Do not protect profile controller with istio
Bobgy Jul 9, 2020
ac238af
Allow admission webhook traffic to cache-server
Bobgy Jul 9, 2020
65584c7
revert gcp stack back to pipeline generic
Bobgy Jul 9, 2020
c7401c1
Reuse minio generic install as base for gcp-pd and ibm
Bobgy Jul 9, 2020
90a0c81
update snapshot
Bobgy Jul 9, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
120 changes: 120 additions & 0 deletions pipeline/installs/multi-user/istio-authorization-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,120 @@
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: ml-pipeline-ui
namespace: kubeflow
spec:
rules:
- services:
- ml-pipeline-ui.kubeflow.svc.cluster.local
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole

@Bobgy Bobgy Jul 9, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note service role is deprecated for istio, but they still work in istio 1.4.x.

I'd prefer leaving this here for a while and migrate when all platforms upgrade to later istio versions.

metadata:
name: ml-pipeline-services
namespace: kubeflow
spec:
rules:
- services:
- ml-pipeline.kubeflow.svc.cluster.local
- ml-pipeline-ui.kubeflow.svc.cluster.local
- ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
- mysql.kubeflow.svc.cluster.local
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: bind-gateway-ml-pipeline-ui
namespace: kubeflow
spec:
subjects:
- properties:
source.namespace: istio-system # gateway
roleRef:
kind: ServiceRole
name: ml-pipeline-ui
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: bind-ml-pipeline-internal
namespace: kubeflow
spec:
subjects:
- properties:
source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline
- properties:
source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-ui
- properties:
source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-persistenceagent
- properties:
source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-scheduledworkflow
- properties:
source.principal: cluster.local/ns/kubeflow/sa/ml-pipeline-viewer-crd-service-account
- properties:
source.principal: cluster.local/ns/kubeflow/sa/kubeflow-pipelines-cache
roleRef:
kind: ServiceRole
name: ml-pipeline-services
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
name: ml-pipeline-ui
spec:
host: ml-pipeline-ui.kubeflow.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
name: ml-pipeline
spec:
host: ml-pipeline.kubeflow.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
name: ml-pipeline-visualizationserver
spec:
host: ml-pipeline-visualizationserver.kubeflow.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL
---
apiVersion: "networking.istio.io/v1alpha3"
kind: DestinationRule
metadata:
name: ml-pipeline-mysql
spec:
host: mysql.kubeflow.svc.cluster.local
trafficPolicy:
tls:
mode: ISTIO_MUTUAL
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: cache-server
namespace: kubeflow
spec:
rules:
- services:
- cache-server.kubeflow.svc.cluster.local
---
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: bind-cache-server-admission-webhook
namespace: kubeflow
spec:
subjects:
- user: "*"
roleRef:
kind: ServiceRole
name: cache-server
1 change: 1 addition & 0 deletions pipeline/installs/multi-user/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ resources:
- persistence-agent
- cache
- metadata-writer
- istio-authorization-config.yaml
patchesStrategicMerge:
- api-service/deployment-patch.yaml
- pipelines-ui/deployment-patch.yaml
Expand Down
3 changes: 1 addition & 2 deletions pipeline/installs/multi-user/pipelines-profile-controller/params.env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,2 @@
KFP_VERSION=1.0.0-rc.3
# TODO: make visualization server work with sidecar
DISABLE_ISTIO_SIDECAR=true
DISABLE_ISTIO_SIDECAR=false
3 changes: 1 addition & 2 deletions pipeline/minio/installs/gcp-pd/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,8 @@ commonLabels:
app.kubernetes.io/component: minio
app.kubernetes.io/name: minio
resources:
- ../../../upstream/env/platform-agnostic/minio/
- ../generic
- persistent-volume.yaml
- ../../overlays/application/application.yaml
patchesStrategicMerge:
- persistent-volume-claim.yaml
configMapGenerator:
Expand Down
9 changes: 9 additions & 0 deletions pipeline/minio/installs/generic/deployment-patch.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: minio
spec:
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
2 changes: 2 additions & 0 deletions pipeline/minio/installs/generic/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,5 @@ commonLabels:
resources:
- ../../../upstream/env/platform-agnostic/minio/
- ../../overlays/application/application.yaml
patchesStrategicMerge:
- deployment-patch.yaml
3 changes: 1 addition & 2 deletions pipeline/minio/installs/ibm/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,7 @@ commonLabels:
app.kubernetes.io/component: minio
app.kubernetes.io/name: minio
resources:
- ../../../upstream/env/platform-agnostic/minio/
- ../../overlays/application/application.yaml
- ../generic
- persistent-volume-claim.yaml
patchesStrategicMerge:
- deployment-patch.yaml
Expand Down
2 changes: 2 additions & 0 deletions tests/stacks/examples/alice/test_data/expected/apps_v1_deployment_minio.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ spec:
type: Recreate
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
labels:
app: minio
app.kubernetes.io/component: minio
Expand Down
2 changes: 2 additions & 0 deletions tests/stacks/gcp/test_data/expected/apps_v1_deployment_minio.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ spec:
type: Recreate
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
labels:
app: minio
app.kubernetes.io/component: minio
Expand Down
2 changes: 2 additions & 0 deletions tests/stacks/generic/test_data/expected/apps_v1_deployment_minio.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ spec:
type: Recreate
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
labels:
app: minio
app.kubernetes.io/component: minio
Expand Down
2 changes: 2 additions & 0 deletions tests/stacks/ibm/test_data/expected/apps_v1_deployment_minio.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ spec:
type: Recreate
template:
metadata:
annotations:
sidecar.istio.io/inject: "false"
labels:
app: minio
app.kubernetes.io/component: minio
Expand Down