k8s multi tenancy group support

[kunmingg]

/kind feature

Exploring necessary components to enable multi tenancy working with groups.

Describe the solution you'd like:
[A clear and concise description of what you want to happen.]

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

[issue-label-bot]

Issue Label Bot is not confident enough to auto-label this issue.
See dashboard for more details.

[nrchakradhar]

/cc @nrchakradhar

[jlewi]

@kunmingg could you elaborate on what the goal of this issue is and what work needs to be completed?

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[yanniszark]

/remove-lifecyle stale
/lifecycle frozen

[lalithvaka]

Was looking into this doc https://docs.google.com/document/d/1C3J30zHDh_qxqbb-HAfmk6gs-s4QcF26nAQMo9AKb_4/edit. Not sure if the groups defined in this document

• "Privileged User Group (ML Engineers),
• Model Builder/Training Group (Data Scientists),
• Serving Group"

are followed or not in 1.0.1 release!. Here is what I see this working well in organizations to have a

• Data science Project group(s) at the top
  - "Privileged User Group (ML Engineers),
  - Model Builder/Training Group (Data Scientists),
  - Serving Group"

with three sub groups as defined above for each project team operating in an ML platform. These groups are defined at the Active Directory level and each project group will get its own namespace (profile) and all users who belong to this top level group or subgroup will get privileges accordingly as defined in the document.
Passing the Group information through JWT tokens can be controlled at the IAM policy level. Project group namespace(profile) creation (auto/ manual) need little more thought.

I would also propose we provide an option to enable / disable for automatic profile creation for individual users logging into the Kubeflow central dashboard 1.0.1 with out any group. In an enterprise setting enabling automatic individual profiles may not work if every one who can SSO into the Kubeflow central dashboard gets a new namespace through profiles.

It's better to discuss these in a meeting setting than one sided.

[krishnadurai]

Thanks @lalithvaka for your input on this issue.

We have to look for a solution to consume the 'group' claim in the OIDC spec for auth. This will require a few changes in applications defined in Kubeflow, which include:

1. Jupyter NB
2. Profile controller

Apart from these, we might have to adapt kubeflow-roles to include specific groups for enabling or disabling permissions.

[kunmingg]

At minimum we need group support for both k8s rbac and istio rbac.

On GCP:

1. k8s rbac group support: https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control?&_ga=2.65111726.-1203667031.1546636905#google-groups-for-gke
2. istio rbac is still not clear, on option is to have a reconcile server to update users in group with proper istio policy.

[issue-label-bot]

Issue-Label Bot is automatically applying the labels:

Label	Probability
area/centraldashboard	0.95

Please mark this comment with 👍 or 👎 to give our bot feedback!
Links: app homepage, dashboard and code for this bot.

[issue-label-bot]

Issue-Label Bot is automatically applying the labels:

Label	Probability
area/centraldashboard	0.95

Please mark this comment with 👍 or 👎 to give our bot feedback!
Links: app homepage, dashboard and code for this bot.

[micemuni]

I am also waiting for this "to enable multi tenancy working with groups" implementation, is that expected in next release of kubeflow..?

[vinayan3]

Any updates on this?

I'd like to have groups similar to the @lalithvaka where we have a couple of high level groups and users associated into one of them. This group information is already in our OIDC provider and managed there. Based on the latest Kubeflow it looks like this would have to be done within Kubeflow which duplicates the data.