Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kfp: Update Service account explanation in mult-user access #3037

Merged
merged 5 commits into from
Nov 3, 2021
Merged

kfp: Update Service account explanation in mult-user access #3037

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fbe818c
pipelines: Follow up on connecting to KFP in multi-user mode.
zijianjoy Oct 12, 2021
b4d3839
address comment
zijianjoy Oct 12, 2021
5a039c3
kfp: Update Service account explanation in mult-user access
zijianjoy Oct 19, 2021
e22ec65
Merge remote-tracking branch 'upstream/master' into followupkfpaccess
zijianjoy Oct 19, 2021
3431a66
clusterbinding
zijianjoy Oct 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion content/en/docs/components/pipelines/sdk/connect-api.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ Choose your use-case from one of the options below:
- mountPath: /var/run/secrets/kubeflow/pipelines
name: volume-kf-pipeline-token
readOnly: true
serviceAccountName: default-editor
volumes:
- name: volume-kf-pipeline-token
projected:
Expand All @@ -165,6 +166,11 @@ Choose your use-case from one of the options below:
audience: pipelines.kubeflow.org
```

Note that this example uses `default-editor` in `my-namespace` as the service account identity, but you can configure
to use any service account that runs in your Pod. You need to bind service account to cluster role `kubeflow-pipelines-edit`
or `kubeflow-pipelines-view` documented in
[view-edit-cluster-roles.yaml](https://github.com/kubeflow/pipelines/blob/master/manifests/kustomize/base/installs/multi-user/view-edit-cluster-roles.yaml#L7-L32).

#### Managing access to Kubeflow Pipelines API across namespaces

As already mentioned, access to Kubeflow Pipelines API requires per namespace setup.
Expand Down Expand Up @@ -207,7 +213,7 @@ Cross-namespace access can be achieved in two ways:

#### How Multi-User mode in-cluster authentication works

When calling Kubeflow Pipelines API in the same cluster, Kubeflow Pipelines SDK authenticates itself as `default-editor` in your namespace using ServiceAccountToken
When calling Kubeflow Pipelines API in the same cluster, Kubeflow Pipelines SDK authenticates itself as your Pod's service account in your namespace using ServiceAccountToken
[projection](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection). This is where a verifiable token with a limited lifetime is being injected into a Pod (e.g. Jupyter notebook's).

Then Kubeflow Pipelines SDK uses this token to authorize against Kubeflow Pipelines API.
Expand Down