mirror of
https://github.com/hanzo-ml/katib.git
synced 2026-10-30 14:46:14 +00:00
apogerandGitHub
6e1ea05fe3
* Upgrade manifests to enable authorization check mechanisms for katib-UI Changes to install-with-kubeflow manifests: * Enable istio sidecar injection for katib-ui component * Add AuthorizationPolicy to allow only istio-ingressgateway to talk to katib-ui [user traffic]. * Set APP_DISABLE_AUTH ENV var to false when in kubeflow-mode to enable authorization checks in UI's backend * Extend the RBAC persmissions of katib-ui so it can crate SAR objects when in kubeflow-mode Signed-off-by: Apostolos Gerakaris <[email protected]> * UI(back): Secure /katib/fetch_trial/ route Introduce authn/authz checks in the backend Signed-off-by: Apostolos Gerakaris <[email protected]> * review: Remove duplicate dependencies Signed-off-by: Apostolos Gerakaris <[email protected]> * review: Move patch to a separate file Signed-off-by: Apostolos Gerakaris <[email protected]> Signed-off-by: Apostolos Gerakaris <[email protected]>
16 lines
344 B
YAML
16 lines
344 B
YAML
---
|
|
apiVersion: security.istio.io/v1beta1
|
|
kind: AuthorizationPolicy
|
|
metadata:
|
|
name: katib-ui
|
|
namespace: kubeflow
|
|
spec:
|
|
action: ALLOW
|
|
selector:
|
|
matchLabels:
|
|
katib.kubeflow.org/component: ui
|
|
rules:
|
|
- from:
|
|
- source:
|
|
principals: ["cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"]
|