Kubeflow access and control boundaries

Kubeflow access and control boundaries An architecture diagram generated by Archify. Identity and gateway · IdP / oauth2-proxy / Istio · Architecture component Identity and gateway IdP / oauth2-proxy / Istio Dashboard and web apps · navigation and component requests · Architecture component Dashboard and web apps navigation and component requests Component APIs · KFP API / authorization / storage · Architecture component Component APIs KFP API / authorization / storage Profile Controller / KFAM · ownership / access / optional quota · Architecture component Profile Controller / KFAM ownership / access / optional quota Kubernetes API Server · RBAC / resource state · Architecture component Kubernetes API Server RBAC / resource state Workload controllers · Notebook / Katib / Trainer / KServe · Architecture component Workload controllers Notebook / Katib / Trainer / KServe authenticated UI request component-specific requests namespace / policy reconciliation supported resource reconciliation K8s calls where implemented Legend Frontend Backend Security

Profile scope

  • • Managed quota is created only with resourceQuotaSpec.hard.
  • • NetworkPolicy, storage, AWS IAM and app authorization are separate.

APIs and data

  • • KFP Run/Experiment concepts are not universally CRDs.
  • • Dashboard does not dispatch work to every controller.