Getting Started with Multi-user Isolation

How to use multi-user isolation with profiles

This Kubeflow component has stable status. See theKubeflow versioning policies.

Usage overview

After Kubeflow is installed and configured, you will by defaultbe accessing your primary profile. A profile owns a Kubernetes namespace ofthe same name along with a collection of Kubernetes resources. Users have viewand modify access to their primary profiles. You can shareaccess to your profile with another user in the system. When sharing the accessto a profile with another user, you can choose to whether provide only read access or read/modifyaccess. For all practical purposes when workingthrough the Kubeflow central dashboard, the active namespace is directly tiedwith the active profile.

Example of usage

You can select your active profile from the top bar on the Kubeflow centraldashboard. Note that you can only view the profiles in the dropdown listto which you have view or modify access.

This guide illustrates the user isolation functionality using the Jupyternotebooks service which is the first service in the system to have fullintegration with the multi-user isolation functionality.

Once an active profile has been selected, the Notebooks Servers UIwill display only the active notebook servers in the currently selectedprofile. All other notebook servers remain hidden from you. If you switchthe active profile, the view will switch the list of active notebooksappropriately. You can connect to any of the listed notebook servers andview and modify the existing Jupyter notebooks available in the server.

For example, the following image shows the list of Notebook servers availablein a user’s primary profile:

And when an unauthorized user accesses the Notebooks in this profile, they arepresented with an error.

When you create Jupyter notebook servers from the Notebooks Servers UI,the notebook pods are created in your active profile. If you don’t havemodify access to the active profile, you can only browse currently activenotebook servers and access the existing jupyter notebooks but cannot createnew notebook servers in that profile. You can create notebookservers in your primary profile which they have view and modify access to.

Onboarding a new user

Kubeflow v1.0 provides automatic profile creation for authenticated users onfirst login. Additionally, an administrator can create a profile for anyuser in the kubeflow cluster. Here an administrator is a person who hascluster-adminrole binding in the Kubernetes cluster. This person has permissions to createand modify Kubernetes resources in the cluster. For example, the person whodeployed Kubeflow will have administration privileges in the cluster.

Pre-requisites: grant user minimal Kubernetes cluster view access

User should be given minimal permission scope that allows them to connect to the Kubernetes cluster.For example for GCP users, they can be granted IAM roles: Kubernetes Engine Cluster Viewer and IAP-secured Web App User

Automatic creation of profiles

Kubeflow v1.0 provides automatic profile creations as a convenienceto the users:

• Kubeflow deployment process automatically creates a profile for the userperforming the deployment. When the user access the Central Dashboardthey’ll already see their profile in the dropdown list.
• When an authenticated user logs into the system and visits the CentralDashboard for the first time, they trigger a profile creation automaticlly.
  • A brief message introduces profiles
  • The user can name their profile and click Finish.
  • This redirects the user to the dashboard where they can view and selectthier profile in the dropdown list.

Manual profile creation

An administrator can manually create profiles for users as described below.

Create aprofile.yaml file with the following contents on your local machine:

$ cat << EOF > profile.yaml
apiVersion: kubeflow.org/v1beta1
kind: Profile
metadata:
  name: profileName   # replace with the name of profile you want, this will be user's namespace name
spec:
  owner:
    kind: User
    name: userid@email.com   # replace with the email of the user
EOF

Create the corresponding profile resource using:

$ kubectl create -f profile.yaml

The above creates a profile named profileName whose owner isuserid@email.com and has view and modify access to that profile.The following resources are created as part of the profile creation:

• A Kubernetes namespace that shares the same name with the correspondingprofile.
• Kubernetes RBAC rolebinding for the namespace Admin. This makes theprofile owner the namespace admin, allowing access to the namespace viaKubernetes API (using kubectl).
• Istio namespace-scoped ServiceRole ns-access-istio. This allows access toall services in the target namespace via Istio routing.
• Istio namespace-scoped ServiceRoleBinding owner-binding-istio. This bindsthe ServiceRole ns-access-istio to the profile owner. The profile owner cantherefore access services in the namespace created.
• Namespace-scoped service-accounts editor and viewer to be used byuser-created pods in above namespace.

Note: Due to a 1-to-1 correspondence of Profiles with KubernetesNamespaces, Profiles and Namespaces are sometimes used interchangably in thedocumentation.

Batch creation of user profiles

Administrators might want to create profiles for multiple users as a batch. This canbe done by creating a profile.yaml on the local machine with multiple sections ofprofile descriptions as shown below:

$ cat << EOF > profile.yaml
apiVersion: kubeflow.org/v1beta1
kind: Profile
metadata:
  name: profileName1   # replace with the name of profile you want
spec:
  owner:
    kind: User
    name: userid1@email.com   # replace with the email of the user
---
apiVersion: kubeflow.org/v1beta1
kind: Profile
metadata:
  name: profileName2   # replace with the name of profile you want
spec:
  owner:
    kind: User
    name: userid2@email.com   # replace with the email of the user
EOF

Apply to the Kubernetes cluster using:

kubectl create -f profile.yaml

This will create multiple profiles for each individual listed in the sectionsin profile.yaml.

Listing and describing profiles

An administrator can list the existing profiles in the system:

$ kubectl get profiles

and describe a specific profile using:

$ kubectl describe profile profileName

Deleting an existing profile

An administrator can delete an existing profile using:

$ kubectl delete profile profileName

This will delete the profile, the corresponding namespace and any Kubernetesresources associated with the profile. The profile’s owner or other users withaccess to the profile will no longer have access to the profile and will not seeit in the dropdown list on the central dashboard.

Managing contributors through UI

Kubeflow v1.0 allows sharing of profiles with other users in thesystem. An owner of a profile can share access to their profile using theManage Contributors tab available through the dashboard.

Here is an example of the Manage Contributors tab view:

Notice that in the above view the account associated with the profile isCluster Admin as this account was used to deploy Kubeflow. It lists theprofiles accessible to the user along with the role associated with thatprofile.

Adding and removing contributors is easily possible by simply adding/removing theemail address or the user identifier in the Contributors to your namespace field.

Once added, the Manage Contributors tab will show the profiles with thiercorresponding contributors listed. Note that Cluster Admin can view all theprofiles in the system along with their contributors.

The contributors will have access to all the Kubernetes resources in thenamespace and will be able to created notebook servers as well as accessexisting notebooks. The contributor’s access can be removed by the owner of aprofile by visiting the Manage Contributors tab and removing the useremail/id from the list of contributors.

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.

Last modified 18.02.2020: Refactor multiuser guides (#1682) (688286b9)