Secure access to KFAM (#6077)

kubeflow · Jan 20, 2022 · 0a79697 · 0a79697
1 parent 5ed0f5f
commit 0a79697
Show file tree

Hide file tree

Showing 6 changed files with 34 additions and 1 deletion.
diff --git a/components/centraldashboard/manifests/base/deployment.yaml b/components/centraldashboard/manifests/base/deployment.yaml
@@ -14,7 +14,7 @@ spec:
       labels:
         app: centraldashboard
       annotations:
-        sidecar.istio.io/inject: "false"
+        sidecar.istio.io/inject: "true"
     spec:
       containers:
       - name: centraldashboard

diff --git a/components/centraldashboard/manifests/overlays/istio/authorizationpolicy.yaml b/components/centraldashboard/manifests/overlays/istio/authorizationpolicy.yaml
@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: central-dashboard
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
+  selector:
+    matchLabels:
+      app: centraldashboard
diff --git a/components/centraldashboard/manifests/overlays/istio/kustomization.yaml b/components/centraldashboard/manifests/overlays/istio/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
 - ../../base
 - virtual-service.yaml
+- authorizationpolicy.yaml
 
 namespace: kubeflow
 

diff --git a/components/profile-controller/config/overlays/kubeflow/authorizationpolicy.yaml b/components/profile-controller/config/overlays/kubeflow/authorizationpolicy.yaml
@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: profiles-kfam
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/kubeflow/sa/centraldashboard
+  selector:
+    matchLabels:
+      kustomize.component: profiles
diff --git a/components/profile-controller/config/overlays/kubeflow/kustomization.yaml b/components/profile-controller/config/overlays/kubeflow/kustomization.yaml
@@ -5,6 +5,7 @@ resources:
 - ../../base
 - service.yaml
 - virtual-service.yaml
+- authorizationpolicy.yaml
 
 commonLabels:
   kustomize.component: profiles

diff --git a/components/profile-controller/config/overlays/kubeflow/patches/kfam.yaml b/components/profile-controller/config/overlays/kubeflow/patches/kfam.yaml
@@ -4,6 +4,9 @@ metadata:
   name: deployment
 spec:
   template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "true"
     spec:
       containers:
       - command: