Use ISTIO to restrict access to Jupyter Notebooks

[jlewi]

Background: #1630

We would like to use ISTIO to secure access to Jupyter notebooks. This is part of the larger effort (#1630) to replace JupyterHub with a set of Cloud Native microservices to manage notebooks.

I think what we want to do is be able to spawn notebooks for each user in their own namespace. We can then rely on RBAC to restrict access to the K8s resources.

However, we still need a way to restrict access to the Jupyter web servers. For this I think we'd like to use ISTIO.

A strawman would be to use ISTIO and JWT's to restrict access to specific notebooks. So we would use ISTIO to enforce policies restricting access to specific notebooks to specific users.

ISTIO would use the JWT in the request to determine the identity of the user making the request.

[lluunn]

cc

[lluunn]

related: #1907

[jlewi]

Should we close this as a duplicate of #2173 ?

[lluunn]

dup of #2173