Secure access to KFAM

components/centraldashboard/manifests/base/deployment.yaml

@@ -14,7 +14,7 @@ spec:
       labels:
         app: centraldashboard
       annotations:
-        sidecar.istio.io/inject: "false"
+        sidecar.istio.io/inject: "true"
     spec:
       containers:
       - name: centraldashboard

components/centraldashboard/manifests/overlays/istio/authorizationpolicy.yaml

@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: central-dashboard
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account
+  selector:
+    matchLabels:
+      app: centraldashboard

components/centraldashboard/manifests/overlays/istio/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
 - ../../base
 - virtual-service.yaml
+- authorizationpolicy.yaml
 
 namespace: kubeflow
 

components/profile-controller/config/overlays/kubeflow/authorizationpolicy.yaml

@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: profiles-kfam
+spec:
+  action: ALLOW
+  rules:
+    - from:
+        - source:
+            principals:
+              - cluster.local/ns/kubeflow/sa/centraldashboard
+  selector:
+    matchLabels:
+      kustomize.component: profiles

components/profile-controller/config/overlays/kubeflow/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
 - ../../base
 - service.yaml
 - virtual-service.yaml
+- authorizationpolicy.yaml
 
 commonLabels:
   kustomize.component: profiles

components/profile-controller/config/overlays/kubeflow/patches/kfam.yaml

@@ -4,6 +4,9 @@ metadata:
   name: deployment
 spec:
   template:
+    metadata:
+      annotations:
+        sidecar.istio.io/inject: "true"
     spec:
       containers:
       - command: