Service Mesh SSO(Auth) Integration

[jkoehler-redhat]

This is a tracker for all the various bits we will need to track to complete the feature work for incorporating Service Mesh into ODH.

Individual Efforts

• UX: N/A
  • Lead: N/A
• UI: N/A
  • Lead: N/A
• Dev: (add link to issue in github that captures all individual issues)
  • Lead: @bartoszmajsak
  • See below for tracking
  • Lead Operator: @VaishnaviHire
  • https://github.com/opendatahub-io/opendatahub-operator/issues/496
• QE: (add link)
  • Lead: TBD
• Doc: (add link)
  • Lead: TBD

[LaVLaS]

Updating the status from an offline conversation:

• ServiceMesh integration using a kfdef will be made avaiable using the odh-manifests/service-mesh-integration branch. Component owners can use this to start development & migration to enable support for ServiceMesh (Istio) in the respective components
• In parallel, the @opendatahub-io/service-mesh-integration team will be working on migrating their service-mesh-integration manifests to the new odh-operator v2.x kustomize manifest AND work on integrating ServiceMesh logic into the codebase
• Follow-up with the @opendatahub-io/odh-operator-maintainers will decide how they want to make the ODH Operator + ServiceMesh integration available for component owners to test against

[VaishnaviHire]

@bartoszmajsak @LaVLaS Following is the tracker issue for all the changes required for servicemesh in operator. This doesnot capture changes in individual repos. https://github.com/opendatahub-io/opendatahub-operator/issues/496

[bartoszmajsak]

Work items for enabling Service Mesh Auth(z) across ODH

Operator v2

• [ ] Bring Service Mesh configuration to Operator V2
  • [ ] https://github.com/opendatahub-io/opendatahub-operator/issues/496
  • [ ] https://github.com/opendatahub-io/opendatahub-operator/pull/605
  • [x] https://github.com/opendatahub-io/opendatahub-operator/pull/668 (Feature fluent interface for KServe setup)
• [ ] Add service-mesh overlays to supported components' manifests (as there is a split in the works)
  • for reasons you can read this ADR
  • the current state of migration is reflected in https://github.com/opendatahub-io/opendatahub-operator/blob/incubation/get_all_manifests.sh
  • https://github.com/opendatahub-io/odh-dashboard/pull/1900
  • https://github.com/opendatahub-io/kubeflow/pull/184
    • [x] done as part of https://github.com/opendatahub-io/kubeflow/pull/172

Authorization (cross-cutting)

Reference: Auth(z) redesign

• [x] Configure Authorino as an external authorization provider
• [ ] Create project-specific AuthConfig maistra/odh-project-controller#58
  • [ ] https://github.com/maistra/odh-project-controller/pull/64

Components

Dashboard

• [x] UI: https://github.com/opendatahub-io/odh-dashboard/issues/1087
  • https://github.com/opendatahub-io/odh-dashboard/pull/1088
• [x] Manifests: Configure Service Mesh for Dashboard

Workbenches

• [x] Manifests: Configure Service Mesh for Notebooks components
• [x] Adjust Istio logic in Kubeflow controllers to handle Openshift Service Mesh integration
  • https://github.com/opendatahub-io/kubeflow/pull/96
  • https://github.com/opendatahub-io/kubeflow/issues/168
    • PR https://github.com/opendatahub-io/kubeflow/pull/172
• [ ] https://github.com/opendatahub-io/opendatahub-operator/issues/616

KServe / Model Serving Auth(z) using Service Mesh

• [ ] Enable Service Mesh Auth(z) configuration for KServe in Operator-V2
  • https://github.com/opendatahub-io/opendatahub-operator/issues/614
• [ ] Handle KServe Domain pattern
  • https://github.com/opendatahub-io/kserve/issues/96
• [ ] Envoyfilter for Activator requests with Host context
  • https://github.com/maistra/opendatahub-operator/pull/13
• [ ] Workaround Envoy bug related to Authorization headers
  • https://github.com/maistra/opendatahub-operator/pull/13
• [ ] AuthorizationPolicy to capture gRPC calls (exclude health checks)
  • https://github.com/maistra/opendatahub-operator/pull/13
• [ ] Support anonymous models
  • https://github.com/opendatahub-io/odh-model-controller/issues/98

Pipelines

• [ ] https://github.com/opendatahub-io/opendatahub-operator/issues/615

Distributed Workloads

not started

~Operator v1~ not going to be supported

• [x] Initial/PoC integration]
  • https://github.com/opendatahub-io/odh-manifests/pull/818
• [ ] ~Implement proper resource reconciliation for KfDef~ not going to be supported for V1
  • https://github.com/opendatahub-io/opendatahub-operator/pull/515/
• [ ] ~Update upstream manifests repository~ not going to be supported
  • https://github.com/opendatahub-io/odh-manifests/pull/932

[jkoehler-redhat]

@bartoszmajsak can you please update the work complete date?

[zdtsw]

should "new" components like TrustyAI, Codeflare and KubeRay be added into the "work item" list too?

[astefanutti]

should "new" components like TrustyAI, Codeflare and KubeRay be added into the "work item" list too?

Codeflare and KubeRay fall into the Distributed Workloads item. We plan to start the integration ASAP, and we may break down the work items then.

[anishasthana]

@bartoszmajsak where would you like the issues to be created for tracking the DW pieces?

[bartoszmajsak]

@bartoszmajsak where would you like the issues to be created for tracking the DW pieces?

to be honest I do not have an answer to that... perhaps @jkoehler-redhat can suggest something?