search

zenml-io / mlstacks

A series of Terraform based recipes to provision popular MLOps stacks on the cloud.
https://mlstacks.zenml.io/
Apache License 2.0
246 stars 32 forks source link

Mlflow is exposed with basic authentication without TLS #25

Closed fg91 closed 1 year ago

fg91 commented 1 year ago

The gcp-kubeflow-kserve stack recipe deploys the mlflow tracking server which is exposed with a Nginx Ingress. The deployed tracking server is configured to use only basic authentication (username + password) but does so over plain http without TLS encryption. This is dangerous (see here, here) since the credentials which are sent with every request when using basic auth are then not encrypted.

wjayesh commented 1 year ago

Hi @fg91! Thanks for raising concern on the security of the MLflow tracking server. Right now, the setup is very basic as you pointed out but I'm open to hearing any suggestions you have to make it better.