update kubeflow dip-catalog

2025-01-13 02:31:27 +00:00
parent 1dc1181a03
commit 5451f16d72
1959 changed files with 602337 additions and 0 deletions
@@ -0,0 +1,23 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: istio-ingressgateway-oauth2-proxy
+  namespace: istio-system
+spec:
+  action: CUSTOM
+  provider:
+    name: oauth2-proxy
+  selector:
+    matchLabels:
+      app: istio-ingressgateway
+  rules:
+  - to:
+    - operation:
+        notPaths:
+        - /favicon*
+        - /webcomponentsjs*
+        - /vendor.bundle.js
+        - /app.bundle.js
+        - /dashboard_lib.bundle.js
+        - /assets*
+        - /app.css
@@ -0,0 +1,14 @@
+apiVersion: security.istio.io/v1beta1
+kind: AuthorizationPolicy
+metadata:
+  name: istio-ingressgateway-oauth2-proxy
+  namespace: istio-system
+spec:
+  action: CUSTOM
+  provider:
+    name: oauth2-proxy
+  selector:
+    matchLabels:
+      app: istio-ingressgateway
+  rules:
+  - {}
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+- authorizationpolicy.istio-ingressgateway-oauth2-proxy.yaml
+
+# If you're running Kubeflow behind CloudFlare, use 
+# authorizationpolicy.istio-ingressgateway-oauth2-proxy-cloudflare.yaml
+# instead of 
+# authorizationpolicy.istio-ingressgateway-oauth2-proxy.yaml
@@ -0,0 +1,19 @@
+apiVersion: security.istio.io/v1beta1
+kind: RequestAuthentication
+metadata:
+  name: dex-jwt
+  namespace: istio-system
+spec:
+  jwtRules:
+    # forwardOriginalToken must be set to true so the authorization header will
+    # be passed between Kubeflow Components and Istio can configure the
+    # Kubeflow Auth Headers based on this request authorization header.
+    - forwardOriginalToken: true
+      issuer: http://dex.auth.svc.cluster.local:5556/dex
+      # These 5 lines provides integration of istio/oauth2-proxy with
+      # Kubeflow custom auth headers.
+      outputClaimToHeaders:
+        - header: kubeflow-userid
+          claim: email
+        - header: kubeflow-groups
+          claim: groups