Kubeflow
- Kubeflow Charmers | bundle
- Cloud
Channel | Revision | Published |
---|---|---|
latest/candidate | 294 | 24 Jan 2022 |
latest/beta | 430 | 30 Aug 2024 |
latest/edge | 423 | 26 Jul 2024 |
1.9/stable | 426 | 31 Jul 2024 |
1.9/beta | 420 | 19 Jul 2024 |
1.9/edge | 425 | 31 Jul 2024 |
1.8/stable | 414 | 22 Nov 2023 |
1.8/beta | 411 | 22 Nov 2023 |
1.8/edge | 413 | 22 Nov 2023 |
1.7/stable | 409 | 27 Oct 2023 |
1.7/beta | 408 | 27 Oct 2023 |
1.7/edge | 407 | 27 Oct 2023 |
juju deploy kubeflow --channel 1.9/stable
Deploy Kubernetes operators easily with Juju, the Universal Operator Lifecycle Manager. Need a Kubernetes cluster? Install MicroK8s to create a full CNCF-certified Kubernetes system in under 60 seconds.
Platform:
Charmed Kubeflow is a Juju bundle consisting of several charms integrated using Juju relations. See Kubeflow bundle for more details.
Below is an overview of all cryptographic processes handled by the charms integrated in the Kubeflow bundle.
The charms within the Kubeflow bundle that are not mentioned in this guide do not involve any cryptography in their logic.
admission-webhook
This charm is responsible for applying Kubeflow PodDefaults to newly created pods, and thus creates a MutatingWebhookConfiguration object for registering a webhook.
The charm code generates a self-signed X.509 certificate, so that the Kubernetes API server can confirm the workload container identity.
dex-auth
This charm is an operator for Dex, which provides authentication to Charmed Kubeflow. If the Dex builtin connector is used, the user password in the static_password
field is hashed with the bcrypt
library before being stored in the Dex configuration.
Additionally, the stored charm state is salted with bcrypt
to prevent reverse engineering.
istio-pilot
Charmed Kubeflow uses the Istio service mesh to enable end-to-end authentication and access control. The workload container of istio-pilot
is responsible for distributing an X.509 certificate using sha25withRSAEncryption
to every sidecar container in the following path: /var/run/secrets/istio/root-cerm.pem
.
When a workload container, i.e., the client, sends a request to another workload container, i.e., the server:
- Istio reroutes the outbound traffic to the client’s sidecar.
- The client’s sidecar starts an mTLS handshake with the server’s sidecar.
- The two sidecars establish an mTLS connection, and Istio forwards the traffic from the client to the server.
- The server sidecar authorises the request, and forwards the traffic to the backend service through local TCP connections.
The minimum required version of TLS is TLSv1_2
.
See Istio Mutual TLS authentication for more details.
Additionally, the charm uses the cert-handler library to generate an X.509 certificate for the Istio Gateway
object.
katib-controller
This charm creates a MutatingWebhookConfiguration
object that calls a webhook whenever a new Kubeflow experiment is created or updated.
Similar to the other charms that create MutatingWebhookConfiguration
objects, katib-controller
generates a self-signed X.509 certificate so that the Kubernetes API server can confirm the workload container identity.
kfp-persistence
This charm creates a service account token that is used to verify requests to the Kubeflow Pipelines service.
kserve-controller
This charm creates a MutatingWebhookConfiguration
object that calls a webhook whenever a new KServe InferenceService is created or updated.
Similar to the other charms that create MutatingWebhookConfiguration
objects, this charm generates a self-signed X.509 certificate so that the Kubernetes API server can confirm the workload container identity.
minio
This charm is an operator for MinIO, which provides S3 object storage. It uses a field in the object-storage
interface named secret-key
. Its value is created from a randomly generated 30-character string.
Additionally, the charm adds a randomly generated salt to its configuration before it is hashed with SHA-256, to prevent reverse engineering the secret-key
field.
oidc-gatekeeper
This charm uses the client-name
and client-secret
configuration options for the OpenID Connect client. Similarly to minio
, the value of secret-key
is created from a randomly generated 30-character string.
pvc-viewer
This charm creates a MutatingWebhookConfiguration
object that calls a webhook whenever a new PVCViewer is created or updated.
Similar to the other charms that create MutatingWebhookConfiguration
objects, this charm generates a self-signed X.509 certificate so that the Kubernetes API server can confirm the workload container identity.
Charm libraries
Some charms used in the Kubeflow bundle make use of the Grafana, Loki, and Prometheus libraries. These libraries are developed for the Canonical Observability Stack (COS). See COS-Lite cryptographic documentation for more details.