Service Mesh SSO(Auth) Integration

[jkoehler-redhat]

This is a tracker for all the various bits we will need to track to complete the feature work for incorporating Service Mesh into ODH.

Individual Efforts

• UX: N/A
  • Lead: N/A
• UI: N/A
  • Lead: N/A
• Dev: (add link to issue in github that captures all individual issues)
  • Lead: @bartoszmajsak
  • See below for tracking
  • Lead Operator: @VaishnaviHire
  • Integration of Servicemesh + Authorino with operator opendatahub-operator#496
• QE: (add link)
  • Lead: TBD
• Doc: (add link)
  • Lead: TBD

[LaVLaS]

Updating the status from an offline conversation:

• ServiceMesh integration using a kfdef will be made avaiable using the odh-manifests/service-mesh-integration branch. Component owners can use this to start development & migration to enable support for ServiceMesh (Istio) in the respective components
• In parallel, the @opendatahub-io/service-mesh-integration team will be working on migrating their service-mesh-integration manifests to the new odh-operator v2.x kustomize manifest AND work on integrating ServiceMesh logic into the codebase
• Follow-up with the @opendatahub-io/odh-operator-maintainers will decide how they want to make the ODH Operator + ServiceMesh integration available for component owners to test against

[VaishnaviHire]

@bartoszmajsak @LaVLaS Following is the tracker issue for all the changes required for servicemesh in operator. This doesnot capture changes in individual repos.
opendatahub-io/opendatahub-operator#496

[bartoszmajsak]

Work items for enabling Service Mesh Auth(z) across ODH

Operator v2

• Bring Service Mesh configuration to Operator V2
  • Integration of Servicemesh + Authorino with operator opendatahub-operator#496
  • feat(service-mesh): adds service mesh authz support for Dashboard and Workbenches opendatahub-operator#605
  • feat: introduces features fluent interface opendatahub-operator#668 (Feature fluent interface for KServe setup)
• Add service-mesh overlays to supported components' manifests (as there is a split in the works)
  • for reasons you can read this ADR
  • the current state of migration is reflected in https://github.com/opendatahub-io/opendatahub-operator/blob/incubation/get_all_manifests.sh
  • OSSM: Add service mesh manifests overlay odh-dashboard#1900
  • OSSM: Add SM overlays to notebook-controller manifests kubeflow#184
    • done as part of feat: disables features not needed for Istio deployments kubeflow#172

Authorization (cross-cutting)

Reference: Auth(z) redesign

• Configure Authorino as an external authorization provider
• Create project-specific AuthConfig maistra/odh-project-controller#58
  • feat: create project level authorino authconfig maistra/odh-project-controller#64

Components

Dashboard

• UI: [Feature Request]: Support use of Service Mesh for routing odh-dashboard#1087
  • feat(ossm): adds OSSM annotations to the relevant cluster resources odh-dashboard#1088
• Manifests: Configure Service Mesh for Dashboard

Workbenches

• Manifests: Configure Service Mesh for Notebooks components
• Adjust Istio logic in Kubeflow controllers to handle Openshift Service Mesh integration
  • feat: disables features not needed for Istio deployments kubeflow#96
  • v1.7 branch is missing Service Mesh logic for handling notebooks kubeflow#168
    • PR feat: disables features not needed for Istio deployments kubeflow#172
• Jupyter application fails to start when Service Mesh is enabled opendatahub-operator#616

KServe / Model Serving Auth(z) using Service Mesh

• Enable Service Mesh Auth(z) configuration for KServe in Operator-V2
  • Enable Service Mesh Auth(z) settings for KServe opendatahub-operator#614
• Handle KServe Domain pattern
  • Change in domain templates kserve#96
• Envoyfilter for Activator requests with Host context
  • feat: support kserve with authorino  maistra/opendatahub-operator#13
• Workaround Envoy bug related to Authorization headers
  • feat: support kserve with authorino  maistra/opendatahub-operator#13
• AuthorizationPolicy to capture gRPC calls (exclude health checks)
  • feat: support kserve with authorino  maistra/opendatahub-operator#13
• Support anonymous models
  • Support anonymous models odh-model-controller#98

Pipelines

• Enable Pipeline component to use Service Mesh opendatahub-operator#615

Distributed Workloads

not started

Operator v1 not going to be supported

• Initial/PoC integration]
  • feat(mvp): enabling service mesh for ODH odh-manifests#818
• Implement proper resource reconciliation for KfDef not going to be supported for V1
  • feat: introduces OSSM plugin for KfDef opendatahub-operator#515
• Update upstream manifests repository not going to be supported
  • feat: simplifies manifest structure for the plugin odh-manifests#932

[jkoehler-redhat]

@bartoszmajsak can you please update the work complete date?

[zdtsw]

should "new" components like TrustyAI, Codeflare and KubeRay be added into the "work item" list too?

[astefanutti]

should "new" components like TrustyAI, Codeflare and KubeRay be added into the "work item" list too?

Codeflare and KubeRay fall into the Distributed Workloads item. We plan to start the integration ASAP, and we may break down the work items then.

[anishasthana]

@bartoszmajsak where would you like the issues to be created for tracking the DW pieces?

[bartoszmajsak]

@bartoszmajsak where would you like the issues to be created for tracking the DW pieces?

to be honest I do not have an answer to that... perhaps @jkoehler-redhat can suggest something?