Is there an existing feature request for this?
Problem or Motivation
Add basic (coarse) AuthZ to support multiple project teams sharing one KubeAirunway instance via namespace isolation (e.g., AKS-style). Avoids “one deploy per team” sprawl while ensuring security.
Motivation:
- IT teams need quick stamp-outs but shared GPU/compute efficiency.
- Current single-namespace limits multi-tenancy.
Requirements:
- Web UI auth (OIDC/basic) maps users/groups to namespaces
- RBAC enforcement: can-i hecks for create/list in user’s ns only
- Inference CRDs scoped to spec.namespace
- Namespace quotas for resources/models
Prototype with Keycloak/OIDC proxy for feedback
Proposed Solution
Auth Flow:
- Login -> Impersonate SA bound to user's ns.
- UI filters resources to authorized ns.
- Controller mutates/admits based on ns RBAC.
Quotas via K8s ResourceQuota.
MVP Scope:
- OIDC integration + ns selector in UI.
- Tests for cross-ns denial.
Alternatives Considered
Reverse ProxyBased Approach
Deploy as a sidecar or ingress proxy:
Auth Flow: User logs in via OIDC (Entra AD, etc.); proxy extracts groups/claims to map to namespaces (e.g., group “team-a” -> ns-team-a).
Headers: Injects Impersonate-User / Impersonate-Group for backend RBAC checks.
Routing: Path/Host-based (e.g., team-a.kubeairunway.example.com) or query param for ns selection, validated server-side.
Feature Area
Deployments / Model Management
How important is this feature to you?
Nice to have
Mockups or Examples
No response
Additional Context
No response
Is there an existing feature request for this?
Problem or Motivation
Add basic (coarse) AuthZ to support multiple project teams sharing one KubeAirunway instance via namespace isolation (e.g., AKS-style). Avoids “one deploy per team” sprawl while ensuring security.
Motivation:
Requirements:
Prototype with Keycloak/OIDC proxy for feedback
Proposed Solution
Auth Flow:
Quotas via K8s ResourceQuota.
MVP Scope:
Alternatives Considered
Reverse ProxyBased Approach
Deploy as a sidecar or ingress proxy:
Auth Flow: User logs in via OIDC (Entra AD, etc.); proxy extracts groups/claims to map to namespaces (e.g., group “team-a” -> ns-team-a).
Headers: Injects Impersonate-User / Impersonate-Group for backend RBAC checks.
Routing: Path/Host-based (e.g., team-a.kubeairunway.example.com) or query param for ns selection, validated server-side.
Feature Area
Deployments / Model Management
How important is this feature to you?
Nice to have
Mockups or Examples
No response
Additional Context
No response