Skip to content

feat: add NetworkPolicy for the dashboard #159

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
google-oss-prow merged 2 commits into from
Oct 23, 2025
+55 −0
Merged

feat: add NetworkPolicy for the dashboard #159

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6b41b80
feat: add NetworkPolicy for the dashboard
kimwnasptd Oct 10, 2025
90afa57
feat: integration tests for networkpolicies
kimwnasptd Oct 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions components/centraldashboard-angular/manifests/base/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ resources:
- service-account.yaml
- service.yaml
- configmap.yaml
- network-policy.yaml
Copy link
Contributor

@andyatmiami andyatmiami Oct 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we are starting to move network policies to within components (from kubeflow/manifests where these definitions reside today) - what should we do about the https://github.com/kubeflow/manifests/blob/master/common/networkpolicies/base/default-allow-same-namespace.yaml file?

Seems like we should a networkpolicy to allow traffic within the kubeflow namespace also defined somewhere in this repo (?)

Copy link
Member Author

@kimwnasptd kimwnasptd Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a very good question!

My proposal is that every repo should own the NetworkPolicies of its components, and the kubeflow/manifests should own resources that should live in the kubeflow namespace, and don't target/configure a workload that is owned by another repo.

But this should have a dedicated issue (I'm trying to create one, but GH doesn't allow me to create it!)
image

So for this PR, I'd suggest we only copy the ones that are specific to components of this repo. And continue the discussion about "generic" resources in kubeflow to kubeflow/manifests, as this can be generalised to other resources.

Copy link
Member Author

@kimwnasptd kimwnasptd Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Slightly orthogonal, we could also create a NetworkPolicy that allows only the dashboard to talk to access-management, so that we don't rely at all in the NetworkPolicy in the kubeflow namespace.

But was thinking of not introducing a new functionality outside of the overall one yet, as I would treat it as a dedicated feature. But if you feel strongly otherwise let me know @andyatmiami @juliusvonkohout

Copy link
Contributor

@andyatmiami andyatmiami Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am comfortable with that response - appreciate the follow up!

Copy link
Contributor

@andyatmiami andyatmiami Oct 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, for now focusing on "feature parity" I think is good ... so we can deal with adding new functionality once the general release process has been vetted (imho)

Copy link
Member Author

@kimwnasptd kimwnasptd Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Created also kubeflow/manifests#3261 to track the discussion for the policies

Copy link
Member

@juliusvonkohout juliusvonkohout Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"Slightly orthogonal, we could also create a NetworkPolicy that allows only the dashboard to talk to access-management, so that we don't rely at all in the NetworkPolicy in the kubeflow namespace." Yes that should be done and you also need to add tests to verify that the networkpolicy blocks it.

images:
- name: ghcr.io/kubeflow/dashboard/dashboard-angular
newName: ghcr.io/kubeflow/dashboard/dashboard-angular
Expand Down
22 changes: 22 additions & 0 deletions components/centraldashboard-angular/manifests/base/network-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: dashboard-angular
spec:
podSelector:
matchExpressions:
- key: app
operator: In
values:
- dashboard-angular
ingress:
- from:
- namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: In
values:
- istio-system
- podSelector: {}
policyTypes:
- Ingress
1 change: 1 addition & 0 deletions components/centraldashboard/manifests/base/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ resources:
- service-account.yaml
- service.yaml
- configmap.yaml
- network-policy.yaml
images:
- name: ghcr.io/kubeflow/dashboard/dashboard
newName: ghcr.io/kubeflow/dashboard/dashboard
Expand Down
22 changes: 22 additions & 0 deletions components/centraldashboard/manifests/base/network-policy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: dashboard
spec:
podSelector:
matchExpressions:
- key: app
operator: In
values:
- dashboard
ingress:
- from:
- namespaceSelector:
matchExpressions:
- key: kubernetes.io/metadata.name
operator: In
values:
- istio-system
- podSelector: {}
policyTypes:
- Ingress
9 changes: 9 additions & 0 deletions testing/shared/test_service.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,15 @@ case "$OPERATION" in
-H "kubeflow-userid: test-user" \
"http://localhost:${PORT}/api/workgroup/exists" \
>/dev/null 2>&1

# test the NetworkPolicy, by ensuring other Pods timeout talking to the dashboard
OUTPUT=$(kubectl run \
netshoot-test --rm -i \
--restart=Never \
--image nicolaka/netshoot \
-- curl dashboard.kubeflow.svc --connect-timeout 5 \
2>&1 || true)
echo $OUTPUT | grep "Connection timed out after"
;;

"test-kfam")
Expand Down