This is a Bug Report
Problem:
The "Deploying Kubeflow Pipelines with Pod-to-Pod TLS Enabled" section of the installation guide presents pod-to-pod TLS as a general deployment option:
Kubeflow Pipelines can be deployed with pod-to-pod TLS enabled. The API server serves over TLS, and all connecting deployments are mounted with CA certificates.
In practice this applies to standalone deployments only. Pod-to-pod TLS is not available in multi-user mode, and the documentation does not say so.
Evidence:
- The only pod-to-pod TLS overlay in the repository is
manifests/kustomize/env/cert-manager/platform-agnostic-standalone-tls, which is standalone, as its name indicates. There is no multi-user equivalent on master.
- In
.github/resources/scripts/deploy-kfp.sh, the standalone branch selects a tls-enabled manifest when pod-to-pod TLS is requested. The multi-user branch does not reference the TLS flag at all — manifest selection there depends only on the database type, artifact proxy, and cache settings.
Because the current wording does not scope the feature, an operator running multi-user can reasonably conclude that pod-to-pod TLS is available to them. It is not, and nothing in the deployment path signals that, so the setting appears to be accepted while traffic between pods is not encrypted by this mechanism.
Proposed Solution:
State in the pod-to-pod TLS section that the feature applies to standalone deployments only, and that no multi-user pod-to-pod TLS overlay exists.
If multi-user deployments are expected to obtain in-mesh traffic encryption from Istio instead — multi-user mode requires Istio — then the section should say that as well, and point to the relevant configuration. That distinction determines whether the fix is a wording change alone or should also cover what multi-user operators are meant to use.
Page to Update (provide the full path):
https://www.kubeflow.org/docs/components/pipelines/operator-guides/installation/#deploying-kubeflow-pipelines-with-pod-to-pod-tls-enabled
Component/Kubeflow Version:
Kubeflow Pipelines, master (verified against the current manifests/kustomize/env tree and deploy-kfp.sh)
Labels
/area pipelines
Impacted by this bug? Give it a 👍.
This is a Bug Report
Problem:
The "Deploying Kubeflow Pipelines with Pod-to-Pod TLS Enabled" section of the installation guide presents pod-to-pod TLS as a general deployment option:
In practice this applies to standalone deployments only. Pod-to-pod TLS is not available in multi-user mode, and the documentation does not say so.
Evidence:
manifests/kustomize/env/cert-manager/platform-agnostic-standalone-tls, which is standalone, as its name indicates. There is no multi-user equivalent onmaster..github/resources/scripts/deploy-kfp.sh, the standalone branch selects atls-enabledmanifest when pod-to-pod TLS is requested. The multi-user branch does not reference the TLS flag at all — manifest selection there depends only on the database type, artifact proxy, and cache settings.Because the current wording does not scope the feature, an operator running multi-user can reasonably conclude that pod-to-pod TLS is available to them. It is not, and nothing in the deployment path signals that, so the setting appears to be accepted while traffic between pods is not encrypted by this mechanism.
Proposed Solution:
State in the pod-to-pod TLS section that the feature applies to standalone deployments only, and that no multi-user pod-to-pod TLS overlay exists.
If multi-user deployments are expected to obtain in-mesh traffic encryption from Istio instead — multi-user mode requires Istio — then the section should say that as well, and point to the relevant configuration. That distinction determines whether the fix is a wording change alone or should also cover what multi-user operators are meant to use.
Page to Update (provide the full path):
https://www.kubeflow.org/docs/components/pipelines/operator-guides/installation/#deploying-kubeflow-pipelines-with-pod-to-pod-tls-enabled
Component/Kubeflow Version:
Kubeflow Pipelines,
master(verified against the currentmanifests/kustomize/envtree anddeploy-kfp.sh)Labels
/area pipelines
Impacted by this bug? Give it a 👍.