Authenticating to Kubeflow Pipelines API

Plugin supports 2 ways of authenticating to Kubeflow Pipelines API:

1. KFP behind IAP proxy on Google Cloud

It’s already described in GCP AI Platform support chapter.

2. KFP behind Dex+authservice

Dex is the recommended authentication mechanism for on-premise Kubeflow clusters. The usual setup looks in a way that:

  • oidc-autheservice redirect unauthenticated users to Dex,

  • Dex authenticates user in remote system, like LDAP or OpenID and also acts as OpenID provider,

  • oidc-autheservice asks Dex for token and creates the session used across entire Kubeflow.

In order to use kedro-kubeflow behind Dex-secured clusters, use the following manual:

  1. Setup staticPassword authentication method and add a user that you’re going to use as CI/CD account.

  2. Point your Kedro project to /pipeline API on Kubeflow, for example: https://kubeflow.local/pipeline

  3. Set environment variables DEX_USERNAME and DEX_PASSWORD before calling kedro kubeflow