Katib: Katib UI allows you to delete experiments when no namespace is selected on central dashboard

[maganaluis]

/kind bug

What steps did you take and what happened:
[A clear and concise description of what the bug is.]
Katib UI allows you to delete experiments in other namespaces where the user is not authorized. This happens when the user does not select a namespace in the central dashboard.

What did you expect to happen:
If there is no namespace selected in the central dashboard no experiments should be available in the Katib UI and the user should not have access to delete them.

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

Environment:

• Kubeflow version (kfctl version): 1.1
• Minikube version (minikube version): N/A
• Kubernetes version: (use kubectl version): 1.16.10
• OS (e.g. from /etc/os-release): N/A

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the labels:

| Label | Probability |
| ------------- | ------------- |
| area/front-end | 0.95 |

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: app homepage, dashboard and code for this bot.

[andreyvelich]

Thank you for submitting this @maganaluis.

Yes, this is the current problem when you are using Katib UI as part of Kubeflow dashboard.
We should think about better way of handling global namespace.
Related issue: https://github.com/kubeflow/katib/issues/1136.

Maybe we should not let user enter Katib UI if namespace is not selected.

/cc @gaocegege @johnugeorge
/priority p1

[yanniszark]

@andreyvelich we (Arrikto) have also noticed this issue with Katib. This issue is common in every web app (eg jupyter). We have contributed the Kubeflow Authentication and Authorization guidelines which prescribes certain best practices for securing web apps in kubernetes. Katib should also follow these best practices to secure its web app:
https://github.com/kubeflow/community/blob/master/guidelines/auth.md

[robbertvdg]

Hi guys, any progress on this? For us it is a blocking issue unfortunately.

[andreyvelich]

Hi @robbertvdg, we've prioritised this task and we would be grateful if our community could help with this problem.
I think the next release can be our target.

In the meantime, Profile Controller is maintained by Notebook WG.
@kubeflow/wg-notebook-leads Do you have any plans to change the Authentication and Authorization for the Kubeflow Applications ?
Does this guide: https://github.com/kubeflow/community/blob/master/guidelines/auth.md help us to set-up proper user-isolation and security for the Katib UI ?

/cc @gaocegege @johnugeorge
/priority p0

[andreyvelich]

/help

[k8s-ci-robot]

@andreyvelich:
This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yanniszark]

In the meantime, Profile Controller is maintained by Notebook WG.
@kubeflow/wg-notebook-leads Do you have any plans to change the Authentication and Authorization for the Kubeflow Applications ?

I'm not sure what this means, but Profiles are orthogonal to authentication and authorization for Kubeflow web apps. Profiles are a way to group together a bunch of resources needed for namespace initialization.

@andreyvelich we (Arrikto) have a lot of experience on getting Kubeflow applications to work with proper auth. For example, the Jupyter Web App or the recent move of KFP to SubjectAccessReview. We will be back right after KubeCon to put some effort and help you with this because we also feel is important

[andreyvelich]

@yanniszark That would be great, thank you!
Let me know once you can help us with the details.

[StevenReitsma]

Any news?

[andreyvelich]

Any news?

@kimwnasptd is currently working on the new Katib UI where user should have an access only to the profile namespace when Katib is installed as part of Kubeflow.
@StevenReitsma You can check proposal for the new UI here: https://docs.google.com/document/d/14cfGYJiTl32GWBUTbYQHzXC4UWA7r_ysgWYSWsxcDvU/edit

[kimwnasptd]

Thank you for summing it up @andreyvelich. The UI effort is progressing as expected and I'm confident we will meet our set goal of having a first PR by the end of this week.

Wrt the issue of the Namespace, we are aiming to make the app comply with Kubeflow's authnz mechanisms. In case Katib UI will be deployed inside Kubeflow, and not as a standalone app, then

1. The web app will perform SubjectAccessReviews to ensure that the logged in user is allowed, based on K8s RBAC, to apply any action like DELETE, GET, POST on Experiments, Trials etc
2. We will have extended the manifests to give permissions to the kubeflow-{edit,view,admin} cluster roles to allow a user created from a Profile to have permissions to interact with Experiments, Trials etc.

Once we move forward with the first UI PR then we will be opening relative issues to break this task into smaller ones and track their progress.

[StevenReitsma]

That's great to hear, thanks for the information! I'm excited to see the results.

[DavidSpek]

I added this to the WG-Notebooks Kanban as it is also relevant to the Jupyter Web App and related to another issue where apparently users can access jupyter notebook servers in other namespaces (I have not validated this personally).