Kfserving: Authentication setup interfering with kfserving

[abdulsalama]

/kind bug

How authentication is supposed to interact with kfserving?

I followed this article to setup istio/dex authentication here:
https://journal.arrikto.com/kubeflow-authentication-with-istio-dex-5eafdfac4782

And it has been working great. However, we are trying to get kfserving to work and now the envoy filter below is interfering with it.

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: authn-filter
spec:
workloadLabels:
istio: ingressgateway
filters:

• filterConfig:
  httpService:
  serverUri:
  uri: http://authservice.istio-system.svc.cluster.local
  cluster: outbound|8080||authservice.istio-system.svc.cluster.local
  authorizationRequest:
  allowedHeaders:
  patterns:
  - exact: "cookie"
  filterName: envoy.ext_authz
  filterType: HTTP
  listenerMatch:
  portNumber: 443
  listenerType: GATEWAY

We are trying to simply make serving api calls pass this filter all together, so I'm trying to see how I can scope down when this filter applies.

For example the call below (making a backend prediction api call) shouldn't go through this filter:
curl -v -H "Host: sklearn-iris.foo.example.com" http://localhost:8080/v1/models/sklearn-iris:predict -d @https://raw.githubusercontent.com/kubeflow/kfserving/master/docs/samples/sklearn/iris-input.json

Ideally we want a mechanism to say if the host header is "sklearn-iris.foo.example.com", then pass the authentication filter...

Looks to me kfserving is using the same kubeflow-gateway and thus the filter will apply no matter what, which seems wrong.

So just in general, how is this kfserving configuration supposed to be compatible with the recommended UI authentication setup/filter indicated above?

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the labels:

| Label | Probability |
| ------------- | ------------- |
| kind/question | 0.67 |

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: app homepage, dashboard and code for this bot.

[issue-label-bot[bot]]

Issue Label Bot is not confident enough to auto-label this issue.
See dashboard for more details.

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the labels:

| Label | Probability |
| ------------- | ------------- |
| area/front-end | 0.52 |

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: app homepage, dashboard and code for this bot.

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the labels:

| Label | Probability |
| ------------- | ------------- |
| area/front-end | 0.52 |

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: app homepage, dashboard and code for this bot.

[yuzisun]

@yanniszark @krishnadurai Any thoughts on this?

[josete89]

@yuzisun any update on this one? I'm falling in the same error!

[issue-label-bot[bot]]

Issue-Label Bot is automatically applying the labels:

| Label | Probability |
| ------------- | ------------- |
| area/engprod | 0.50 |

Please mark this comment with :thumbsup: or :thumbsdown: to give our bot feedback!
Links: app homepage, dashboard and code for this bot.