Manage Multi-tenant ML Workloads Using Istio
summary
Istio plus Kubeflow sets up per-tenant Kubernetes namespaces, injects Envoy sidecars, and enforces mTLS with Istio-issued certificates and end-user OIDC authentication so user requests carry short-lived JWTs. Authorization uses claim- and namespace-based policies enabling per-namespace RBAC policies and service-to-service restrictions. Traffic management supports 95/5 traffic splits and mirroring for safe rollouts. Demo shows centralized notebook UI denies cross-tenant access and measured overhead is about 100µs per hop.
AI-written summary · about
chapters (10)
- 0:00Intro
- 1:04What does Istio do?
- 2:15Istio Architectural Components
- 3:28Multi-tenant ML Workloads
- 4:32Challenges on Multi-Tenancy
- 6:57Case Study: Kubeflow
- 10:57User Access Isolation: End User Authentication
- 12:40User Access Isolation: Authorization
- 16:04Demo
- 20:45Come Participatel
related talks
01h 01mMeshing Around with Istio
29mManaging a Multi-Tenanted Kubernetes Cluster in Production
26mManaging Kubernetes Deployment with Istio
43mService Mesh for developers
47mPainless Multi-Tenant Kafka on Kubernetes with Istio at ASML
42mSecuring Kubernetes Workloads with Istio Service Mesh
40mMulti-tenancy in Kubernetes- 47mPainless Multi-Tenant Kafka on Kubernetes with Istio at