Integerating Webapps into Kubeflow

Question

Kubeflow can be used not just for orchestration, kubeflow dashboard can also be used for hosting your custom webapps, or other applications.

In this case, I have installed the kubeflow as per the docs provided in the offical repository https://github.com/kubeflow/manifests.

For webapp am going to deploy this very basic application https://hub.docker.com/r/paulbouwer/hello-kubernetes/

Deploy and expose the service using these commands

kubectl run hello-app - image=paulbouwer/hello-kubernetes:1.10 - port=8080 -n kubeflow
kubectl expose pod hello-app - port=80 - target-port=8080 -n kubeflow - name=hello-service

Once the simple application is up and running, ensure the cluster IP is working by port forwarding them.

Step — 1 Once its all up and running, first we need to add our sample application in the sandwich bar of the kubeflow dashboard. Essentially the list of applications are stored in the config-map. In the centraldashboard-config, config map present in the kubeflow ns, add the following the menuLinks list

{
  "type": "item",
  "link": "/hello-app/",
  "text": "Sample App",
  "icon": "icons:stars"
}

Essentially your cm will look something like this

"menuLinks": [
        {
            "icon": "book",
            "link": "/jupyter/",
            "text": "Notebooks",
            "type": "item"
        },
        {
            "icon": "assessment",
            "link": "/tensorboards/",
            "text": "TensorBoards",
            "type": "item"
        },
        {
            "icon": "device:storage",
            "link": "/volumes/",
            "text": "Volumes",
            "type": "item"
        },
        {
            "icon": "kubeflow:katib",
            "link": "/katib/",
            "text": "Katib Experiments",
            "type": "item"
        },
        {
            "type": "item",
            "link": "/kserve-endpoints/",
            "text": "KServe Endpoints",
            "icon": "kubeflow:models"
        },
        {
              "type": "item",
              "link": "/hello-app/",
              "text": "Sample App",
              "icon": "icons:stars"
        },..
]

Once the config map is updated, ensure to rollout restart the centraldashboard deployment.

Step — 2
Create a destination roule, so they are routed to the right destination on clicking the link

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: hello-service
  namespace: kubeflow
spec:
  host: hello-service.kubeflow.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

Step — 3

Create virutal service for endpoint

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: hello-app-route
  namespace: kubeflow
spec:
  gateways:
     - kubeflow-gateway # Using your specific gateway
  hosts:
    - '*'
  http:
    - headers:
        request:
          add:
            x-forwarded-prefix: /hello-app
      match:
        - uri:
          # Using a path structure Kubeflow's auth filter often expects
            prefix: /hello-app/ 
      rewrite:
        uri: /
      route:
        - destination:
            host: hello-service.kubeflow.svc.cluster.local
            port:
              number: 80
    - match:
      - uri:
          prefix: /css/
      - uri:
          prefix: /images/
      - uri:
          prefix: /js/
      route:
      - destination:
          host: hello-service.kubeflow.svc.cluster.local
          port:
            number: 80

Ensure to add the sub url prefixes, so the things like css, images are also loaded without the 404, now even with all this you will notice that you will get a RBAC error, cos we need to add the authpolicy so kubeflow to pass the auth headers and allow the page load as iframe

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-gateway-to-sample-app
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      run: hello-app  # Must match the label on your pod
  action: ALLOW
  rules:
  - from:
    - source:
        # This allows traffic specifically coming from your gateway
        namespaces: ["istio-system", "kgateway-system"]

With this you have successfully added a custom application into the kubeflow and it will look something like this