How to disable Multi User Isolation/ Remove Manage Contributors from UI

[brianmoran]

/kind question

Question:

I have a specific need to completely disable Multi-User Isolation, preventing users from sharing notebooks. Is it possible to remove the Manage Contributors section from the UI, similar to the customizing the UI via a ConfigMap?

[brianmoran]

In the interim, I added an AuthorizationPolicy to deny the add-contributor and remove-contributor paths. Still would be nice to have a feature flag to disable Multi User Isolation.

[thesuperzapper]

@brianmoran for now, adding that authorization policy is the best approach because it also prevents people doing it with the KFAM API calls directly (even if the UI prevented it).

Do you want to share your AuthorizationPolicy resource YAML?

[brianmoran]

@thesuperzapper here's the AuthorizationPolicy.

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: central-dashboard-deny-manage-users
  namespace: kubeflow
spec:
  selector:
    matchLabels:
      app: centraldashboard
  action: DENY
  rules:
  - to:
    - operation:
        paths:
          - "/api/workgroup/add-contributor/*"
          - "/api/workgroup/remove-contributor/*"