Skip to main content
Before we start working with Kubeflow as a machine learning platform, we first need to understand how user access and security are managed inside a Kubernetes environment. Imagine an organization where multiple data scientists, ML engineers, and researchers share the same Kubernetes cluster. Without proper authentication and isolation, permissions and resources quickly become chaotic: users might access each other’s notebooks or datasets, GPUs and storage are hard to allocate securely, and administrators have little control over who can do what.
A slide titled "The Problem" showing data scientists, ML engineers, and researchers sharing a Kubernetes cluster labeled "No auth / No isolation." The diagram highlights issues: users can access each other's notebooks and data, GPUs and storage are hard to manage, and there is no permission control.
Modern ML platforms run many users on shared Kubernetes infrastructure, so they must provide secure authentication, isolated user workspaces, role-based access control (RBAC), and multi-user isolation to operate safely and predictably.
A presentation slide titled "The Problem" showing four colored panels for Secure Authentication, User-Specific Workspaces, Role-Based Access Control, and Multi-User Isolation, each with a simple icon and brief explanatory text.
Kubernetes authentication verifies identities and establishes who is making requests to the API server. RBAC and namespaces are then used to enforce what those authenticated users may do and which resources they can access. Kubeflow builds on these primitives: it delegates identity management to an identity provider (commonly Dex — https://dexidp.io), maps identities to Kubernetes subjects, and uses Kubeflow Profiles to provision per-user isolated workspaces.
Kubeflow does not implement its own authentication layer. Instead it integrates with identity providers (Dex is frequently used) and translates external identities into Kubernetes users/groups so that RBAC and namespace isolation can enforce policies.
A presentation slide titled "What We Will Cover" with a vertical timeline of four numbered topics. The topics list authentication in Kubernetes, how Kubeflow manages users securely, the role of Dex in authentication, and Kubeflow profiles/namespace isolation.
In this lesson/article we will:
  • Review how authentication works in Kubernetes and how RBAC and namespaces enforce access.
  • Explain how Kubeflow integrates with identity providers (commonly Dex — https://dexidp.io) to manage user identities.
  • Show how users are represented and granted access inside Kubernetes namespaces.
  • Demonstrate how Kubeflow Profiles create secure, isolated workspaces for each user backed by dedicated namespaces, resource quotas, and role-based permissions.
Why this matters
  • Prevents accidental or malicious access to other users’ notebooks, datasets, or GPUs.
  • Enables predictable resource allocation (quotas for CPU, memory, GPU, and storage).
  • Gives administrators fine-grained control using RBAC policies and namespace scoping.
Key concepts at a glance: Links and references
As you continue, keep these terms in mind: authentication (who you are), authorization (what you can do), and isolation (what resources you can see and use). Kubeflow ties these together so multiple users can safely share a cluster.

Watch Video