> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Section Introduction > Explains how Kubeflow uses external authentication, RBAC, and Profiles to provide secure multi-user isolation and per-user namespaces on Kubernetes Before we start working with [Kubeflow](https://learn.kodekloud.com/user/courses/kubeflow) as a machine learning platform, we first need to understand how user access and security are managed inside a [Kubernetes](https://learn.kodekloud.com/user/courses/kubernetes-for-the-absolute-beginners-hands-on-tutorial) environment. Imagine an organization where multiple data scientists, ML engineers, and researchers share the same Kubernetes cluster. Without proper authentication and isolation, permissions and resources quickly become chaotic: users might access each other's notebooks or datasets, GPUs and storage are hard to allocate securely, and administrators have little control over who can do what. A slide titled "The Problem" showing data scientists, ML engineers, and researchers sharing a Kubernetes cluster labeled "No auth / No isolation." The diagram highlights issues: users can access each other's notebooks and data, GPUs and storage are hard to manage, and there is no permission control.

A slide titled "The Problem" showing data scientists, ML engineers, and researchers sharing a Kubernetes cluster labeled "No auth / No isolation." The diagram highlights issues: users can access each other's notebooks and data, GPUs and storage are hard to manage, and there is no permission control.

Modern ML platforms run many users on shared Kubernetes infrastructure, so they must provide secure authentication, isolated user workspaces, role-based access control (RBAC), and multi-user isolation to operate safely and predictably. A presentation slide titled "The Problem" showing four colored panels for Secure Authentication, User-Specific Workspaces, Role-Based Access Control, and Multi-User Isolation, each with a simple icon and brief explanatory text.

A presentation slide titled "The Problem" showing four colored panels for Secure Authentication, User-Specific Workspaces, Role-Based Access Control, and Multi-User Isolation, each with a simple icon and brief explanatory text.

Kubernetes authentication verifies identities and establishes who is making requests to the API server. RBAC and namespaces are then used to enforce what those authenticated users may do and which resources they can access. Kubeflow builds on these primitives: it delegates identity management to an identity provider (commonly Dex — [https://dexidp.io](https://dexidp.io)), maps identities to Kubernetes subjects, and uses Kubeflow Profiles to provision per-user isolated workspaces. Kubeflow does not implement its own authentication layer. Instead it integrates with identity providers (Dex is frequently used) and translates external identities into Kubernetes users/groups so that RBAC and namespace isolation can enforce policies. A presentation slide titled "What We Will Cover" with a vertical timeline of four numbered topics. The topics list authentication in Kubernetes, how Kubeflow manages users securely, the role of Dex in authentication, and Kubeflow profiles/namespace isolation.

A presentation slide titled "What We Will Cover" with a vertical timeline of four numbered topics. The topics list authentication in Kubernetes, how Kubeflow manages users securely, the role of Dex in authentication, and Kubeflow profiles/namespace isolation.

In this lesson/article we will: * Review how authentication works in [Kubernetes](https://learn.kodekloud.com/user/courses/kubernetes-for-the-absolute-beginners-hands-on-tutorial) and how RBAC and namespaces enforce access. * Explain how [Kubeflow](https://learn.kodekloud.com/user/courses/kubeflow) integrates with identity providers (commonly Dex — [https://dexidp.io](https://dexidp.io)) to manage user identities. * Show how users are represented and granted access inside Kubernetes namespaces. * Demonstrate how Kubeflow Profiles create secure, isolated workspaces for each user backed by dedicated namespaces, resource quotas, and role-based permissions. Why this matters * Prevents accidental or malicious access to other users’ notebooks, datasets, or GPUs. * Enables predictable resource allocation (quotas for CPU, memory, GPU, and storage). * Gives administrators fine-grained control using RBAC policies and namespace scoping. Key concepts at a glance: | Concept | Kubernetes primitive | How Kubeflow uses it | | - | - | - | | Authentication | External identity provider (OIDC/Dex) | Delegates login to Dex; maps identities to Kubernetes subjects | | Authorization | RBAC (Roles & RoleBindings) | Grants permissions to users/groups for actions inside namespaces | | Isolation | Namespaces + resource quotas | Kubeflow Profiles provision per-user namespaces with quotas and bindings | Links and references * [Kubernetes Authentication Concepts](https://kubernetes.io/docs/reference/access-authn-authz/authentication/) * [Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) * [Dex Identity Provider](https://dexidp.io) * [Kubeflow Documentation — Multi-User and Profiles](https://www.kubeflow.org/docs/components/multi-user-overview/) As you continue, keep these terms in mind: `authentication` (who you are), `authorization` (what you can do), and `isolation` (what resources you can see and use). Kubeflow ties these together so multiple users can safely share a cluster. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.