temporarily disable ml-pipeline AuthorizationPolicy

kromanow94 · Mar 5, 2024 · 9fc7ed8 · 9fc7ed8
1 parent 662e46f
commit 9fc7ed8
Showing 1 changed file with 12 additions and 9 deletions.
diff --git a/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/authorizationpolicy.yaml b/charts/kubeflow/templates/pipelines/ml-pipeline/apiserver/authorizationpolicy.yaml
@@ -12,15 +12,18 @@ spec:
     matchLabels:
       {{- include "kubeflow.pipelines.mlPipeline.selectorLabels" . | nindent 6 }}
   rules:
-  - from:
-    - source:
-        principals:
-        - {{ include "kubeflow.pipelines.mlPipeline.serviceAccountPrincipal" . }}
-        - {{ include "kubeflow.pipelines.ui.serviceAccountPrincipal" . }}
-        - {{ include "kubeflow.pipelines.persistenceAgent.serviceAccountPrincipal" . }}
-        - {{ include "kubeflow.pipelines.scheduledWorkflow.serviceAccountPrincipal" . }}
-        - {{ include "kubeflow.pipelines.viewerCrd.serviceAccountPrincipal" . }}
-        - {{ include "kubeflow.pipelines.cache.serviceAccountPrincipal" . }}
+  # NOTE(kromanow94): this is temporarily configured with open access to verify
+  # if it will make it work
+  - {}
+  # - from:
+  #   - source:
+  #       principals:
+  #       - {{ include "kubeflow.pipelines.mlPipeline.serviceAccountPrincipal" . }}
+  #       - {{ include "kubeflow.pipelines.ui.serviceAccountPrincipal" . }}
+  #       - {{ include "kubeflow.pipelines.persistenceAgent.serviceAccountPrincipal" . }}
+  #       - {{ include "kubeflow.pipelines.scheduledWorkflow.serviceAccountPrincipal" . }}
+  #       - {{ include "kubeflow.pipelines.viewerCrd.serviceAccountPrincipal" . }}
+  #       - {{ include "kubeflow.pipelines.cache.serviceAccountPrincipal" . }}
 
   # NOTE(kromanow94): with m2m tokens through istio/oauth2-proxy and
   # ml-pipeline-ui, the following is probably not needed anymore.