Set up OAuth for Cloud IAP

    If you want to useCloud Identity-Aware Proxy (Cloud IAP)when deploying Kubeflow on GCP,then you must follow these instructions to create an OAuth client for usewith Kubeflow.

    You can skip the instructions on this page if you want to use basicauthentication (username and password) with Kubeflow instead of Cloud IAP.Cloud IAP is recommended for production deployments or deployments with accessto sensitive data.

    Follow the steps below to create an OAuth client ID that identifies Cloud IAPwhen requesting access to a user’s email account. Kubeflow uses the emailaddress to verify the user’s identity.

    • Set up your OAuth :

      • In the Application name box, enter the name of your application.The example below uses the name “Kubeflow”.
      • Under Support email, select the email address that you want to displayas a public contact. You must use either your email address or a GoogleGroup that you own.
      • If you see Authorized domains, enter

    • Click Save.

    • On the credentials screen:

      • Click Create credentials, and then click OAuth client ID.
      • Under Application type, select Web application.
      • In the Name box enter any name for your OAuth client ID. This is _not_the name of your application nor the name of your Kubeflow deployment. It’sjust a way to help you identify the OAuth client ID.
    • Click Create. A dialog box appears, like the one below:

    • Copy the client ID shown in the dialog box, because you need the clientID in the next step.

    • On the Create credentials screen, find your newly created OAuthcredential and click the pencil icon to edit it:

    OAuth consent screen

    • is the OAuth client ID that you copied from the dialog box instep four. It looks like XXX.apps.googleusercontent.com.
    • Note that the URI is not dependent on the Kubeflow deployment or endpoint.Multiple Kubeflow deployments can share the same OAuth client without theneed to modify the redirect URIs.
      • Press Enter/Return to add the URI. Check that the URI now appears asa confirmed item under Authorized redirect URIs. (The URI should no longer beeditable.)

    • Click Save.

    • Make note that you can find your OAuth client credentials in the credentialssection of the GCP Console. You need to retrieve the client ID andclient secret later when you’re ready to enable Cloud IAP.

    Choose one of the following ways to deploy Kubeflow:

    • . This option provides a simpleway to deploy Kubeflow.
    • Using the CLI. This option provides morecontrol over the deployment process.

    Feedback

    Was this page helpful?

    Glad to hear it! Please tell us how we can improve.

    Last modified 08.10.2019: