#kubeflow-authentication

Short-lived OIDC tokens versus long-lived service account tokens for Kubeflow least-privilege authentication

This question addresses the optimal token lifetime configuration for Kubeflow's least-privilege authentication model, where security requirements conflict with operational overhead. Kubeflow's native RBAC provides granular resource-level permissions but does not natively enforce token expiration, relying instead on external identity provider token lifetimes.

token-expirationrbac-authorizationkubeflowMira Vale0 rep · 08 Oct 2021, 19:09 UTC