Create a kubeflow application in the GCP Marketplace

[kkasravi]

GKE allows the user to deploy an Application CRD using the GKE console
as shown below:

The applications in the marketplace include seldon io.

We should add
a kubeflow application using the Application CRD once the PR is merged. The kubeflow Application CR implementation will allow different components to be bundled and could be exposed in the Configuration section in a similar way as the seldonio configuration

Unfortunately I'm not sure how to add this to the marketplace. @jlewi ?

[kkasravi]

/assign @jlewi

[jlewi]

We had a lengthy discussion about putting Kubeflow in the apps marketplace and we decided against it at least for now.

The primary reason is that apps marketplace doesn't give us enough control so the resulting experience would not be the recommended Kubeflow experience (i.e. what users get if they follow our GKE getting started guide). This is why we went down the path of building a click to deploy web app.

GKE marketplace really only lets you create K8s resources. Its primarily a wrapper around YAML manifests or helm packages. At this time it offers very little control over the GKE cluster itself (right now we use deployment manager to specify a lot of GKE configuration options).

If you need cluster admin permissions, I think marketplace needs to prompt users in Cloud shell for permissions. (I think marketplace prefers for everything to be namespace scoped).

More importantly it doesn't let us do things like create IAM roles, service accounts, and most importantly setup IAP.

One direction we did discuss was putting our click to deploy app into marketplace.

This makes more sense if we turn our deploy app into an admin app for Kubeflow deployments. We could then create custom, complex wizards that would walk admins/users through setting up Kubeflow.

For example, this would allow us to create a wizard that would allow an admin to setup Kubeflow to be deployed via GitOps.

[kkasravi]

Hi @jlewi

We do have a CRD/metacontroller based approach that allows this to work with Application CR's and namespaced users (RoleBindings). Ebi (@ashahba) and I could open a PR in the next week or so - we were thinking of showing you a demo in that timeframe. The approach doesn't exclude GKE/IAP and could possibly integrate within GKE/IAP. Since users are namespace scoped RoleBindings, they might be able to include the IAM subject in addition to the user based serviceaccount. We haven't explored this yet.

[jlewi]

A demo at one of the community meetings would be great.

[ashahba]

Sounds good @jlewi
@kkasravi and I keep you in the loop when the demo is ready.
For now our goal is to have it for late next week.

[kkasravi]

This has been implemented in #2154