About
Does the idea of running and managing "own" web server for every user with the corresponding user/group IDs and securing access to it sound crazy? Definitely 10 years ago it was, but not in the current Cloud Native world. [KubePie](https://gitlab.com/MaxIV/kubernetes/kubepie) facilitates streamlined access to end-user data by harnessing Kubernetes' scalability and deployment capabilities to actually running, managing and securing web-servers on a large scale.
Inspired by the success of JupyterHub on Kubernetes, KubePie implements *Permissions Impersonated Environments ("Pies")*, constructed from open-source components to provide a personalized data consumption experience for end-users through any web browser or HTTP client.
The microservices framework within KubePie is structured around various "Pies":
- **PieData:** The personal web-server Pie, stuffed with data services. Wrapped in a nice Helm chart. - **PieTrack:** Transfer activities keeping for PieData. Tracks your calories consumption over time. - **PiePass:** Ensure secure passage to the KubePie bakery services for the customers. - **PieCut:** The "Control Unit" of KubePie bakery, taking orders and delivering PieData. - **PieDeck:** The "Data Endpoints Controller for Kubernetes" operates the baking process of the PieDatas for end-users. - **PieSec:** Admission webhook for the security seasoning of the PieData. Adds the UID/GID and SGID spices. Make sure no rotten eggs are added. - **PieEat:** "Erases at Timeout" the stale PieDatas.
PiePass serves as the authentication and authorization entry point for end-users, relying strictly on OIDC/OAuth2 protocols and leveraging Apache web servers, equipped with mod\_oauth2 and mod\_auth\_openidc modules from [OpenIDC](https://github.com/OpenIDC).
PieCut is a main action point for end-users. Technically it is Kubernetes Controller that creates PieData Custom Resource Definitions (CRDs), based on authenticated user information from HTTP headers set by PiePass.…
The talk
Credits and licence
- Institution
- CERN
- Department
- HEP Computing
- Speaker
- Andrii Salnikov
- Year
- 2025
- Language
- English
- Subjects
- Computer science
- Source
- CERN
- Licence
- CERN, as CERN states it. CERN's terms
- Attribution
- © CERN. CERN provides its audiovisual media free of charge for educational and informational use, credited to CERN; this lecture is shown in CERN's own player.
- Who can watch
- CERN gives no rating. Invisible Network shows it to Tweens profiles and older, judged from what the source says about it. How courses are placed