# KubePie: Leveraging Kubernetes for Scalable End-User Data Access

- Institution: CERN
- Department: HEP Computing
- Speaker: Andrii Salnikov
- Year: 2025
- Language: English
- Subjects: Computer science
- Source: [CERN](https://videos.cern.ch/record/3021336)
- Licence: [CERN](http://copyright.web.cern.ch)
- Who can watch: Tweens profiles and older (sources give no ratings; placed by Invisible Network from the source's own words)

Does the idea of running and managing "own" web server for every user with the corresponding user/group IDs and securing access to it sound crazy? Definitely 10 years ago it was, but not in the current Cloud Native world. \[KubePie\](https://gitlab.com/MaxIV/kubernetes/kubepie) facilitates streamlined access to end-user data by harnessing Kubernetes' scalability and deployment capabilities to actually running, managing and securing web-servers on a large scale.

Inspired by the success of JupyterHub on Kubernetes, KubePie implements *Permissions Impersonated Environments ("Pies")*, constructed from open-source components to provide a personalized data consumption experience for end-users through any web browser or HTTP client.

The microservices framework within KubePie is structured around various "Pies":

- **PieData:** The personal web-server Pie, stuffed with data services. Wrapped in a nice Helm chart. - **PieTrack:** Transfer activities keeping for PieData. Tracks your calories consumption over time. - **PiePass:** Ensure secure passage to the KubePie bakery services for the customers. - **PieCut:** The "Control Unit" of KubePie bakery, taking orders and delivering PieData. - **PieDeck:** The "Data Endpoints Controller for Kubernetes" operates the baking process of the PieDatas for end-users. - **PieSec:** Admission webhook for the security seasoning of the PieData. Adds the UID/GID and SGID spices. Make sure no rotten eggs are added. - **PieEat:** "Erases at Timeout" the stale PieDatas.

PiePass serves as the authentication and authorization entry point for end-users, relying strictly on OIDC/OAuth2 protocols and leveraging Apache web servers, equipped with mod\_oauth2 and mod\_auth\_openidc modules from \[OpenIDC\](https://github.com/OpenIDC).

PieCut is a main action point for end-users. Technically it is Kubernetes Controller that creates PieData Custom Resource Definitions (CRDs), based on authenticated user information from HTTP headers set by PiePass.…

## Lectures

1. [KubePie: Leveraging Kubernetes for Scalable End-User Data Access](https://invisiblenetwork.ai/learn/cern/3021336/f300c1d4716e), 17 min (CERN's player)