Accessing Kubeflow UIs

How to access the Kubeflow web UIs

Kubeflow includes a number of web user interfaces (UIs). This document providesinstructions on how to connect to them.

Overview of Kubeflow UIs

The Kubeflow UIs include the following:

  • A central Kubeflow UI for navigation between the Kubeflow applications.
  • Pipelines for a Kubeflow Pipelines dashboard.
  • Notebook Servers for Jupyter notebooks.
  • Katib for hyperparameter tuning.
  • Artifact Store for tracking of artifact metadata.

Instructions below indicate how to connect to the Kubeflow central UI. Fromthere you can navigate to the different services using the left hand navigationbar.

The central UI dashboard looks like this:

Kubeflow central UI

Overview of accessing the Kubeflow UIs

To access the Kubeflow UIs, you need to connect to theIstio gateway thatprovides access to the Kubeflowservice mesh.

How you access the Istio gateway varies depending on how you’ve configured it.

URL pattern with Google Cloud Platform (GCP)

If you followed the guide to deploying Kubeflow on GCP,the Kubeflow central UI is accessible at a URL of the following pattern:

  1. https://<application-name>.endpoints.<project-id>.cloud.goog/

The URL brings up the dashboard illustrated above.

If you deploy Kubeflow with Cloud Identity-Aware Proxy (IAP), Kubeflow uses theLet’s Encrypt service to provide an SSL certificatefor the Kubeflow UI. For troubleshooting issues with your certificate, see theguide tomonitoring your Cloud IAP setup.

Using kubectl and port-forwarding

If you didn’t configure Kubeflow to integrate with an identity provider and performany authorization then you can port-forward directly to the Istio gateway.

Port-forwarding typically does not work if any of the following are true:

  • You’ve deployed Kubeflow on GCP using theGCP deployment UI or the default settingswith the CLI deployment. (If you want touse port forwarding, you must deploy Kubeflow on an existing Kubernetescluster using the kfctl_k8s_istioconfiguration.)

  • You’ve configured the Istio ingress to only acceptHTTPS traffic on a specific domain or IP address.

  • You’ve configured the Istio ingress to perform an authorization check(for example, using Cloud IAP or Dex).

You can access Kubeflow via kubectl and port-forwarding as follows:

  • Install kubectl if you haven’t already done so:

    • If you’re using Kubeflow on GCP, run the following command on the commandline: gcloud components install kubectl.
    • Alternatively, follow the kubectlinstallation guide.
  • Use the following command to set up port forwarding to theIstio gateway.
  1. export NAMESPACE=istio-system
  2. kubectl port-forward -n istio-system svc/istio-ingressgateway 8080:80
  • Access the central navigation dashboard at:
  1. http://localhost:8080/
  • Depending on how you’ve configured Kubeflow, not all UIs work behindport-forwarding to the reverse proxy.

For some web applications, you need to configure the base URL on whichthe app is serving.

For example, if you deployed Kubeflow with an ingress serving athttps://example.mydomain.com and configured an applicationto be served at the URL https://example.mydomain.com/myapp, then theapp may not work when served onhttps://localhost:8080/myapp because the paths do not match.

Next steps