hi, metaflow fan here with a question about metadata service auth. I'm running metaflow on k8s on azure: metaflow service is the only thing that is exposed publicly (accessible at

METAFLOW_SERVICE_URL

). now this service (ingress) does not have any auth out of the box. I am curious to see what other are doing to secure this component. I'm still setting up authentication, but the idea is to create an azure role, something like "Metaflow Contributor", that grants metaflow developers in our company access to k8s (for

--with kubernetes

) and azure storage (for storage..). Is there a recommended way I can use azure-based authentication to manage access to the metaflow service? I'm assuming I have to instruct the metaflow client library to be able to authenticate with such a custom setup? or maybe I'm misunderstanding. thank youuu

Hi @bland-beach-18078, we actually looked into this a few weeks ago. The solution we came up with includes deploying a k8s service of type private loadbalancer for the metadata-service and configuring an API Management deployment to talk to it within the same vnet. The API Management can be configured to simply require a subscription key or authenticate using an OAuth server or OpenID connect. This doc is a good starting point.

thank you for the pointer, I'll check it out!