TL;DR

The platform maps Keycloak groups to managed Kubernetes namespaces and uses each namespace as the shared home for a group’s services and workloads.
A tenant-member Role authorizes the group and its notebook ServiceAccount to submit approved RayClusters and RayJobs. CheckMAITE submits a RayJob as the authenticated person through tightly bounded Kubernetes impersonation.
Admission, quota, and networking constrain every submission path. RayService remains restricted to the Ray Serve Pack because it operates persistent shared infrastructure.
Submission identity records who requested work; workload identity controls what the resulting Pods may access. These are separate security decisions.
Workload Pods receive pinned ServiceAccounts and project-scoped AWS IAM roles. EKS Pod Identity, STS, S3 policies, and KMS enforce their data access.
New packs and services can reuse this tenant design instead of creating a separate identity, security, and operations model each time.

Identity + authorization plane

PeopleUsersBrowser clients

Authenticated edgeEnvoy GatewayBrowser routes · OIDC policy

Identity providerKeycloakOIDC login · full group paths

Data authorizationGeneric data catalogMetadata · grants · durable references

ATEP Kubernetes cluster

checkmaite-packUI + API

Web UIRayJob submitterBounded impersonation

Validates the person and tenant, then submits as the authenticated caller.

data-science-packJupyterHub + JupyterLab

User notebookTenant ServiceAccountRay client

Tenant-member access: launch approved RayClusters and RayJobs, then connect directly.

Extensible platformOther NIC packs

ServicesAPIsWorkflows

Reuse tenant identity, policy, compute, and S3.

Cluster control + orchestrationKubernetes API

KubeRay operatorArgo Workflows

Shared team boundary · not a per-user namespaceGroup A namespaceRBAC · quota · admission · NetworkPolicy

Notebook path · separate Ray runtimesInteractive RayClusters

AliceBob

Separate heads and object stores; shared tenant boundary

Batch path · notebook or UIRayJob + RayClusterOne ephemeral cluster per run

Serving pathRayServiceOne per group

tenant-member Rolenotebook / interactive ServiceAccountrunner ServiceAccountserving ServiceAccount

Repeated boundaryGroup BSeparate namespace

Its own clusters, RayService, identities, quota, and data grants.

AWS data planeEKS Pod Identity → IAM rolesNo static credentials

API result reader · Group ANotebook / interactive · Group ARunner / workflow · Group AServing · Group ANIC pack service rolesAPI result reader · Group B

Durable Kubernetes workload storageS3Datasets · models · run inputs · resultsArgo artifacts · group-separated prefixes

IdentityControl and submissionData and AWS identity

On a small screen, swipe the diagram horizontally.

27 items shown