How to do authentication of Kserve?

[shauryagoel]

I wanted to add authentication to my kserve service. So, I found out that Istio provides such features using RequestAuthentication. However, I am not able to make this work for InferenceService.
I have this Kserve service-

apiVersion: serving.kserve.io/v1beta1
kind: InferenceService
metadata:
  name: sklearn-iris
  namespace: kserve-test
  labels:
    app: sklearn-iris
spec:
  predictor:
    model:
      modelFormat:
        name: sklearn
      storageUri: gs://kfserving-examples/models/sklearn/1.0/model

Here is my RequestAuthentication-

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: iris
  namespace: kserve-test
spec:
  selector:
    matchLabels:
      app: sklearn-iris
  jwtRules:
    - issuer: admin@istio.com
      jwks: |-
        <JWKS_TOKEN>

After applying both of these files, I pass the token in curl request and nothing happens. Even if I change the token format, it does not give any error. I have applied a similar config to a non kserve deployment and it is working on that service.

[yuzisun]

Did you see the istio proxy gets injected to the inference service pod ?

[shauryagoel]

Yes, that is happening as kubectl get pods is showing 2 containers for my deployment.

[yuzisun]

No If you are running serverless mode with istio sidecar you’d expect 3 containers not 2.

[shauryagoel]

I installed Kserve v0.9 using the quick_install.sh script.

[yuzisun]

That script does not inject istio sidecar by default, you would need to add the istio sidecar injection annotation on the inference service yaml.

[shauryagoel]

Thank you, that worked. Adding the annotation spawned another container in the pod and the above RequestAuthentication started working.