Skip to content

Commit b2099bc

Browse files
authored
Docs: Add example of network policy configuration for accessing Dask scheduler dashboard (#955)
1 parent c9f228b commit b2099bc

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

docs/source/installing.rst

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -236,8 +236,15 @@ Then, apply your updated configuration and restart your notebook pod as previous
236236

237237
.. warning::
238238

239-
Setting `c.ServerProxy.host_allowlist = lambda app, host: True` is inherently insecure and may enable unintended access to other services within your network.
240-
Ideally, you should modify this condition to restrict the host to your Dask Scheduler’s domain or service name (for instance, dask-cluster-name.default.svc.cluster.local) instead of allowing everything.
239+
Setting ``c.ServerProxy.host_allowlist = lambda app, host: True`` is inherently insecure and may enable unintended access to other services within your network.
240+
Ideally, you should restrict the host to your Dask Scheduler’s namespace or cluster name and namespace (for instance, "<dask-cluster-name>.<namespace>").
241+
However, depending on your configuration, matching by suffix may be sufficient.
242+
For example:
243+
244+
.. code-block:: python
245+
246+
# Authorize network flows to the Kubernetes namespace in which your Dask cluster will be deployed.
247+
c.ServerProxy.host_allowlist = lambda app, host: host.endswith('.your-dask-operator-namespace')
241248
242249
Kubeflow
243250
^^^^^^^^

0 commit comments

Comments
 (0)