Add an application to the ML platform

Last update: October 16 2026Open in Markdown

In the ML Platform, you can add additional applications using kubectl, helm, and kustomize.

You can open the application using a URL like https://myapp-yourdomain.mlops.selcloud.ru or add the application to the ML Platform start page.

For applications that will be accessible on the internet, you need to configure authorization.

Add a new application to the ML platform

To add a new application to the ML Platform, create an Ingress object. You do not need to create an Ingress Controller — the Traefik controller is pre-installed in the ML Platform on Managed Kubernetes clusters.

There is no need to obtain TLS certificates directly in the ML platform, as the certificate is installed on the reverse proxy.

1. Connect to the Managed Kubernetes cluster created when connecting the ML Platform.

2. Create a yaml file with a manifest for the Ingress object.

   Example manifest:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: myapp
     namespace: <ml_platform_namespace>
     annotations:
       traefik.ingress.kubernetes.io/router.tls: "true"
   spec:
     tls:
       - hosts:
           - "myapp-<ml_platform_domain>"
         secretName: myapp-<ml_platform_domain>-cert
     rules:
       - host: "myapp-<ml_platform_domain>"
         http:
           paths:
             - path: /
               pathType: Prefix
               backend:
                 service:
                   name: myapp
                   port:
                     number: 80

   Specify:

   • <ml_platform_namespace> — ML Platform namespace;
   • <ml_platform_domain> — URL like yourdomain.mlops.selcloud.ru issued after connecting the ML Platform.

3. Create an Ingress:

   kubectl apply -f <ingress.yaml>

   Specify <ingress.yaml> — the name of the YAML file with the Ingress manifest.

4. Open the application at the address:

   https://myapp-<ml_platform_domain>

   Specify <ml_platform_domain> — URL like yourdomain.mlops.selcloud.ru issued after connecting the ML Platform.

5. Configure authorization for the application.

6. Optional: add the application to the start page.

Add an application to the ML platform home page

The ML Platform start page is powered by the Forecastle tool. On the page, you can view all applications running by default in the Managed Kubernetes cluster.

If you added a new application to the ML Platform, it can also be added to the start page.

1. Connect to the Managed Kubernetes cluster created when connecting the ML Platform.

2. Open the yaml file with the manifest for the application Ingress and add annotations to it:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: myapp
     namespace: <ml_platform_namespace>
     annotations:
       traefik.ingress.kubernetes.io/router.tls: "true"
       forecastle.stakater.com/expose: "true"
       forecastle.stakater.com/appName: MyApp # App name shown on the start page
       forecastle.stakater.com/group: MyAppsGroup # Group on the start page where the app will be added
       forecastle.stakater.com/icon: <app_icon_url>

   Specify:

   • <ml_platform_namespace> — ML Platform namespace;
   • <app_icon_url> — optional: URL of the image for the application icon.

3. Apply the changes for the Ingress:

   kubectl apply -f <ingress.yaml>

   Specify <ingress.yaml> — the name of the YAML file with the Ingress manifest.

4. Open the ML platform home page and verify that the application has been added:

   https://myapp-<ml_platform_domain>

   Specify <ml_platform_domain> — URL like yourdomain.mlops.selcloud.ru issued after connecting the ML Platform.

Configure authorization for the application

If you have added an application to the ML platform, be sure to configure authorization.

Authorization setup depends on the protocols supported by the application:

• if the application supports authorization using OIDC/OAuth2/SAML protocols, create a Keycloak client;
• if the application does not support OIDC/OAuth2/SAML protocols or has no authorization mechanisms, use gogatekeeper—this is a sidecar for Keycloak.

Authorization using OIDC

Create a Keycloak client and configure authorization for the application via the ML Platform Keycloak. When a user logs in to the application, a request is sent to the Keycloak client. If validated, the user can access the application. Learn more about using Keycloak in the ML Platform in the Manage Keycloak users instructions.

1. Connect to the Managed Kubernetes cluster created when connecting the ML Platform.

2. Create a Keycloak client via the Keycloak Admin Console at https://keycloak-<ml_platform_domain>/admin/cmlp/console/ or create a YAML file with the manifest for the KeycloakClient object.

   Example manifest:

   apiVersion: keycloak.org/v1alpha1
   kind: KeycloakClient
   metadata:
     name: myapp-client
     namespace: <ml_platform_namespace>
   spec:
     client:
       # Settings
       enabled: true
       clientId: "<appclient_name>"
       name: ""
       description: ''
       secret: "<password>"
       protocol: "openid-connect"
       redirectUris:
         - "https://<appclient_name>-.<ml_platform_namespace>/*" # URI from which the redirect to Keycloak occurs
       rootUrl: "${authBaseUrl}"
       baseUrl: "/"
       publicClient: false
       bearerOnly: false
       serviceAccountsEnabled: false
       consentRequired: false
       directAccessGrantsEnabled: true
       implicitFlowEnabled: false
       frontchannelLogout: false
       standardFlowEnabled: true
       surrogateAuthRequired: false
       useTemplateConfig: true
       useTemplateMappers: true
       # Scopes
       useTemplateScope: true
       fullScopeAllowed: false
       defaultClientScopes:
         - "profile"
         - "email"
       # Roles
       protocolMappers:
       - config:
           access.token.claim: "true"
           id.token.claim: "false"
           included.custom.audience: <appclient_name>
         consentRequired: false
         name: Audience-forecastle-cmlp
         protocol: openid-connect
         protocolMapper: oidc-audience-mapper
     realmSelector:
       matchLabels:
         app.kubernetes.io/name: keycloak-realm-cmlp
         app.kubernetes.io/instance: keycloak-operator

   Specify:

   • <ml_platform_namespace> — ML Platform namespace;
   • <appclient_name> — unique name of the Keycloak client;
   • <password> — password for the Keycloak client. Required for application configuration.

3. Create a Keycloak client:

   kubectl apply -f <keycloakclient.yaml>

   Specify <keycloakclient.yaml> — the name of the YAML file with the manifest for creating the Keycloak client.

4. Verify that the client is created: open the Security Admin Console application and go to Configure → Clients.

5. Configure the application for authorization via the created Keycloak client:

   • use the python-keycloak Python library;
   • or use Grafana and modify the configuration file following the example in the Grafana documentation.

Authorization using gogatekeeper

Gogatekeeper acts as a proxy between the application container and the service, requests a JWT (JSON Web Token), and validates it to grant access to the application.

gogatekeeper-operator is installed as an Injector in the ML Platform.

1. Connect to the Managed Kubernetes cluster created when connecting the ML Platform.

2. Create a yaml file with a manifest for a Gogatekeeper object in any namespace.

   Example manifest:

   apiVersion: gatekeeper.theendbeta.me/v1alpha1
   kind: Gogatekeeper
   metadata:
     name: gatekeeper-for-myapp
     namespace: mynamespace
   spec:
     defaultconfig: |-
       upstream-url:          http://127.0.0.1:80 # Port where the myapp container listens
       listen:                :3000 # gogatekeeper port to switch traffic to
       listen-admin:          :4000
       enable-refresh-tokens: true
       secure-cookie:         false
     oidcurl: https://keycloak-<ml_platform_domain>/auth/realms/CMLP # Realm URL

   Specify <ml_platform_domain> — URL like yourdomain.mlops.selcloud.ru issued after connecting the ML Platform.

3. Create Gogatekeeper:

   kubectl apply -f <gogatekeeper.yaml>

   Specify <gogatekeeper.yaml> — the name of the YAML file with the manifest for creating Gogatekeeper.

4. Open the yaml file with the manifest for the Pod and add annotations to it:

   apiVersion: v1
   kind: Pod
   metadata:
     annotations:
       gatekeeper.gogatekeeper: gatekeeper-for-myapp
       gatekeeper.gogatekeeper/client-id: myapp # ID from KeycloakClient
       gatekeeper.gogatekeeper/client-secret: <password>
       gatekeeper.gogatekeeper/encryption-key: <another_password>
       gatekeeper.gogatekeeper/redirection-url: https://myapp-<ml_platform_domain>
       gatekeeper.gogatekeeper/upstream-url: http://127.0.0.1:80

   Specify:

   • <password> — password for the Keycloak client. Required for application configuration;
   • <another_password> — another random password;
   • <ml_platform_domain> — URL like yourdomain.mlops.selcloud.ru issued after connecting the ML Platform.

5. Apply the changes in the manifest:

   kubectl apply -f <pod.yaml>

   Specify <pod.yaml> — the name of the YAML file with the manifest for the pod.

   gogatekeeper-operator will add the gogatekeeper container to the running myapp pod. The pod will have two containers: the original myapp container and the gogatekeeper sidecar container.

6. Change the port in myapp from 80 (application port) to 3000 (gogatekeeper port).

7. Check that gogatekeeper is running:

   https://myapp-<ml_platform_domain>

   Specify <ml_platform_domain> — URL like yourdomain.mlops.selcloud.ru issued after connecting the ML Platform.

   In incognito mode, a Keycloak login window will appear.