Flyte Console discovery: validate the path from UI to FlyteAdmin auth
Flyte Console discovery: validate the path from UI to FlyteAdmin auth
Flyte Console is a browser interface that displays workflows, executions, schedules, and task details from FlyteAdmin. The console is only one part of the control path. A public console that appears to require a login can still be paired with an API route, ingress rule, or service credential that reaches FlyteAdmin differently.
The ZoomEye count-only observations for this topic were recorded on 2026-11-01 with sub_type=all, page 1, and page size 1. app="Flyte" returned 29 matches. title="Flyte" returned 189. The counts are independent query results, not a count of production Flyte deployments. A single app or title match can be a demo, documentation page, or a staging environment.
Flyte's OSS authentication documentation describes external OIDC integration, with the ingress and console enforcing login. The legacy Flyte authentication documentation describes OpenID Connect as a way to secure a user's login to FlyteAdmin through the UI. The exact deployment depends on the Flyte version and distribution, so read the guide for the running version instead of assuming that one configuration applies to every release.
Start with the public route to the console and the corresponding FlyteAdmin endpoint. Test an unauthenticated request, an expired session, a low-privilege user, and an administrative user. Observe whether the console redirects to the identity provider, whether the API rejects the request, and whether the UI still renders workflow names or execution data before the redirect.
The ingress and console need a shared interpretation of authentication. If the ingress authenticates a user but forwards an unvalidated identity header, a direct request to the console or API may bypass that identity. If the console handles login but the API is exposed separately, the API must validate the same OIDC issuer, audience, and user context. Test both paths with and without the proxy.
Flyte workflows can carry credentials for code repositories, data stores, and cloud services. The UI may show execution inputs, output locations, task names, and error messages. An exposed console can therefore reveal architecture even if it cannot start a workflow. An exposed API may be able to create or terminate executions, which changes the impact.
Review the service-to-service credentials. FlyteAdmin, FlytePropeller, and other components may have their own authentication relationships. A user login does not automatically secure internal service calls. Check the deployed values for the current release and look for default credentials, legacy settings, or authentication bypasses documented in the release notes. Do not infer safety from the presence of an OIDC login page.
The measurements are summarized here:
| Signal | Query | Count | Interpretation |
| --- | --- | ---: | --- |
| Product fingerprint | app="Flyte" | 29 | Candidate product-related matches |
| Page title | title="Flyte" | 189 | Broad title matches |
The title result is larger, so ownership validation is essential. A page with the product name may be a documentation mirror or a community example. Use the organization's DNS, certificate, and cloud inventory to decide whether a candidate belongs to a managed environment.
If the console is internet-facing, put it behind an identity-aware access layer and restrict the administration surface. Verify that static assets, API calls, and WebSocket or streaming endpoints follow the same policy. A login redirect on / is not enough if /api or a console route serves data to an unauthenticated request.
Test authorization inside Flyte. A user should not be able to inspect executions across projects or namespaces without the appropriate role. A workflow execution may start a job that has access to data or credentials. Review who can register workflows, who can launch them, and who can retrieve their logs or outputs. Separate read-only monitoring from execution control.
The console's OIDC session should use secure cookies, appropriate SameSite behavior, and bounded lifetimes. Logout should revoke the local session and, where supported, the identity-provider session. An old session that remains valid after a user's role is removed is a governance problem even if the login page looks correct.
For an owner investigating a match, preserve the candidate URL, collection time, and query evidence. Do not attempt to enumerate executions or use default credentials. Compare the hostname with the deployment's environment register, then follow the organization's authorized process for checking authentication.
The useful conclusion from the external data is limited: Flyte-related records exist and a title search expands the candidate set. The security answer comes from the deployed authentication configuration and the boundary between Console and FlyteAdmin. Those require internal evidence, not a count alone.
Measurement notes
The two probes were run on 2026-11-01 Asia/Shanghai with page 1, page size 1, and sub_type=all. The result set was not downloaded. Counts describe matches under the selected scope and do not establish vulnerability, exploitation, or confirmed ownership.
References
- Flyte OSS authentication and SSO
- Flyte Console repository
How we got Linux VM container workloads running natively on the Mac so they can use the Apple Silicon GPU (mps/MLX): how we did it and the sandbox tradeoff
(Disclosure: I work at Union AI and maintain Flyte.)
Flyte is an open source AI runtime with a durable execution engine where you can train, fine-tune, and serve AI models and agents.
Problem: Flyte's local devbox runs every task and app in a container. On a Mac that container is a Linux VM, and a Linux VM has no Metal. So torch.backends.mps.is_available() is False, MLX doesn't run, and any ML code you iterate on locally falls back to the CPU. You can't pass the GPU through: there's nothing in the VM to pass it to.
What we did: a task or app that requests flyte.Resources(gpu="AppleSilicon") runs its code natively on the Mac instead. The container starts as normal, then its entrypoint hands its own invocation to a bridge running on the host. The bridge builds a cached uv environment from the image's pip packages, rewrites the in-cluster endpoints to the devbox's host ports, and runs it. The container streams the logs, mirrors the exit code, forwards aborts, and proxies the app port, so the console and the run look normal.
On an M5 Max: a small CNN trained on MNIST in 7 s on mps; a Qwen2.5-0.5B app served from mps at roughly 84–97 tokens/s; a 4096×4096 fp32 matmul ran at 13.4 TFLOPS on mps vs 1.6 on the CPU.
Things worth knowing:
- Running workload code on your laptop means running it outside any sandbox. So it's opt-in (flyte start devbox --apple-silicon), and the flag binds every devbox port to 127.0.0.1.
- Only pip packages carry over to the Mac, not apt packages or the rest of the image. Mounted k8s secrets don't either.
- Asking for the GPU on a devbox without the flag, an Intel Mac, Linux, or a real cluster fails before the task starts with a named error. We chose that over a quiet CPU fallback.
- If you only need completions and want to keep container isolation, there's a container mode that gives the task a host mlx_lm.server behind OPENAI_BASE_URL.
PRs for implementation details:
- flyte#8181 (backend)
- flyte-sdk#1685 (SDK, examples, proof runbook)
- flyte2-ui#42 (console).
Check out the docs to give it a try: union.ai
Curious whether others have gone the "run it on the host" route for local GPU access, or found a way to keep the sandbox.
5 points · 2 comments
Mentions
Flyte Console discovery: validate the path from UI to FlyteAdmin auth Flyte Console discovery: validate the path from UI to FlyteAdmin auth Flyte Console is a browser interface that displays workflows, executions, schedules, and task details from FlyteAdmin. The console is only one part of the control path. A public console that appears to require a login can still be paired with an API route, ingress rule, or service credential that reaches FlyteAdmin differently. The ZoomEye count-only observations for this topic were recorded on 2026-11-01 with sub_type=all, page 1, and page size 1. app="Flyte" returned 29 matches. title="Flyte" returned 189. The counts are independent query results, not a count of production Flyte deployments. A single app or title match can be a demo, documentation page, or a staging environment. Flyte's OSS authentication documentation describes external OIDC integration, with the ingress and console enforcing login. The legacy Flyte authentication documentation describes OpenID Connect as a way to secure a user's login to FlyteAdmin through the UI. The exact deployment depends on the Flyte version and distribution, so read the guide for the running version instead of assuming that one configuration applies to every release. Start with the public route to the console and the corresponding FlyteAdmin endpoint. Test an unauthenticated request, an expired session, a low-privilege user, and an administrative user. Observe whether the console redirects to the identity provider, whether the API rejects the request, and whether the UI still renders workflow names or execution data before the redirect. The ingress and console need a shared interpretation of authentication. If the ingress authenticates a user but forwards an unvalidated identity header, a direct request to the console or API may bypass that identity. If the console handles login but the API is exposed separately, the API must validate the same OIDC issuer, audience, and user context. Test both paths with and without the proxy. Flyte workflows can carry credentials for code repositories, data stores, and cloud services. The UI may show execution inputs, output locations, task names, and error messages. An exposed console can therefore reveal architecture even if it cannot start a workflow. An exposed API may be able to create or terminate executions, which changes the impact. Review the service-to-service credentials. FlyteAdmin, FlytePropeller, and other components may have their own authentication relationships. A user login does not automatically secure internal service calls. Check the deployed values for the current release and look for default credentials, legacy settings, or authentication bypasses documented in the release notes. Do not infer safety from the presence of an OIDC login page. The measurements are summarized here: | Signal | Query | Count | Interpretation | | --- | --- | ---: | --- | | Product fingerprint | app="Flyte" | 29 | Candidate product-related matches | | Page title | title="Flyte" | 189 | Broad title matches | The title result is larger, so ownership validation is essential. A page with the product name may be a documentation mirror or a community example. Use the organization's DNS, certificate, and cloud inventory to decide whether a candidate belongs to a managed environment. If the console is internet-facing, put it behind an identity-aware access layer and restrict the administration surface. Verify that static assets, API calls, and WebSocket or streaming endpoints follow the same policy. A login redirect on / is not enough if /api or a console route serves data to an unauthenticated request. Test authorization inside Flyte. A user should not be able to inspect executions across projects or namespaces without the appropriate role. A workflow execution may start a job that has access to data or credentials. Review who can register workflows, who can launch them, and who can retrieve their logs or outputs. Separate read-only monitoring from execution control. The console's OIDC session should use secure cookies, appropriate SameSite behavior, and bounded lifetimes. Logout should revoke the local session and, where supported, the identity-provider session. An old session that remains valid after a user's role is removed is a governance problem even if the login page looks correct. For an owner investigating a match, preserve the candidate URL, collection time, and query evidence. Do not attempt to enumerate executions or use default credentials. Compare the hostname with the deployment's environment register, then follow the organization's authorized process for checking authentication. The useful conclusion from the external data is limited: Flyte-related records exist and a title search expands the candidate set. The security answer comes from the deployed authentication configuration and the boundary between Console and FlyteAdmin. Those require internal evidence, not a count alone. Measurement notes The two probes were run on 2026-11-01 Asia/Shanghai with page 1, page size 1, and sub_type=all. The result set was not downloaded. Counts describe matches under the selected scope and do not establish vulnerability, exploitation, or confirmed ownership. References - Flyte OSS authentication and SSO - Flyte Console repository
How we got Linux VM container workloads running natively on the Mac so they can use the Apple Silicon GPU (mps/MLX): how we did it and the sandbox tradeoff (Disclosure: I work at Union AI and maintain Flyte.) Flyte is an open source AI runtime with a durable execution engine where you can train, fine-tune, and serve AI models and agents. Problem: Flyte's local devbox runs every task and app in a container. On a Mac that container is a Linux VM, and a Linux VM has no Metal. So torch.backends.mps.is_available() is False, MLX doesn't run, and any ML code you iterate on locally falls back to the CPU. You can't pass the GPU through: there's nothing in the VM to pass it to. What we did: a task or app that requests flyte.Resources(gpu="AppleSilicon") runs its code natively on the Mac instead. The container starts as normal, then its entrypoint hands its own invocation to a bridge running on the host. The bridge builds a cached uv environment from the image's pip packages, rewrites the in-cluster endpoints to the devbox's host ports, and runs it. The container streams the logs, mirrors the exit code, forwards aborts, and proxies the app port, so the console and the run look normal. On an M5 Max: a small CNN trained on MNIST in 7 s on mps; a Qwen2.5-0.5B app served from mps at roughly 84–97 tokens/s; a 4096×4096 fp32 matmul ran at 13.4 TFLOPS on mps vs 1.6 on the CPU. Things worth knowing: - Running workload code on your laptop means running it outside any sandbox. So it's opt-in (flyte start devbox --apple-silicon), and the flag binds every devbox port to 127.0.0.1. - Only pip packages carry over to the Mac, not apt packages or the rest of the image. Mounted k8s secrets don't either. - Asking for the GPU on a devbox without the flag, an Intel Mac, Linux, or a real cluster fails before the task starts with a named error. We chose that over a quiet CPU fallback. - If you only need completions and want to keep container isolation, there's a container mode that gives the task a host mlx_lm.server behind OPENAI_BASE_URL. PRs for implementation details: - flyte#8181 (backend) - flyte-sdk#1685 (SDK, examples, proof runbook) - flyte2-ui#42 (console). Check out the docs to give it a try: union.ai Curious whether others have gone the "run it on the host" route for local GPU access, or found a way to keep the sandbox.