<p>I have followed the steps in <a href="https://www.kubeflow.org/docs/started/getting-started-gke/" rel="nofollow noreferrer">Kubernetes Engine for Kubeflow</a>.</p>

<p>The deployment went fine and all pods/services are up, including the endpoint at <code>https://&lt;name&gt;.endpoints.&lt;project&gt;.cloud.goog/</code>, with the correct <code>&lt;name&gt;</code> and <code>&lt;project&gt;</code> of course.</p>

<p>When I went to the above url, I was redirected to a "Sign in with Google" page. I assumed that OAuth was also configured correctly.</p>

<p>However, after signing in, I was shown an Access Denied page below.</p>

<p>Is there another way to provide access? I thought it was handled by OAuth.</p>

<p><img src="https://i.stack.imgur.com/T7L7m.jpg" alt="Access Denied" title="Access Denied"></p>

<p>The deployment created by <code>kfctl.sh</code> in "Deploy Kubeflow on GKE using the command line" also creates a load balancer resource for the ingress into the cluster and secures it using Cloud Identity-Aware Proxy (IAP).</p>

<p>To allow access to the resource for new users, go to:</p>

<p>Google Cloud Console > IAM &amp; Admin > Identity-Aware Proxy</p>

<p>Select the desired resource and click "Add Member".</p>

<p>Fill in the user in the "Access Denied" page and select "Cloud IAP > IAP-Secured Web App User" for role.</p>

<p>Once the policy change is propagated, the user will be able to access the URL successfully.</p>
