At Bloomberg, we operate a secure, enterprise-scale Jupyter platform supporting hundreds of data scientists, engineers, and researchers across the firm. This talk explores how we’ve built and evolved our internal managed notebooks infrastructure using open source principles and custom orchestration tools tailored for multi-tenant Kubernetes environments.
We’ll dive into how we manage notebook lifecycle and orchestration via our Jupyter CRD and controller, and how we enforce strong authentication and authorization using Istio, Open Policy Agent, and Single Sign-On. We’ll also share our strategies for enforcing service boundaries with Calico, reverse proxies, and other middleware integrations, as well as how we approach GPU management at scale.
As security and usability go hand-in-hand, attendees will also learn how we use a Vault-backed CSI secrets provider to securely inject Git credentials into user notebooks, and how we prevent sensitive data exposure using Fluent Bit filters. We’ll discuss operational challenges like zombie processes and long-lived sessions, and look ahead at ideas like kernel sharing, checkpointing, and integrations with our AI model serving/ inference platform.