forked from kubeflow/pipelines
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Separate run resources in namespaces (kubeflow#2694)
* add namespace to some run APIs * update only the create run api * add resourcereference for namespace runs * pass user identity header from the gRPC server to KFP service * add variables in const * declare a flag and fill in the authorizations * add types to toModel func * bug fix * strip the namespace resource reference when mapping to the db model * add unit tests * add authorization * interpret json response * use gofmt * add more meaningful error message; format * refactoring codes * separate workflow client * replace belonging relationshipreference to owner * put a todo for further investigation of using namespace or uuid * apply gofmt * revert minor change * refactor codes * minor change * use internal server error in kfam client * minor change * use timeout in kfam client * make kfam service host/port configurable * minor changes * update name * rename * update the util function to accept a list of resourcereferences * better error message * reformat * remove IsRequestAuthorized func * add multi-user mode flag * apply different service accounts based on the multi-user mode flag * apply service account only when it is not set * add kfam host and port in config.json * generalize the auth code * rename KFAMInterface to KFAMClientInterface * add kfam fake for tests * add build bazel * add unit tests for util func * remove the config * add unit test for authorization with httptest * only intialize the kfam client when kubeflow deployment * minor change * fix typo * wrap the whole auth func * update authz logic to be enabled when it is kubeflow deployment * change flag from kubeflow deployment to multiuser mode * gofmt * minor change * combine getnamespace func * insert annotation to disable istio injection * move unit tests * move fake kfam to the original kfam; create multiple fake kfam clients * combine authorize func, add unit tests for util_test * wrap errors * fix unit test * service unauthorized info to user * better user errors * inject default sa when it is empty or injected by the SDK in multi-user mode * revert some accidental change * revert some accidental change * Update util.go * make functions local * deduplicate return values from isauthorized * update kfam service host env variable * disable istio injection * set annotations to template instead of the workflow * fix reference/value bug * addressing comments * Create an argoclient class * move podnamespace to argo client * addressing comments * addressing comments
- Loading branch information
1 parent
f9c17d7
commit dae90c3
Showing
17 changed files
with
313 additions
and
165 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| // Copyright 2018 Google LLC | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // https://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package client | ||
|
|
||
| import ( | ||
| "time" | ||
|
|
||
| argoclient "github.com/argoproj/argo/pkg/client/clientset/versioned" | ||
| argoprojv1alpha1 "github.com/argoproj/argo/pkg/client/clientset/versioned/typed/workflow/v1alpha1" | ||
| "github.com/cenkalti/backoff" | ||
| "github.com/golang/glog" | ||
| "github.com/kubeflow/pipelines/backend/src/apiserver/common" | ||
| "github.com/pkg/errors" | ||
| "k8s.io/client-go/rest" | ||
| ) | ||
|
|
||
| const ( | ||
| PodNamespace = "POD_NAMESPACE" | ||
| ) | ||
|
|
||
| type ArgoClientInterface interface { | ||
| Workflow(namespace string) argoprojv1alpha1.WorkflowInterface | ||
| } | ||
|
|
||
| type ArgoClient struct { | ||
| argoProjClient argoprojv1alpha1.ArgoprojV1alpha1Interface | ||
| } | ||
|
|
||
| func (argoClient *ArgoClient) Workflow(namespace string) argoprojv1alpha1.WorkflowInterface { | ||
| if len(namespace) == 0 { | ||
| namespace = common.GetStringConfig(PodNamespace) | ||
| } | ||
| return argoClient.argoProjClient.Workflows(namespace) | ||
| } | ||
|
|
||
| func NewArgoClientOrFatal(initConnectionTimeout time.Duration) *ArgoClient { | ||
| var argoProjClient argoprojv1alpha1.ArgoprojV1alpha1Interface | ||
| var operation = func() error { | ||
| restConfig, err := rest.InClusterConfig() | ||
| if err != nil { | ||
| return errors.Wrap(err, "Failed to initialize the RestConfig") | ||
| } | ||
| argoProjClient = argoclient.NewForConfigOrDie(restConfig).ArgoprojV1alpha1() | ||
| return nil | ||
| } | ||
|
|
||
| b := backoff.NewExponentialBackOff() | ||
| b.MaxElapsedTime = initConnectionTimeout | ||
| err := backoff.Retry(operation, b) | ||
|
|
||
| if err != nil { | ||
| glog.Fatalf("Failed to create ArgoClient. Error: %v", err) | ||
| } | ||
| return &ArgoClient{argoProjClient} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| // Copyright 2019 Google LLC | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // https://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package client | ||
|
|
||
| import ( | ||
| argoprojv1alpha1 "github.com/argoproj/argo/pkg/client/clientset/versioned/typed/workflow/v1alpha1" | ||
| "github.com/pkg/errors" | ||
| ) | ||
|
|
||
| type FakeArgoClient struct { | ||
| workflowClientFake *FakeWorkflowClient | ||
| } | ||
|
|
||
| func NewFakeArgoClient() *FakeArgoClient { | ||
| return &FakeArgoClient{NewWorkflowClientFake()} | ||
| } | ||
|
|
||
| func (c *FakeArgoClient) Workflow(namespace string) argoprojv1alpha1.WorkflowInterface { | ||
| return c.workflowClientFake | ||
| } | ||
|
|
||
| func (c *FakeArgoClient) GetWorkflowCount() int { | ||
| return len(c.workflowClientFake.workflows) | ||
| } | ||
|
|
||
| func (c *FakeArgoClient) GetWorkflowKeys() map[string]bool { | ||
| result := map[string]bool{} | ||
| for key := range c.workflowClientFake.workflows { | ||
| result[key] = true | ||
| } | ||
| return result | ||
| } | ||
|
|
||
| func (c *FakeArgoClient) IsTerminated(name string) (bool, error) { | ||
| workflow, ok := c.workflowClientFake.workflows[name] | ||
| if !ok { | ||
| return false, errors.New("No workflow found with name: " + name) | ||
| } | ||
|
|
||
| activeDeadlineSeconds := workflow.Spec.ActiveDeadlineSeconds | ||
| if activeDeadlineSeconds == nil { | ||
| return false, errors.New("No ActiveDeadlineSeconds found in workflow with name: " + name) | ||
| } | ||
|
|
||
| return *activeDeadlineSeconds == 0, nil | ||
| } | ||
|
|
||
| type FakeArgoClientWithBadWorkflow struct { | ||
| workflowClientFake *FakeBadWorkflowClient | ||
| } | ||
|
|
||
| func NewFakeArgoClientWithBadWorkflow() *FakeArgoClientWithBadWorkflow { | ||
| return &FakeArgoClientWithBadWorkflow{&FakeBadWorkflowClient{}} | ||
| } | ||
|
|
||
| func (c *FakeArgoClientWithBadWorkflow) Workflow(namespace string) argoprojv1alpha1.WorkflowInterface { | ||
| return c.workflowClientFake | ||
| } |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.