Add gcp secret parameter to container op

sdk/python/kfp/compiler/compiler.py

@@ -144,6 +144,17 @@ def _op_to_template(self, op):
       if op.cpu_request:
         template['container']['resources']['requests']['cpu'] = op.cpu_request
 
+    if op.gcp_secret:
+      template['container']['env'] = {}
+      template['container']['env']['name'] = 'GOOGLE_APPLICATION_CREDENTIALS'
+      template['container']['env']['value'] = '/secret/gcp-credentials/user-gcp-sa.json'
+      template['container']['volumeMounts'] = {}
+      template['container']['volumeMounts']['mountPath'] = '/secret/gcp-credentials'
+      template['container']['volumeMounts']['name'] = 'gcp-credentials'
+      template['volumes'] = {}
+      template['volumes']['name'] = 'gcp-credentials'
+      template['volumes']['secret'] = {}
+      template['volumes']['secret']['secretName'] = op.gcp_secret
     return template
 
   def _get_groups_for_ops(self, root_group):

sdk/python/kfp/dsl/_container_op.py

@@ -24,7 +24,7 @@ class ContainerOp(object):
 
   def __init__(self, name: str, image: str, command: str=None, arguments: str=None,
                file_inputs : Dict[_pipeline_param.PipelineParam, str]=None,
-               file_outputs : Dict[str, str]=None, is_exit_handler=False):
+               file_outputs : Dict[str, str]=None, gcp_secret: str=None, is_exit_handler=False):
     """Create a new instance of ContainerOp.
 
     Args:
@@ -41,6 +41,8 @@ def __init__(self, name: str, image: str, command: str=None, arguments: str=None
       file_outputs: Maps output labels to local file paths. At pipeline run time,
           the value of a PipelineParam is saved to its corresponding local file. It's
           one way for outside world to receive outputs of the container.
+      gcp_secret: Specifying what secret to mount to the container for accessing
+          GCP APIs.
       is_exit_handler: Whether it is used as an exit handler.
     """
 
@@ -52,6 +54,7 @@ def __init__(self, name: str, image: str, command: str=None, arguments: str=None
     self.image = image
     self.command = command
     self.arguments = arguments
+    self.gcp_secret = gcp_secret
     self.is_exit_handler = is_exit_handler
     self.memory_limit = None
     self.memory_request = None
@@ -150,6 +153,6 @@ def set_cpu_limit(self, cpu):
 
     self._validate_cpu_string(cpu)
     self.cpu_limit = cpu
-    
+
   def __repr__(self):
       return str({self.__class__.__name__: self.__dict__})

sdk/python/tests/compiler/compiler_tests.py

@@ -35,14 +35,22 @@ def test_operator_to_template(self):
       msg2 = dsl.PipelineParam('msg2', value='value2')
       op = dsl.ContainerOp(name='echo', image='image', command=['sh', '-c'],
                            arguments=['echo %s %s | tee /tmp/message.txt' % (msg1, msg2)],
-                           file_outputs={'merged': '/tmp/message.txt'})
+                           file_outputs={'merged': '/tmp/message.txt'}, gcp_secret='user-gcp-sa')
     golden_output = {
       'container': {
         'image': 'image',
         'args': [
           'echo {{inputs.parameters.msg1}} {{inputs.parameters.msg2}} | tee /tmp/message.txt'
         ],
         'command': ['sh', '-c'],
+        'env': {
+          'name': 'GOOGLE_APPLICATION_CREDENTIALS',
+          'value': '/secret/gcp-credentials/user-gcp-sa.json'
+        },
+        'volumeMounts': {
+          'mountPath': '/secret/gcp-credentials',
+          'name': 'gcp-credentials'
+        }
       },
       'inputs': {'parameters':
         [
@@ -90,6 +98,12 @@ def test_operator_to_template(self):
             }
           }
         }]
+      },
+      'volumes': {
+        'name': 'gcp-credentials',
+        'secret': {
+          'secretName': 'user-gcp-sa'
+        }
       }
     }