Flyte Authentication within Task Containers [Newbie] #4570
Conversation
Signed-off-by: zeryx <[email protected]>
|
Thank you for opening this pull request! 🙌 These tips will help get your PR across the finish line:
|
dosubot
bot
added
the
size:L
zeryx
changed the title
zeryx
changed the title
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #4570 +/- ##
=======================================
Coverage 58.98% 58.99%
=======================================
Files 621 621
Lines 52483 52483
=======================================
+ Hits 30957 30962 +5
+ Misses 19059 19056 -3
+ Partials 2467 2465 -2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Signed-off-by: zeryx <[email protected]>
zeryx
changed the title
zeryx
changed the title
zeryx
changed the title
There was a problem hiding this comment.
Hey James, thank you for your contribution here! I think this generally sounds like a good idea. However, given auth is definitely not my strongsuite (both on the theoretical as well as on the k8s implementation side) I don't have any valuable feedback on the implementation of potential feedback.
Maybe @EngHabu would know more here?
|
|
||
| This RFC proposes a method to flow Flyte authentication information into task containers. | ||
| It aims to simplify access to execution-specific information and enable secure, streamlined usage of Flyte features within tasks. | ||
| The proposal introduces a Flyte Auth Agent system to bind the authentication context of the task/workflow executor to all executed tasks. |
There was a problem hiding this comment.
What would be the task/workflow executor here? I'm thinking the user who triggered the workflow?
| ## 2 Motivation | ||
|
|
||
| - In many workflows, accessing execution-specific information (e.g., used images, versions) is crucial. | ||
| - Tasks often need to interact with Flyte for remote registration or to use Flyte features (e.g., pyflyte register, build, project creation). |
There was a problem hiding this comment.
I would slightly challenge this that "often" might be an overstatement here. However, I do see a fair usecase with @eager mode
|
This might be out of scope for this RFC, but has any similar consideration been given to Flyte agents? cc @noahjax |
|
Contributors meetup notes: move to "Needs owner" stage |
|
Cleaning stale PRs. Please reopen if you wan to discuss this further. |
Describe your changes
RFC Proposal continuing off of #4527
Checklist: