Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Separate run resources in namespaces #2694

Merged
merged 105 commits into from
Dec 16, 2019
Merged
Show file tree
Hide file tree
Changes from 104 commits
Commits
Show all changes
105 commits
Select commit Hold shift + click to select a range
75c309d
add namespace to some run APIs
gaoning777 Nov 26, 2019
566cc10
update only the create run api
gaoning777 Nov 26, 2019
1060cbb
add resourcereference for namespace runs
gaoning777 Nov 26, 2019
05151b6
pass user identity header from the gRPC server to KFP service
gaoning777 Nov 26, 2019
e6c1443
add variables in const
gaoning777 Nov 26, 2019
fdb260b
Merge branch 'add-ns-in-API' into get-user-identity-from-header
gaoning777 Nov 26, 2019
be5a167
declare a flag and fill in the authorizations
gaoning777 Nov 26, 2019
659165e
add types to toModel func
gaoning777 Nov 26, 2019
f92c90f
Merge branch 'add-ns-in-API' into get-user-identity-from-header
gaoning777 Nov 26, 2019
5016f3a
Merge branch 'get-user-identity-from-header' into authorize-requests
gaoning777 Nov 26, 2019
755f542
bug fix
gaoning777 Nov 27, 2019
ee45be5
strip the namespace resource reference when mapping to the db model
gaoning777 Nov 27, 2019
2ace3fc
Merge branch 'add-ns-in-API' into get-user-identity-from-header
gaoning777 Nov 27, 2019
aea1924
Merge branch 'get-user-identity-from-header' into authorize-requests
gaoning777 Nov 27, 2019
bdd7dac
Merge branch 'master' into add-ns-in-API
gaoning777 Nov 27, 2019
204824b
add unit tests
gaoning777 Nov 27, 2019
b0aaf18
Merge branch 'add-ns-in-API' into get-user-identity-from-header
gaoning777 Nov 27, 2019
50eb63c
Merge branch 'get-user-identity-from-header' into authorize-requests
gaoning777 Nov 27, 2019
a21b60a
add authorization
gaoning777 Nov 28, 2019
a7d3db3
interpret json response
gaoning777 Nov 28, 2019
8085cbf
use gofmt
gaoning777 Dec 2, 2019
c5db317
Merge branch 'add-ns-in-API' into get-user-identity-from-header
gaoning777 Dec 2, 2019
91963c0
Merge branch 'get-user-identity-from-header' into authorize-requests
gaoning777 Dec 2, 2019
cefc903
add more meaningful error message; format
gaoning777 Dec 2, 2019
a48a554
refactoring codes
gaoning777 Dec 2, 2019
28dab1c
separate workflow client
gaoning777 Dec 3, 2019
836573a
replace belonging relationshipreference to owner
gaoning777 Dec 3, 2019
80ab78d
put a todo for further investigation of using namespace or uuid
gaoning777 Dec 3, 2019
7cc2397
apply gofmt
gaoning777 Dec 3, 2019
882872d
revert minor change
gaoning777 Dec 3, 2019
4c21962
Merge branch 'add-ns-in-API' into authorize-requests
gaoning777 Dec 3, 2019
42fa5c5
refactor codes
gaoning777 Dec 3, 2019
cd9967e
minor change
gaoning777 Dec 3, 2019
65ea8e5
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 3, 2019
7d273e5
Merge branch 'master' into authorize-requests
gaoning777 Dec 4, 2019
7c5cdc1
use internal server error in kfam client
gaoning777 Dec 4, 2019
bf30a21
minor change
gaoning777 Dec 4, 2019
a497f79
use timeout in kfam client
gaoning777 Dec 4, 2019
d24542a
make kfam service host/port configurable
gaoning777 Dec 4, 2019
f3a303d
minor changes
gaoning777 Dec 4, 2019
d4fb0f5
update name
gaoning777 Dec 4, 2019
67f414a
rename
gaoning777 Dec 4, 2019
24e5994
update the util function to accept a list of resourcereferences
gaoning777 Dec 4, 2019
bbe6f56
better error message
gaoning777 Dec 4, 2019
96aa2e3
reformat
gaoning777 Dec 4, 2019
1815bf9
remove IsRequestAuthorized func
gaoning777 Dec 4, 2019
5dc4263
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 4, 2019
0a54b7e
add multi-user mode flag
gaoning777 Dec 5, 2019
eea973a
apply different service accounts based on the multi-user mode flag
gaoning777 Dec 5, 2019
70bffca
apply service account only when it is not set
gaoning777 Dec 5, 2019
4aa1064
add kfam host and port in config.json
gaoning777 Dec 5, 2019
e1dbb41
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 5, 2019
aa08a9a
generalize the auth code
gaoning777 Dec 5, 2019
66a1150
rename KFAMInterface to KFAMClientInterface
gaoning777 Dec 5, 2019
008e7a6
add kfam fake for tests
gaoning777 Dec 5, 2019
39df35b
add build bazel
gaoning777 Dec 5, 2019
752c8de
add unit tests for util func
gaoning777 Dec 5, 2019
d68ad13
remove the config
gaoning777 Dec 5, 2019
50b1d19
add unit test for authorization with httptest
gaoning777 Dec 6, 2019
60ded01
only intialize the kfam client when kubeflow deployment
gaoning777 Dec 6, 2019
2e5e4a1
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 6, 2019
20d70c7
minor change
gaoning777 Dec 9, 2019
01a0cd4
fix typo
gaoning777 Dec 9, 2019
15cfb0e
wrap the whole auth func
gaoning777 Dec 9, 2019
1aea670
update authz logic to be enabled when it is kubeflow deployment
gaoning777 Dec 9, 2019
7158548
change flag from kubeflow deployment to multiuser mode
gaoning777 Dec 10, 2019
20de11a
gofmt
gaoning777 Dec 10, 2019
cbf8490
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
e07755a
minor change
gaoning777 Dec 10, 2019
4b158c4
combine getnamespace func
gaoning777 Dec 10, 2019
aee108e
insert annotation to disable istio injection
gaoning777 Dec 10, 2019
86e7b31
move unit tests
gaoning777 Dec 10, 2019
c4fcb9c
move fake kfam to the original kfam; create multiple fake kfam clients
gaoning777 Dec 10, 2019
cca49c4
combine authorize func, add unit tests for util_test
gaoning777 Dec 10, 2019
a69d965
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
f2e75eb
Merge branch 'master' into authorize-requests
gaoning777 Dec 10, 2019
cf95a94
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
f649b6a
wrap errors
gaoning777 Dec 10, 2019
2128b27
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
18864db
fix unit test
gaoning777 Dec 10, 2019
0d403a7
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
673db26
service unauthorized info to user
gaoning777 Dec 10, 2019
1cfe9a5
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
8744848
better user errors
gaoning777 Dec 10, 2019
1b83f94
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
464c7a9
inject default sa when it is empty or injected by the SDK in multi-us…
gaoning777 Dec 10, 2019
52eab3e
revert some accidental change
gaoning777 Dec 10, 2019
97535ba
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
684e725
revert some accidental change
gaoning777 Dec 10, 2019
df09ce1
Update util.go
IronPan Dec 10, 2019
be2806b
make functions local
gaoning777 Dec 10, 2019
3ebff5a
Merge branch 'authorize-requests' of https://github.com/gaoning777/pi…
gaoning777 Dec 10, 2019
c371e20
deduplicate return values from isauthorized
gaoning777 Dec 10, 2019
c47ec14
Merge branch 'authorize-requests' into separate-run-resources-in-name…
gaoning777 Dec 10, 2019
60714bb
Merge branch 'master' into separate-run-resources-in-namespaces
gaoning777 Dec 11, 2019
dbbb34c
update kfam service host env variable
gaoning777 Dec 11, 2019
8f1e4ee
Merge branch 'update_kfam_env_variable' into separate-run-resources-i…
gaoning777 Dec 11, 2019
472c1e5
disable istio injection
gaoning777 Dec 11, 2019
f1a2bdc
set annotations to template instead of the workflow
gaoning777 Dec 11, 2019
9757420
fix reference/value bug
gaoning777 Dec 11, 2019
adaea40
addressing comments
gaoning777 Dec 12, 2019
46b9075
Create an argoclient class
gaoning777 Dec 13, 2019
96a0c3f
move podnamespace to argo client
gaoning777 Dec 13, 2019
bf59b0e
addressing comments
gaoning777 Dec 13, 2019
d1c9547
addressing comments
gaoning777 Dec 16, 2019
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion backend/src/apiserver/client/BUILD.bazel
Original file line number Diff line number Diff line change
Expand Up @@ -7,18 +7,22 @@ go_library(
"pod.go",
"scheduled_workflow.go",
"sql.go",
"workflow.go",
"argo.go",
"argo_fake.go",
"workflow_fake.go",
"kfam.go",
"kfam_fake.go",
],
importpath = "github.com/kubeflow/pipelines/backend/src/apiserver/client",
visibility = ["//visibility:public"],
deps = [
"//backend/src/common/util:go_default_library",
"//backend/src/apiserver/common:go_default_library",
"//backend/src/crd/pkg/client/clientset/versioned:go_default_library",
"//backend/src/crd/pkg/client/clientset/versioned/typed/scheduledworkflow/v1beta1:go_default_library",
"@com_github_argoproj_argo//pkg/client/clientset/versioned:go_default_library",
"@com_github_argoproj_argo//pkg/client/clientset/versioned/typed/workflow/v1alpha1:go_default_library",
"@com_github_argoproj_argo//pkg/apis/workflow/v1alpha1:go_default_library",
"@com_github_cenkalti_backoff//:go_default_library",
"@com_github_go_sql_driver_mysql//:go_default_library",
"@com_github_golang_glog//:go_default_library",
Expand All @@ -27,6 +31,9 @@ go_library(
"@io_k8s_client_go//kubernetes:go_default_library",
"@io_k8s_client_go//kubernetes/typed/core/v1:go_default_library",
"@io_k8s_client_go//rest:go_default_library",
"@io_k8s_apimachinery//pkg/apis/meta/v1:go_default_library",
"@io_k8s_apimachinery//pkg/types:go_default_library",
"@io_k8s_apimachinery//pkg/watch:go_default_library",
],
)

Expand Down
67 changes: 67 additions & 0 deletions backend/src/apiserver/client/argo.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
// Copyright 2018 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package client

import (
"time"

argoclient "github.com/argoproj/argo/pkg/client/clientset/versioned"
argoprojv1alpha1 "github.com/argoproj/argo/pkg/client/clientset/versioned/typed/workflow/v1alpha1"
"github.com/cenkalti/backoff"
"github.com/golang/glog"
"github.com/kubeflow/pipelines/backend/src/apiserver/common"
"github.com/pkg/errors"
"k8s.io/client-go/rest"
)

const (
PodNamespace = "POD_NAMESPACE"
)

type ArgoClientInterface interface {
Workflow(namespace string) argoprojv1alpha1.WorkflowInterface
}

type ArgoClient struct {
argoProjClient argoprojv1alpha1.ArgoprojV1alpha1Interface
}

func (argoClient *ArgoClient) Workflow(namespace string) argoprojv1alpha1.WorkflowInterface {
if len(namespace) == 0 {
namespace = common.GetStringConfig(PodNamespace)
}
return argoClient.argoProjClient.Workflows(namespace)
}

func NewArgoClientOrFatal(initConnectionTimeout time.Duration) *ArgoClient {
var argoProjClient argoprojv1alpha1.ArgoprojV1alpha1Interface
var operation = func() error {
restConfig, err := rest.InClusterConfig()
if err != nil {
return errors.Wrap(err, "Failed to initialize the RestConfig")
}
argoProjClient = argoclient.NewForConfigOrDie(restConfig).ArgoprojV1alpha1()
return nil
}

b := backoff.NewExponentialBackOff()
b.MaxElapsedTime = initConnectionTimeout
err := backoff.Retry(operation, b)

if err != nil {
glog.Fatalf("Failed to create ArgoClient. Error: %v", err)
}
return &ArgoClient{argoProjClient}
}
39 changes: 39 additions & 0 deletions backend/src/apiserver/client/argo_fake.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
// Copyright 2019 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package client

import (
argoprojv1alpha1 "github.com/argoproj/argo/pkg/client/clientset/versioned/typed/workflow/v1alpha1"
)

type FakeArgoClient struct {
workflowClientFake FakeWorkflowClientInterface
gaoning777 marked this conversation as resolved.
Show resolved Hide resolved
}

func NewFakeArgoClient() *FakeArgoClient {
return &FakeArgoClient{NewWorkflowClientFake()}
}

func (c *FakeArgoClient) Workflow(namespace string) argoprojv1alpha1.WorkflowInterface {
gaoning777 marked this conversation as resolved.
Show resolved Hide resolved
return c.workflowClientFake
}

func (c *FakeArgoClient) FakeWorkflow() FakeWorkflowClientInterface {
return c.workflowClientFake
}

func (c *FakeArgoClient) SetFakeWorkflow(fakeWorkflow FakeWorkflowClientInterface) {
c.workflowClientFake = fakeWorkflow
}
57 changes: 0 additions & 57 deletions backend/src/apiserver/client/workflow.go

This file was deleted.

Original file line number Diff line number Diff line change
Expand Up @@ -12,21 +12,29 @@
// See the License for the specific language governing permissions and
// limitations under the License.

package resource
package client

import (
"encoding/json"
"github.com/kubeflow/pipelines/backend/src/common/util"
"strconv"

"github.com/argoproj/argo/pkg/apis/workflow/v1alpha1"
workflowclient "github.com/argoproj/argo/pkg/client/clientset/versioned/typed/workflow/v1alpha1"
"github.com/golang/glog"
"github.com/pkg/errors"
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/watch"
)

type FakeWorkflowClientInterface interface {
workflowclient.WorkflowInterface
GetWorkflowCount() int
GetWorkflowKeys() map[string]bool
IsTerminated(name string) (bool, error)
}

type FakeWorkflowClient struct {
workflows map[string]*v1alpha1.Workflow
lastGeneratedId int
Expand Down Expand Up @@ -129,7 +137,7 @@ func (c *FakeWorkflowClient) Patch(name string, pt types.PatchType, data []byte,
return nil, errors.New("Failed to patch workflow")
}

func (c *FakeWorkflowClient) isTerminated(name string) (bool, error) {
func (c *FakeWorkflowClient) IsTerminated(name string) (bool, error) {
workflow, ok := c.workflows[name]
if !ok {
return false, errors.New("No workflow found with name: " + name)
Expand Down
24 changes: 11 additions & 13 deletions backend/src/apiserver/client_manager.go
Original file line number Diff line number Diff line change
Expand Up @@ -17,12 +17,12 @@ package main
import (
"database/sql"
"fmt"
"github.com/kubeflow/pipelines/backend/src/apiserver/common"
v1 "k8s.io/client-go/kubernetes/typed/core/v1"
"os"
"time"

workflowclient "github.com/argoproj/argo/pkg/client/clientset/versioned/typed/workflow/v1alpha1"
"github.com/kubeflow/pipelines/backend/src/apiserver/common"
v1 "k8s.io/client-go/kubernetes/typed/core/v1"

"github.com/cenkalti/backoff"
"github.com/golang/glog"

Expand All @@ -45,13 +45,12 @@ const (
mysqlPassword = "DBConfig.Password"
mysqlDBName = "DBConfig.DBName"
mysqlGroupConcatMaxLen = "DBConfig.GroupConcatMaxLen"
kfamServiceHost = "KFAM_SERVICE_HOST"
kfamServicePort = "KFAM_SERVICE_PORT"
kfamServiceHost = "PROFILES_KFAM_SERVICE_HOST"
kfamServicePort = "PROFILES_KFAM_SERVICE_PORT"

visualizationServiceHost = "ML_PIPELINE_VISUALIZATIONSERVER_SERVICE_HOST"
visualizationServicePort = "ML_PIPELINE_VISUALIZATIONSERVER_SERVICE_PORT"

podNamespace = "POD_NAMESPACE"
initConnectionTimeout = "InitConnectionTimeout"
)

Expand All @@ -66,7 +65,7 @@ type ClientManager struct {
dBStatusStore storage.DBStatusStoreInterface
defaultExperimentStore storage.DefaultExperimentStoreInterface
objectStore storage.ObjectStoreInterface
wfClient workflowclient.WorkflowInterface
argoClient client.ArgoClientInterface
swfClient scheduledworkflowclient.ScheduledWorkflowInterface
podClient v1.PodInterface
kfamClient client.KFAMClientInterface
Expand Down Expand Up @@ -106,8 +105,8 @@ func (c *ClientManager) ObjectStore() storage.ObjectStoreInterface {
return c.objectStore
}

func (c *ClientManager) Workflow() workflowclient.WorkflowInterface {
return c.wfClient
func (c *ClientManager) ArgoClient() client.ArgoClientInterface {
return c.argoClient
}

func (c *ClientManager) ScheduledWorkflow() scheduledworkflowclient.ScheduledWorkflowInterface {
Expand Down Expand Up @@ -149,14 +148,13 @@ func (c *ClientManager) init() {
c.defaultExperimentStore = storage.NewDefaultExperimentStore(db)
c.objectStore = initMinioClient(common.GetDurationConfig(initConnectionTimeout))

c.wfClient = client.CreateWorkflowClientOrFatal(
common.GetStringConfig(podNamespace), common.GetDurationConfig(initConnectionTimeout))
c.argoClient = client.NewArgoClientOrFatal(common.GetDurationConfig(initConnectionTimeout))

c.swfClient = client.CreateScheduledWorkflowClientOrFatal(
common.GetStringConfig(podNamespace), common.GetDurationConfig(initConnectionTimeout))
common.GetStringConfig(client.PodNamespace), common.GetDurationConfig(initConnectionTimeout))

c.podClient = client.CreatePodClientOrFatal(
common.GetStringConfig(podNamespace), common.GetDurationConfig(initConnectionTimeout))
common.GetStringConfig(client.PodNamespace), common.GetDurationConfig(initConnectionTimeout))

runStore := storage.NewRunStore(db, c.time)
c.runStore = runStore
Expand Down
15 changes: 14 additions & 1 deletion backend/src/apiserver/common/BUILD.bazel
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
load("@io_bazel_rules_go//go:def.bzl", "go_library")
load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")

go_library(
name = "go_default_library",
Expand All @@ -8,6 +8,7 @@ go_library(
"filter_context.go",
"pagination_context.go",
"paths.go",
"util.go",
],
importpath = "github.com/kubeflow/pipelines/backend/src/apiserver/common",
visibility = ["//visibility:public"],
Expand All @@ -18,3 +19,15 @@ go_library(
"@com_github_spf13_viper//:go_default_library",
],
)

go_test(
name = "go_default_test",
srcs = [
"util_test.go",
],
embed = [":go_default_library"],
deps = [
"//backend/api:go_default_library",
"@com_github_stretchr_testify//assert:go_default_library",
],
)
30 changes: 30 additions & 0 deletions backend/src/apiserver/common/util.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
// Copyright 2019 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package common

import (
api "github.com/kubeflow/pipelines/backend/api/go_client"
)

func GetNamespaceFromResourceReferences(resourceRefs []*api.ResourceReference) string {
namespace := ""
for _, resourceRef := range resourceRefs {
if resourceRef.Key.Type == api.ResourceType_NAMESPACE {
namespace = resourceRef.Key.Id
break
}
}
return namespace
}
Loading