Samples - Moved secret application to the pipeline definition

[Ark-kun]

P.S. How did samples/tfx/taxi-cab-classification-pipeline.py work if the confusion_matrix_op did not use a secret?

---

This change is 

[IronPan]

just wondering why this is better.
not strong opinion on this. LGTM

[IronPan]

/lgtm

[Ark-kun]

just wondering why this is better.
not strong opinion on this. LGTM

The component definitions should be shareable/portable. Adding secrets to the definitions ties them to a particular installation so at least the components are portable/shareable.

In future we can try to move this to even higher level (pipeline level or cluster level), so that the pipeline can also be portable.

[hongye-sun]

The implementation of the component depends on a gcp secret. It's better to let component author to declare it. Ideally, user just need to setup the secrete in their pipeline service once and no need to configure any secret in their pipelines.

[Ark-kun]

The implementation of the component depends on a gcp secret. It's better to let component author to declare it.

That's true for some components (e.g. CMLE), but most of other components can actually work on files.

Ideally, user just need to setup the secrete in their pipeline service once and no need to configure any secret in their pipelines.

That's the goal, yes.

[qimingj]

I think it is a good idea since the component code is supposed to be "binary" and not modifiable. Setting credential in component code causes it less portable. I though of doing this when we have a packaging story (yaml).

[Ark-kun]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ark-kun

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• samples/OWNERS [Ark-kun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Ark-kun

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• samples/OWNERS [Ark-kun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[gaoning777]

/lgtm

[hongye-sun]

One implementation option is that we let component author to put a secret hint in the component spec and it pass through as a label on pod. We can leverage podpreset to mount the GCP secret volume by matching label.