-
Notifications
You must be signed in to change notification settings - Fork 294
[AuthVerifier] Support iguazio-v4 authentication mode [feature/ig4-authentication] #8366
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[AuthVerifier] Support iguazio-v4 authentication mode [feature/ig4-authentication] #8366
Conversation
rokatyy
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looking very good, just two very minor things
TomerShor
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Minor comments
TomerShor
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
ba6e104
into
mlrun:feature/ig4-authentication
…thentication] (mlrun#8366) In this PR: 1. Introduced a new client for IG4 on the server side. 2. Created a `BaseClient` to hold shared logic between clients. 3. Added `iguazio.v3.Client` (for IG3) and `iguazio.v4.Client` (for IG4), with the appropriate client selected based on `mlrun.mlconf.httpdb.authentication.mode`. 4. Introduced a new `AuthenticationMode` enum to represent the available authentication modes. 5. Removed the `verify_request_session` method from the sync client, as it is no longer used. 6. Moved all HTTP header keys to the `HeaderNames` constants module. 7. Introduced a new `AuthorizationHeaderPrefixes` enum for commonly used header value prefixes (e.g., Bearer, Basic). **Notes:** 1. This PR does not yet support sending requests using the Iguazio SDK package, this will be handled in a separate story/PR - https://iguazio.atlassian.net/browse/ML-10644. 2. The `iguazio.v4.Client` implementation is not yet complete, this PR only includes the initial file restructuring. https://iguazio.atlassian.net/browse/ML-10294
### 📝 Description <!-- A short summary of what this PR does. --> <!-- Include any relevant context or background information. --> This PR introduces support for MLRun authentication with IG4. It rebases the `feature/ig4-authentication` branch onto `development` This PR includes the following PRs: 1. #8345 2. #8370 3. #8366 4. #8388 5. #8440 6. #8408 7. #8466 8. #8471 9. #8443 10. #8484 11. #8498 12. #8574 13. #8529 14. #8584 15. #8588 16. #8589 17. #8567 18. #8623 19. #8612 20. #8514 21. #8626 22. #8632 23. #8633 24. #8667 25. #8668 26. #8674 27. #8780 28. #8754 29. #8796 30. #8811 --- ### 🛠️ Changes Made <!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) --> To enable IG4 project authorization, set the following configs in mlrun api: ``` MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4 MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self MLRUN_IGUAZIO_API_URL: http://igz-api:8000 ``` Before importing MLRun, you must set: ``` MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token" ``` --- ### ✅ Checklist - [x] I updated the documentation (if applicable) - [x] I have tested the changes in this PR - [ ] If I introduced a deprecation: - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md) - [ ] I updated the relevant Jira ticket for documentation --- ### 🧪 Testing <!-- - How it was tested (unit tests, manual, integration) --> <!-- - Any special cases covered. --> Tested on IG4 system + unit tests --- ### 🔗 References - Ticket link: https://iguazio.atlassian.net/browse/ML-9683, https://iguazio.atlassian.net/browse/ML-9870, https://iguazio.atlassian.net/browse/ML-9998 - Design docs links: https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD, - External links: https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4 --- ### 🚨 Breaking Changes? - [x] Yes (explain below) - [] No Removed unused API endpoints `- POST /api/v1/user-secrets` which was not in used --- ### 🔍️ Additional Notes How to enable IG4 authentication - https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun --------- Co-authored-by: Katerina Molchanova <[email protected]> Co-authored-by: Amit Elbaz <[email protected]>
In this PR:
BaseClientto hold shared logic between clients.iguazio.v3.Client(for IG3) andiguazio.v4.Client(for IG4), with the appropriate client selected based onmlrun.mlconf.httpdb.authentication.mode.AuthenticationModeenum to represent the available authentication modes.verify_request_sessionmethod from the sync client, as it is no longer used.HeaderNamesconstants module.AuthorizationHeaderPrefixesenum for commonly used header value prefixes (e.g., Bearer, Basic).Notes:
iguazio.v4.Clientimplementation is not yet complete, this PR only includes the initial file restructuring.https://iguazio.atlassian.net/browse/ML-10294