Skip to content

Conversation

@moranbental
Copy link
Member

@moranbental moranbental commented Aug 14, 2025

📝 Description

Enable conditional support for secret tokens based on mlrun.httpdb.authentication.mode.
This PR restricts certain SDK methods and API endpoints so they can only be used when authentication.mode is set to iguazio-v4.


🛠️ Changes Made

  1. Moved AuthenticationMode enum to a shared location.
  2. Created a iguazio_v4_only wrapper for SDK methods to control execution based on the authentication mode.
  3. Added a FastAPI dependency for user-secrets endpoints to enforce mode-based access control.

✅ Checklist

  • I updated the documentation (if applicable)
  • I have tested the changes in this PR

🧪 Testing

  1. Verified SDK methods fail when called outside iguazio-v4 mode.
  2. Verified API user-secrets endpoints return 400 when the mode is not iguazio-v4.

🔗 References


🚨 Breaking Changes?

  • Yes (explain below)
  • No

🔍️ Additional Notes

@moranbental moranbental requested review from a team, liranbg and quaark as code owners August 14, 2025 07:23
@moranbental moranbental changed the title [IG4] Enable Conditional Support for Secret Tokens Based on authentication.mode [feature/ig4-authentication] [Secret Tokens] Enable Conditional Support for Secret Tokens Based on authentication.mode [feature/ig4-authentication] Aug 14, 2025
@moranbental moranbental changed the title [Secret Tokens] Enable Conditional Support for Secret Tokens Based on authentication.mode [feature/ig4-authentication] [Secret Tokens] Enable Conditional Support Based on authentication.mode [feature/ig4-authentication] Aug 14, 2025
Copy link
Member

@TomerShor TomerShor left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overall looking good, added some suggestion for improvement

@moranbental moranbental requested a review from TomerShor August 17, 2025 11:48
@moranbental moranbental merged commit 56a107f into mlrun:feature/ig4-authentication Aug 17, 2025
14 checks passed
@moranbental moranbental deleted the required-iguazio-v4 branch August 17, 2025 13:29
moranbental added a commit to moranbental/mlrun that referenced this pull request Oct 15, 2025
…de [feature/ig4-authentication] (mlrun#8471)

<!-- A short summary of what this PR does. -->
<!-- Include any relevant context or background information. -->
Enable conditional support for secret tokens based on
`mlrun.httpdb.authentication.mode`.
This PR restricts certain SDK methods and API endpoints so they can only
be used when authentication.mode is set to `iguazio-v4`.

---

<!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) -->

1. Moved AuthenticationMode enum to a shared location.
2. Created a `iguazio_v4_only ` wrapper for SDK methods to control
execution based on the authentication mode.
3. Added a FastAPI dependency for `user-secrets` endpoints to enforce
mode-based access control.

---

- [ ] I updated the documentation (if applicable)
- [x] I have tested the changes in this PR

---

<!-- - How it was tested (unit tests, manual, integration) -->
<!-- - Any special cases covered. -->

1. Verified SDK methods fail when called outside iguazio-v4 mode.
2. Verified API user-secrets endpoints return 400 when the mode is not
iguazio-v4.

---

- Ticket link: https://iguazio.atlassian.net/browse/ML-10494
- Design docs links:
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD#2.1.9-Configurable-Authentication-Mode

---

- [ ] Yes (explain below)
- [x] No

<!-- If yes, describe what needs to be changed downstream: -->

---

<!-- Anything else reviewers should know (follow-up tasks, known issues,
affected areas etc.). -->
<!-- ### 📸 Screenshots / Logs -->
liranbg pushed a commit that referenced this pull request Nov 3, 2025
### 📝 Description
<!-- A short summary of what this PR does. -->
<!-- Include any relevant context or background information. -->
This PR introduces support for MLRun authentication with IG4.
It rebases the `feature/ig4-authentication` branch onto `development`

This PR includes the following PRs:

1. #8345
2. #8370
3.  #8366
4. #8388
5. #8440
6. #8408
7. #8466
8. #8471
9. #8443
10. #8484
11. #8498
12. #8574
13. #8529
14. #8584
15. #8588
16. #8589
17. #8567
18. #8623
19. #8612
20. #8514
21. #8626
22. #8632
23. #8633
24. #8667
25. #8668
26. #8674
27. #8780
28. #8754
29. #8796
30. #8811
---

### 🛠️ Changes Made
<!-- - Key changes (e.g., added feature X, refactored Y, fixed Z) -->
To enable IG4 project authorization, set the following configs in mlrun
api:

```
MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4
MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self
MLRUN_IGUAZIO_API_URL: http://igz-api:8000
```

Before importing MLRun, you must set:
```
MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true
MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token"
```

---

### ✅ Checklist
- [x] I updated the documentation (if applicable)
- [x] I have tested the changes in this PR
- [ ] If I introduced a deprecation:
  - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md)
  - [ ] I updated the relevant Jira ticket for documentation

---

### 🧪 Testing
<!-- - How it was tested (unit tests, manual, integration) -->  
<!-- - Any special cases covered. -->  
Tested on IG4 system + unit tests

---

### 🔗 References
- Ticket link: https://iguazio.atlassian.net/browse/ML-9683,
https://iguazio.atlassian.net/browse/ML-9870,
https://iguazio.atlassian.net/browse/ML-9998
- Design docs links:
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD,
https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD,
- External links:
https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4

---

### 🚨 Breaking Changes?

- [x] Yes (explain below)
- [] No

Removed unused API endpoints `- POST /api/v1/user-secrets` which was not
in used

---

### 🔍️ Additional Notes


How to enable IG4 authentication -
https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun

---------

Co-authored-by: Katerina Molchanova <[email protected]>
Co-authored-by: Amit Elbaz <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants