Skip to content

Commit ad4192c

Browse files
pingsutwCopilot
pingsutw
and
Copilot
authored
feat(flyte-binary): add optional JWT and auth-discovery ingresses (#7546)
Signed-off-by: Kevin Su <pingsutw@apache.org> Signed-off-by: Kevin Su <pingsutw@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
1 parent 2f169b0 commit ad4192c

5 files changed

Lines changed: 170 additions & 0 deletions

File tree

‎charts/flyte-binary/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,10 @@ Chart for basic single Flyte executable deployment
150150
| flyte-core-components.secret.kubernetes.timeout | string | `"30s"` | |
151151
| flyteconnector.enabled | bool | `false` | |
152152
| fullnameOverride | string | `""` | |
153+
| ingress.apiJwtIngress.annotations | object | `{}` | |
154+
| ingress.apiJwtIngress.enabled | bool | `false` | |
155+
| ingress.apiJwtIngress.ingressClassName | string | `""` | |
156+
| ingress.apiJwtIngress.tls | list | `[]` | |
153157
| ingress.commonAnnotations | object | `{}` | |
154158
| ingress.create | bool | `false` | |
155159
| ingress.host | string | `""` | |
@@ -161,6 +165,10 @@ Chart for basic single Flyte executable deployment
161165
| ingress.ingressClassName | string | `""` | |
162166
| ingress.labels | object | `{}` | |
163167
| ingress.tls | list | `[]` | |
168+
| ingress.wellknownIngress.annotations | object | `{}` | |
169+
| ingress.wellknownIngress.enabled | bool | `false` | |
170+
| ingress.wellknownIngress.ingressClassName | string | `""` | |
171+
| ingress.wellknownIngress.tls | list | `[]` | |
164172
| nameOverride | string | `""` | |
165173
| rbac.annotations | object | `{}` | |
166174
| rbac.create | bool | `true` | |

‎charts/flyte-binary/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,22 @@ Get the Flyte API paths for ingress.
193193
- /flyteidl2.app.AppService/*
194194
- /flyteidl2.trigger.TriggerService
195195
- /flyteidl2.trigger.TriggerService/*
196+
- /flyteidl2.auth.IdentityService
197+
- /flyteidl2.auth.IdentityService/*
198+
- /flyteidl2.settings.SettingsService
199+
- /flyteidl2.settings.SettingsService/*
200+
{{- end -}}
201+
202+
{{/*
203+
Get the Flyte auth-discovery paths for ingress. These are unauthenticated:
204+
clients must reach them before they hold a token (OAuth server metadata and the
205+
auth metadata service). IdentityService and SettingsService require auth and live
206+
in apiPaths instead.
207+
*/}}
208+
{{- define "flyte-binary.ingress.wellknownPaths" -}}
209+
- /.well-known/oauth-authorization-server
210+
- /flyteidl2.auth.AuthMetadataService
211+
- /flyteidl2.auth.AuthMetadataService/*
196212
{{- end -}}
197213
198214
{{/*

‎charts/flyte-binary/templates/ingress/api-jwt.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if and .Values.ingress.create .Values.ingress.apiJwtIngress.enabled }}
2+
{{- $paths := (include "flyte-binary.ingress.apiPaths" .) | fromYamlArray }}
3+
apiVersion: networking.k8s.io/v1
4+
kind: Ingress
5+
metadata:
6+
name: {{ include "flyte-binary.fullname" . }}-api-jwt
7+
namespace: {{ .Release.Namespace | quote }}
8+
labels: {{- include "flyte-binary.labels" . | nindent 4 }}
9+
{{- if .Values.commonLabels }}
10+
{{- tpl ( .Values.commonLabels | toYaml ) . | nindent 4 }}
11+
{{- end }}
12+
{{- if .Values.ingress.labels }}
13+
{{- tpl ( .Values.ingress.labels | toYaml ) . | nindent 4 }}
14+
{{- end }}
15+
annotations:
16+
{{- if .Values.commonAnnotations }}
17+
{{- tpl ( .Values.commonAnnotations | toYaml ) . | nindent 4 }}
18+
{{- end }}
19+
{{- if .Values.ingress.commonAnnotations }}
20+
{{- tpl ( .Values.ingress.commonAnnotations | toYaml ) . | nindent 4 }}
21+
{{- end }}
22+
{{- if .Values.ingress.apiJwtIngress.annotations }}
23+
{{- tpl ( .Values.ingress.apiJwtIngress.annotations | toYaml ) . | nindent 4 }}
24+
{{- end }}
25+
spec:
26+
{{- if .Values.ingress.apiJwtIngress.ingressClassName }}
27+
ingressClassName: {{ .Values.ingress.apiJwtIngress.ingressClassName | quote }}
28+
{{- else if .Values.ingress.ingressClassName }}
29+
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
30+
{{- end }}
31+
{{- if .Values.ingress.apiJwtIngress.tls }}
32+
tls: {{- tpl ( .Values.ingress.apiJwtIngress.tls | toYaml ) . | nindent 2 }}
33+
{{- else if .Values.ingress.tls }}
34+
tls: {{- tpl ( .Values.ingress.tls | toYaml ) . | nindent 2 }}
35+
{{- end }}
36+
rules:
37+
- http:
38+
paths:
39+
{{- range $path := $paths }}
40+
- path: {{ $path }}
41+
{{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
42+
pathType: ImplementationSpecific
43+
{{- end }}
44+
backend:
45+
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
46+
service:
47+
name: {{ include "flyte-binary.service.http.name" $ }}
48+
port:
49+
number: {{ include "flyte-binary.service.http.port" $ }}
50+
{{- else }}
51+
serviceName: {{ include "flyte-binary.service.http.name" $ }}
52+
servicePort: {{ include "flyte-binary.service.http.port" $ }}
53+
{{- end }}
54+
{{- end }}
55+
{{- if .Values.ingress.host }}
56+
host: {{ tpl .Values.ingress.host . | quote }}
57+
{{- end }}
58+
{{- end }}

‎charts/flyte-binary/templates/ingress/wellknown.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if and .Values.ingress.create .Values.ingress.wellknownIngress.enabled }}
2+
{{- $paths := (include "flyte-binary.ingress.wellknownPaths" .) | fromYamlArray }}
3+
apiVersion: networking.k8s.io/v1
4+
kind: Ingress
5+
metadata:
6+
name: {{ include "flyte-binary.fullname" . }}-wellknown
7+
namespace: {{ .Release.Namespace | quote }}
8+
labels: {{- include "flyte-binary.labels" . | nindent 4 }}
9+
{{- if .Values.commonLabels }}
10+
{{- tpl ( .Values.commonLabels | toYaml ) . | nindent 4 }}
11+
{{- end }}
12+
{{- if .Values.ingress.labels }}
13+
{{- tpl ( .Values.ingress.labels | toYaml ) . | nindent 4 }}
14+
{{- end }}
15+
annotations:
16+
{{- if .Values.commonAnnotations }}
17+
{{- tpl ( .Values.commonAnnotations | toYaml ) . | nindent 4 }}
18+
{{- end }}
19+
{{- if .Values.ingress.commonAnnotations }}
20+
{{- tpl ( .Values.ingress.commonAnnotations | toYaml ) . | nindent 4 }}
21+
{{- end }}
22+
{{- if .Values.ingress.wellknownIngress.annotations }}
23+
{{- tpl ( .Values.ingress.wellknownIngress.annotations | toYaml ) . | nindent 4 }}
24+
{{- end }}
25+
spec:
26+
{{- if .Values.ingress.wellknownIngress.ingressClassName }}
27+
ingressClassName: {{ .Values.ingress.wellknownIngress.ingressClassName | quote }}
28+
{{- else if .Values.ingress.ingressClassName }}
29+
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
30+
{{- end }}
31+
{{- if .Values.ingress.wellknownIngress.tls }}
32+
tls: {{- tpl ( .Values.ingress.wellknownIngress.tls | toYaml ) . | nindent 2 }}
33+
{{- else if .Values.ingress.tls }}
34+
tls: {{- tpl ( .Values.ingress.tls | toYaml ) . | nindent 2 }}
35+
{{- end }}
36+
rules:
37+
- http:
38+
paths:
39+
{{- range $path := $paths }}
40+
- path: {{ $path }}
41+
{{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
42+
pathType: ImplementationSpecific
43+
{{- end }}
44+
backend:
45+
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
46+
service:
47+
name: {{ include "flyte-binary.service.http.name" $ }}
48+
port:
49+
number: {{ include "flyte-binary.service.http.port" $ }}
50+
{{- else }}
51+
serviceName: {{ include "flyte-binary.service.http.name" $ }}
52+
servicePort: {{ include "flyte-binary.service.http.port" $ }}
53+
{{- end }}
54+
{{- end }}
55+
{{- if .Values.ingress.host }}
56+
host: {{ tpl .Values.ingress.host . | quote }}
57+
{{- end }}
58+
{{- end }}

‎charts/flyte-binary/values.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,36 @@ ingress:
401401
httpExtraPaths:
402402
prepend: []
403403
append: []
404+
# apiJwtIngress Optional separate ingress that JWT-validates the flyteidl2 API
405+
# paths for requests carrying an `Authorization: Bearer` token (SDK/machine
406+
# clients). Needed on controllers like AWS ALB where a single ingress cannot
407+
# combine cookie-OIDC (browser) and JWT (token) auth. It renders the shared API
408+
# paths backed by the http service; supply the controller/JWT config (e.g. ALB
409+
# cert-arn, jwt-validation, the `Authorization: Bearer*` match condition, and a
410+
# group.order lower than the http ingress (but higher than the wellknown ingress)) via `annotations`.
411+
apiJwtIngress:
412+
# enabled Create the JWT (Bearer) API ingress
413+
enabled: false
414+
# annotations Annotations for the JWT API ingress (controller/JWT config)
415+
annotations: {}
416+
# ingressClassName Ingress class for the JWT API ingress. Overrides `ingressClassName`
417+
ingressClassName: ""
418+
# tls Add TLS configuration to the JWT API ingress. Overrides `tls`
419+
tls: []
420+
# wellknownIngress Optional separate ingress for the unauthenticated
421+
# auth-discovery endpoints (`/.well-known/oauth-authorization-server`,
422+
# AuthMetadataService) — clients must reach these before they hold a token. Give it the highest controller precedence
423+
# (e.g. ALB group.order lower than the JWT/http ingresses) so these paths bypass
424+
# auth. Supply controller config via `annotations`.
425+
wellknownIngress:
426+
# enabled Create the unauthenticated auth-discovery ingress
427+
enabled: false
428+
# annotations Annotations for the auth-discovery ingress (controller config)
429+
annotations: {}
430+
# ingressClassName Ingress class for the auth-discovery ingress. Overrides `ingressClassName`
431+
ingressClassName: ""
432+
# tls Add TLS configuration to the auth-discovery ingress. Overrides `tls`
433+
tls: []
404434

405435
# rbac Configure Kubernetes RBAC for Flyte
406436
rbac:

0 commit comments

Comments
 (0)