for a running jupyterlab notebook on K8S, info like cos_username and cos_password should not be coming from a runtime json config file

[jiridanek]

@jiridanek
https://issues.redhat.com/browse/RHOAIENG-4574
yes, though I am speaking here more of running notebooks, i.e. anything related to S3 that happens before execution in the target environment (KFP, Airflow). Since there is that runtime config json, I'd like that mechanism to stay, just a different way of getting the runtime config into Elyra in Jupyterlab. Same as you do here with the runtimes json file.
But I definitely do not want to, doesn't matter whether submitting stuff for KFP or Airflow, have Elyra depend on config cos_username and cos_password, should at least be optional. Best for corporate environments is getting S3 info from a K8S secret, be it with personal or non-personal bucket credentials.
https://issues.redhat.com/browse/RHOAIENG-133
I do not have access rights on that ticket.
https://issues.redhat.com/browse/RHOAIENG-4531
This is related to DSPA config and runtime behavior, not Jupyter. Seems like a good idea for your uses cases outside running notebooks.
My point here is mainly, that for a running jupyterlab notebook on K8S, info like cos_username and cos_password should not be coming from a runtime json config file. People can specify the ENVs necessary either via CICD or via ODH Dashboard workbench env section - save in and reference from K8S Secret in background.

See my new ticket over at elyra. Caveat: I have not checked whether this has ever been adressed in odh-elyra, but it looks like the issue is present there, too, from a conceptual perspective
https://github.com/opendatahub-io/elyra/blob/main/elyra/util/cos.py#L68

Originally posted by @shalberd in opendatahub-io/kubeflow#513 (comment)

[shalberd]

I am trying out an Elyra PR

elyra-ai/elyra#3299

See my latest run-through with the changes from the PR, I hope I described what I do differently now (env Var, from secret in openshift workbench namespace, plus Elyra now takes username and password for cos from env var when KUBERNETES_SECRET is selected.
What Elyra does not do: It does not get secret content via e.g. Openshift API ... it just evaluates the env vars, which best are stored and come from an Openshift / K8S secret.
With the S3 credentials gone from the runtime conf, and Gitlab personal token left out, and the S3 openshift secret in the workbench namespace (in addition to the KFP or Airflow namespace) now being the basis for Elyra S3 (via env vars), I can now either

• safely bake in the runtime config json file into a container build
  or
• supply the runtime config json file via a volume Mount from configmap.