Hi Community, I tried to integrate self-hosted Gitlab as an external OAuth2 Authorization Server but...
x

Xuan Hu

almost 3 years ago
Hi Community, I tried to integrate self-hosted Gitlab as an external OAuth2 Authorization Server but stuck at
CSRF_TOKEN_VALIDATION_FAILED
, any clues on how to debug the problem? The flyte is deployed on self-hosted k8s cluster with an internal domain name and HTTP access (not HTTPS) using template generated by
flyte-core
helm chart (
helm template flyte-core -f values.yaml
). The OIDC seems to work (After a fresh deployment, when opening flyte console, it will redirect to the gitlab authorization page, and after approval it can redirect back to flyte console page with username show on the top-right corner), but when I try to register workflow according to the tutorial [1] with command
flytectl register files --project flytesnacks --domain development --archive flyte-package.tgz --version v1
, the gitlab authorization page is prompted successfully but when redirect back to
<http://flyte.example.com/callback|flyte.example.com/callback>
page, it complains about
401
error. And the log of
flyteadmin
shows something like
{"json":{},"level":"error","msg":"Invalid CSRF token cookie [CSRF_TOKEN_VALIDATION_FAILED] CSRF token does not match state 2r4rcd3npg, 3237e1083ec0ae2bd20acbe8a5817d18475faaee5a060d2184ab7ffddd151290 vs OXpoczQyanRxcW43c3hnZ3RjbnBnZjZrNnptMnA2dDY","ts":"2023-01-29T06:43:34Z"}
There are several small questions that might be relevant: 1. In the auth doc [2], there is a comment for
redirectUri: <http://localhost:53593/callback>
saying that
This should not change
, but I suppose it is for sandbox deployment so I changed it to the domain name something like
<http://flyte.example.com/callback>
. Otherwise, it will complains about invalid redirect uri when authorize on gitlab page. 2. For the
scopes
, according to the gitlab doc [3], I only set it to
read_user
. 3. Any approach to show more logs for
flytectl
CLI? I tried to set the log level to
0
, but it does not show anything. 4. Any approach to show more logs for
flyteadmin
service? I found there is a
flyteadmin.extraArgs
in the template but does not know how to inject
--logger.level 0
. The relevant
values.yaml
for auth is shown as following (with some sensitive info masked):
configmap:
  adminServer:
    auth:
      appAuth:
        authServerType: External
        externalAuthServer:
          metadataUrl: .well-known/openid-configuration
        thirdPartyConfig:
          flyteClient:
            clientId: <client_id generated by gitlab>
            redirectUri: <http://flyte.example.com/callback>
            scopes:
              - read_user
      authorizedUris:
        - <http://flyte.example.com>
        - <http://flyteadmin:80>
        - <http://flyteadmin.flyte.svc.cluster.local:80>
      userAuth:
        openId:
          baseUrl: <https://git.example.com>
          clientId: <client_id generated by gitlab>
          scopes:
            - openid
    server:
      security:
        useAuth: true
flyteadmin:
  secrets:
    oidc_client_secret: <client_secret generated by gitlab>
secrets:
  adminOauthClientCredentials:
    clientId: <client_id generated by gitlab>
    clientSecret: <client_secret generated by gitlab>
[1] https://docs.flyte.org/projects/cookbook/en/latest/auto/larger_apps/larger_apps_deploy.html#build-deploy-your-application-to-the-cluster [2] https://docs.flyte.org/en/latest/deployment/cluster_config/auth_setup.html [3] https://docs.gitlab.com/ee/integration/oauth_provider.html#view-all-authorized-applications
Hello, I’m trying to run the Getting Started <wine classification example> on my Flyte setup, but ha...
e

Erik Dao

over 2 years ago
Hello, I’m trying to run the Getting Started wine classification example on my Flyte setup, but have faced several errors. My setup is consisted of: Jupyter Hub + Flyte on the same K8S cluster. The codes are
from flytekit.remote import FlyteRemote
from flytekit.configuration import Config, PlatformConfig, ImageConfig, SerializationSettings

remote = FlyteRemote(
    config=Config(
        platform=PlatformConfig(
            endpoint="dns:///flyte-backend-flyte-binary-grpc.namespace.svc.cluster.local:8089",
            insecure=True,
            insecure_skip_verify=True,
        )
    ),
    default_project="flytesnacks",
    default_domain="development",
    data_upload_location="<s3a://flyte-storage/>"
)

HYPERPARAMS = {
    "hyperparameters": {"C": 0.1}
}

flyte_entity = training_workflow

flyte_workflow = remote.register_workflow(
    entity=flyte_entity,
    serialization_settings=SerializationSettings(image_config=ImageConfig.auto_default_image()),
    version="v1"
)

launch_plan = LaunchPlan.get_or_create(
    workflow=flyte_workflow,
    name="wine_classification_lp",
    default_inputs=HYPERPARAMS,
)
remote.register_launch_plan(launch_plan, "v1", project="flytesnacks", domain="development")
And the workflow failed right at the first task
get_data
, here is the error I’ve got
[1/1] currentAttempt done. Last Error: USER::rapped(*args, **kwargs)                        β”‚
β”‚                                                                              β”‚
β”‚ /usr/local/lib/python3.8/site-packages/flytekit/bin/entrypoint.py:347 in     β”‚
β”‚ _execute_task                                                                β”‚
β”‚                                                                              β”‚
β”‚ ❱ 347 β”‚   β”‚   _task_def = resolver_obj.load_task(loader_args=resolver_args)  β”‚
β”‚                                                                              β”‚
β”‚ /usr/local/lib/python3.8/site-packages/flytekit/core/utils.py:295 in wrapper β”‚
β”‚                                                                              β”‚
β”‚ ❱ 295 β”‚   β”‚   β”‚   β”‚   return func(*args, **kwargs)                           β”‚
β”‚                                                                              β”‚
β”‚ /usr/local/lib/python3.8/site-packages/flytekit/core/python_auto_container.p β”‚
β”‚ y:235 in load_task                                                           β”‚
β”‚                                                                              β”‚
β”‚ ❱ 235 β”‚   β”‚   task_module = importlib.import_module(name=task_module)  # typ β”‚
β”‚                                                                              β”‚
β”‚ /usr/local/lib/python3.8/importlib/__init__.py:127 in import_module          β”‚
β”‚                                                                              β”‚
β”‚ ❱ 127 β”‚   return _bootstrap._gcd_import(name[level:], package, level)        β”‚
β”‚ in _gcd_import:1011                                                          β”‚
β”‚ in _sanity_check:950                                                         β”‚
╰──────────────────────────────────────────────────────────────────────────────╯
ValueError: Empty module name
Any suggestion on which might have caused this error and how to fix it? I’m suspecting that I haven’t registered the workflow or the launch plan properly.