Hello all I ve deployed a flyte cluster in AWS EKS following

Question

Hello all I ve deployed a flyte cluster in AWS EKS following the current documentation with some help from David s Flyte the hard way guide The cluster is behind an AWS load balancer and secure domain i e available at `` I am following the for adding Azure openID auth but it does not look like I have the same secrets nor configmap available

Ketan (kumare3) · Answer

the azure ad guide was added by < Byron Hsu>

Byron Hsu · Answer

hi what issue you met

Byron Hsu · Answer

hmm i am not sure `clientSecretLocation` is in use for us I think only `clientID` matters

Cody Scandore · Answer

Thanks < Byron Hsu> I think my issues may be more fundamental My deployment has the following ns ```NAME STATUS AGE default Active 38d flyte Active 38d flytesnacks development Active 36d flytesnacks production Active 36d flytesnacks staging Active 36d kube node lease Active 38d kube public Active 38d kube system Active 38d``` And the flyte ns has the following resources ```NAME READY STATUS RESTARTS AGE pod flyte backend flyte binary 5f5465b4f7 7hmt7 1 1 Running 0 22d NAME TYPE CLUSTER IP EXTERNAL IP PORT S AGE service flyte backend flyte binary grpc ClusterIP 10 100 27 200 lt none gt 8089 TCP 22d service flyte backend flyte binary http ClusterIP 10 100 55 136 lt none gt 8088 TCP 22d service flyte backend flyte binary webhook ClusterIP 10 100 41 202 lt none gt 443 TCP 22d NAME READY UP TO DATE AVAILABLE AGE deployment apps flyte backend flyte binary 1 1 1 1 22d NAME DESIRED CURRENT READY AGE replicaset apps flyte backend flyte binary 5f5465b4f7 1 1 1 22d``` The flyte ns has the following configmaps ```NAME DATA AGE flyte backend flyte binary cluster resource templates 1 22d flyte backend flyte binary config 5 22d kube root ca crt 1 38d propeller leader 0 37d``` I don t see the `flyte admin base config` listed ```kubectl edit configmap n flyte flyte admin base config```

David Espejo (he/him) · Answer

< Cody Scandore> yeah we plan to extend the docs because what s written there assumes you re using the `flyte core` chart For `flyte binary` the CM is `flyte backend flyte binary config` and I don t think you longer need to edit the secret nor the CM any more To confirm please run `kubectl describe cm flyte backend flyte binary config n flyte`

Cody Scandore · Answer

```Name flyte backend flyte binary config Namespace flyte Labels Annotations flyte backend flyte Data ==== 000 core yaml admin endpoint localhost 8089 insecure true catalog cache endpoint localhost 8081 insecure true type datacatalog cluster resources standaloneDeployment false templatePath etc flyte cluster resource templates logger show source true level 5 propeller create flyteworkflow crd true webhook certDir var run flyte certs localCert true secretName flyte backend flyte binary webhook secret serviceName flyte backend flyte binary webhook servicePort 443 001 plugins yaml tasks task plugins enabled plugins container sidecar K8S ARRAY default for task types container container container array K8S ARRAY plugins logs kubernetes enabled false cloudwatch enabled false stackdriver enabled false k8s co pilot image k8s array logs config kubernetes enabled false cloudwatch enabled false stackdriver enabled false 002 database yaml database postgres username xxxxx passwordPath var run secrets flyte db pass host port 5432 dbname xxxxxx options sslmode=disable 003 storage yaml propeller rawoutput prefix storage type stow stow kind s3 config region us west 2 disable ssl false v2 signing false auth type iam container xxxxx flyte metadata 010 inline config yaml cluster resources customData null plugins k8s default env vars AWS METADATA SERVICE TIMEOUT 5 AWS METADATA SERVICE NUM ATTEMPTS 20 inject finalizer true storage cache max size mbs 10 target gc percent 100 task resources defaults cpu 100m memory 100Mi storage 100Mi limits memory 2Gi tasks task plugins default for task types container container container array K8S ARRAY enabled plugins container sidecar K8S ARRAY BinaryData ==== Events lt none gt ```

David Espejo (he/him) · Answer

isn t there a `004 auth yaml` section Did you have a chance to enable `auth` in the Helm values file

Cody Scandore · Answer

```Error INSTALLATION FAILED execution error at flyte binary templates deployment yaml 37 35 Internal client secret hash required when built in authentication server is enabled``` From The Hard Way guide it looks like this is required ``` auth enabled false oidc baseUrl clientId lt IDP CLIENT ID gt clientSecret lt IDP CLIENT SECRET gt internal clientSecret lt CC PASSWD gt clientSecretHash lt HASHED CC PASSWD gt authorizedUris ``` I can fill out the oidc section with my azure app information but what is the internal section referencing Are those k8s cluster secrets ~ Resolved In Azure go to the portal gt Certificates amp Secrets gt Add a new secret The `oidc clientSecret` refers to the `Secret ID` while the `internal clientSecret` refers to the `Value` field Base64 encode the password to produce the `internal clientSecretHash` ~

David Espejo (he/him) · Answer

The FTHW guide doesn t include auth yet coming soon `internal` is there if you re going to use the authorization server that ships with flyteadmin hence internal as opposed your IdP s authorization server

Cody Scandore · Answer

Okay sorry just found the thread a few lines above Leaving off internal produces errors on `helm install`

David Espejo (he/him) · Answer

so regarding the `auth` parameters `enabled` `true` `baseUrl` you should obtain this from Azure AD probably < Byron Hsu> knows how `clientId` from Azure AD s registered app `clienteSecret` generate it in Azure AD for `internal` `clientId` `flytepropeller` `clientSecret lt generate a random password and add it here gt ` `clientSecretHash` Use the following command to produce the hash ```pip install bcrypt amp amp python c import bcrypt import base64 print base64 b64encode bcrypt hashpw lt your client secret gt encode utf 8 bcrypt gensalt 6 ``` I m working on reproducing this in my environment and adding docs

David Espejo (he/him) · Answer

also `authorizedUris` would be the FQDN for your Ingress