Question does `flyte binary` just not support TLS on the ing

Question

Question does `flyte binary` just not support TLS on the ingress resources How is TLS currently being done if not using an Ingress

jeev · Answer

it was designed primarily for AWS and GCP where the cert is set in an annotation it would be a small change to add support for a TLS block to the ingress object i believe someone else wanted to a while back but i haven t seen a PR for it

Greg Linklater · Answer

I got around it by manually creating and kustomizing Ingress objects not ideal but works for now while I am experimenting

jeev · Answer

can you paste the final ingress object redacted i ll push a change to the chart if i find time

Greg Linklater · Answer

< jeev> I only added the following to both the http and grpc ingresses ```spec tls hosts lt host gt secretName flyte tls```

Gopal Vashishtha · Answer

< jeev> saw you added thanks I m not sure how to use the list block though do you have any examples

Gopal Vashishtha · Answer

also I m guessing this hasn t actually been relased yet

jeev · Answer

yes unreleased but you can use the nightly <https github com flyteorg flyte pkgs container helm charts 2Fflyte binary|chart>

jeev · Answer

the tls list block is passed through to the ingress object as is i don t have an example but it should be pretty straightforward

Gopal Vashishtha · Answer

how do I reference the nightly chart Will give this a shot and report back

jeev · Answer

Use <oci ghcr io flyteorg helm charts flyte binary|oci ghcr io flyteorg helm charts flyte binary> as the chart path and 0 0 lt COMMIT SHA gt as the version

Gopal Vashishtha · Answer

so latest is `0 0 9cbd3a2a0abc0a3978460bc0eb4eb1c3e01991e0` right I see neither `ingressClassName` nor httpTls changes reflected when doing `kubectl describe ingress flyte flyte binary http`

Gopal Vashishtha · Answer

``` ingress host lt redacted gt TODO update chart once tls support lands to add this grpcTls hosts lt redacted gt secretName cluster wildcard tls httpTls hosts lt redacted gt secretName cluster wildcard tls create true ingressClassName nginx commonAnnotations false TODO once ingressClassName support lands delete this nginx grpcAnnotations GRPC```

jeev · Answer

kubectl get ingress o yaml

jeev · Answer

hmm maybe we should add a tls config so users can keep things dry consistent with the other configs

jeev · Answer

are your grpcTls and httpTls configs the same < Gopal Vashishtha>

Gopal Vashishtha · Answer

```apiVersion v1 items apiVersion kind Ingress metadata annotations addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path console allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path console allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path api allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path api allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path healthcheck allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path v1 allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path well known allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path well known allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path login allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path login allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path logout allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path logout allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path callback allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path callback allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path me allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path config allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path config allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path oauth2 allNodes false addresses 10 48 3 19 10 48 3 23 52 235 149 87 52 244 67 12 port 80 protocol HTTP serviceName flyte flyte flyte binary http ingressName flyte flyte flyte binary http hostname path oauth2 allNodes false nginx flyte flyte false creationTimestamp 2023 08 08T15 01 48Z generation 1 labels flyte Helm flyte binary 1 16 0 flyte binary v1 8 1 name flyte flyte binary http namespace flyte resourceVersion 553670 uid 42e2247e 7ded 42ba b1d0 fb1c1dc1ad08 spec rules host http paths backend service name flyte flyte binary http port number 8088 path console pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path console pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path api pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path api pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path healthcheck pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path v1 pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path well known pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path well known pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path login pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path login pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path logout pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path logout pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path callback pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path callback pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path me pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path config pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path config pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path oauth2 pathType ImplementationSpecific backend service name flyte flyte binary http port number 8088 path oauth2 pathType ImplementationSpecific status loadBalancer ingress ip 10 48 3 19 ip 10 48 3 23 ip 52 235 149 87 ip 52 244 67 12 ```

Gopal Vashishtha · Answer

yes they re the same

jeev · Answer

opened this PR <https github com flyteorg flyte pull 3930 files>

jeev · Answer

``` 202 6 +202 15 ingress name use annotation path pathType Exact + ingressClassName foobar + httpTls + hosts + foo bar + secretName foo + grpcTls + hosts + foo bar + secretName foo rbac extraRules apiGroups ``` produces ``` 854 6 +854 7 metadata alb GRPC spec + ingressClassName foobar rules http paths 942 6 +943 10 spec path flyteidl service SignalService pathType ImplementationSpecific host lt redacted gt + tls + hosts + foo bar + secretName foo``` and ``` spec + ingressClassName foobar rules http paths 1110 3 +1116 7 spec path oauth2 pathType ImplementationSpecific host lt redacted gt + tls + hosts + foo bar + secretName foo``` for me

jeev · Answer

and now i can just do ``` 202 6 +202 11 ingress name use annotation path pathType Exact + ingressClassName foobar + tls + hosts + foo bar + secretName foo rbac extraRules apiGroups ```

jeev · Answer

are you sure you installed the correct helm chart < Gopal Vashishtha>

jeev · Answer

you can generate a manifest with this ```helm template flyte binary <oci ghcr io flyteorg helm charts flyte binary> namespace flyte set deployment image tag=sha 9cbd3a2a0abc0a3978460bc0eb4eb1c3e01991e0 version 0 0 9cbd3a2a0abc0a3978460bc0eb4eb1c3e01991e0 values values yaml gt generated yaml``` and inspect it

Gopal Vashishtha · Answer

When I use the command you sent the generated yaml looks correct jeev The problem is I m actually running flyte as a dependency in a helm chart When I do this ```dependencies name flyte binary version 0 0 9cbd3a2a0abc0a3978460bc0eb4eb1c3e01991e0 repository ``` I get the following error from `helm dependency build` ```Save error occurred could not download failed to authorize failed to fetch anonymous token unexpected status from GET request to 403 Forbidden ```

Gopal Vashishtha · Answer

I worked around the issue by doing `helm pull` I now see ```W0809 06 50 42 034001 83117 warnings go 70 unknown field spec rules 0 tls W0809 06 50 42 617311 83117 warnings go 70 unknown field spec rules 0 tls ``` looking at<https kubernetes io docs concepts services networking ingress tls| the docs> shouldn t tls be a sibling of rules not a child

jeev · Answer

ah looks like i made a mistake will fix

jeev · Answer

< Gopal Vashishtha>

jeev · Answer

can you take a look at that

jeev · Answer

you can even try it out as a local chart

Gopal Vashishtha · Answer

Yeah this looks right

jeev · Answer

did you have a chance to try it out < Gopal Vashishtha>

Gopal Vashishtha · Answer

< jeev> I can t figure out how to reference your nightly build in my helm chart Can you suggest syntax I can put in a Chart yml to list the chart as a dependency

Gopal Vashishtha · Answer

see <https flyte org slack com archives C01P3B761A6 p1691588429243549 thread ts=1690373582 368169 amp cid=C01P3B761A6|this error> I was getting above

Gopal Vashishtha · Answer

ah wait I got it

Gopal Vashishtha · Answer

needed to do this <https github com helm helm issues 12062 issuecomment 1542746180>