#1795 Feat: Add plugin for generating GCP IAP ID tokens via external command Pull request opened by fg91 TL;DR See flyteorg/flyte#3965 This PR adds a plugin called

flytekit-identity-aware-proxy

that provides a CLI called

flyte-iap

which performs an OAuth 2.0 flow with

<https://accounts.google.com>

. The CLI will be used by

flytekit

and

flytectl

as an external command to create ID tokens to authenticate with GCP Identity Aware Proxy (IAP) protecting Flyte. Type ☐ Bug Fix ☐ Feature ☑︎ Plugin Are all requirements met? ☐ Code completed ☑︎ Smoke tested ☐ Unit tests added ☐ Code documentation added ☐ Any pending items have an associated Issue Still need to fix tests. Complete description Flytekit already provides logic to perform OAuth 2.0 flows (see here):

class AuthorizationClient(metaclass=_SingletonPerEndpoint):
    """
    Authorization client that stores the credentials in keyring and uses oauth2 standard flow to retrieve the
    credentials. NOTE: This will open an web browser to retreive the credentials.
    """

This authorization client is currently only used by the `PKCEAuthenticator` which is used by flyte's clis to authenticate with flyteadmin. However, in contrast to what is claimed in the doc string, the

AuthorizationClient

does not perform a standard oauth2 flow but rather a PKCE flow. Here, for instance, a code challenge is generated which is part of the pkce flow but not the standard oauth2 flow. This PR slightly refactors the

AuthorizationClient

by moving pkce-related things like code challenge generation into the

PKCEAuthenticator

(without actually changing the pkce auth flow). The

AuthorizationClient

is then re-used to perform a standard OAuth 2.0 flow with

<https://accounts.google.com>

in the new IAP plugin. Tracking Issue flyteorg/flyte#3965 Follow-up issue NA flyteorg/flytekit GitHub Actions: build-plugins GitHub Actions: build (macos-latest, 3.11) GitHub Actions: build (macos-latest, 3.10) GitHub Actions: build (macos-latest, 3.9) GitHub Actions: build (macos-latest, 3.8) GitHub Actions: build (windows-latest, 3.11) GitHub Actions: build (windows-latest, 3.9) GitHub Actions: build (windows-latest, 3.8) GitHub Actions: build (ubuntu-latest, 3.11) GitHub Actions: build (ubuntu-latest, 3.10) GitHub Actions: build (ubuntu-latest, 3.9) GitHub Actions: build (ubuntu-latest, 3.8) ✅ 4 other checks have passed 4/16 successful checks