#1787 Feat: Enable `flytekit` to authenticate with proxy in front of FlyteAdmin Pull request opened by fg91 TL;DR Part of an effort to integrate Flyte with GCP Identity Aware Proxy (IAP). See tracking issue for details and motivation: flyteorg/flyte#3965 Type ☐ Bug Fix ☑︎ Feature ☑︎ Plugin Are all requirements met? ☑︎ Code completed ☑︎ Smoke tested (Deployed Flyte with IAP in sandbox cluster according to deployment guide in the readme added in this PR. Tested that

FlyteRemote

can talk to admin through the IAP, e.g. to retrieve executions, start new ones etc.) ☑︎ Unit tests added ☑︎ Code documentation added ☐ Any pending items have an associated Issue Complete description • Add a new option called

proxyCommand

to the platform config in which users can specify an external command which, if specified, is used to generate ID tokens for a proxy in front of Flyte. • This idea is derived from the existing

command

(external command auth type) which is used to generate tokens for Flyte itself. • The ID tokens generated by this

proxyCommand

are added as

"proxy-authorization"

header to every request (http, gRPC) that flytekit's client makes to flyteadmin, including the initial unauthenticated requests of the auth flow with flyteadmin. These additional ID tokens in the

"proxy-authorization"

header allow clients to interact with a flyteadmin that is protected by GCP Identity Aware Proxy (or in theory similar services from other providers) • Refactor the

AuthorizationClient

which currently can only be used for a pkce auth flow (despite its doc string claiming it works for a general OAuth 2.0 flow) to actually work for both pkce and default OAuth 2.0. • Add a plugin which provides a CLI that generates ID tokens for GCP Identity Aware Proxy • This plugin re-uses the

AuthorizationClient

in flytekit to perform an OAuth 2.0 flow with

<http://accounts.google.com|accounts.google.com>

. • The command is to be used as

proxyCommand

in the platform config for Flyte deployments protected with IAP • Add a step-by-step guide on how to deploy Flyte protected with GCP IAP Tracking Issue https://github.com/flyteorg/flyte/issues/ Follow-up issue NA OR https://github.com/flyteorg/flyte/issues/ flyteorg/flytekit GitHub Actions: build (macos-latest, 3.11) ✅ 15 other checks have passed 15/16 successful checks

#1787 Feat: Enable `flytekit` to authenticate with proxy in front of FlyteAdmin Pull request ready for review by fg91 flyteorg/flytekit