Hello wave Question about CICD + auth Flyte #flyte-support

Join Slack

Hello :wave: Question about CICD + auth

# flyte-support

boundless-lifeguard-61788

08/09/2024, 6:42 PM

Hello 👋 Question about CICD + auth

boundless-lifeguard-61788

08/09/2024, 6:46 PM

We are testing CICD and encountered some issues with authenticating. Currently we have authentication + internal flyte authorization. We did not enable an external authorization service The first question is can ClientSecret work with flytes internal authorization?

The requested feature is not enabled in this environment

if it does what are we missing The error we are encountering is

Copy code

{"json":{"src":"main.go:13"},"level":"error","msg":"authentication error! Original Error: <nil>, Auth Error: failed to issue token. Error: failed to get token: oauth2: \"access_denied\" \"The requested feature is not enabled in this environment.\"","ts":}

the config file

Copy code

admin:
  endpoint: dns:///[ourendpoint]
  authType: ClientSecret
  clientId: [clientId:]
  clientSecretEnvVar: FLYTE_CLIENT_SECRET
  authorizationServerUrl: https://[ouoidcurl]]
  scopes:
    - openid
    - profile
    - email
    - read_user
  tokenUrl: https://[ouroidtokenurl]
  insecure: false
logger:
  show-source: true
  level: 6

@damp-animal-95109

average-finland-92144

08/09/2024, 10:00 PM

@boundless-lifeguard-61788 I don't think there's a limitation on ClientCredentials and the internal auth server. A previous thread touches this topic and seems like

ClientSecret

and

clientSecreLocation

are two of the configs that need to go together, and this is preferred over using an envvar (ref)

thankful-minister-83577

08/09/2024, 11:21 PM

@boundless-lifeguard-61788 it definitely can. we do this in one of our test environments.

👍 1

damp-animal-95109

08/09/2024, 11:22 PM

This is working now. The issue we were running into was we thought we needed to use the literal clientId we created for flytepropeller in okta but we actually just needed to use

flytepropeller

Copy code

admin:
  endpoint: dns:///<our_endpoint>
  authType: ClientSecret
  clientId: flytepropeller
  clientSecretEnvVar: FLYTE_CLIENT_SECRET
logger:
  show-source: true
  level: 6

This worked inside a docker container for both

flytectl

and

pyflyte

using either the env var or the secret file. Thanks for your quick response!

🙌🏽 1

4 Views

Open in Slack

Previous Next