#6710 [Feat] add user annotations to k8s objects Pull request opened by ttitsworth-lila ## Why are the changes needed? Presently when submitting workflows via Flyte, it's hard to know who submitted what. This PR addresses one of two concerns: 1. I can't filter by users in the Flyte Console 2. I can't see a user identifier in k8s Why do I/we care about 2? Let's say you have two teams (A & B), if team A has access to 10 resources and team B has access to 1000 resources and we know who is in each team (exclusively). One can create further admission controls for any user in team A that requests more resources than are allotted to that team. Furthermore, this can be tracked properly with Kueue. Today when I submit a Flyte workflow I have no way to actually know who submitted what from a k8s perspective because principal information is not passed to the downstream k8s

flyteworkflow

object. ## What changes were proposed in this pull request? This PR adds a parameter that enables a new annotation to be injected into each flyteworkflow object that contains the user

principal

, which usually carries oauth information. Additionally, it allows customization of the annotation prefix. ## How was this patch tested? I added some unit tests, and I also tested in production with the

flyte-core

chart on EKS and using Keycloak:

$ kubectl describe flyteworkflow -n flyte-workspace ax5hwpvbmwnkhdkmq67m | grep <http://flyte.org|flyte.org>
Annotations:  <http://flyte.org/user|flyte.org/user>: <mailto:ttitsworth@lila.ai|ttitsworth@lila.ai>

### Labels Please add one or more of the following labels to categorize your PR: • added: For new features. • changed: For changes in existing functionality. • deprecated: For soon-to-be-removed features. • removed: For features being removed. • fixed: For any bug fixed. • security: In case of vulnerabilities This is important to improve the readability of release notes. ### Setup process ### Screenshots ## Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. ## Related PRs ## Docs link https://bito.ai#summarystart| ### Summary by Bito • This pull request introduces a feature for injecting user annotations into Flyte workflows, enhancing visibility and accountability in multi-team environments, while also addressing potential risks related to data integrity and security in Kubernetes environments. • It updates the identity annotation prefix to 'flyte.org' and includes customization options for better tracking of user submissions. • The changes improve error handling in the execution manager, ensuring better resource management and security. • Configuration updates include new identity annotation fields and modifications to deployment configurations, aiding in resource management. • Unit tests have been added to ensure the functionality works as intended, validating the new features. • Overall, this update introduces new user annotation features, customization options, and enhancements in resource management and security. flyteorg/flyte