#6998 [WIP] Add AuthMetadataService Pull request opened by pingsutw Tracking issue Why are the changes needed? The current

runs/service/auth_metadata.go

is a simple static-config implementation that directly maps config values to the response. The flyteadmin implementation supports two modes: self auth server (builds metadata from relative URLs) and external auth server (fetches from

.well-known/oauth-authorization-server

with retry logic). We need full parity with flyteadmin for the v2 runs service. What changes were proposed in this pull request? •

runs/config/config.go

— Restructured auth config to match flyteadmin's shape: •

AuthConfig

with

AuthorizedURIs

,

GrpcAuthorizationHeader

,

AppAuth

,

HTTPProxyURL

,

TokenEndpointProxyConfig

•

OAuth2Options

with

AuthServerType

(Self/External enum),

SelfAuthServer

,

ExternalAuthServer

,

ThirdParty

•

ExternalAuthorizationServer

with

BaseURL

,

MetadataEndpointURL

,

RetryAttempts

,

RetryDelay

•

FlyteClientConfig

,

TokenEndpointProxyConfig

sub-structs •

runs/service/auth_metadata.go

— Rewrote with two code paths: • Self mode (default): Builds OAuth2 metadata with relative URLs (

/oauth2/token

,

/oauth2/authorize

,

/oauth2/jwks

) based on first

AuthorizedURI

, with hardcoded supported methods/scopes • External mode: Fetches metadata from

.well-known/oauth-authorization-server

with retry logic, HTTP proxy support, and optional token endpoint proxy rewriting •

runs/service/auth_metadata_test.go

— Rewrote tests covering both modes with 13 test cases •

runs/setup.go

— Added AuthMetadataService registration How was this patch tested? Unit tests covering: •

TestGetPublicClientConfig

— config values mapped correctly •

TestGetOAuth2Metadata_SelfAuthServer

— verifies issuer, token/authorize/jwks URLs relative to authorized URI •

TestGetOAuth2Metadata_SelfAuthServerWithCustomIssuer

— custom issuer override •

TestGetOAuth2Metadata_SelfAuthServerNoAuthorizedURIs

— fallback to localhost •

TestGetOAuth2Metadata_ExternalAuthServer

— httptest server serving metadata JSON •

TestGetOAuth2Metadata_ExternalWithCustomMetadataURL

— custom metadata endpoint •

TestGetOAuth2Metadata_ExternalWithTokenProxy

— token endpoint rewriting •

TestGetOAuth2Metadata_ExternalWithTokenProxyAndPathPrefix

— rewriting with path prefix •

TestGetOAuth2Metadata_ExternalNoBaseURL

— error on missing base URL •

TestSendAndRetryHTTPRequest_*

— immediate success, retry into success, all retries fail, context cancelled All tests pass:

go test ./runs/service/ -v

Labels • added: New self/external auth server mode support Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. 🤖 Generated with Claude Code •

main

• #6583 • #6998 👈 flyteorg/flyte