Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Feature] Access control on who can run/view workflows #555

Closed
1 of 13 tasks
senthilnathan23 opened this issue Oct 15, 2020 · 8 comments
Closed
1 of 13 tasks

[Feature] Access control on who can run/view workflows #555

senthilnathan23 opened this issue Oct 15, 2020 · 8 comments
Labels
enhancement New feature or request spec-first This issue needs a spec to be created and then work. It should be an independent stream

Comments

@senthilnathan23
Copy link

senthilnathan23 commented Oct 15, 2020 •
edited by kumare3
Loading

Motivation: Why do you think this is important?
We want to have better access control over who can run/view workflows. Currently this is blocker to create any critical pipelines on Flyte.

Goal: What should the final outcome look like, ideally?
Flyte UI/CLI: Should allow certain list of users to view/run the workflows. This could be configured through the code.

Describe alternatives you've considered
There are no alternatives at this point to overcome this.

Flyte component

  • Overall
  • Flyte Setup and Installation scripts
  • Flyte Documentation
  • Flyte communication (slack/email etc)
  • FlytePropeller
  • FlyteIDL (Flyte specification language)
  • Flytekit (Python SDK)
  • FlyteAdmin (Control Plane service)
  • FlytePlugins
  • DataCatalog
  • FlyteStdlib (common libraries)
  • FlyteConsole (UI)
  • Other

[Optional] Propose: Link/Inline
N/A

Additional context
N/A

Is this a blocker for you to adopt Flyte
This is a blocker for us to start using Flyte for our critical data pipelines.
@senthilnathan23 senthilnathan23 added enhancement New feature or request untriaged This issues has not yet been looked at by the Maintainers labels Oct 15, 2020
@kumare3 kumare3 added the spec-first This issue needs a spec to be created and then work. It should be an independent stream label Oct 18, 2020
@kumare3 kumare3 removed the untriaged This issues has not yet been looked at by the Maintainers label Jan 29, 2021
@kumare3
Copy link
Contributor

kumare3 commented Jan 29, 2021

This is something that we want to work on in Milestone Q1, 2021

@senthilnathan23
Copy link
Author

@kumare3 Thank you for the update. Looking forward to it. Are we planning to use google auth or something different? just curious.

@kumare3
Copy link
Contributor

kumare3 commented Feb 1, 2021

@senthilnathan23 so Flyte already supports OAuth2 based Authentication flow. https://flyte.readthedocs.io/en/latest/administrator/install/authentication.html?highlight=auth. Since this uses OAuth2 you should be able to use Google Auth for the sign in.

This issue aims at implementing Authorization (AuthZ / Role based access control). I am not 100% sure if we can have RBAC policies in Google. We are definitely thinking on the lines of Open Policy Agent. Would love your thoughts. Please join the slack channel at https://docs.google.com/forms/d/e/1FAIpQLScWPJZncyL-bBCWbuQ9HWuMzA8-r2RJc__CSWJoAYUQADN-BQ/viewform and join the discussin

@kumare3
Copy link
Contributor

kumare3 commented Feb 1, 2021

I guess your intention here is to use the singular hosted platform at Lyft for more sensitive pipelines. If so, then we should be able to support this soon.

@senthilnathan23
Copy link
Author

I guess your intention here is to use the singular hosted platform at Lyft for more sensitive pipelines. If so, then we should be able to support this soon.

Yes, that's right. Thank you!

@kumare3 kumare3 added this to the 0.13.0 milestone Feb 28, 2021
@kumare3 kumare3 modified the milestones: 0.13.0, 0.15.0 May 5, 2021
This was referenced May 5, 2021
Closed
Closed
@kumare3 kumare3 modified the milestones: 0.15.0, 0.16.0 Jun 7, 2021
@tekumara
Copy link

tekumara commented Jul 5, 2021

Hi all, I've taken a stab at a proposal for authz... Probably needs more work but thought I'd put it out there to start the discussion and get your input.
https://docs.google.com/document/d/1-dacHa0iaZl-Nq-nypfjbIqGq3m-Z2rp3T6AmLiburA/edit?usp=sharing

@kumare3
Copy link
Contributor

kumare3 commented Jul 5, 2021

Cc @kanterov @jeevb @EngHabu @wild-endeavor @pmahindrakar-oss @narape

@EngHabu EngHabu modified the milestones: 0.16.0, 0.17.0 Aug 2, 2021
@EngHabu EngHabu removed this from the 0.17.0 milestone Aug 31, 2021
@kumare3
Copy link
Contributor

kumare3 commented Jun 25, 2023

There is no standard for authZ available in open source, so we are closing this issue - until someone proposes a workable rfc

@kumare3 kumare3 closed this as completed Jun 25, 2023
eapolinario pushed a commit to eapolinario/flyte that referenced this issue Jul 24, 2023
@hamersaw
Setting primaryContainerName by default on Pod plugin (flyteorg#555)
e4ca252 
* updated flyteplugins version

Signed-off-by: Daniel Rammer <[email protected]>

* go mod tidy

Signed-off-by: Daniel Rammer <[email protected]>

---------

Signed-off-by: Daniel Rammer <[email protected]>
eapolinario pushed a commit to eapolinario/flyte that referenced this issue Aug 9, 2023
@hamersaw
Setting primaryContainerName by default on Pod plugin (flyteorg#555)
0af9c55 
* updated flyteplugins version

Signed-off-by: Daniel Rammer <[email protected]>

* go mod tidy

Signed-off-by: Daniel Rammer <[email protected]>

---------

Signed-off-by: Daniel Rammer <[email protected]>
@dosubot dosubot bot mentioned this issue Apr 5, 2024
Open
pmahindrakar-oss added a commit that referenced this issue Nov 13, 2024
@pmahindrakar-oss
Auth/prevent lookup per call (#5686) (#555)
d6d59a9 
Cherry-pick the following change to populate oauth metadata once on initialization using Sync.Do
ca04314

Tested locally using uctl-admin and fetched projects calling into admin which exercises the auth flow
https://buildkite.com/unionai/org-staging-sync/builds/3541

Rollout to all canary and then prod tenants

- [x] To be upstreamed to OSS

*TODO: Link Linear issue(s) using [magic words](https://linear.app/docs/github#magic-words). `fixes` will move to merged status, while `ref` will only link the PR.*

* [ ] Added tests
* [ ] Ran a deploy dry run and shared the terraform plan
* [ ] Added logging and metrics
* [ ] Updated [dashboards](https://unionai.grafana.net/dashboards) and [alerts](https://unionai.grafana.net/alerting/list)
* [ ] Updated documentation
pmahindrakar-oss added a commit that referenced this issue Nov 13, 2024
@pmahindrakar-oss
Auth/prevent lookup per call (#5686) (#555)
9bcaad2 
Cherry-pick the following change to populate oauth metadata once on initialization using Sync.Do
ca04314

Tested locally using uctl-admin and fetched projects calling into admin which exercises the auth flow
https://buildkite.com/unionai/org-staging-sync/builds/3541

Rollout to all canary and then prod tenants

- [x] To be upstreamed to OSS

*TODO: Link Linear issue(s) using [magic words](https://linear.app/docs/github#magic-words). `fixes` will move to merged status, while `ref` will only link the PR.*

* [ ] Added tests
* [ ] Ran a deploy dry run and shared the terraform plan
* [ ] Added logging and metrics
* [ ] Updated [dashboards](https://unionai.grafana.net/dashboards) and [alerts](https://unionai.grafana.net/alerting/list)
* [ ] Updated documentation

Signed-off-by: pmahindrakar-oss <[email protected]>
pmahindrakar-oss added a commit that referenced this issue Nov 14, 2024
@pmahindrakar-oss
Upstream changes to fix token validity and utilizing inmemory creds s…
da220be 
…ource (#6001)

* Auth/prevent lookup per call (#5686) (#555)

Cherry-pick the following change to populate oauth metadata once on initialization using Sync.Do
ca04314

Tested locally using uctl-admin and fetched projects calling into admin which exercises the auth flow
https://buildkite.com/unionai/org-staging-sync/builds/3541

Rollout to all canary and then prod tenants

- [x] To be upstreamed to OSS

*TODO: Link Linear issue(s) using [magic words](https://linear.app/docs/github#magic-words). `fixes` will move to merged status, while `ref` will only link the PR.*

* [ ] Added tests
* [ ] Ran a deploy dry run and shared the terraform plan
* [ ] Added logging and metrics
* [ ] Updated [dashboards](https://unionai.grafana.net/dashboards) and [alerts](https://unionai.grafana.net/alerting/list)
* [ ] Updated documentation

Signed-off-by: pmahindrakar-oss <[email protected]>

* [COR-1114]  Fix token validity check logic to use exp field in access token (#330)

* Add logs for token

* add logs

* Fixing the validity check logic for token

* nit

* nit

* Adding in memory token source provider

* nit

* changed Valid method to log and ignore parseDateClaim error

* nit

* Fix unit tests

* lint

* fix unit tests

Signed-off-by: pmahindrakar-oss <[email protected]>

* remove debug logs

Signed-off-by: pmahindrakar-oss <[email protected]>

---------

Signed-off-by: pmahindrakar-oss <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement New feature or request spec-first This issue needs a spec to be created and then work. It should be an independent stream
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@EngHabu @tekumara @kumare3 @senthilnathan23