Kedro kubeflow kfp authentication

[cpereir1]

Hi!

I am wondering how does kedro authenticate to kfp internally. I am using the kedro sample iris project locally and the kedro kubeflow plugin to deploy the iris pipeline to a kubeflow pipelines deployed instance (cloud). All seems to go fine except that I don't see any instructions in the tutorials to authenticate the kfp client? I believe this is a necessary step from the kfp sdk docs, when using the client outside the cluster.

Is this already handled by the kedro kubeflow plugin somehow?

I am not able to kedro kubeflow upload-pipeline. Could the lack of auth be the reason?

Thank you so much!

[em-pe]

Hi, kfp library uses Google's ADC under the hood. If you're running Kubeflow on GCP you, could install google cloud SDK and run gcloud auth application-default login to populate credentials on your local machine.

[marrrcin]

If you have custom authorization, one option is to generate context.json file in the KFPs config directory, e.g.

#!/bin/bash
set -e -x
KFP_AUTH_FILE=${2:-"/home/kedro/.config/kfp/context.json"}
mkdir -p $(dirname $KFP_AUTH_FILE)
cat << EOF > $KFP_AUTH_FILE
{
    "namespace": "",
    "client_authentication_header_name": "Authorization",
    "client_authentication_header_value": "Bearer $TOKEN"
}
EOF
kedro $1

[cpereir1]

Hi, kfp library uses Google's ADC under the hood. If you're running Kubeflow on GCP you, could install google cloud SDK and run gcloud auth application-default login to populate credentials on your local machine.

Hi @em-pe , my Kubeflow instance is running in Azure, with dex configured for authentication

[cpereir1]

Hi @marrrcin , what would the token then be? Is it the cookie generated from browser?

[marrrcin]

If you're using DEX, then maybe just setting appropriate username and password in environment variables will be sufficient as it's used here https://github.com/getindata/kedro-kubeflow/blob/ab709867507bbe61ee6ae52a9a95986173a344dd/kedro_kubeflow/kfpclient.py#L31 Unfortunately, that piece of code was tested long time ago and it's error prone, so you might as well use the flow with context.json, obtain cookie and set client_authentication_cookie in the JSON instead of client_authentication_header_(...).

[szczeles]

@cpereir1 If you're using Dex, then please follow this steps: https://kedro-kubeflow.readthedocs.io/en/0.7.3/source/03_getting_started/05_authentication.html#kfp-behind-dex-with-authservice - they work well, tested in Kubeflow 1.4 and Kubeflow 1.6.

[marrrcin]

@cpereir1 - can you confirm the solution suggested by @szczeles works for you?