Skip to content

Commit 349ec4b

Browse files
iaroslav-ciupiniaroslav-ciupin
committed
Merge branch 'main' into yaroslav/queue-idl
2 parents 24020c1 + ad4192c commit 349ec4b

13 files changed

Lines changed: 3075 additions & 2524 deletions

File tree

‎charts/flyte-binary/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,10 @@ Chart for basic single Flyte executable deployment
150150
| flyte-core-components.secret.kubernetes.timeout | string | `"30s"` | |
151151
| flyteconnector.enabled | bool | `false` | |
152152
| fullnameOverride | string | `""` | |
153+
| ingress.apiJwtIngress.annotations | object | `{}` | |
154+
| ingress.apiJwtIngress.enabled | bool | `false` | |
155+
| ingress.apiJwtIngress.ingressClassName | string | `""` | |
156+
| ingress.apiJwtIngress.tls | list | `[]` | |
153157
| ingress.commonAnnotations | object | `{}` | |
154158
| ingress.create | bool | `false` | |
155159
| ingress.host | string | `""` | |
@@ -161,6 +165,10 @@ Chart for basic single Flyte executable deployment
161165
| ingress.ingressClassName | string | `""` | |
162166
| ingress.labels | object | `{}` | |
163167
| ingress.tls | list | `[]` | |
168+
| ingress.wellknownIngress.annotations | object | `{}` | |
169+
| ingress.wellknownIngress.enabled | bool | `false` | |
170+
| ingress.wellknownIngress.ingressClassName | string | `""` | |
171+
| ingress.wellknownIngress.tls | list | `[]` | |
164172
| nameOverride | string | `""` | |
165173
| rbac.annotations | object | `{}` | |
166174
| rbac.create | bool | `true` | |

‎charts/flyte-binary/templates/_helpers.tpl‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,22 @@ Get the Flyte API paths for ingress.
193193
- /flyteidl2.app.AppService/*
194194
- /flyteidl2.trigger.TriggerService
195195
- /flyteidl2.trigger.TriggerService/*
196+
- /flyteidl2.auth.IdentityService
197+
- /flyteidl2.auth.IdentityService/*
198+
- /flyteidl2.settings.SettingsService
199+
- /flyteidl2.settings.SettingsService/*
200+
{{- end -}}
201+
202+
{{/*
203+
Get the Flyte auth-discovery paths for ingress. These are unauthenticated:
204+
clients must reach them before they hold a token (OAuth server metadata and the
205+
auth metadata service). IdentityService and SettingsService require auth and live
206+
in apiPaths instead.
207+
*/}}
208+
{{- define "flyte-binary.ingress.wellknownPaths" -}}
209+
- /.well-known/oauth-authorization-server
210+
- /flyteidl2.auth.AuthMetadataService
211+
- /flyteidl2.auth.AuthMetadataService/*
196212
{{- end -}}
197213
198214
{{/*

‎charts/flyte-binary/templates/clusterrole.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,27 @@ rules:
9090
- patch
9191
- update
9292
- watch
93+
{{- if dig "inline" "internalApps" "enabled" false (.Values.configuration | default dict) }}
94+
# Knative Serving access for the data-plane app controller, added automatically
95+
# when apps are enabled (configuration.inline.internalApps.enabled) so operators
96+
# don't have to hand-maintain rbac.extraRules. The controller creates and watches
97+
# KServices and deletes their Revisions when an app is stopped.
98+
- apiGroups:
99+
- serving.knative.dev
100+
resources:
101+
- services
102+
- revisions
103+
- configurations
104+
- routes
105+
verbs:
106+
- create
107+
- delete
108+
- get
109+
- list
110+
- patch
111+
- update
112+
- watch
113+
{{- end }}
93114
{{- if .Values.rbac.extraRules }}
94115
{{- toYaml .Values.rbac.extraRules | nindent 2 }}
95116
{{- end }}

‎charts/flyte-binary/templates/ingress/api-jwt.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if and .Values.ingress.create .Values.ingress.apiJwtIngress.enabled }}
2+
{{- $paths := (include "flyte-binary.ingress.apiPaths" .) | fromYamlArray }}
3+
apiVersion: networking.k8s.io/v1
4+
kind: Ingress
5+
metadata:
6+
name: {{ include "flyte-binary.fullname" . }}-api-jwt
7+
namespace: {{ .Release.Namespace | quote }}
8+
labels: {{- include "flyte-binary.labels" . | nindent 4 }}
9+
{{- if .Values.commonLabels }}
10+
{{- tpl ( .Values.commonLabels | toYaml ) . | nindent 4 }}
11+
{{- end }}
12+
{{- if .Values.ingress.labels }}
13+
{{- tpl ( .Values.ingress.labels | toYaml ) . | nindent 4 }}
14+
{{- end }}
15+
annotations:
16+
{{- if .Values.commonAnnotations }}
17+
{{- tpl ( .Values.commonAnnotations | toYaml ) . | nindent 4 }}
18+
{{- end }}
19+
{{- if .Values.ingress.commonAnnotations }}
20+
{{- tpl ( .Values.ingress.commonAnnotations | toYaml ) . | nindent 4 }}
21+
{{- end }}
22+
{{- if .Values.ingress.apiJwtIngress.annotations }}
23+
{{- tpl ( .Values.ingress.apiJwtIngress.annotations | toYaml ) . | nindent 4 }}
24+
{{- end }}
25+
spec:
26+
{{- if .Values.ingress.apiJwtIngress.ingressClassName }}
27+
ingressClassName: {{ .Values.ingress.apiJwtIngress.ingressClassName | quote }}
28+
{{- else if .Values.ingress.ingressClassName }}
29+
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
30+
{{- end }}
31+
{{- if .Values.ingress.apiJwtIngress.tls }}
32+
tls: {{- tpl ( .Values.ingress.apiJwtIngress.tls | toYaml ) . | nindent 2 }}
33+
{{- else if .Values.ingress.tls }}
34+
tls: {{- tpl ( .Values.ingress.tls | toYaml ) . | nindent 2 }}
35+
{{- end }}
36+
rules:
37+
- http:
38+
paths:
39+
{{- range $path := $paths }}
40+
- path: {{ $path }}
41+
{{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
42+
pathType: ImplementationSpecific
43+
{{- end }}
44+
backend:
45+
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
46+
service:
47+
name: {{ include "flyte-binary.service.http.name" $ }}
48+
port:
49+
number: {{ include "flyte-binary.service.http.port" $ }}
50+
{{- else }}
51+
serviceName: {{ include "flyte-binary.service.http.name" $ }}
52+
servicePort: {{ include "flyte-binary.service.http.port" $ }}
53+
{{- end }}
54+
{{- end }}
55+
{{- if .Values.ingress.host }}
56+
host: {{ tpl .Values.ingress.host . | quote }}
57+
{{- end }}
58+
{{- end }}

‎charts/flyte-binary/templates/ingress/wellknown.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if and .Values.ingress.create .Values.ingress.wellknownIngress.enabled }}
2+
{{- $paths := (include "flyte-binary.ingress.wellknownPaths" .) | fromYamlArray }}
3+
apiVersion: networking.k8s.io/v1
4+
kind: Ingress
5+
metadata:
6+
name: {{ include "flyte-binary.fullname" . }}-wellknown
7+
namespace: {{ .Release.Namespace | quote }}
8+
labels: {{- include "flyte-binary.labels" . | nindent 4 }}
9+
{{- if .Values.commonLabels }}
10+
{{- tpl ( .Values.commonLabels | toYaml ) . | nindent 4 }}
11+
{{- end }}
12+
{{- if .Values.ingress.labels }}
13+
{{- tpl ( .Values.ingress.labels | toYaml ) . | nindent 4 }}
14+
{{- end }}
15+
annotations:
16+
{{- if .Values.commonAnnotations }}
17+
{{- tpl ( .Values.commonAnnotations | toYaml ) . | nindent 4 }}
18+
{{- end }}
19+
{{- if .Values.ingress.commonAnnotations }}
20+
{{- tpl ( .Values.ingress.commonAnnotations | toYaml ) . | nindent 4 }}
21+
{{- end }}
22+
{{- if .Values.ingress.wellknownIngress.annotations }}
23+
{{- tpl ( .Values.ingress.wellknownIngress.annotations | toYaml ) . | nindent 4 }}
24+
{{- end }}
25+
spec:
26+
{{- if .Values.ingress.wellknownIngress.ingressClassName }}
27+
ingressClassName: {{ .Values.ingress.wellknownIngress.ingressClassName | quote }}
28+
{{- else if .Values.ingress.ingressClassName }}
29+
ingressClassName: {{ .Values.ingress.ingressClassName | quote }}
30+
{{- end }}
31+
{{- if .Values.ingress.wellknownIngress.tls }}
32+
tls: {{- tpl ( .Values.ingress.wellknownIngress.tls | toYaml ) . | nindent 2 }}
33+
{{- else if .Values.ingress.tls }}
34+
tls: {{- tpl ( .Values.ingress.tls | toYaml ) . | nindent 2 }}
35+
{{- end }}
36+
rules:
37+
- http:
38+
paths:
39+
{{- range $path := $paths }}
40+
- path: {{ $path }}
41+
{{- if semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion }}
42+
pathType: ImplementationSpecific
43+
{{- end }}
44+
backend:
45+
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
46+
service:
47+
name: {{ include "flyte-binary.service.http.name" $ }}
48+
port:
49+
number: {{ include "flyte-binary.service.http.port" $ }}
50+
{{- else }}
51+
serviceName: {{ include "flyte-binary.service.http.name" $ }}
52+
servicePort: {{ include "flyte-binary.service.http.port" $ }}
53+
{{- end }}
54+
{{- end }}
55+
{{- if .Values.ingress.host }}
56+
host: {{ tpl .Values.ingress.host . | quote }}
57+
{{- end }}
58+
{{- end }}

‎charts/flyte-binary/values.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,6 +401,36 @@ ingress:
401401
httpExtraPaths:
402402
prepend: []
403403
append: []
404+
# apiJwtIngress Optional separate ingress that JWT-validates the flyteidl2 API
405+
# paths for requests carrying an `Authorization: Bearer` token (SDK/machine
406+
# clients). Needed on controllers like AWS ALB where a single ingress cannot
407+
# combine cookie-OIDC (browser) and JWT (token) auth. It renders the shared API
408+
# paths backed by the http service; supply the controller/JWT config (e.g. ALB
409+
# cert-arn, jwt-validation, the `Authorization: Bearer*` match condition, and a
410+
# group.order lower than the http ingress (but higher than the wellknown ingress)) via `annotations`.
411+
apiJwtIngress:
412+
# enabled Create the JWT (Bearer) API ingress
413+
enabled: false
414+
# annotations Annotations for the JWT API ingress (controller/JWT config)
415+
annotations: {}
416+
# ingressClassName Ingress class for the JWT API ingress. Overrides `ingressClassName`
417+
ingressClassName: ""
418+
# tls Add TLS configuration to the JWT API ingress. Overrides `tls`
419+
tls: []
420+
# wellknownIngress Optional separate ingress for the unauthenticated
421+
# auth-discovery endpoints (`/.well-known/oauth-authorization-server`,
422+
# AuthMetadataService) — clients must reach these before they hold a token. Give it the highest controller precedence
423+
# (e.g. ALB group.order lower than the JWT/http ingresses) so these paths bypass
424+
# auth. Supply controller config via `annotations`.
425+
wellknownIngress:
426+
# enabled Create the unauthenticated auth-discovery ingress
427+
enabled: false
428+
# annotations Annotations for the auth-discovery ingress (controller config)
429+
annotations: {}
430+
# ingressClassName Ingress class for the auth-discovery ingress. Overrides `ingressClassName`
431+
ingressClassName: ""
432+
# tls Add TLS configuration to the auth-discovery ingress. Overrides `tls`
433+
tls: []
404434

405435
# rbac Configure Kubernetes RBAC for Flyte
406436
rbac:

‎flyteidl2/app/app_definition.proto‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,10 @@ message Condition {
118118

119119
// Actor is the principal that caused the condition.
120120
common.EnrichedIdentity actor = 5;
121+
122+
// Finer-grained substate qualifying deployment_status (e.g. FAILED + IMAGE_PULL_ERROR).
123+
// Human-readable detail for a failure is carried in the existing `message` field.
124+
Status.Substate substate = 6;
121125
}
122126

123127
// Represents the status of an app.
@@ -150,6 +154,25 @@ message Status {
150154
DEPLOYMENT_STATUS_DEPLOYING = 10;
151155
}
152156

157+
// Finer-grained substate that qualifies a DeploymentStatus, surfaced on a Condition.
158+
enum Substate {
159+
SUBSTATE_UNSPECIFIED = 0;
160+
// The container image is being pulled.
161+
PULLING_IMAGE = 1;
162+
// The container is starting up.
163+
INITIALIZING = 2;
164+
// The Knative admission webhook rejected the revision.
165+
WEBHOOK_ERROR = 3;
166+
// The container image could not be pulled.
167+
IMAGE_PULL_ERROR = 4;
168+
// A referenced secret could not be mounted.
169+
SECRET_MOUNT_ERROR = 5;
170+
// The container is repeatedly crashing on startup.
171+
CRASH_LOOP = 6;
172+
// The container was killed for exceeding its memory limit.
173+
OOM_KILLED = 7;
174+
}
175+
153176
// Current number of replicas.
154177
uint32 current_replicas = 2 [(buf.validate.field).uint32.gte = 0];
155178

0 commit comments

Comments
 (0)