Misc fixes to flyte-binary helm chart (#3365)

* Misc fixes to flyte-binary helm chart Signed-off-by: Jeev B <[email protected]> * add example Signed-off-by: Yee Hing Tong <[email protected]> * Add rbac permissions to read podtemplates Signed-off-by: Jeev B <[email protected]> * Update flyte-binary chart in flyte-sandbox Signed-off-by: Jeev B <[email protected]> * make helm Signed-off-by: Jeev B <[email protected]> --------- Signed-off-by: Jeev B <[email protected]> Signed-off-by: Yee Hing Tong <[email protected]> Co-authored-by: Yee Hing Tong <[email protected]>
flyteorg · Feb 23, 2023 · 8edb125 · 8edb125
1 parent d60c9af
commit 8edb125
Show file tree

Hide file tree

Showing 10 changed files with 36 additions and 8 deletions.
diff --git a/charts/flyte-binary/README.md b/charts/flyte-binary/README.md
@@ -16,6 +16,7 @@ Chart for basic single Flyte executable deployment
 | commonAnnotations | object | `{}` |  |
 | commonLabels | object | `{}` |  |
 | configuration.annotations | object | `{}` |  |
+| configuration.auth.authorizedUris | list | `[]` |  |
 | configuration.auth.enabled | bool | `false` |  |
 | configuration.auth.internal.clientSecret | string | `""` |  |
 | configuration.auth.internal.clientSecretHash | string | `""` |  |

diff --git a/charts/flyte-binary/eks-production.yaml b/charts/flyte-binary/eks-production.yaml
@@ -27,6 +27,8 @@ configuration:
     internal:
       clientSecret: <CC_PASSWD>
       clientSecretHash: <HASHED_CC_PASSWD>
+    authorizedUris:
+    - https://flyte.company.com
   inline:
     cluster_resources:
       customData:

diff --git a/charts/flyte-binary/templates/clusterrole.yaml b/charts/flyte-binary/templates/clusterrole.yaml
@@ -52,6 +52,14 @@ rules:
     - delete
     - patch
     - update
+  - apiGroups:
+    - ""
+    resources:
+    - podtemplates
+    verbs:
+    - get
+    - list
+    - watch
   - apiGroups:
     - flyte.lyft.com
     resources:

diff --git a/charts/flyte-binary/templates/configmap.yaml b/charts/flyte-binary/templates/configmap.yaml
@@ -164,11 +164,10 @@ data:
             clientId: flytectl
             redirectUri: http://localhost:53593/callback
             scopes:
-            - offline
             - all
       authorizedUris:
-      {{- if .Values.ingress.host }}
-      - https://{{ tpl .Values.ingress.host . }}
+      {{- if .Values.configuration.auth.authorizedUris }}
+      {{- tpl ( .Values.configuration.auth.authorizedUris | toYaml ) . | nindent 6 }}
       {{- end }}
       - http://{{ include "flyte-binary.fullname" . }}:{{ include "flyte-binary.service.httpPort" . }}
       - http://{{ include "flyte-binary.fullname" . }}.{{ .Release.Namespace }}:{{ include "flyte-binary.service.httpPort" . }}

diff --git a/charts/flyte-binary/values.yaml b/charts/flyte-binary/values.yaml
@@ -94,6 +94,8 @@ configuration:
       clientSecret: ""
       # clientSecretHash Bcrypt hash of of clientSecret
       clientSecretHash: ""
+    # authorizedUris Set of URIs that clients are allowed to visit the service on
+    authorizedUris: []
   # externalConfigMap Specify an existing, external ConfigMap to use as configuration for Flyte
   # If set, no ConfigMap will be generated by this chart
   externalConfigMap: ""

diff --git a/charts/flyte-sandbox/Chart.lock b/charts/flyte-sandbox/Chart.lock
@@ -15,4 +15,4 @@ dependencies:
   repository: https://charts.bitnami.com/bitnami
   version: 12.1.9
 digest: sha256:e7155e540bbdb98f690eb12e2bd301a19d8b36833336f6991410cb44d8d9bb5e
-generated: "2023-01-24T21:51:30.908465-08:00"
+generated: "2023-02-22T21:45:07.411055-08:00"
diff --git a/charts/flyte-sandbox/charts/flyte-binary-v0.1.10.tgz b/charts/flyte-sandbox/charts/flyte-binary-v0.1.10.tgz
diff --git a/deployment/sandbox-binary/flyte_sandbox_binary_helm_generated.yaml b/deployment/sandbox-binary/flyte_sandbox_binary_helm_generated.yaml
@@ -160,6 +160,14 @@ rules:
     - delete
     - patch
     - update
+  - apiGroups:
+    - ""
+    resources:
+    - podtemplates
+    verbs:
+    - get
+    - list
+    - watch
   - apiGroups:
     - flyte.lyft.com
     resources:

diff --git a/docker/sandbox-bundled/manifests/complete.yaml b/docker/sandbox-bundled/manifests/complete.yaml
@@ -141,6 +141,14 @@ rules:
   - delete
   - patch
   - update
+- apiGroups:
+  - ""
+  resources:
+  - podtemplates
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - flyte.lyft.com
   resources:
@@ -750,7 +758,7 @@ type: Opaque
 ---
 apiVersion: v1
 data:
-  haSharedSecret: SUdJSnFtSFFLeVFYaXZOdg==
+  haSharedSecret: VnZiU0xIZjBLRVcxcjI0Zw==
   proxyPassword: ""
   proxyUsername: ""
 kind: Secret
@@ -1245,7 +1253,7 @@ spec:
     metadata:
       annotations:
         checksum/config: 8f50e768255a87f078ba8b9879a0c174c3e045ffb46ac8723d2eedbe293c8d81
-        checksum/secret: 7e8c8bcd08e450301a677b157c349f1d64b5b987ba0580368791b9c6d2cf245f
+        checksum/secret: 29be0ecfab0aea939a12ccb785931dedaccca4b6be7d3d38d925c4dc6487085e
       labels:
         app: docker-registry
         release: flyte-sandbox

diff --git a/docker/sandbox-bundled/manifests/dev.yaml b/docker/sandbox-bundled/manifests/dev.yaml
@@ -499,7 +499,7 @@ metadata:
 ---
 apiVersion: v1
 data:
-  haSharedSecret: QmRQWnc2VTdWUmdETWZuUQ==
+  haSharedSecret: dUtFcWNGbGpLSHFTSGJSMg==
   proxyPassword: ""
   proxyUsername: ""
 kind: Secret
@@ -875,7 +875,7 @@ spec:
     metadata:
       annotations:
         checksum/config: 8f50e768255a87f078ba8b9879a0c174c3e045ffb46ac8723d2eedbe293c8d81
-        checksum/secret: 5670b503299f0ece39519c285827758e4381c6637792b66fa394ca1cc3f6fa58
+        checksum/secret: f28d4e39d03147a771f800611c0bba800259f4596e6ea82b05b238df50f427c3
       labels:
         app: docker-registry
         release: flyte-sandbox