flytekit.clients.auth_helper

Directory

Classes

Methods

Variables

Methods

bootstrap_creds_from_server()

def bootstrap_creds_from_server(
    endpoint: str,
) -> grpc.ChannelCredentials

Retrieves the SSL cert from the remote and uses that. should be used only if insecure-skip-verify

get_authenticated_channel()

def get_authenticated_channel(
    cfg: flytekit.configuration.PlatformConfig,
) -> grpc.Channel

Returns a new channel for the given config that is authenticated

get_authenticator()

def get_authenticator(
    cfg: flytekit.configuration.PlatformConfig,
    cfg_store: flytekit.clients.auth.authenticator.ClientConfigStore,
) -> flytekit.clients.auth.authenticator.Authenticator

Returns a new authenticator based on the platform config.

Built-in auth types (PKCE, ClientSecret, ExternalCommand, DeviceFlow) are tried first. If auth_mode is a string that does not match any built-in type, the function falls back to entry-point discovery: any installed package can register an authenticator factory under the flytekit.auth entry point group and it will be loaded automatically.

get_channel()

def get_channel(
    cfg: flytekit.configuration.PlatformConfig,
    **kwargs,
) -> grpc.Channel

Creates a new grpc.Channel given a platformConfig. It is possible to pass additional options to the underlying channel. Examples for various options are as below

get_channel(cfg=PlatformConfig(...))

get_channel(cfg=PlatformConfig(...), options=..., compression=...)

get_channel(cfg=PlatformConfig(insecure=False,...), credentials=...)

Returns: grpc.Channel (secure / insecure)

get_proxy_authenticator()

def get_proxy_authenticator(
    cfg: flytekit.configuration.PlatformConfig,
) -> flytekit.clients.auth.authenticator.Authenticator

get_session()

def get_session(
    cfg: flytekit.configuration.PlatformConfig,
    **kwargs,
) -> requests.sessions.Session

Return a new session for the given platform config.

register_authenticator_plugin()

def register_authenticator_plugin(
    name: str,
    factory: typing.Callable[[ForwardRef('PlatformConfig'), flytekit.clients.auth.authenticator.ClientConfigStore], flytekit.clients.auth.authenticator.Authenticator],
)

Register an authenticator factory by name.

This is the primary registration mechanism and works in every environment (pip, Bazel, mono-repo vendoring, etc.). Entry-point discovery is attempted as a fallback when no explicit registration exists.

upgrade_channel_to_authenticated()

def upgrade_channel_to_authenticated(
    cfg: flytekit.configuration.PlatformConfig,
    in_channel: grpc.Channel,
) -> grpc.Channel

Given a grpc.Channel, preferably a secure channel, it returns a composed channel that uses Interceptor to perform an Oauth2.0 Auth flow

Returns: grpc.Channel. New composite channel

upgrade_channel_to_proxy_authenticated()

def upgrade_channel_to_proxy_authenticated(
    cfg: flytekit.configuration.PlatformConfig,
    in_channel: grpc.Channel,
) -> grpc.Channel

If activated in the platform config, given a grpc.Channel, preferably a secure channel, it returns a composed channel that uses Interceptor to perform authentication with a proxy in front of Flyte

Returns: grpc.Channel. New composite channel

upgrade_session_to_proxy_authenticated()

def upgrade_session_to_proxy_authenticated(
    cfg: flytekit.configuration.PlatformConfig,
    session: requests.sessions.Session,
) -> requests.sessions.Session

Given a requests.Session, it returns a new session that uses a custom HTTPAdapter to perform authentication with a proxy in front of Flyte

Returns: requests.Session. New session with custom HTTPAdapter mounted

wrap_exceptions_channel()

def wrap_exceptions_channel(
    cfg: flytekit.configuration.PlatformConfig,
    in_channel: grpc.Channel,
) -> grpc.Channel

Wraps the input channel with RetryExceptionWrapperInterceptor. This wrapper will cover all exceptions and raise Exception from the Family flytekit.exceptions

Returns: grpc.Channel

flytekit.clients.auth_helper.AuthenticationHTTPAdapter

A custom HTTPAdapter that adds authentication headers to requests of a session.

Parameters

class AuthenticationHTTPAdapter(
    authenticator,
    *args,
    **kwargs,
)

Methods

add_auth_header()

def add_auth_header(
    request,
)

Adds authentication headers to the request.

send()

def send(
    request,
    *args,
    **kwargs,
)

Sends the request with added authentication headers. If the response returns a 401 status code, refreshes the credentials and retries the request.

Returns: The response object.

flytekit.clients.auth_helper.RemoteClientConfigStore

This class implements the ClientConfigStore that is served by the Flyte Server, that implements AuthMetadataService

Parameters

class RemoteClientConfigStore(
    secure_channel: grpc.Channel,
)

Methods

get_client_config()

def get_client_config()

Retrieves the ClientConfig from the given grpc.Channel assuming AuthMetadataService is available