Skip to content

Commit 80d3912

Browse files
laurafitzgeraldopenshift-merge-bot[bot]
laurafitzgerald
authored and
openshift-merge-bot[bot]
committed
Migrate demo notebooks and docs to kube-authkit authentication
Replaces the deprecated TokenAuthentication / KubeConfigFileAuthentication pattern with kube-authkit across all 14 demo notebooks and the authentication.rst docs, as part of BYOIDC support (RHAISTRAT-942). Each notebook auth cell now offers three options, with token-based auth active by default: - Option 1 (commented): AuthConfig(method="auto") — auto-detect kubeconfig or in-cluster service account. Includes a note that workbench service accounts may lack Ray RBAC permissions (see RHOAIENG-46748). - Option 2 (active): AuthConfig(method="openshift", token=...) — recommended for RHOAI Workbenches using an oc whoami -t token. - Option 3 (commented): AuthConfig(method="oidc", ...) — for BYOIDC-enabled clusters using device flow. The two common lines (get_k8s_client / set_api_client) appear once at the bottom of the cell, shared across all options. CI workflows updated to strip the auth cell using the new kube-auheader rather than the old TokenAuthentication comment, so KinD-based notebook tests continue to run without explicit authentication. Relates to: RHOAIENG-26483, RHAISTRAT-942
1 parent 258cc0b commit 80d3912

17 files changed

Lines changed: 503 additions & 184 deletions

‎.github/workflows/guided_notebook_tests.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -104,9 +104,8 @@ jobs:
104104
run: |
105105
set -euo pipefail
106106
107-
# Remove login/logout cells, as KinD doesn't support authentication using token
108-
jq -r 'del(.cells[] | select(.source[] | contains("Create authentication object for user permissions")))' 0_basic_ray.ipynb > 0_basic_ray.ipynb.tmp && mv 0_basic_ray.ipynb.tmp 0_basic_ray.ipynb
109-
jq -r 'del(.cells[] | select(.source[] | contains("auth.logout()")))' 0_basic_ray.ipynb > 0_basic_ray.ipynb.tmp && mv 0_basic_ray.ipynb.tmp 0_basic_ray.ipynb
107+
# Remove auth cell, as KinD uses kubeconfig and doesn't need explicit authentication
108+
jq -r 'del(.cells[] | select(.source[] | contains("Authenticate to your Kubernetes/OpenShift cluster using kube-authkit")))' 0_basic_ray.ipynb > 0_basic_ray.ipynb.tmp && mv 0_basic_ray.ipynb.tmp 0_basic_ray.ipynb
110109
# Set explicit namespace as SDK need it (currently) to resolve local queues
111110
sed -i "s/head_memory_limits=8,/head_memory_limits=8, namespace='default',/" 0_basic_ray.ipynb
112111
# Disable dashboard check as KinD doesn't have HTTPRoute/Route configured

‎.github/workflows/ui_notebooks_test.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -138,9 +138,8 @@ jobs:
138138
139139
- name: Fix 3_widget_example.ipynb notebook for test
140140
run: |
141-
# Remove login/logout cells, as KinD doesn't support authentication using token
142-
jq -r 'del(.cells[] | select(.source[] | contains("Create authentication object for user permissions")))' 3_widget_example.ipynb > 3_widget_example.ipynb.tmp && mv 3_widget_example.ipynb.tmp 3_widget_example.ipynb
143-
jq -r 'del(.cells[] | select(.source[] | contains("auth.logout()")))' 3_widget_example.ipynb > 3_widget_example.ipynb.tmp && mv 3_widget_example.ipynb.tmp 3_widget_example.ipynb
141+
# Remove auth cell, as KinD uses kubeconfig and doesn't need explicit authentication
142+
jq -r 'del(.cells[] | select(.source[] | contains("Authenticate to your Kubernetes/OpenShift cluster using kube-authkit")))' 3_widget_example.ipynb > 3_widget_example.ipynb.tmp && mv 3_widget_example.ipynb.tmp 3_widget_example.ipynb
144143
# Set explicit namespace as SDK need it (currently) to resolve local queues
145144
sed -i "s|head_memory_limits=8,|head_memory_limits=8, namespace='default',|" 3_widget_example.ipynb
146145
sed -i "s|view_clusters()|view_clusters('default')|" 3_widget_example.ipynb

‎demo-notebooks/additional-demos/hf_interactive.ipynb‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,8 @@
4040
"outputs": [],
4141
"source": [
4242
"# Import pieces from codeflare-sdk\n",
43-
"from codeflare_sdk import Cluster, ClusterConfiguration, TokenAuthentication"
43+
"from codeflare_sdk import Cluster, ClusterConfiguration, set_api_client\n",
44+
"from kube_authkit import AuthConfig, get_k8s_client"
4445
]
4546
},
4647
{
@@ -50,15 +51,33 @@
5051
"metadata": {},
5152
"outputs": [],
5253
"source": [
53-
"# Create authentication object for user permissions\n",
54-
"# IF unused, SDK will automatically check for default kubeconfig, then in-cluster config\n",
55-
"# KubeConfigFileAuthentication can also be used to specify kubeconfig path manually\n",
56-
"auth = TokenAuthentication(\n",
57-
" token = \"XXXX\",\n",
58-
" server = \"XXXX\",\n",
59-
" skip_tls = False\n",
54+
"# Authenticate to your Kubernetes/OpenShift cluster using kube-authkit\n",
55+
"\n",
56+
"# Option 1: Auto-detect credentials (kubeconfig or in-cluster service account)\n",
57+
"# NOTE: In RHOAI Workbenches the workbench service account may not have Ray RBAC\n",
58+
"# permissions. Use Option 2 (token) unless your admin has granted SA permissions\n",
59+
"# (see RHOAIENG-46748). Auto-detect works if you have a local kubeconfig.\n",
60+
"# auth_config = AuthConfig(method=\"auto\")\n",
61+
"\n",
62+
"# Option 2 (Recommended for RHOAI Workbenches): Token-based authentication\n",
63+
"# Get your token with: oc whoami -t (or from the OpenShift console → Copy login command)\n",
64+
"auth_config = AuthConfig(\n",
65+
" method=\"openshift\",\n",
66+
" k8s_api_host=\"https://api.example.com:6443\",\n",
67+
" token=\"sha256~XXXXX\", # oc whoami -t\n",
6068
")\n",
61-
"auth.login()"
69+
"\n",
70+
"# Option 3: OIDC authentication (for BYOIDC-enabled clusters)\n",
71+
"# auth_config = AuthConfig(\n",
72+
"# method=\"oidc\",\n",
73+
"# k8s_api_host=\"https://api.example.com:6443\",\n",
74+
"# oidc_issuer=\"https://your-oidc-provider.com\",\n",
75+
"# client_id=\"your-client-id\",\n",
76+
"# use_device_flow=True, # Interactive device flow for notebook environments\n",
77+
"# )\n",
78+
"\n",
79+
"api_client = get_k8s_client(config=auth_config)\n",
80+
"set_api_client(api_client)"
6281
]
6382
},
6483
{
@@ -385,7 +404,7 @@
385404
"metadata": {},
386405
"outputs": [],
387406
"source": [
388-
"auth.logout()"
407+
"# No explicit logout needed - authentication is managed automatically by kube-authkit"
389408
]
390409
},
391410
{

‎demo-notebooks/additional-demos/local_interactive.ipynb‎

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@
1010
"outputs": [],
1111
"source": [
1212
"# Import pieces from codeflare-sdk\n",
13-
"from codeflare_sdk import Cluster, ClusterConfiguration, TokenAuthentication"
13+
"from codeflare_sdk import Cluster, ClusterConfiguration, set_api_client\n",
14+
"from kube_authkit import AuthConfig, get_k8s_client"
1415
]
1516
},
1617
{
@@ -20,13 +21,33 @@
2021
"metadata": {},
2122
"outputs": [],
2223
"source": [
23-
"# Create authentication object and log in to desired user account (if not already authenticated)\n",
24-
"auth = TokenAuthentication(\n",
25-
" token = \"XXXX\",\n",
26-
" server = \"XXXX\",\n",
27-
" skip_tls = False\n",
24+
"# Authenticate to your Kubernetes/OpenShift cluster using kube-authkit\n",
25+
"\n",
26+
"# Option 1: Auto-detect credentials (kubeconfig or in-cluster service account)\n",
27+
"# NOTE: In RHOAI Workbenches the workbench service account may not have Ray RBAC\n",
28+
"# permissions. Use Option 2 (token) unless your admin has granted SA permissions\n",
29+
"# (see RHOAIENG-46748). Auto-detect works if you have a local kubeconfig.\n",
30+
"# auth_config = AuthConfig(method=\"auto\")\n",
31+
"\n",
32+
"# Option 2 (Recommended for RHOAI Workbenches): Token-based authentication\n",
33+
"# Get your token with: oc whoami -t (or from the OpenShift console → Copy login command)\n",
34+
"auth_config = AuthConfig(\n",
35+
" method=\"openshift\",\n",
36+
" k8s_api_host=\"https://api.example.com:6443\",\n",
37+
" token=\"sha256~XXXXX\", # oc whoami -t\n",
2838
")\n",
29-
"auth.login()"
39+
"\n",
40+
"# Option 3: OIDC authentication (for BYOIDC-enabled clusters)\n",
41+
"# auth_config = AuthConfig(\n",
42+
"# method=\"oidc\",\n",
43+
"# k8s_api_host=\"https://api.example.com:6443\",\n",
44+
"# oidc_issuer=\"https://your-oidc-provider.com\",\n",
45+
"# client_id=\"your-client-id\",\n",
46+
"# use_device_flow=True, # Interactive device flow for notebook environments\n",
47+
"# )\n",
48+
"\n",
49+
"api_client = get_k8s_client(config=auth_config)\n",
50+
"set_api_client(api_client)"
3051
]
3152
},
3253
{

‎demo-notebooks/additional-demos/ray_job_client.ipynb‎

Lines changed: 32 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@
1414
"outputs": [],
1515
"source": [
1616
"# Import pieces from codeflare-sdk\n",
17-
"from codeflare_sdk import Cluster, ClusterConfiguration, TokenAuthentication, RayJobClient"
17+
"from codeflare_sdk import Cluster, ClusterConfiguration, RayJobClient, set_api_client\n",
18+
"from kube_authkit import AuthConfig, get_k8s_client"
1819
]
1920
},
2021
{
@@ -23,16 +24,36 @@
2324
"metadata": {},
2425
"outputs": [],
2526
"source": [
26-
"# Create authentication object for user permissions\n",
27-
"# IF unused, SDK will automatically check for default kubeconfig, then in-cluster config\n",
28-
"# KubeConfigFileAuthentication can also be used to specify kubeconfig path manually\n",
29-
"auth_token = \"XXXXX\" # The auth_token is used later for the RayJobClient\n",
30-
"auth = TokenAuthentication(\n",
31-
" token = auth_token,\n",
32-
" server = \"XXXXX\",\n",
33-
" skip_tls=False\n",
27+
"# Authenticate to your Kubernetes/OpenShift cluster using kube-authkit\n",
28+
"\n",
29+
"# Option 1: Auto-detect credentials (kubeconfig or in-cluster service account)\n",
30+
"# NOTE: In RHOAI Workbenches the workbench service account may not have Ray RBAC\n",
31+
"# permissions. Use Option 2 (token) unless your admin has granted SA permissions\n",
32+
"# (see RHOAIENG-46748). Auto-detect works if you have a local kubeconfig.\n",
33+
"# auth_config = AuthConfig(method=\"auto\")\n",
34+
"\n",
35+
"# Option 2 (Recommended for RHOAI Workbenches): Token-based authentication\n",
36+
"# Get your token with: oc whoami -t (or from the OpenShift console → Copy login command)\n",
37+
"# Note: auth_token is also used below as the bearer token for the RayJobClient\n",
38+
"auth_token = \"sha256~XXXXX\" # oc whoami -t\n",
39+
"auth_config = AuthConfig(\n",
40+
" method=\"openshift\",\n",
41+
" k8s_api_host=\"https://api.example.com:6443\",\n",
42+
" token=auth_token,\n",
3443
")\n",
35-
"auth.login()"
44+
"\n",
45+
"# Option 3: OIDC authentication (for BYOIDC-enabled clusters)\n",
46+
"# auth_config = AuthConfig(\n",
47+
"# method=\"oidc\",\n",
48+
"# k8s_api_host=\"https://api.example.com:6443\",\n",
49+
"# oidc_issuer=\"https://your-oidc-provider.com\",\n",
50+
"# client_id=\"your-client-id\",\n",
51+
"# use_device_flow=True,\n",
52+
"# )\n",
53+
"# auth_token = ... # Retrieve access token from your OIDC provider for RayJobClient\n",
54+
"\n",
55+
"api_client = get_k8s_client(config=auth_config)\n",
56+
"set_api_client(api_client)"
3657
]
3758
},
3859
{
@@ -273,7 +294,7 @@
273294
"metadata": {},
274295
"outputs": [],
275296
"source": [
276-
"auth.logout()"
297+
"# No explicit logout needed - authentication is managed automatically by kube-authkit"
277298
]
278299
}
279300
],

‎demo-notebooks/guided-demos/0_basic_ray.ipynb‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@
1919
"outputs": [],
2020
"source": [
2121
"# Import pieces from codeflare-sdk\n",
22-
"from codeflare_sdk import Cluster, ClusterConfiguration, TokenAuthentication"
22+
"from codeflare_sdk import Cluster, ClusterConfiguration, set_api_client\n",
23+
"from kube_authkit import AuthConfig, get_k8s_client"
2324
]
2425
},
2526
{
@@ -29,15 +30,33 @@
2930
"metadata": {},
3031
"outputs": [],
3132
"source": [
32-
"# Create authentication object for user permissions\n",
33-
"# IF unused, SDK will automatically check for default kubeconfig, then in-cluster config\n",
34-
"# KubeConfigFileAuthentication can also be used to specify kubeconfig path manually\n",
35-
"auth = TokenAuthentication(\n",
36-
" token = \"XXXXX\",\n",
37-
" server = \"XXXXX\",\n",
38-
" skip_tls=False\n",
33+
"# Authenticate to your Kubernetes/OpenShift cluster using kube-authkit\n",
34+
"\n",
35+
"# Option 1: Auto-detect credentials (kubeconfig or in-cluster service account)\n",
36+
"# NOTE: In RHOAI Workbenches the workbench service account may not have Ray RBAC\n",
37+
"# permissions. Use Option 2 (token) unless your admin has granted SA permissions\n",
38+
"# (see RHOAIENG-46748). Auto-detect works if you have a local kubeconfig.\n",
39+
"# auth_config = AuthConfig(method=\"auto\")\n",
40+
"\n",
41+
"# Option 2 (Recommended for RHOAI Workbenches): Token-based authentication\n",
42+
"# Get your token with: oc whoami -t (or from the OpenShift console → Copy login command)\n",
43+
"auth_config = AuthConfig(\n",
44+
" method=\"openshift\",\n",
45+
" k8s_api_host=\"https://api.example.com:6443\",\n",
46+
" token=\"sha256~XXXXX\", # oc whoami -t\n",
3947
")\n",
40-
"auth.login()"
48+
"\n",
49+
"# Option 3: OIDC authentication (for BYOIDC-enabled clusters)\n",
50+
"# auth_config = AuthConfig(\n",
51+
"# method=\"oidc\",\n",
52+
"# k8s_api_host=\"https://api.example.com:6443\",\n",
53+
"# oidc_issuer=\"https://your-oidc-provider.com\",\n",
54+
"# client_id=\"your-client-id\",\n",
55+
"# use_device_flow=True, # Interactive device flow for notebook environments\n",
56+
"# )\n",
57+
"\n",
58+
"api_client = get_k8s_client(config=auth_config)\n",
59+
"set_api_client(api_client)"
4160
]
4261
},
4362
{
@@ -183,7 +202,7 @@
183202
"metadata": {},
184203
"outputs": [],
185204
"source": [
186-
"auth.logout()"
205+
"# No explicit logout needed - authentication is managed automatically by kube-authkit"
187206
]
188207
}
189208
],

‎demo-notebooks/guided-demos/1_cluster_job_client.ipynb‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@
1414
"outputs": [],
1515
"source": [
1616
"# Import pieces from codeflare-sdk\n",
17-
"from codeflare_sdk import Cluster, ClusterConfiguration, TokenAuthentication"
17+
"from codeflare_sdk import Cluster, ClusterConfiguration, set_api_client\n",
18+
"from kube_authkit import AuthConfig, get_k8s_client"
1819
]
1920
},
2021
{
@@ -23,15 +24,33 @@
2324
"metadata": {},
2425
"outputs": [],
2526
"source": [
26-
"# Create authentication object for user permissions\n",
27-
"# IF unused, SDK will automatically check for default kubeconfig, then in-cluster config\n",
28-
"# KubeConfigFileAuthentication can also be used to specify kubeconfig path manually\n",
29-
"auth = TokenAuthentication(\n",
30-
" token = \"XXXXX\",\n",
31-
" server = \"XXXXX\",\n",
32-
" skip_tls=False\n",
27+
"# Authenticate to your Kubernetes/OpenShift cluster using kube-authkit\n",
28+
"\n",
29+
"# Option 1: Auto-detect credentials (kubeconfig or in-cluster service account)\n",
30+
"# NOTE: In RHOAI Workbenches the workbench service account may not have Ray RBAC\n",
31+
"# permissions. Use Option 2 (token) unless your admin has granted SA permissions\n",
32+
"# (see RHOAIENG-46748). Auto-detect works if you have a local kubeconfig.\n",
33+
"# auth_config = AuthConfig(method=\"auto\")\n",
34+
"\n",
35+
"# Option 2 (Recommended for RHOAI Workbenches): Token-based authentication\n",
36+
"# Get your token with: oc whoami -t (or from the OpenShift console → Copy login command)\n",
37+
"auth_config = AuthConfig(\n",
38+
" method=\"openshift\",\n",
39+
" k8s_api_host=\"https://api.example.com:6443\",\n",
40+
" token=\"sha256~XXXXX\", # oc whoami -t\n",
3341
")\n",
34-
"auth.login()"
42+
"\n",
43+
"# Option 3: OIDC authentication (for BYOIDC-enabled clusters)\n",
44+
"# auth_config = AuthConfig(\n",
45+
"# method=\"oidc\",\n",
46+
"# k8s_api_host=\"https://api.example.com:6443\",\n",
47+
"# oidc_issuer=\"https://your-oidc-provider.com\",\n",
48+
"# client_id=\"your-client-id\",\n",
49+
"# use_device_flow=True, # Interactive device flow for notebook environments\n",
50+
"# )\n",
51+
"\n",
52+
"api_client = get_k8s_client(config=auth_config)\n",
53+
"set_api_client(api_client)"
3554
]
3655
},
3756
{
@@ -223,7 +242,7 @@
223242
"metadata": {},
224243
"outputs": [],
225244
"source": [
226-
"auth.logout()"
245+
"# No explicit logout needed - authentication is managed automatically by kube-authkit"
227246
]
228247
}
229248
],

‎demo-notebooks/guided-demos/2_basic_interactive.ipynb‎

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@
1616
"outputs": [],
1717
"source": [
1818
"# Import pieces from codeflare-sdk\n",
19-
"from codeflare_sdk import Cluster, ClusterConfiguration, TokenAuthentication"
19+
"from codeflare_sdk import Cluster, ClusterConfiguration, set_api_client\n",
20+
"from kube_authkit import AuthConfig, get_k8s_client"
2021
]
2122
},
2223
{
@@ -26,15 +27,33 @@
2627
"metadata": {},
2728
"outputs": [],
2829
"source": [
29-
"# Create authentication object for user permissions\n",
30-
"# IF unused, SDK will automatically check for default kubeconfig, then in-cluster config\n",
31-
"# KubeConfigFileAuthentication can also be used to specify kubeconfig path manually\n",
32-
"auth = TokenAuthentication(\n",
33-
" token = \"XXXXX\",\n",
34-
" server = \"XXXXX\",\n",
35-
" skip_tls=False\n",
30+
"# Authenticate to your Kubernetes/OpenShift cluster using kube-authkit\n",
31+
"\n",
32+
"# Option 1: Auto-detect credentials (kubeconfig or in-cluster service account)\n",
33+
"# NOTE: In RHOAI Workbenches the workbench service account may not have Ray RBAC\n",
34+
"# permissions. Use Option 2 (token) unless your admin has granted SA permissions\n",
35+
"# (see RHOAIENG-46748). Auto-detect works if you have a local kubeconfig.\n",
36+
"# auth_config = AuthConfig(method=\"auto\")\n",
37+
"\n",
38+
"# Option 2 (Recommended for RHOAI Workbenches): Token-based authentication\n",
39+
"# Get your token with: oc whoami -t (or from the OpenShift console → Copy login command)\n",
40+
"auth_config = AuthConfig(\n",
41+
" method=\"openshift\",\n",
42+
" k8s_api_host=\"https://api.example.com:6443\",\n",
43+
" token=\"sha256~XXXXX\", # oc whoami -t\n",
3644
")\n",
37-
"auth.login()"
45+
"\n",
46+
"# Option 3: OIDC authentication (for BYOIDC-enabled clusters)\n",
47+
"# auth_config = AuthConfig(\n",
48+
"# method=\"oidc\",\n",
49+
"# k8s_api_host=\"https://api.example.com:6443\",\n",
50+
"# oidc_issuer=\"https://your-oidc-provider.com\",\n",
51+
"# client_id=\"your-client-id\",\n",
52+
"# use_device_flow=True, # Interactive device flow for notebook environments\n",
53+
"# )\n",
54+
"\n",
55+
"api_client = get_k8s_client(config=auth_config)\n",
56+
"set_api_client(api_client)"
3857
]
3958
},
4059
{
@@ -317,7 +336,7 @@
317336
"metadata": {},
318337
"outputs": [],
319338
"source": [
320-
"auth.logout()"
339+
"# No explicit logout needed - authentication is managed automatically by kube-authkit"
321340
]
322341
}
323342
],

0 commit comments

Comments
 (0)