Skip to content

use kube-authkit for better k8s authentication#970

Merged
pawelpaszki merged 18 commits into
project-codeflare:mainfrom
szaher:use-authkit
Jan 29, 2026
Merged

use kube-authkit for better k8s authentication#970
pawelpaszki merged 18 commits into
project-codeflare:mainfrom
szaher:use-authkit

Conversation

@szaher

@szaher szaher commented Jan 7, 2026

Copy link
Copy Markdown
Contributor

Issue link

What changes have been made

Verification steps

Use the following python snippet to validate everything works with authkit

# Import pieces from codeflare-sdk and authkit
from codeflare_sdk import Cluster, ClusterConfiguration, TokenAuthentication, set_api_client
from kube_authkit import get_k8s_client, AuthConfig

token = "sha256~token"
server = "https://api.example.com:6443"

# Create authentication object for user permissions

auth_config = AuthConfig(k8s_api_host=server, token=token, verify_ssl=False)

api_client = get_k8s_client(config=auth_config)

# set the authenticated api client for codeflare sdk
set_api_client(api_client)

# Create and configure our cluster object
cluster = Cluster(ClusterConfiguration(
    name='ray-data-cpu',
    head_cpu_requests=1,
    head_cpu_limits=1,
    head_memory_requests=6,
    head_memory_limits=8,
    head_extended_resource_requests={'nvidia.com/gpu':0}, # For GPU enabled workloads 
    worker_extended_resource_requests={'nvidia.com/gpu':0},
    num_workers=1,
    worker_cpu_requests=1,
    worker_cpu_limits=1,
    worker_memory_requests=4,
    worker_memory_limits=6,
    # image="", # Optional Field 
    write_to_file=False, # When enabled Ray Cluster yaml files are written to $HOME/.codeflare/resources 
    # local_queue="local-queue-name" # Specify the local queue manually
))

# Bring up the cluster
cluster.apply()

# fetch cluster details 
cluster.details()

# delete the cluster
cluster.down()

Checks

  • I've made sure the tests are passing.
  • Testing Strategy
    • Unit tests
    • Manual tests
    • Testing is not required for this change

Signed-off-by: Saad Zaher <szaher@redhat.com>
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 7, 2026
szaher added 6 commits January 7, 2026 12:12
Signed-off-by: Saad Zaher <szaher@redhat.com>
Signed-off-by: Saad Zaher <szaher@redhat.com>
Signed-off-by: Saad Zaher <szaher@redhat.com>
Signed-off-by: Saad Zaher <szaher@redhat.com>
Signed-off-by: Saad Zaher <szaher@redhat.com>
Replace global no-op of kubeconfig loaders with targeted test-only mocks so tests that assert loader behavior can still patch them locally.
Add fake k8s clients (AuthenticationApi, CoreV1Api, CustomObjectsApi) implementing the methods used by unit tests (get_api_group, read_namespaced_secret, list_namespaced_custom_object, list_cluster_custom_object, get/create/delete_namespaced_custom_object, etc.).
Create minimal resource YAMLs under $HOME/.codeflare/resources and TLS files in a tmp CWD so tests do not raise FileNotFoundError.
Test-only change: no production code modified.

Signed-off-by: Saad Zaher <szaher@redhat.com>
@codecov

codecov Bot commented Jan 7, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 97.46835% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 95.96%. Comparing base (ac5ae0e) to head (ac4f7db).
⚠️ Report is 1 commits behind head on main.

Files with missing lines Patch % Lines
src/codeflare_sdk/ray/cluster/build_ray_cluster.py 71.42% 2 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #970      +/-   ##
==========================================
+ Coverage   95.91%   95.96%   +0.05%     
==========================================
  Files          22       23       +1     
  Lines        2130     2206      +76     
==========================================
+ Hits         2043     2117      +74     
- Misses         87       89       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@szaher szaher marked this pull request as ready for review January 7, 2026 17:10
Signed-off-by: Saad Zaher <szaher@redhat.com>
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 12, 2026
Signed-off-by: Saad Zaher <szaher@redhat.com>
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 12, 2026
Signed-off-by: Saad Zaher <szaher@redhat.com>
@szaher szaher removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 12, 2026
@szaher szaher changed the title [WIP] use kube-authkit for better k8s authentication use kube-authkit for better k8s authentication Jan 12, 2026
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 15, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 19, 2026

@kryanbeane kryanbeane left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Couple of nits but other than those lgtm. Haven't done a verification yet only code review

Comment thread src/codeflare_sdk/common/kubernetes_cluster/auth.py Outdated
Comment thread src/codeflare_sdk/common/kubernetes_cluster/auth.py
@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Jan 27, 2026
@openshift-ci

openshift-ci Bot commented Jan 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kryanbeane

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 27, 2026
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 27, 2026
@kryanbeane

Copy link
Copy Markdown
Contributor

holding for more reviews
/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 27, 2026
Signed-off-by: Saad Zaher <szaher@redhat.com>
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 28, 2026
@openshift-ci

openshift-ci Bot commented Jan 28, 2026

Copy link
Copy Markdown
Contributor

New changes are detected. LGTM label has been removed.

szaher and others added 3 commits January 28, 2026 13:38
Co-authored-by: Bryan Keane <bryankeane0@gmail.com>
Signed-off-by: Saad Zaher <szaher@redhat.com>
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 28, 2026
@pawelpaszki

Copy link
Copy Markdown
Contributor

I have verified the changes on non-byoidc cluster with provided steps from the description and executed e2e tests on byoidc and non-byoidc clusters (with additional changes for the e2e tests). all looks good

@pawelpaszki pawelpaszki merged commit dff72be into project-codeflare:main Jan 29, 2026
13 of 14 checks passed
@szaher szaher deleted the use-authkit branch January 29, 2026 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants