Common Component: oidc-authservice

[rohank07]

Overview

EPIC: Kubeflow Upgrade Planning

Component	Local Manifests Path	Upstream	Initial Work
oidc-authservice	common/oidc-authservice	v1.3.1

Adjustments

• Configmap which stores all of the OIDC secrets
• The EnvoyFilter with slight customizations to the auth request
• Our custom image of the oidc-authservice and image pull secrets

Kubeflow V2 Manifests

The following is the kustomize that was used in Kubeflow V2:

• https://github.com/StatCan/aaw-kubeflow-manifests/tree/master/kustomize/oidc-authservice

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
patchesStrategicMerge:
- configmap.yaml
- envoy-filter.yaml
- statefulset.yaml
resources:
- ../../.cache/manifests/manifests-1.2-branch/stacks/azure/application/oidc-authservice

AAW Dev / Prod Live Manifests

At the moment there is no difference in state then what is overridden above.

Note: While most everything 95% would have been automated, stored as config and is using what is referenced above. I believe a few things could have been done as manual adjustments that we should make sure we are keeping. Largely any manual yaml adjustments would have been documented in high level GitHub issues or tracked in the YAML repository under the AAW group.

Kubeflow V3 Manifests

The following is the P.R. that will be merged into the main branch for Kubeflow V3:

• feat(component): Add common component oidc-authservice #129

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- github.com/kubeflow/manifests/common/oidc-authservice/base?ref=v1.3.1

patchesStrategicMerge:
- configmap.yaml
- envoy-filter.yaml
- statefulset.yaml

Testing

Usually a good idea to make sure all of the overrides are working is to run the following command and verify all of the yaml output for the component is what you expect and all of the overrides are taken into account.

• The oidc-authservice configmap (oidc-authservice-parameters) has been modified correctly
• The oidc-authservice enovy-filter has been modified correctly
• The oidc-authservice statefulset (image, envar, imagepullSecrets) has been modified correctly

task stack:aaw:preview

Note: The command above will render all of the manifests into manifests top level folder with the name aaw.yaml. A trick to keep the yaml output small is under stacks/aaw/kustomization.yaml to only have the component you wish to test referenced.