Failed to call kfp.Client() in jupyter notebook

[rohank07]

Unable to call kfp.Client()

We would have to use access-ml-pipeline PodDefault (canonical/bundle-kubeflow#423)

apiVersion: kubeflow.org/v1alpha1
kind: PodDefault
metadata:
  name: access-ml-pipeline
  namespace: "<YOUR_USER_PROFILE_NAMESPACE>"
spec:
  desc: Allow access to Kubeflow Pipelines
  selector:
    matchLabels:
      access-ml-pipeline: "true"
  volumes:
    - name: volume-kf-pipeline-token
      projected:
        sources:
          - serviceAccountToken:
              path: token
              expirationSeconds: 7200
              audience: pipelines.kubeflow.org      
  volumeMounts:
    - mountPath: /var/run/secrets/kubeflow/pipelines
      name: volume-kf-pipeline-token
      readOnly: true
  env:
    - name: KF_PIPELINES_SA_TOKEN_PATH
      value: /var/run/secrets/kubeflow/pipelines/token

Using PodDefault https://www.kubeflow.org/docs/components/pipelines/sdk/connect-api/#multi-user-mode
Waiting for https://github.com/kubeflow/pipelines/pull/6629/files to be merged (pipelines-profile-controller needs PodDefault updates)

[sylus]

I got this to finally work the last thing we need to do is remove the EnvoyFilter logic we had for KF 1.2 which will fix us getting access denied in KF 1.3.

    - when:
        - key: 'request.headers[kubeflow-userid]'
          notValues:
            - '*'
  selector:
    matchLabels:
      app: ml-pipeline

https://github.com/StatCan/aaw-kubeflow-controller/blob/master/istio.go#L17

[rohank07]

        - key: 'request.headers[kubeflow-userid]'
          notValues:
            - '*'
  selector:
    matchLabels:
      app: ml-pipeline

What is this snippet from? Were there other modifications made to the manifests?

[sylus]

Its comes from kubeflow and we need to remove our personalized envoy filters which force add kubeflow-userid so it never passes RBAC.

https://github.com/kubeflow/pipelines/blob/74c7773ca40decfd0d4ed40dc93a6af591bbc190/manifests/kustomize/base/installs/multi-user/istio-authorization-config.yaml#L36

[sylus]

Performed the following steps:

a) Removed the legacy logic that breaks in KF 1.3

• StatCan/aaw-kubeflow-controller@8ba4b2e

b) Removed all the created envoyfilters of name "kubeflow-pipelines" in dev cluster

[zachomedia]

Cleanup in prod performed with the following command:

kubectl get all envoyfilter -o json | jq -r '.items[] | select(.metadata.name == "kubeflow-pipelines") | "kubectl -n \(.metadata.namespace) delete envoyfilter \(.metadata.name) --wait=false"' | xargs -n1 -d "\n" -- bash -c