sdk/client/auth - refactor GCP auth into a module

[Bobgy]

There are many types of auth features in KFP SDK, they are injected kind of ad-hoc in code.

I think we need to refactor it into auth modules, so that

1. it's cleanly separated
2. it's easy for other providers to add auth modules

Another common proposal is to make the auth parameters explicit, right now we are doing the auth part automatically based on host url regex matching, but users may set up their own dns name. We should try to make it more controllable.

[yanniszark]

Hi @Bobgy! We find this issue interesting because we have actually implemented something like this for our purposes.
As you said, the current client is not extensible with regards to authentication methods, as authentication methods are hardcoded inside the client's __init__.

What we have done in our own fork of the KFP client, is to add a TokenCredentials class, which encapsulates the retrieval and refresh of token credentials. The existing token argument is not enough, because we need to be able to refresh the token as well.

To make this concrete, this is the abstract class we used:

class TokenCredentials(object):
    __metaclass__ = abc.ABCMeta

    def refresh_api_key_hook(self, config):
        """Refresh the api key.

        This is a helper function for registering token refresh with swagger
        generated clients.
        """
        config.api_key["authorization"] = self.get_token()

    @abc.abstractmethod
    def get_token(self):
        raise NotImplementedError()

It has a get_token function which is responsible for fetching and refreshing (if needed) a token for authentication.
In addition, it has a helper refresh_api_key_hook function, which is designed to be used together with swagger-generated clients like so:

# config is the swagger client config
credentials = MyCredentialClass()
config.refresh_api_key_hook = credentials.refresh_api_key_hook

Finally, add an extra argument to the client's __init__ to be able to pass credentials this way.

In the GCP example, you could implement different credential classes for different GCP auth methods (GCP ServiceAccount, Default App Credentials, IAP). What do you think?

[Bobgy]

Thanks @yanniszark! I think that sounds like a clean and abstract interface. Will you be willing to contribute?

/cc @chensun @numerology @Ark-kun
What do you think about this?

[yanniszark]

@Bobgy sure, we could open a PR for it.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because it has not had recent activity. Please comment "/reopen" to reopen it.