Question

I want to share some secrets with my Kubeflow pipeline so I can use them as environment variables in my containers. I ve written a pipeline-secrets.yaml that looks like this:

apiVersion: v1
kind: Secret
metadata:
  name: pipeline-secrets
  namespace: kubeflow
type: Opaque
data:
  mysql_db_name: <SECRET>
  mysql_username: <SECRET>
  mysql_password: <SECRET>
  mysql_endpoint: <SECRET>

和输油管系统。 looks:

apiVersion: kubeflow.org/v1alpha1
kind: PodDefault
metadata:
  name: pipeline-pod-defaults
  namespace: kubeflow
specs:
  desc: Configure pipeline secrets as environment variables
  env:
  - name: MYSQL_DB_NAME
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_db_name
  - name: MYSQL_USER_NAME
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_username
  - name: MYSQL_PASSWORD
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_password
  - name: MYSQL_ENDPOINT
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_endpoint

这正是我的管线如何看待:

import kfp
from kfp.dsl import ContainerOp
from kubernetes import client as k8s_client

@kfp.dsl.pipeline(
    name="Training pipeline",
    description=""
)
def train_pipeline():
    get_data = ContainerOp(
        name="Get data",
        image=BASE_IMAGE,
        file_outputs={
             data :  data.csv 
        }
    )
    
    kfp.dsl.get_pipeline_conf().set_image_pull_secrets([
        k8s_client.V1ObjectReference(name="regcred"),
        k8s_client.V1ObjectReference(name="pipeline-secrets"),
    ])
    kfp.dsl.ResourceOp(
        name="pipeline-pod-defaults",
        k8s_resource=k8s_client.V1ObjectReference(name="pipeline-pod-defaults"),
        action="apply"
    )

但最后,我发现这一错误:

This step is in Failed state with this message: error: error validating "/tmp/manifest.yaml": error validating data: [apiVersion not set, kind not set]; if you choose to ignore these errors, turn validation off with --validate=false

这种做法是否正确? 我怎么能够把我的秘密与其余管道分享? 如果出现新的比耶问题,Kubernetes和Kubeflow的Im

Answer 1

因此,最后,我写的是数据汇编。创建我的构成部分并撰写以下职能:

def build_get_data():
    component = kfp.components.load_component_from_file(os.path.join(COMPONENTS_PATH,  get-data-component.yaml ))()
    component.add_volume(k8s_client.V1Volume(
        name="get-data-volume",
        secret=k8s_client.V1SecretVolumeSource(secret_name="pipeline-secrets"))
    )
    envs = [
        ("MYSQL_DB_NAME", "mysql_db_name"),
        ("MYSQL_USER_NAME", "mysql_username"), 
        ("MYSQL_PASSWORD", "mysql_password"), 
        ("MYSQL_ENDPOINT", "mysql_endpoint")
    ]
    for name, key in envs:
        component.add_env_variable(
            V1EnvVar(
                name=name,
                value_from=k8s_client.V1EnvVarSource(secret_key_ref=k8s_client.V1SecretKeySelector(
                    name="pipeline-secrets",
                    key=key
                    )
                )
            )
        )
    return component

Answer 2

我不敢肯定什么是最佳办法,但我正在同一个名称空间制造一个秘密,在这一空间,管道将在分组内运行。然后,在牛顿的文字中,我执行以下法典。

config.load_incluster_config()
v1 = client.CoreV1Api()
sec = v1.read_namespaced_secret(<name of the secret>, <namespace you pick the secret from>).data

YOUR_SECRET_1 = base64.b64decode(sec.get(<name of the env variable >)).decode( utf-8 )
YOUR_SECRET_2 = base64.b64decode(sec.get(<name of the env variable >)).decode( utf-8 )

Answer 3

当地支持现在使用库韦涅特:

https://kfp-kubernetes.readthedocs.io/en/kfp-kubernetes-1.0.0/

友情链接