Fix ml-pipeline-ui doesn't have gcp permission bug (kubeflow#594)

* Fix ml-pipeline-ui doesn't have gcp permission bug * Moved patch to gcp overlay * Regenerated tests
blublinsky · Nov 2, 2019 · eb328ec · eb328ec
1 parent 22d6b35
commit eb328ec
Show file tree

Hide file tree

Showing 19 changed files with 313 additions and 54 deletions.
diff --git a/kfdef/kfctl_gcp_basic_auth.yaml b/kfdef/kfctl_gcp_basic_auth.yaml
@@ -266,6 +266,7 @@ spec:
     name: pipelines-runner
   - kustomizeConfig:
       overlays:
+      - gcp
       - istio
       - application
       repoRef:

diff --git a/kfdef/kfctl_gcp_iap.yaml b/kfdef/kfctl_gcp_iap.yaml
@@ -276,6 +276,7 @@ spec:
     name: pipelines-runner
   - kustomizeConfig:
       overlays:
+      - gcp
       - istio
       - application
       repoRef:

diff --git a/pipeline/pipelines-ui/overlays/gcp/deployment.yaml b/pipeline/pipelines-ui/overlays/gcp/deployment.yaml
@@ -0,0 +1,20 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ml-pipeline-ui
+spec:
+  template:
+    spec:
+      volumes:
+      - name: gcp-sa-token
+        secret:
+          secretName: user-gcp-sa
+      containers:
+      - name: ml-pipeline-ui
+        env:
+        - name: GOOGLE_APPLICATION_CREDENTIALS
+          value: /etc/credentials/user-gcp-sa.json
+        volumeMounts:
+        - name: gcp-sa-token
+          mountPath: "/etc/credentials"
+          readOnly: true
diff --git a/pipeline/pipelines-ui/overlays/gcp/kustomization.yaml b/pipeline/pipelines-ui/overlays/gcp/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+bases:
+- ../../base
+patchesStrategicMerge:
+- deployment.yaml
diff --git a/tests/iap-ingress-base_test.go b/tests/iap-ingress-base_test.go
@@ -540,8 +540,7 @@ varReference:
 - path: data/healthcheck_route.yaml
   kind: ConfigMap
 - path: spec/domains
-  kind: ManagedCertificate
-`)
+  kind: ManagedCertificate`)
 	th.writeF("/manifests/gcp/iap-ingress/base/params.env", `
 namespace=kubeflow
 appName=kubeflow
@@ -553,8 +552,7 @@ oauthSecretName=kubeflow-oauth
 project=
 adminSaSecretName=admin-gcp-sa
 tlsSecretName=envoy-ingress-tls
-istioNamespace=istio-system
-`)
+istioNamespace=istio-system`)
 	th.writeK("/manifests/gcp/iap-ingress/base", `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

diff --git a/tests/iap-ingress-overlays-application_test.go b/tests/iap-ingress-overlays-application_test.go
@@ -588,8 +588,7 @@ varReference:
 - path: data/healthcheck_route.yaml
   kind: ConfigMap
 - path: spec/domains
-  kind: ManagedCertificate
-`)
+  kind: ManagedCertificate`)
 	th.writeF("/manifests/gcp/iap-ingress/base/params.env", `
 namespace=kubeflow
 appName=kubeflow
@@ -601,8 +600,7 @@ oauthSecretName=kubeflow-oauth
 project=
 adminSaSecretName=admin-gcp-sa
 tlsSecretName=envoy-ingress-tls
-istioNamespace=istio-system
-`)
+istioNamespace=istio-system`)
 	th.writeK("/manifests/gcp/iap-ingress/base", `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

diff --git a/tests/iap-ingress-overlays-certmanager_test.go b/tests/iap-ingress-overlays-certmanager_test.go
@@ -621,8 +621,7 @@ varReference:
 - path: data/healthcheck_route.yaml
   kind: ConfigMap
 - path: spec/domains
-  kind: ManagedCertificate
-`)
+  kind: ManagedCertificate`)
 	th.writeF("/manifests/gcp/iap-ingress/base/params.env", `
 namespace=kubeflow
 appName=kubeflow
@@ -634,8 +633,7 @@ oauthSecretName=kubeflow-oauth
 project=
 adminSaSecretName=admin-gcp-sa
 tlsSecretName=envoy-ingress-tls
-istioNamespace=istio-system
-`)
+istioNamespace=istio-system`)
 	th.writeK("/manifests/gcp/iap-ingress/base", `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

diff --git a/tests/iap-ingress-overlays-gcp-credentials_test.go b/tests/iap-ingress-overlays-gcp-credentials_test.go
@@ -595,8 +595,7 @@ varReference:
 - path: data/healthcheck_route.yaml
   kind: ConfigMap
 - path: spec/domains
-  kind: ManagedCertificate
-`)
+  kind: ManagedCertificate`)
 	th.writeF("/manifests/gcp/iap-ingress/base/params.env", `
 namespace=kubeflow
 appName=kubeflow
@@ -608,8 +607,7 @@ oauthSecretName=kubeflow-oauth
 project=
 adminSaSecretName=admin-gcp-sa
 tlsSecretName=envoy-ingress-tls
-istioNamespace=istio-system
-`)
+istioNamespace=istio-system`)
 	th.writeK("/manifests/gcp/iap-ingress/base", `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

diff --git a/tests/iap-ingress-overlays-managed-cert_test.go b/tests/iap-ingress-overlays-managed-cert_test.go
@@ -560,8 +560,7 @@ varReference:
 - path: data/healthcheck_route.yaml
   kind: ConfigMap
 - path: spec/domains
-  kind: ManagedCertificate
-`)
+  kind: ManagedCertificate`)
 	th.writeF("/manifests/gcp/iap-ingress/base/params.env", `
 namespace=kubeflow
 appName=kubeflow
@@ -573,8 +572,7 @@ oauthSecretName=kubeflow-oauth
 project=
 adminSaSecretName=admin-gcp-sa
 tlsSecretName=envoy-ingress-tls
-istioNamespace=istio-system
-`)
+istioNamespace=istio-system`)
 	th.writeK("/manifests/gcp/iap-ingress/base", `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

diff --git a/tests/istio-ingress-overlays-cognito_test.go b/tests/istio-ingress-overlays-cognito_test.go
@@ -31,14 +31,12 @@ metadata:
 	th.writeF("/manifests/aws/istio-ingress/overlays/cognito/params.yaml", `
 varReference:
 - path: metadata/annotations
-  kind: Ingress
-`)
+  kind: Ingress`)
 	th.writeF("/manifests/aws/istio-ingress/overlays/cognito/params.env", `
 CognitoUserPoolArn=
 CognitoAppClientId=
 CognitoUserPoolDomain=
-certArn=
-`)
+certArn=`)
 	th.writeK("/manifests/aws/istio-ingress/overlays/cognito", `
 bases:
 - ../../base

diff --git a/tests/istio-ingress-overlays-oidc_test.go b/tests/istio-ingress-overlays-oidc_test.go
@@ -40,8 +40,7 @@ oidcAuthorizationEndpoint=
 oidcTokenEndpoint=
 oidcUserInfoEndpoint=
 oidcSecretName=istio-oidc-secret
-certArn=
-`)
+certArn=`)
 	th.writeF("/manifests/aws/istio-ingress/overlays/oidc/secrets.env", `
 clientId=
 clientSecret=

diff --git a/tests/istio-overlays-https-gateway_test.go b/tests/istio-overlays-https-gateway_test.go
@@ -227,12 +227,10 @@ varReference:
 - path: spec/mode
   kind: ClusterRbacConfig
 - path: spec/selector
-  kind: Gateway
-`)
+  kind: Gateway`)
 	th.writeF("/manifests/istio/istio/base/params.env", `
 clusterRbacConfig=ON
-gatewaySelector=ingressgateway
-`)
+gatewaySelector=ingressgateway`)
 	th.writeK("/manifests/istio/istio/base", `
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization