import of cloud-endpoints component and support in iap-ingress component #605

danisla · 2018-04-06T18:18:20Z

Fixes #586

Import of cloud-endpoints CRD and controller. Depends on kube-metacontroller which is bundled with the component.
Updated iap-ingress component to create the CloudEndpoint resource if the FQDN matches the form of NAME.endpoints.PROJECT.cloud.goog
Updated the IAP doc with steps for using Cloud Endpoints.

/cc @kunmingg
/cc @ankushagarwal
/cc @jlewi

This change is

jlewi · 2018-04-06T18:28:03Z

Awesome thanks for the quick fix.

jlewi · 2018-04-06T18:29:59Z

/hold
/lgtm
/approve

/assign @ankushagarwal

Ankush any comments?

ankushagarwal · 2018-04-06T23:51:48Z

@danisla : When I tried this on a new k8s cluster, I get the following error from the cloud-endpoints-controller pod

Am I missing anything during the setup?

2018/04/06 23:36:49 [INFO] Fetching Project ID from Compute metadata API...
2018/04/06 23:36:49 [INFO] Fetching Numeric Project ID from Compute metadata API...
2018/04/06 23:36:49 [INFO] Instantiating GCE client...
2018/04/06 23:36:49 [INFO] Instantiating Google Cloud Service Management Client...
2018/04/06 23:36:49 [INFO] Initialized controller on port 80
2018/04/06 23:44:16 [DEBUG][kubeflow] Changed because parent sig different
2018/04/06 23:44:17 [INFO][kubeflow] Service does not yet exist, creating: kubeflow.endpoints.agwl-kubeflow.cloud.goog
2018/04/06 23:44:17 [ERROR] Could not sync state: [ERROR] Failed to creat Cloud Endpoints service: serviceName: kubeflow.endpoints.agwl-kubeflow.cloud.goog, err: googleapi: Error 403: Request had insufficient authentication scopes., forbidden
2018/04/06 23:44:18 [DEBUG][kubeflow] Changed because parent sig different
2018/04/06 23:44:18 [INFO][kubeflow] Service does not yet exist, creating: kubeflow.endpoints.agwl-kubeflow.cloud.goog
2018/04/06 23:44:18 [ERROR] Could not sync state: [ERROR] Failed to creat Cloud Endpoints service: serviceName: kubeflow.endpoints.agwl-kubeflow.cloud.goog, err: googleapi: Error 403: Request had insufficient authentication scopes., forbidden

ankushagarwal · 2018-04-06T23:54:27Z

Looks like I had not enabled Cloud Endpoints API. Just enabled it. Trying again.

ankushagarwal · 2018-04-07T00:11:27Z

Still getting the same error.

danisla · 2018-04-07T00:18:51Z

I just updated the docs with the API and cluster prerequisites.

You have to enable the APIs and create the GKE cluster with the cloud-platform scope.

gcloud container clusters create kubeflow \
  --scopes cloud-platform \
  --zone us-central1-b

jlewi · 2018-04-09T12:34:47Z

I don't think we should rely on the VM scope. That gives every pod cloud-platform scope.
Instead we should use a service account stored stored as a K8s secret.

Here are some gcloud commands for creating the service account.

jlewi · 2018-04-09T12:35:01Z

Is it possible for the CRD to check if cloud endpoints is enabled and if not enable it?

jlewi · 2018-04-13T18:10:50Z

@danisla Ping any chance we could get support for secrets?

danisla · 2018-04-13T18:12:36Z

Yes! I'm working on it now and should have the commit in today.

danisla · 2018-04-13T21:01:16Z

@jlewi ok updated component and docs to use a service account and secret for credentials.

jlewi · 2018-04-13T21:42:37Z

docs/gke/iap.md

+export FQDN="kubeflow.endpoints.$(gcloud config get-value project).cloud.goog"
+```
+
+Alternatively if you already have a DNS provider (e.g. Google Domains) create a type A custom resource record that associates the host you want e.g "kubeflow"


If we have our own domain then we don't need a cloud-endpoints component right?

Correct, I can separate those sections for clarity.

The IP reservation gcloud step is also optional if you are using cloud-endpoints since the endpoint is coupled to any dynamically provisioned Ingress IP. We would just have to make the annotation on the Ingress conditional on the presence of an IP name.

If both work lets document but if you have to reserve an IP I think that's fine. I think that's best practice anyway so that's what we'll probably recommend.

jlewi · 2018-04-13T21:44:34Z

kubeflow/core/prototypes/cloud-endpoints.jsonnet

+// @optionalParam secretKey string cloudep-sa.json Name of the key in the secret containing the JSON service account key.
+// @optionalParam namespace string null Namespace to use for the components. It is automatically inherited from the environment if not set.
+
+// TODO(https://github.com/ksonnet/ksonnet/issues/222): We have to add namespace as an explicit parameter


Delete this since the issue has been resolved you are inheriting namespace below.

ankushagarwal · 2018-04-16T21:46:15Z

/lgtm

jlewi · 2018-04-17T05:40:22Z

Test failure looks like a flake. There was a problem talking to the GitHub API while initializing the app

Get https://api.github.com/repos/ksonnet/parts/commits/master: dial tcp: lookup api.github.com on 10.39.240.10:53: read udp 10.36.10.19:54866->10.39.240.10:53: i/o timeout

jlewi · 2018-04-17T05:40:39Z

/test all
/approve

k8s-ci-robot · 2018-04-17T05:40:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ankushagarwal, jlewi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [ankushagarwal,jlewi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jlewi · 2018-04-17T05:41:07Z

/hold cancel

…ent (kubeflow#605) * import of cloud-endpoints component and support in iap-ingress component * removed namespace TODO from prototypes * update to IAP docs

* update metadata tag to v0.1.10 * fix test * rm cherry_pick_pull.sh

k8s-ci-robot requested review from ankushagarwal, jlewi and kunmingg April 6, 2018 18:18

k8s-ci-robot added the size/L label Apr 6, 2018

k8s-ci-robot assigned jlewi and ankushagarwal Apr 6, 2018

k8s-ci-robot added do-not-merge/hold lgtm approved labels Apr 6, 2018

k8s-ci-robot removed the lgtm label Apr 7, 2018

import of cloud-endpoints component and support in iap-ingress component

e2b9172

danisla force-pushed the import-cloud-endpoints branch from 30921b9 to e2b9172 Compare April 13, 2018 20:59

jlewi reviewed Apr 13, 2018

View reviewed changes

danisla added 2 commits April 13, 2018 15:15

removed namespace TODO from prototypes

96c50d9

update to IAP docs

64fa99d

k8s-ci-robot added the lgtm label Apr 16, 2018

k8s-ci-robot removed the do-not-merge/hold label Apr 17, 2018

k8s-ci-robot merged commit e5b911b into kubeflow:master Apr 17, 2018

yanniszark pushed a commit to arrikto/kubeflow that referenced this pull request Feb 15, 2021

Fine-grained docker image build. (kubeflow#605)

b9b179a

surajkota pushed a commit to surajkota/kubeflow that referenced this pull request Jun 13, 2022

Update metadata tag to v0.1.10 (kubeflow#605)

76cf7d4

* update metadata tag to v0.1.10 * fix test * rm cherry_pick_pull.sh

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

import of cloud-endpoints component and support in iap-ingress component #605

import of cloud-endpoints component and support in iap-ingress component #605

danisla commented Apr 6, 2018 •

edited by jlewi

jlewi commented Apr 6, 2018

jlewi commented Apr 6, 2018

ankushagarwal commented Apr 6, 2018

ankushagarwal commented Apr 6, 2018

ankushagarwal commented Apr 7, 2018

danisla commented Apr 7, 2018 •

edited

jlewi commented Apr 9, 2018

jlewi commented Apr 9, 2018

jlewi commented Apr 13, 2018

danisla commented Apr 13, 2018

danisla commented Apr 13, 2018

jlewi Apr 13, 2018

danisla Apr 13, 2018

danisla Apr 13, 2018

jlewi Apr 13, 2018

jlewi Apr 13, 2018

ankushagarwal commented Apr 16, 2018

jlewi commented Apr 17, 2018

jlewi commented Apr 17, 2018

k8s-ci-robot commented Apr 17, 2018

jlewi commented Apr 17, 2018

import of cloud-endpoints component and support in iap-ingress component #605

import of cloud-endpoints component and support in iap-ingress component #605

Conversation

danisla commented Apr 6, 2018 • edited by jlewi

jlewi commented Apr 6, 2018

jlewi commented Apr 6, 2018

ankushagarwal commented Apr 6, 2018

ankushagarwal commented Apr 6, 2018

ankushagarwal commented Apr 7, 2018

danisla commented Apr 7, 2018 • edited

jlewi commented Apr 9, 2018

jlewi commented Apr 9, 2018

jlewi commented Apr 13, 2018

danisla commented Apr 13, 2018

danisla commented Apr 13, 2018

jlewi Apr 13, 2018

Choose a reason for hiding this comment

danisla Apr 13, 2018

Choose a reason for hiding this comment

danisla Apr 13, 2018

Choose a reason for hiding this comment

jlewi Apr 13, 2018

Choose a reason for hiding this comment

jlewi Apr 13, 2018

Choose a reason for hiding this comment

ankushagarwal commented Apr 16, 2018

jlewi commented Apr 17, 2018

jlewi commented Apr 17, 2018

k8s-ci-robot commented Apr 17, 2018

jlewi commented Apr 17, 2018

danisla commented Apr 6, 2018 •

edited by jlewi

danisla commented Apr 7, 2018 •

edited