Skip to content

feat(SDK+backend): Add optional field for the secret/configmap as env vars #12216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Sep 12, 2025
Merged

feat(SDK+backend): Add optional field for the secret/configmap as env vars #12216

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e6e07ab
Add optional field for the secret/configmap as env vars
rimolive Dec 26, 2024
70fc60d
Add tests for the optional field for secret/configmap environment var…
DharmitD Sep 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 20 additions & 6 deletions backend/src/v2/driver/k8s.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,12 +316,19 @@ func extendPodSpecPatch(
// Get secret env information
for _, secretAsEnv := range kubernetesExecutorConfig.GetSecretAsEnv() {
for _, keyToEnv := range secretAsEnv.GetKeyToEnv() {
secretKeySelector := &k8score.SecretKeySelector{
Key: keyToEnv.GetSecretKey(),
}

// Set Optional field when explicitly provided (true or false), leave nil when not specified
if secretAsEnv.Optional != nil {
secretKeySelector.Optional = secretAsEnv.Optional
}
Comment on lines +324 to +326
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you add a unit test for this codepath?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, added tests here.


secretEnvVar := k8score.EnvVar{
Name: keyToEnv.GetEnvVar(),
ValueFrom: &k8score.EnvVarSource{
SecretKeyRef: &k8score.SecretKeySelector{
Key: keyToEnv.GetSecretKey(),
},
SecretKeyRef: secretKeySelector,
},
}

Expand Down Expand Up @@ -399,12 +406,19 @@ func extendPodSpecPatch(
// Get config map env information
for _, configMapAsEnv := range kubernetesExecutorConfig.GetConfigMapAsEnv() {
for _, keyToEnv := range configMapAsEnv.GetKeyToEnv() {
configMapKeySelector := &k8score.ConfigMapKeySelector{
Key: keyToEnv.GetConfigMapKey(),
}

// Set Optional field when explicitly provided (true or false), leave nil when not specified
if configMapAsEnv.Optional != nil {
configMapKeySelector.Optional = configMapAsEnv.Optional
}

configMapEnvVar := k8score.EnvVar{
Name: keyToEnv.GetEnvVar(),
ValueFrom: &k8score.EnvVarSource{
ConfigMapKeyRef: &k8score.ConfigMapKeySelector{
Key: keyToEnv.GetConfigMapKey(),
},
ConfigMapKeyRef: configMapKeySelector,
},
}

Expand Down
176 changes: 176 additions & 0 deletions backend/src/v2/driver/k8s_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -602,6 +602,94 @@ func Test_extendPodSpecPatch_Secret(t *testing.T) {
"param_1": structpb.NewStringValue("secret-name"),
},
},
{
"Valid - secret as env with optional true",
&kubernetesplatform.KubernetesExecutorConfig{
SecretAsEnv: []*kubernetesplatform.SecretAsEnv{
{
SecretNameParameter: inputParamConstant("my-secret"),
KeyToEnv: []*kubernetesplatform.SecretAsEnv_SecretKeyToEnvMap{
{
SecretKey: "password",
EnvVar: "SECRET_VAR",
},
},
Optional: &[]bool{true}[0],
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
Env: []k8score.EnvVar{
{
Name: "SECRET_VAR",
ValueFrom: &k8score.EnvVarSource{
SecretKeyRef: &k8score.SecretKeySelector{
LocalObjectReference: k8score.LocalObjectReference{Name: "my-secret"},
Key: "password",
Optional: &[]bool{true}[0],
},
},
},
},
},
},
},
nil,
},
{
"Valid - secret as env with optional false",
&kubernetesplatform.KubernetesExecutorConfig{
SecretAsEnv: []*kubernetesplatform.SecretAsEnv{
{
SecretNameParameter: inputParamConstant("my-secret"),
KeyToEnv: []*kubernetesplatform.SecretAsEnv_SecretKeyToEnvMap{
{
SecretKey: "password",
EnvVar: "SECRET_VAR",
},
},
Optional: &[]bool{false}[0],
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
Env: []k8score.EnvVar{
{
Name: "SECRET_VAR",
ValueFrom: &k8score.EnvVarSource{
SecretKeyRef: &k8score.SecretKeySelector{
LocalObjectReference: k8score.LocalObjectReference{Name: "my-secret"},
Key: "password",
Optional: &[]bool{false}[0],
},
},
},
},
},
},
},
nil,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
Expand Down Expand Up @@ -1011,6 +1099,94 @@ func Test_extendPodSpecPatch_ConfigMap(t *testing.T) {
"param_1": structpb.NewStringValue("cm-name"),
},
},
{
"Valid - config map as env with optional true",
&kubernetesplatform.KubernetesExecutorConfig{
ConfigMapAsEnv: []*kubernetesplatform.ConfigMapAsEnv{
{
ConfigMapNameParameter: inputParamConstant("my-cm"),
KeyToEnv: []*kubernetesplatform.ConfigMapAsEnv_ConfigMapKeyToEnvMap{
{
ConfigMapKey: "foo",
EnvVar: "CONFIG_MAP_VAR",
},
},
Optional: &[]bool{true}[0],
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
Env: []k8score.EnvVar{
{
Name: "CONFIG_MAP_VAR",
ValueFrom: &k8score.EnvVarSource{
ConfigMapKeyRef: &k8score.ConfigMapKeySelector{
LocalObjectReference: k8score.LocalObjectReference{Name: "my-cm"},
Key: "foo",
Optional: &[]bool{true}[0],
},
},
},
},
},
},
},
nil,
},
{
"Valid - config map as env with optional false",
&kubernetesplatform.KubernetesExecutorConfig{
ConfigMapAsEnv: []*kubernetesplatform.ConfigMapAsEnv{
{
ConfigMapNameParameter: inputParamConstant("my-cm"),
KeyToEnv: []*kubernetesplatform.ConfigMapAsEnv_ConfigMapKeyToEnvMap{
{
ConfigMapKey: "foo",
EnvVar: "CONFIG_MAP_VAR",
},
},
Optional: &[]bool{false}[0],
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
},
},
},
&k8score.PodSpec{
Containers: []k8score.Container{
{
Name: "main",
Env: []k8score.EnvVar{
{
Name: "CONFIG_MAP_VAR",
ValueFrom: &k8score.EnvVarSource{
ConfigMapKeyRef: &k8score.ConfigMapKeySelector{
LocalObjectReference: k8score.LocalObjectReference{Name: "my-cm"},
Key: "foo",
Optional: &[]bool{false}[0],
},
},
},
},
},
},
},
nil,
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
Expand Down
40 changes: 32 additions & 8 deletions kubernetes_platform/go/kubernetesplatform/kubernetes_executor_config.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 4 additions & 0 deletions kubernetes_platform/proto/kubernetes_executor_config.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,8 @@ message SecretAsEnv {
}

repeated SecretKeyToEnvMap key_to_env = 2;
// An optional boolean value indicating whether the Secret must be defined.
optional bool optional = 3;

// Name of the Secret.
ml_pipelines.TaskInputsSpec.InputParameterSpec secret_name_parameter = 4;
Expand Down Expand Up @@ -176,6 +178,8 @@ message ConfigMapAsEnv {

// Name of the ConfigMap.
ml_pipelines.TaskInputsSpec.InputParameterSpec config_map_name_parameter = 3;
// An optional boolean value indicating whether the ConfigMap must be defined.
optional bool optional = 4;
}

message GenericEphemeralVolume {
Expand Down
4 changes: 3 additions & 1 deletion kubernetes_platform/python/kfp/kubernetes/config_map.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ def use_config_map_as_env(
task: PipelineTask,
config_map_name: Union[pipeline_channel.PipelineParameterChannel, str],
config_map_key_to_env: Dict[str, str],
optional: bool = False,
) -> PipelineTask:
"""Use a Kubernetes ConfigMap as an environment variable as described by the `Kubernetes documentation
https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/#define-container-environment-variables-using-configmap-data` _.
Expand All @@ -32,6 +33,7 @@ def use_config_map_as_env(
task: Pipeline task.
config_map_name: Name of the ConfigMap.
config_map_key_to_env: Dictionary of ConfigMap key to environment variable name. For example, ``{'foo': 'FOO'}`` sets the value of the ConfigMap's foo field to the environment variable ``FOO``.
optional: Optional field specifying whether the ConfigMap must be defined.

Returns:
Task object with updated ConfigMap configuration.
Expand All @@ -45,7 +47,7 @@ def use_config_map_as_env(
env_var=env_var,
) for config_map_key, env_var in config_map_key_to_env.items()
]
config_map_as_env = pb.ConfigMapAsEnv(key_to_env=key_to_env)
config_map_as_env = pb.ConfigMapAsEnv(key_to_env=key_to_env, optional=optional)

config_map_name_parameter = common.parse_k8s_parameter_input(config_map_name, task)
config_map_as_env.config_map_name_parameter.CopyFrom(config_map_name_parameter)
Expand Down
Loading
Loading