Kubeflow Runner/BaseComponent dont force inject GCP credentials/secret into pods

[rummens]

Description

As many people we don’t deploy Kubeflow on GCP, therefore we don’t need/have GCP cred. Unfortunately the GCP env vars and more annoyingly the secret is hardcoded into the BaseComponent. Therefore no component pod can be started without the required secret (named user-gcp-sa per default).

Possible Solution

Please make this mount optionally, controlled via an option given to the runner.
This can go in hand with a better documentation of the additional arguments of the Pipeline class.
A possible solution is to create an overall platform parameter, similar to the solution in the Pipelines example:

The relevant code is around line 124 in tfx.orchestration.kubeflow.base_component. I am happy to assist if needed.

Workaround

Deploy a fake secret:

apiVersion: v1
kind: Secret
metadata:
  name: user-gcp-sa
type: Opaque
data:
  user-gcp-sa.json: YXBpVXJsOiAiaHR0cHM6Ly9teS5hcGkuY29tL2FwaS92MSIKdXNlcm5hbWU6IHt7dXNlcm5hbWV9fQpwYXNzd29yZDoge3twYXNzd29yZH19

[neuromage]

We'll make this optional. I'll send out a fix shortly.