feat: optional OAuth auth for the remote executor worker#81
Draft
max-datahub wants to merge 2 commits into
Draft
feat: optional OAuth auth for the remote executor worker#81max-datahub wants to merge 2 commits into
max-datahub wants to merge 2 commits into
Conversation
… PAT)
- Wrap DATAHUB_GMS_TOKEN env in an if-guard so pods start without the
PAT secret when global.datahub.gms.secretRef is set to "".
- Add global.datahub.auth.{type,tokenFile,audience,azure,oidc} values
and render DATAHUB_AUTH_TYPE + provider-specific env vars in the
workload env block (k8s_oidc, azure_entra, oidc_client_credentials).
- Existing PAT deployments are byte-for-byte unchanged (secretRef still
defaults to datahub-access-token-secret).
The DATAHUB_GMS_TOKEN guard and the OAuth DATAHUB_AUTH_* block were independent, so leaving the default (non-empty) secretRef while also setting auth.type rendered both DATAHUB_GMS_TOKEN and DATAHUB_AUTH_TYPE, violating the token-XOR-auth contract (the SDK rejects both at once). Make auth.type the dominant switch: the PAT env now renders only when a secretRef is set AND no OAuth auth.type is configured.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds optional OAuth authentication to the remote executor worker chart, the companion to the executor-side OAuth work.
DATAHUB_GMS_TOKENis now rendered conditionally — only when a PAT secret is configured and no OAuthauth.typeis set (soauth.typeis the dominant switch and PAT/OAuth can never both render).global.datahub.auth.*values render theDATAHUB_AUTH_*env vars fork8s_oidc/azure_entra/oidc_client_credentials.extraEnvs/extraEnvsFrom(ConfigMap) /extraVolumes/serviceAccount.annotationsextension points — no plaintext secret values in chart values.Backward compatibility
Fully preserved. The default
secretRefis unchanged, so an existing PAT install rendersDATAHUB_GMS_TOKENexactly as before;auth.typedoes nothing until the executor image that consumes it ships. OAuth-only users setsecretRef: ""and anauth.type.Verification
helm lintclean;helm templateconfirmed across four modes — default (PAT only),k8s_oidc,azure_entra,oidc_client_credentials— and the dual-set regression (default secretRef +auth.type) renders the auth env and noDATAHUB_GMS_TOKEN.Why Draft
Pairs with the executor OAuth PR in
datahub-fork; holding until that lands.🤖 Generated with Claude Code