[Secrets] Remove labels param when reading secret in store_secrets() [feature/ig4-authentication] #8796

elbamit · 2025-10-29T13:31:22Z

📝 Description

As part of #8484, read_secret() was refactored to (optionally) check for a label in the k8s secret. This is needed for IG4's secret tokens.
However, the labels parameter is not needed in store_secrets function (k8s.py).

When running a workflow, the secret is initially created in k8s with the label mlrun/username:admin (for the admin user). However, when resolving KFP secret environment variables to k8s secrets, store_secrets is called with the label mlrun/username:MLRUN_AUTH_SESSION. Using this label with read_secret results in None being returned instead of the actual secret.

🛠️ Changes Made

Remove label param when calling read_secret in store_secrets

✅ Checklist

I updated the documentation (if applicable)
I have tested the changes in this PR
I confirmed whether my changes are covered by system tests
- If yes, I ran all relevant system tests and ensured they passed before submitting this PR
- I updated existing system tests and/or added new ones if needed to cover my changes
If I introduced a deprecation:
- I followed the Deprecation Guidelines
- I updated the relevant Jira ticket for documentation

🧪 Testing

Regression test that was failing now works when run manually

🔗 References

Ticket link: https://iguazio.atlassian.net/browse/ML-11330
Design docs links:
External links:

🚨 Breaking Changes?

Yes (explain below)
No

🔍️ Additional Notes

liranbg · 2025-10-29T14:16:09Z

server/py/services/api/tests/unit/utils/singletons/test_k8s_utils.py



+# Labels param in read_secret should be used only with IG4 secrets
+def test_store_secrets_does_not_pass_labels_to_read_secret(k8s_helper):


move comment to test func doc so we can see it nicely on test output when it fails
"Test ensures that ..."

Yacouby

Few suggestions to improve readability.

Yacouby · 2025-10-29T18:24:57Z

server/py/services/api/tests/unit/utils/singletons/test_k8s_utils.py

+    for call in k8s_helper.read_secret.call_args_list:
+        assert "labels" not in call.kwargs


can be simplified with a direct call argument assertion:

Suggested change

for call in k8s_helper.read_secret.call_args_list:

assert "labels" not in call.kwargs

k8s_helper.read_secret.assert_called_once_with(secret_name="my-secret", namespace="default")

Yacouby · 2025-10-29T18:29:59Z

server/py/services/api/tests/unit/utils/singletons/test_k8s_utils.py



+
+def test_store_secrets_does_not_pass_labels_to_read_secret(k8s_helper):


test name too long. if you write in the comment of the test what it does, then IMO it can be shortened, something like:

Suggested change

def test_store_secrets_does_not_pass_labels_to_read_secret(k8s_helper):

def test_no_labels_in_read_secret(k8s_helper):

or test_store_secrets_ignores_labels

### 📝 Description   This PR introduces support for MLRun authentication with IG4. It rebases the `feature/ig4-authentication` branch onto `development` This PR includes the following PRs: 1. #8345 2. #8370 3. #8366 4. #8388 5. #8440 6. #8408 7. #8466 8. #8471 9. #8443 10. #8484 11. #8498 12. #8574 13. #8529 14. #8584 15. #8588 16. #8589 17. #8567 18. #8623 19. #8612 20. #8514 21. #8626 22. #8632 23. #8633 24. #8667 25. #8668 26. #8674 27. #8780 28. #8754 29. #8796 30. #8811 --- ### 🛠️ Changes Made  To enable IG4 project authorization, set the following configs in mlrun api: ``` MLRUN_HTTPDB__AUTHENTICATION__MODE: iguazio-v4 MLRUN_HTTPDB__AUTHENTICATION__IGUAZIO__SESSION_VERIFICATION_ENDPOINT: v1/identity/self MLRUN_IGUAZIO_API_URL: http://igz-api:8000 ``` Before importing MLRun, you must set: ``` MLRUN_AUTH_WITH_OAUTH_TOKEN__ENABLED=true MLRUN_AUTH_TOKEN_ENDPOINT="https://igz-api.<namespace>.<system-domain>/api/v1/refresh-access-token" ``` --- ### ✅ Checklist - [x] I updated the documentation (if applicable) - [x] I have tested the changes in this PR - [ ] If I introduced a deprecation: - [ ] I followed the [Deprecation Guidelines](./DEPRECATION.md) - [ ] I updated the relevant Jira ticket for documentation --- ### 🧪 Testing   Tested on IG4 system + unit tests --- ### 🔗 References - Ticket link: https://iguazio.atlassian.net/browse/ML-9683, https://iguazio.atlassian.net/browse/ML-9870, https://iguazio.atlassian.net/browse/ML-9998 - Design docs links: https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/399179866/Support+IG4+Authentication+in+MLRun+AuthVerifier+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/411960071/Support+sdk-side+IG4+authentication+-+token+usage+and+management+HLD, https://iguazio.atlassian.net/wiki/spaces/MLRUN/pages/404521061/BE+Secret+Token+Support+HLD, - External links: https://iguazio.atlassian.net/wiki/spaces/ARC/pages/361103361/MLRun+Secret+Tokens+in+IG4 --- ### 🚨 Breaking Changes? - [x] Yes (explain below) - [] No Removed unused API endpoints `- POST /api/v1/user-secrets` which was not in used --- ### 🔍️ Additional Notes How to enable IG4 authentication - https://iguazio.atlassian.net/wiki/spaces/PLAT/pages/457671097/Enable+IG4+Authentication+in+MLRun --------- Co-authored-by: Katerina Molchanova <35141662+rokatyy@users.noreply.github.com> Co-authored-by: Amit Elbaz <66309521+elbamit@users.noreply.github.com>

remove 'labels' param when reading secret in store_secrets()

256c8aa

github-actions bot added area/sdk area/server area/api area/framework area/tests area/system-tests area/ci labels Oct 29, 2025

elbamit changed the base branch from development to feature/ig4-authentication October 29, 2025 13:32

elbamit marked this pull request as ready for review October 29, 2025 13:32

elbamit requested review from a team and quaark as code owners October 29, 2025 13:32

elbamit changed the title ~~[Secrets] Remove labels param when reading secret in store_secrets()~~ [Secrets] Remove labels param when reading secret in store_secrets() [feature/ig4-authentication] Oct 29, 2025

moranbental approved these changes Oct 29, 2025

View reviewed changes

liranbg approved these changes Oct 29, 2025

View reviewed changes

Added test to ensure labels param is not added in store_secrets

b759321

liranbg reviewed Oct 29, 2025

View reviewed changes

Move comment to test func doc

85b053a

Yacouby requested changes Oct 29, 2025

View reviewed changes

liranbg approved these changes Oct 30, 2025

View reviewed changes

moranbental approved these changes Oct 30, 2025

View reviewed changes

Yacouby approved these changes Oct 30, 2025

View reviewed changes

elbamit requested review from a team and jillnogold as code owners October 30, 2025 08:34

github-actions bot added area/docs area/automation labels Oct 30, 2025

elbamit force-pushed the ML-11330 branch from f8f0116 to 85b053a Compare October 30, 2025 10:43

Change test name + assertion error message

c0c6a17

mlrun deleted a comment from review-notebook-app bot Oct 30, 2025

moranbental merged commit 4df2c4f into mlrun:feature/ig4-authentication Oct 30, 2025
34 of 35 checks passed

moranbental mentioned this pull request Oct 30, 2025

[Authentication] Allow authentication against IG4 #8724

Merged

6 tasks

elbamit deleted the ML-11330 branch December 18, 2025 09:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Secrets] Remove labels param when reading secret in store_secrets() [feature/ig4-authentication] #8796

[Secrets] Remove labels param when reading secret in store_secrets() [feature/ig4-authentication] #8796

Uh oh!

elbamit commented Oct 29, 2025 •

edited

Loading

Uh oh!

liranbg Oct 29, 2025

Uh oh!

Yacouby left a comment

Uh oh!

Yacouby Oct 29, 2025

Uh oh!

Yacouby Oct 29, 2025

Uh oh!

Yacouby Oct 29, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants



		# Labels param in read_secret should be used only with IG4 secrets
		def test_store_secrets_does_not_pass_labels_to_read_secret(k8s_helper):

		for call in k8s_helper.read_secret.call_args_list:
		assert "labels" not in call.kwargs

	for call in k8s_helper.read_secret.call_args_list:
	assert "labels" not in call.kwargs
	k8s_helper.read_secret.assert_called_once_with(secret_name="my-secret", namespace="default")

	def test_store_secrets_does_not_pass_labels_to_read_secret(k8s_helper):
	def test_no_labels_in_read_secret(k8s_helper):

[Secrets] Remove labels param when reading secret in store_secrets() [feature/ig4-authentication] #8796

[Secrets] Remove labels param when reading secret in store_secrets() [feature/ig4-authentication] #8796

Uh oh!

Conversation

elbamit commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description

🛠️ Changes Made

✅ Checklist

🧪 Testing

🔗 References

🚨 Breaking Changes?

🔍️ Additional Notes

Uh oh!

liranbg Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Yacouby left a comment

Choose a reason for hiding this comment

Uh oh!

Yacouby Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Yacouby Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Yacouby Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

elbamit commented Oct 29, 2025 •

edited

Loading