在 Kubeflow 管道中共享秘密

Question

我想与我的 Kubeflow 管道共享一些秘密，以便我可以将它们用作容器中的环境变量。我编写了一个 pipeline-secrets.yaml ，如下所示：

apiVersion: v1
kind: Secret
metadata:
  name: pipeline-secrets
  namespace: kubeflow
type: Opaque
data:
  mysql_db_name: <SECRET>
  mysql_username: <SECRET>
  mysql_password: <SECRET>
  mysql_endpoint: <SECRET>

和 pipeline-pod-defaults.yaml 如下所示：

apiVersion: kubeflow.org/v1alpha1
kind: PodDefault
metadata:
  name: pipeline-pod-defaults
  namespace: kubeflow
specs:
  desc: Configure pipeline secrets as environment variables
  env:
  - name: MYSQL_DB_NAME
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_db_name
  - name: MYSQL_USER_NAME
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_username
  - name: MYSQL_PASSWORD
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_password
  - name: MYSQL_ENDPOINT
    valueFrom:
      secretKeyRef:
        name: pepeline-secrets
        key: mysql_endpoint

这就是我的管道的样子：

import kfp
from kfp.dsl import ContainerOp
from kubernetes import client as k8s_client

@kfp.dsl.pipeline(
    name="Training pipeline",
    description=""
)
def train_pipeline():
    get_data = ContainerOp(
        name="Get data",
        image=BASE_IMAGE,
        file_outputs={
            'data': 'data.csv'
        }
    )
    
    kfp.dsl.get_pipeline_conf().set_image_pull_secrets([
        k8s_client.V1ObjectReference(name="regcred"),
        k8s_client.V1ObjectReference(name="pipeline-secrets"),
    ])
    kfp.dsl.ResourceOp(
        name="pipeline-pod-defaults",
        k8s_resource=k8s_client.V1ObjectReference(name="pipeline-pod-defaults"),
        action="apply"
    )

但最后我收到了这个错误：

This step is in Failed state with this message: error: error validating "/tmp/manifest.yaml": error validating data: [apiVersion not set, kind not set]; if you choose to ignore these errors, turn validation off with --validate=false

这是正确的方法吗？我如何与管道中的其他人分享我的秘密？抱歉，如果这是一个新手问题，我对 Kubernetes 和 Kubeflow 都是新手

Answer 1

现在原生支持使用 Kubernetes Secrets：

https://kfp-kubernetes.readthedocs.io/en/kfp-kubernetes-1.0.0/