Always inject user identity as pod label if known

Signed-off-by: Fabio Graetz <[email protected]>
flyteorg · Jan 4, 2024 · 115c23d · 115c23d
1 parent a9652e8
commit 115c23d
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 32 deletions.
diff --git a/flytepropeller/pkg/controller/nodes/task/k8s/task_exec_context.go b/flytepropeller/pkg/controller/nodes/task/k8s/task_exec_context.go
@@ -3,7 +3,6 @@ package k8s
 import (
 	"github.com/flyteorg/flyte/flyteidl/gen/pb-go/flyteidl/core"
 	pluginsCore "github.com/flyteorg/flyte/flyteplugins/go/tasks/pluginmachinery/core"
-	"github.com/flyteorg/flyte/flyteplugins/go/tasks/pluginmachinery/flytek8s/config"
 	"github.com/flyteorg/flyte/flyteplugins/go/tasks/pluginmachinery/utils"
 	"github.com/flyteorg/flyte/flyteplugins/go/tasks/pluginmachinery/utils/secrets"
 )
@@ -45,7 +44,7 @@ func (t TaskExecutionMetadata) GetAnnotations() map[string]string {
 }
 
 // newTaskExecutionMetadata creates a TaskExecutionMetadata with secrets serialized as annotations and a label added
-// to trigger the flyte pod webhook. Optionally, the execution identity is injected as a label.
+// to trigger the flyte pod webhook. If known, the execution identity is injected as a label.
 func newTaskExecutionMetadata(tCtx pluginsCore.TaskExecutionMetadata, taskTmpl *core.TaskTemplate) (TaskExecutionMetadata, error) {
 	var err error
 	secretsMap := make(map[string]string)
@@ -59,11 +58,9 @@ func newTaskExecutionMetadata(tCtx pluginsCore.TaskExecutionMetadata, taskTmpl *
 		injectLabels[secrets.PodLabel] = secrets.PodLabelValue
 	}
 
-	if config.GetK8sPluginConfig().InjectExecutionIdentity {
-		id := tCtx.GetSecurityContext().RunAs.ExecutionIdentity
-		if id != "" {
-			injectLabels[executionIdentityVariable] = id
-		}
+	id := tCtx.GetSecurityContext().RunAs.ExecutionIdentity
+	if id != "" {
+		injectLabels[executionIdentityVariable] = id
 	}
 
 	return TaskExecutionMetadata{

diff --git a/flytepropeller/pkg/controller/nodes/task/k8s/task_exec_context_test.go b/flytepropeller/pkg/controller/nodes/task/k8s/task_exec_context_test.go
@@ -7,7 +7,6 @@ import (
 
 	"github.com/flyteorg/flyte/flyteidl/gen/pb-go/flyteidl/core"
 	"github.com/flyteorg/flyte/flyteplugins/go/tasks/pluginmachinery/core/mocks"
-	"github.com/flyteorg/flyte/flyteplugins/go/tasks/pluginmachinery/flytek8s/config"
 )
 
 func Test_newTaskExecutionMetadata(t *testing.T) {
@@ -67,7 +66,6 @@ func Test_newTaskExecutionMetadata(t *testing.T) {
 	})
 
 	t.Run("Inject exec identity", func(t *testing.T) {
-		assert.NoError(t, config.SetK8sPluginConfig(&config.K8sPluginConfig{InjectExecutionIdentity: true}))
 
 		existingMetadata := &mocks.TaskExecutionMetadata{}
 		existingAnnotations := map[string]string{}
@@ -87,29 +85,7 @@ func Test_newTaskExecutionMetadata(t *testing.T) {
 		assert.Equal(t, "test-exec-identity", actual.GetLabels()[executionIdentityVariable])
 	})
 
-	t.Run("No inject exec identity", func(t *testing.T) {
-		assert.NoError(t, config.SetK8sPluginConfig(&config.K8sPluginConfig{InjectExecutionIdentity: false}))
-
-		existingMetadata := &mocks.TaskExecutionMetadata{}
-		existingAnnotations := map[string]string{}
-		existingMetadata.OnGetAnnotations().Return(existingAnnotations)
-
-		existingMetadata.OnGetSecurityContext().Return(core.SecurityContext{RunAs: &core.Identity{ExecutionIdentity: "test-exec-identity"}})
-
-		existingLabels := map[string]string{
-			"existingLabel": "existingLabelValue",
-		}
-		existingMetadata.OnGetLabels().Return(existingLabels)
-
-		actual, err := newTaskExecutionMetadata(existingMetadata, &core.TaskTemplate{})
-		assert.NoError(t, err)
-
-		assert.Equal(t, 1, len(actual.GetLabels()))
-		assert.Equal(t, "existingLabelValue", actual.GetLabels()["existingLabel"])
-	})
-
-	t.Run("Inject non-existing exec identity", func(t *testing.T) {
-		assert.NoError(t, config.SetK8sPluginConfig(&config.K8sPluginConfig{InjectExecutionIdentity: true})) // configure to inject exec identity
+	t.Run("Empty exec identity", func(t *testing.T) {
 
 		existingMetadata := &mocks.TaskExecutionMetadata{}
 		existingAnnotations := map[string]string{}