mlrun 1.10.0rc39__tar.gz → 1.10.0rc40__tar.gz

{mlrun-1.10.0rc39/mlrun.egg-info → mlrun-1.10.0rc40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mlrun
-Version: 1.10.0rc39
+Version: 1.10.0rc40
 Summary: Tracking and config of machine learning runs
 Home-page: https://github.com/mlrun/mlrun
 Author: Yaron Haviv

{mlrun-1.10.0rc39 → mlrun-1.10.0rc40}/mlrun/common/secrets.py

@@ -11,18 +11,10 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-import re
+
 from abc import ABC, abstractmethod
 
 import mlrun.common.schemas
-from mlrun.config import config as mlconf
-
-_AUTH_SECRET_NAME_TEMPLATE = re.escape(
-    mlconf.secret_stores.kubernetes.auth_secret_name.format(
-        hashed_access_key="",
-    )
-)
-AUTH_SECRET_PATTERN = re.compile(f"^{_AUTH_SECRET_NAME_TEMPLATE}.*")
 
 
 class SecretProviderInterface(ABC):

{mlrun-1.10.0rc39 → mlrun-1.10.0rc40}/mlrun/model.py

@@ -29,7 +29,6 @@ import pydantic.v1.error_wrappers
 import mlrun
 import mlrun.common.constants as mlrun_constants
 import mlrun.common.schemas.notification
-import mlrun.common.secrets
 import mlrun.utils.regex
 
 from .utils import (
@@ -1617,14 +1616,7 @@ class RunTemplate(ModelObj):
 
         :returns: The RunTemplate object
         """
-        if kind == "azure_vault" and isinstance(source, dict):
-            candidate_secret_name = (source.get("k8s_secret") or "").strip()
-            if candidate_secret_name and mlrun.common.secrets.AUTH_SECRET_PATTERN.match(
-                candidate_secret_name
-            ):
-                raise mlrun.errors.MLRunInvalidArgumentError(
-                    f"Forbidden secret '{candidate_secret_name}' matches MLRun auth-secret pattern."
-                )
+
         if kind == "vault" and isinstance(source, list):
             source = {"project": self.metadata.project, "secrets": source}
 

{mlrun-1.10.0rc39 → mlrun-1.10.0rc40}/mlrun/projects/project.py

@@ -45,7 +45,6 @@ import mlrun.common.runtimes.constants
 import mlrun.common.schemas.alert
 import mlrun.common.schemas.artifact
 import mlrun.common.schemas.model_monitoring.constants as mm_constants
-import mlrun.common.secrets
 import mlrun.datastore.datastore_profile
 import mlrun.db
 import mlrun.errors
@@ -3419,12 +3418,7 @@ class MlrunProject(ModelObj):
         self._initialized = True
         return self.spec._function_objects
 
-    def with_secrets(
-        self,
-        kind,
-        source,
-        prefix="",
-    ):
+    def with_secrets(self, kind, source, prefix=""):
         """register a secrets source (file, env or dict)
 
         read secrets from a source provider to be used in workflows, example::
@@ -3446,21 +3440,12 @@ class MlrunProject(ModelObj):
 
         This will enable access to all secrets in vault registered to the current project.
 
-        :param kind:   secret type (file, inline, env, vault, azure_vault)
+        :param kind:   secret type (file, inline, env, vault)
         :param source: secret data or link (see example)
         :param prefix: add a prefix to the keys in this source
 
         :returns: project object
         """
-        # Block using mlrun-auth-secrets.* via azure_vault's k8s_secret param (client-side only)
-        if kind == "azure_vault" and isinstance(source, dict):
-            candidate_secret_name = (source.get("k8s_secret") or "").strip()
-            if candidate_secret_name and mlrun.common.secrets.AUTH_SECRET_PATTERN.match(
-                candidate_secret_name
-            ):
-                raise mlrun.errors.MLRunInvalidArgumentError(
-                    f"Forbidden secret '{candidate_secret_name}' matches MLRun auth-secret pattern."
-                )
 
         if kind == "vault" and isinstance(source, list):
             source = {"project": self.metadata.name, "secrets": source}

{mlrun-1.10.0rc39 → mlrun-1.10.0rc40}/mlrun/runtimes/mounts.py

@@ -17,8 +17,6 @@ import typing
 import warnings
 from collections import namedtuple
 
-import mlrun.common.secrets
-import mlrun.errors
 from mlrun.config import config
 from mlrun.config import config as mlconf
 from mlrun.errors import MLRunInvalidArgumentError
@@ -414,13 +412,6 @@ def mount_secret(
                          the specified paths, and unlisted keys will not be
                          present."""
 
-    if secret_name and mlrun.common.secrets.AUTH_SECRET_PATTERN.match(
-        secret_name.strip()
-    ):
-        raise mlrun.errors.MLRunInvalidArgumentError(
-            f"Forbidden secret '{secret_name}' matches MLRun auth-secret pattern."
-        )
-
     def _mount_secret(runtime: "KubeResource"):
         # Define the secret volume source
         secret_volume_source = {

{mlrun-1.10.0rc39 → mlrun-1.10.0rc40}/mlrun/runtimes/nuclio/serving.py

@@ -44,7 +44,6 @@ from mlrun.serving.states import (
 )
 from mlrun.utils import get_caller_globals, logger, set_paths
 
-from ...common.secrets import AUTH_SECRET_PATTERN
 from .. import KubejobRuntime
 from ..pod import KubeResourceSpec
 from .function import NuclioSpec, RemoteRuntime, min_nuclio_versions
@@ -636,14 +635,7 @@ class ServingRuntime(RemoteRuntime):
 
         :returns: The Runtime (function) object
         """
-        if kind == "azure_vault" and isinstance(source, dict):
-            candidate_secret_name = (source.get("k8s_secret") or "").strip()
-            if candidate_secret_name and AUTH_SECRET_PATTERN.match(
-                candidate_secret_name
-            ):
-                raise mlrun.errors.MLRunInvalidArgumentError(
-                    f"Forbidden secret '{candidate_secret_name}' matches MLRun auth-secret pattern."
-                )
+
         if kind == "vault" and isinstance(source, list):
             source = {"project": self.metadata.project, "secrets": source}
 

{mlrun-1.10.0rc39 → mlrun-1.10.0rc40}/mlrun/runtimes/pod.py

@@ -20,7 +20,6 @@ import typing
 import warnings
 from collections.abc import Iterable
 from enum import Enum
-from typing import Optional
 
 import dotenv
 import kubernetes.client as k8s_client
@@ -35,7 +34,6 @@ from mlrun.common.schemas import (
     SecurityContextEnrichmentModes,
 )
 
-from ..common.secrets import AUTH_SECRET_PATTERN
 from ..config import config as mlconf
 from ..k8s_utils import (
     generate_preemptible_nodes_affinity_terms,
@@ -710,44 +708,19 @@ class KubeResource(BaseRuntime):
     def spec(self, spec):
         self._spec = self._verify_dict(spec, "spec", KubeResourceSpec)
 
-    def set_env_from_secret(
-        self,
-        name: str,
-        secret: Optional[str] = None,
-        secret_key: Optional[str] = None,
-    ):
-        """Set env var from secret; block auth-secret usage on client side."""
-        self._validate_no_auth_secret(
-            secret_name=secret,
-        )
+    def set_env_from_secret(self, name, secret=None, secret_key=None):
+        """set pod environment var from secret"""
         secret_key = secret_key or name
         value_from = k8s_client.V1EnvVarSource(
-            secret_key_ref=k8s_client.V1SecretKeySelector(
-                name=secret,
-                key=secret_key,
-            )
-        )
-        return self._set_env(
-            name=name,
-            value_from=value_from,
+            secret_key_ref=k8s_client.V1SecretKeySelector(name=secret, key=secret_key)
         )
+        return self._set_env(name, value_from=value_from)
 
-    def set_env(
-        self,
-        name: str,
-        value: Optional[str] = None,
-        value_from: Optional[typing.Any] = None,
-    ):
-        """Set env var; block auth-secret usage when coming from a secret."""
-        if value_from is not None:
-            secret_name = self._extract_secret_name_from_value_from(
-                value_from=value_from,
-            )
-            self._validate_no_auth_secret(
-                secret_name=secret_name,
-            )
-            return self._set_env(name, value_from=value_from)
-        return self._set_env(name, value=str(value) if value is not None else None)
+    def set_env(self, name, value=None, value_from=None):
+        """set pod environment var from value"""
+        if value is not None:
+            return self._set_env(name, value=str(value))
+        return self._set_env(name, value_from=value_from)
 
     def with_annotations(self, annotations: dict):
         """set a key/value annotations in the metadata of the pod"""
@@ -1393,37 +1366,6 @@ class KubeResource(BaseRuntime):
 
         return self.status.state
 
-    @staticmethod
-    def _validate_no_auth_secret(
-        secret_name: Optional[str],
-    ):
-        """Raise if secret name matches MLRun auth-secret pattern."""
-        if secret_name and AUTH_SECRET_PATTERN.match(secret_name):
-            raise mlrun.errors.MLRunInvalidArgumentError(
-                f"Forbidden secret '{secret_name}' matches MLRun auth-secret pattern."
-            )
-
-    @staticmethod
-    def _extract_secret_name_from_value_from(
-        value_from: typing.Any,
-    ) -> Optional[str]:
-        """Extract secret name from a V1EnvVarSource or dict representation."""
-        if isinstance(value_from, k8s_client.V1EnvVarSource):
-            if value_from.secret_key_ref:
-                return value_from.secret_key_ref.name
-        elif isinstance(value_from, dict):
-            value_from = (
-                value_from.get("valueFrom")
-                or value_from.get("value_from")
-                or value_from
-            )
-            secret_key_ref = (value_from or {}).get("secretKeyRef") or (
-                value_from or {}
-            ).get("secret_key_ref")
-            if isinstance(secret_key_ref, dict):
-                return secret_key_ref.get("name")
-        return None
-
 
 def _resolve_if_type_sanitized(attribute_name, attribute):
     attribute_config = sanitized_attributes[attribute_name]

mlrun-1.10.0rc40/mlrun/utils/version/version.json

@@ -0,0 +1,4 @@
+{
+  "git_commit": "3bb8c631304e89739430fbb6e6299e190fe6738a",
+  "version": "1.10.0-rc40"
+}

{mlrun-1.10.0rc39 → mlrun-1.10.0rc40/mlrun.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mlrun
-Version: 1.10.0rc39
+Version: 1.10.0rc40
 Summary: Tracking and config of machine learning runs
 Home-page: https://github.com/mlrun/mlrun
 Author: Yaron Haviv

mlrun-1.10.0rc39/mlrun/utils/version/version.json

@@ -1,4 +0,0 @@
-{
-  "git_commit": "a8c2a4e78b2c7ad2c929bb0edce5d9db47c2baea",
-  "version": "1.10.0-rc39"
-}