Improve visualization server docker image #2003
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…rd_party_licenses.csv
|
/assign @IronPan @neuromage |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: IronPan The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
magdalenakuhn17
pushed a commit
to magdalenakuhn17/pipelines
that referenced
this pull request
Oct 22, 2023
) Until now KServe was using the global HTTP endpoint for S3 by default unless the user explicitly provides it with the corresponding annotation. If one wants to use IAM roles for service accounts instead of Secrets with HMAC credentials, storage-initializer will fail in case: * the bucket is configured with SSE * if the bucket allows HTTPS requests only * of an airgapped environment Specifically, if the bucket is configured with SSE it fails with: botocore.exceptions.ClientError: An error occurred (InvalidArgument) when calling the GetObject operation: Requests specifying Server Side Encryption with AWS KMS managed keys must be made over a secure connection. If the bucket policy allows HTTPS requests only it fails with: botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied In case of an airgapped environment, S3 is only available via the regional VPC endpoint so requests to the global endpoint will hang. Handle the above cases by letting boto3 decide the S3 endpoint based on the environment. In case of IRSA, AWS will set AWS_REGION and AWS_DEFAULT_REGION and as such boto3 will use the regional endpoint. boto3 will use HTTPS by default which is inline with the default value of s3-usehttps annotation. Finally, if the bucket is in different region boto3 will be automatically redirected there. This change should not break existing deployments that don't use IRSA but don't set s3-endpoint either; boto3 will default using the global HTTPS endpoint, https://s3.amazonaws.com. Handle also the case where endpoint_url is unset or empty, where boto3 fails with: ValueError: Invalid endpoint: With this commit, one can use service accounts with the `eks.amazonaws.com/role-arn` and `eks.amazonaws.com/sts-regional-endpoints` annotations directly without the need of an attached secret. Refs kubeflow#2003 Refs kubeflow#2113 Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com> Signed-off-by: Dimitris Aragiorgis <dimara@arrikto.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Implemented better caching, switched base image, and reduced image size.
This change is