feat: add authentication headers when proxying pipeline websocket requests #1457
Conversation
rapsealk
added
type:feature
feature.md -> 1457.feature.md
rapsealk
changed the title
X-BackendAI-SessionID and X-BackendAI-SSO headers to the pipeline websocket proxy handler
rapsealk
changed the title
X-BackendAI-SessionID and X-BackendAI-SSO headers to the pipeline websocket proxy handlerX-BackendAI-SessionID and X-BackendAI-SSO headers to the pipeline websocket proxy handler
src/ai/backend/web/proxy.py
Outdated
| aiohttp_session = request.cookies.get("AIOHTTP_SESSION") | ||
| if not (sso_token := request.headers.get("X-BackendAI-SSO")): | ||
| jwt_secret = request.app["config"]["pipeline"]["jwt"]["secret"] | ||
| now = datetime.now(tz=timezone(timedelta(hours=9))) |
There was a problem hiding this comment.
What does that timedelta(hours=9) mean??
Does it mean that this will be expired in 9 hours or something else?
There was a problem hiding this comment.
This is to set the timezone to KST(UTC+09:00).
There was a problem hiding this comment.
where is the counterpart of this? which component uses this jwt token?
There was a problem hiding this comment.
The token is for external services, such as the pipeline service. (https://github.com/lablup/backend.ai-fasttrack/blob/7b3832163a7fe0debd2c5c0c88614aa6b1c3cf28/config/asgi.py#L61-L86)
src/ai/backend/web/proxy.py
Outdated
| aiohttp_session = request.cookies.get("AIOHTTP_SESSION") | ||
| if not (sso_token := request.headers.get("X-BackendAI-SSO")): | ||
| jwt_secret = request.app["config"]["pipeline"]["jwt"]["secret"] | ||
| now = datetime.now(tz=timezone(timedelta(hours=9))) |
There was a problem hiding this comment.
As Backend.AI is not only served on countries with KST (yes, we are international!) it is a bad idea to hardcode the timezone like this. When adding .astimezone() to the end of now() call automatically detects time timezone set on host machine and updates the datetime object (ref), let's update this code to adapt these behavior.
github-actions
bot
added
comp:manager
src/ai/backend/web/config.py
Outdated
| t.Key("jwt"): t.Dict( | ||
| { | ||
| t.Key("secret"): t.String, | ||
| }, | ||
| ), | ||
| }, |
There was a problem hiding this comment.
If I am guessing correctly, this jwt directive is for the traffics from FastTrack. FastTrack is a private project and thus only limited number of users who operate Backend.AI webserver will be required to fill out this field. When taking account into this situation I don't think this whole pipeline configuration body should be a required config values. Please refactor the validator to either mark the pipeline configuration as an Optional value or at lease leave jwt as nullable and dynamically check its existence when the request actually comes from the FastTrack side.
kyujin-cho
changed the title
X-BackendAI-SessionID and X-BackendAI-SSO headers to the pipeline websocket proxy handler
|
Closing as support for WebSocket is not needed yet. |
This PR updates the websocket proxy handler for the pipeline service, in the same fashion as #1350, to support WebSocket-based GraphQL subscription.