Reducing GetPublicClientConfig API call For Pkce and ClientCredential by edwardsun-union · Pull Request #1105 · flyteorg/flyte-sdk

edwardsun-union · 2026-05-22T21:36:13Z

- Description

This PR is made as effort to reduce GetPublicClientConfig API call for Pkce and ClientCredential authType. Currently, this API is called unconditionally to extract metadata like scopes, authenticationHeader, redirectUri. To optimize the auth workflow, necessary metadata are added as static to client configuration so that GetPublicClientConfig became conditional call. Required changes also applied to flyte create config utility so that required auth fields are written for remote authentication.

- Testing

before change:

In local env, triggering flyte run task that will be execute in dogfood staging. Example test command below:
flyte -vvv -c ./.flyte/config.yaml run ./basics/types/int_collection.py main --numbers '[1,2,3,4,5,10,20,30]'
For client configuration refer to dogfood staging config v2
observed that GetPublicClientConfig call is captured in Grafana dashboard for every flyte run execution

after change:

To differentiate traffic from local env, temporarily bump up connectrpc minor version to such as connectrpc/0.10.1
Repeat the same flyte task run
observed that GetPublicClientConfig API call is not made from Grafana

pmahindrakar-oss · 2026-05-26T17:58:31Z

+        if cfg.token_endpoint is None:
+            raise ValueError("token_endpoint is required for client credentials authentication")


Wont this break existing clients who haven't generated there new configs. Ideally we want to keep it backward compat

I addressed this by keeping ClientConfig untouched and pack my changes into LocalClientConfigOverrides, this way is cleaner and ensure backward compatibility for existing client

Signed-off-by: Edward Sun <edward.sun@union.ai>

pmahindrakar-oss · 2026-05-26T23:37:17Z

+        kwargs = set_if_exists(
+            kwargs, "authorization_header", _internal.Platform.AUTHORIZATION_HEADER.read(config_file)
+        )
+        redirect_uri = _internal.Platform.REDIRECT_URI.read(config_file)


this var is not used other that in L120. Can use similar pattern to L121

pmahindrakar-oss · 2026-05-26T23:42:40Z

    "mcp>=1.26.0",
    "starlette",
    "uvicorn",
+    "debugpy>=1.8.20",


Do we need this dependency

@pmahindrakar-oss yes, it is needed to enable breakpoints and it is dev dependency only

pmahindrakar-oss · 2026-05-26T23:44:08Z

+        local_client_config_overrides=local_client_config_overrides,
+        audience=audience,


Any reason to keep audience different from local_client_config_overrides

pmahindrakar-oss · 2026-05-26T23:48:42Z

+    def has_required_public_client_fields(self) -> bool:
+        return bool(self.client_id and self.redirect_uri and self.header_key and self.scopes)


are we missing audience

pmahindrakar-oss · 2026-05-27T00:17:41Z

+    if not org:
+        raise click.BadParameter("--endpoint or --org must be provided")


Check if this could break for local-persistence mode.

--local-persistence enables a local SQLite-backed record of local runs. The data comes from the SDK process itself while it executes locally: task/ run metadata, inputs/outputs references, status, timestamps, etc. It is written to local storage, then tools like the local TUI can read it back.

pmahindrakar-oss · 2026-05-27T00:19:24Z

+    admin["clientId"] = f"{org}-uctl"
+    admin["insecure"] = insecure
+    admin["authorizationHeader"] = "flyte-authorization"
+    admin["redirectUri"] = "http://localhost:53593/callback"
+    admin["scopes"] = ["all"]


We want to make sure these defaults are ok to be used in selfhosted environments.
cc : @mhotan .

I think as an escape hatch , can we allow these to be passed, for eg in cases of selfhosted or where there are deviations in these defaults. An explicit args would help here.

Thinking about this more, we can populate this from GetPublicClientConfig call so we remove these unknowns. We only call this API on create config call and once that data exists in cli's config, it doesn't need to refetch it

edwardsun-union force-pushed the reducerCall branch 2 times, most recently from c3c10eb to c9956d8 Compare May 26, 2026 16:37

pmahindrakar-oss reviewed May 26, 2026

View reviewed changes

edwardsun-union requested a review from pmahindrakar-oss May 26, 2026 20:48

edwardsun-union force-pushed the reducerCall branch from ba416a6 to 60821f4 Compare May 26, 2026 20:53

edwardsun-union added 14 commits May 26, 2026 13:56

make GetPublicClientConfig conditionaly call

cc39290

Signed-off-by: Edward Sun <edward.sun@union.ai>

adding debuger util

c743cfc

Signed-off-by: Edward Sun <edward.sun@union.ai>

fmt and type fixes

bc7bd22

Signed-off-by: Edward Sun <edward.sun@union.ai>

fix uv.lock

d16df49

Signed-off-by: Edward Sun <edward.sun@union.ai>

fix sign off check

2841bdb

Signed-off-by: Edward Sun <edward.sun@union.ai>

write required auth fields for remote authentication

e62fa1f

Signed-off-by: Edward Sun <edward.sun@union.ai>

adding clientid field

c4bc0f0

Signed-off-by: Edward Sun <edward.sun@union.ai>

fix clientId

c1f3eb6

Signed-off-by: Edward Sun <edward.sun@union.ai>

fix test

1716112

Signed-off-by: Edward Sun <edward.sun@union.ai>

fix org inference

537aa6f

Signed-off-by: Edward Sun <edward.sun@union.ai>

Address backward compatibility issue

6306c34

Signed-off-by: Edward Sun <edward.sun@union.ai>

remove duplicate field

0c94169

Signed-off-by: Edward Sun <edward.sun@union.ai>

clean up

bb1531e

Signed-off-by: Edward Sun <edward.sun@union.ai>

clean up log message

8b34025

Signed-off-by: Edward Sun <edward.sun@union.ai>

edwardsun-union force-pushed the reducerCall branch from 60821f4 to 8b34025 Compare May 26, 2026 20:57

address comment

6db5b0a

Signed-off-by: Edward Sun <edward.sun@union.ai>

pmahindrakar-oss reviewed May 27, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Reducing GetPublicClientConfig API call For Pkce and ClientCredential#1105

Reducing GetPublicClientConfig API call For Pkce and ClientCredential#1105
edwardsun-union wants to merge 15 commits into
flyteorg:mainfrom
edwardsun-union:reducerCall

edwardsun-union commented May 22, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

pmahindrakar-oss May 26, 2026

Uh oh!

edwardsun-union May 26, 2026

Uh oh!

pmahindrakar-oss May 26, 2026

Uh oh!

pmahindrakar-oss May 26, 2026

Uh oh!

edwardsun-union May 27, 2026

Uh oh!

pmahindrakar-oss May 26, 2026

Uh oh!

pmahindrakar-oss May 26, 2026

Uh oh!

pmahindrakar-oss May 27, 2026

Uh oh!

pmahindrakar-oss May 27, 2026

Uh oh!

pmahindrakar-oss May 27, 2026

Uh oh!

pmahindrakar-oss May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		if cfg.token_endpoint is None:
		raise ValueError("token_endpoint is required for client credentials authentication")

		local_client_config_overrides=local_client_config_overrides,
		audience=audience,

		def has_required_public_client_fields(self) -> bool:
		return bool(self.client_id and self.redirect_uri and self.header_key and self.scopes)

		if not org:
		raise click.BadParameter("--endpoint or --org must be provided")

Conversation

edwardsun-union commented May 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

- Description

- Testing

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

edwardsun-union commented May 22, 2026 •

edited

Loading