-
Notifications
You must be signed in to change notification settings - Fork 132
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Feature] Introduce new Credential Strategies for Agents #882
[Feature] Introduce new Credential Strategies for Agents #882
Conversation
I've started the integration test for this change, result should appear soon. Meanwhile, could you please run |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM assuming resolution of my last comment. Thanks @aravind-segu!
5fb5b16
to
037d295
Compare
037d295
to
89739b7
Compare
Signed-off-by: aravind-segu <aravind.segu@databricks.com>
Signed-off-by: aravind-segu <aravind.segu@databricks.com>
Signed-off-by: aravind-segu <aravind.segu@databricks.com>
89739b7
to
fd0e4db
Compare
If integration tests don't run automatically, an authorized user can run them manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
What changes are proposed in this pull request?
This PR introduces two new credential strategies for Agents, (AgentEmbeddedCredentials, AgentUserCredentials).
Agents currently use the databricks.sdk in order to interact with databricks resources. However the authentication method for these resources is a little unique where we store the token for the authentication in a Credential File on the Kubernetes Container. Therefore in the past we added the Model Serving Credential Strategy to the defaultCredentials list to read this file.
Now we want to introduce a new authentication where the user's token is instead stored in a thread local variable. Agent users will initialize clients as follows:
Then the users can use the invoker_client to interact with resources with the invokers token or the definers_client to interact with resources using the old method of authentication.
Additionally as the users will be using these clients to test their code locally in Databricks Notebooks, if the code is not being run on model serving environments, users need to be able to authenticate using the DefaultCredential strategies.
More details: https://docs.google.com/document/d/14qLVjyxIAk581w287TWElstIeh8-DR30ab9Z6B_Vydg/edit?usp=sharing
How is this tested?
Added unit tests