Token Authentication enabled and tested for Torchserve workflow (#306)

Signed-off-by: sharvil10 <[email protected]>
Signed-off-by: Tyler Titsworth <[email protected]>
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Tyler Titsworth <[email protected]>
Co-authored-by: Srikanth Ramakrishna <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: 4 people

pytorch/serving/config.properties

@@ -12,3 +12,4 @@ cpu_launcher_enable=true
 cpu_launcher_args=--use_logical_core
 disable_token_authorization=true
 enable_model_api=true
+enable_envvars_config=true

workflows/charts/torchserve/README.md

@@ -18,6 +18,7 @@ For more information about how to use Intel Optimized TorchServe, check out the
 | deploy.resources.limits | object | `{"cpu":"4000m","memory":"1Gi"}` | Maximum resources per pod |
 | deploy.resources.requests | object | `{"cpu":"1000m","memory":"512Mi"}` | Minimum resources per pod |
 | deploy.storage.nfs | object | `{"enabled":false,"path":"nil","readOnly":true,"server":"nil","subPath":"nil"}` | Network File System (NFS) storage for models |
+| deploy.tokens_disabled | bool | `false` | Set token authentication on or off. Checkout the latest [torchserve docs](https://github.com/pytorch/serve/blob/master/docs/token_authorization_api.md) for more details. |
 | fullnameOverride | string | `""` | Full qualified Domain Name |
 | nameOverride | string | `""` | Name of the serving service |
 | pvc.size | string | `"1Gi"` | Size of the storage |
@@ -37,4 +38,4 @@ There are some additional steps that can be taken to prepare your service for yo
 - Integrate an [SSL Certificate](https://pytorch.org/serve/configuration.html#enable-ssl) in your model config file to serve models securely.
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1)
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

workflows/charts/torchserve/templates/NOTES.txt

@@ -14,3 +14,8 @@
   echo "Visit http://127.0.0.1:8080 to use your application"
   kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
 {{- end }}
+{{- if eq false .Values.deploy.tokens_disabled }}
+2. Display the tokens for accessing the APIs. For more details about token authentication checkout: https://github.com/pytorch/serve/blob/master/docs/token_authorization_api.md
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "torchserve.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  kubectl exec --namespace {{ .Release.Namespace }}  $POD_NAME -- cat /home/model-server/key_file.json
+{{- end }}

workflows/charts/torchserve/templates/deploy.yaml

@@ -47,6 +47,9 @@ spec:
           - configMapRef:
               name: {{ .Values.deploy.env.configMapName }}
           {{- end }}
+          env:
+          - name: TS_DISABLE_TOKEN_AUTHORIZATION
+            value: "{{ .Values.deploy.tokens_disabled }}"
           ports:
             - name: rest-1
               containerPort: 8080

workflows/charts/torchserve/values.yaml

@@ -23,6 +23,8 @@ deploy:
   env:
     configMapName: intel-proxy-config
     enabled: true
+  # -- Set token authentication on or off. Checkout the latest [torchserve docs](https://github.com/pytorch/serve/blob/master/docs/token_authorization_api.md) for more details.
+  tokens_disabled: true
   # -- Models to be loaded
   models: all
   # -- Model Server Configuration file location