kubeflow / mcp-server / 39463855372
87%

DEFAULT BRANCH: main
Ran
Jobs 3
Files 38
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 84.419% (+0.7%) from 83.749%
39463855372

push

github

web-flow 
fix(trainer): validate service_account_name and report denied accounts (#318)

* fix(trainer): validate service_account_name and report denied accounts

fine_tune(), run_custom_training() and run_container_training() passed
service_account_name to the runtime patch without any check, so a bad name
only failed later with an unclear Kubernetes or SDK error.

- Validate the name with the DNS-subdomain rules (dots allowed, up to 253
  characters) before any SDK or cluster call. The check from
  validate_runtime_name() is moved into a shared
  validate_k8s_subdomain_name() and reused.
- Validation stays separate from authorization: a valid name does not mean
  the caller may use that account. When the cluster denies the request
  (403 from RBAC or an admission policy), return PERMISSION_DENIED with a
  hint instead of SDK_ERROR.
- Note in the ARCHITECTURE.md hardening checklist that restricting which
  ServiceAccounts jobs may use needs an admission policy.

No tool or schema change.

Fixes #277

Signed-off-by: pratik naik <naikp0241@gmail.com>

* fix(trainer): also check __context__ for a 403 in _sdk_error

Per review: an exception wrapped without `from` keeps the original on
__context__ while __cause__ stays None, so a 403 there would fall back to
SDK_ERROR. Check `__cause__ or __context__`, the same as is_k8s_not_found,
and cover both wrapping styles in the PERMISSION_DENIED test.

Signed-off-by: pratik naik <naikp0241@gmail.com>

* fix(docs): clarify which admission policy denials become PERMISSION_DENIED

Per review: not every admission denial is a 403. A ValidatingAdmissionPolicy
returns 422 unless it sets `reason: Forbidden`, and a webhook returns 400 if
it sets no status code; those come back as SDK_ERROR. Also, a Pod-level
policy only rejects the Pod later in the Job controller, after the tool has
already reported success.

State that the policy must match TrainJobs and deny with 403. The code keeps
mapping only 403, since 400/422 are also returne... (continued)

2682 of 3177 relevant lines covered (84.42%)

2.53 hits per line

Coverage Regressions

Lines Coverage ∆ File
56
83.25
5.1% trainer/api/training.py
2
98.77
0.02% core/security.py
Jobs
ID Job ID Ran Files Coverage
1 python-3.11 - 39463855372.1 38
84.42
GitHub Action Run
2 python-3.12 - 39463855372.2 38
84.42
GitHub Action Run
3 python-3.10 - 39463855372.3 38
84.42
GitHub Action Run
Source Files on build 39463855372