issue 680: configure kale to use different kfp server

[hmtosi]

Closes #680
This is the backend ticket only.
UI will be addressed in #713

Testing

Quick Manual Check

1. Start your kfp server on a known port (default is 8080)
2. Build the kale extension and start JupyterLab
3. In the Kale tab, verify that KFP connection status is Connected
4. From the Launcher page, open a new Terminal and update the configuration

    # change directory to kale
    cd kale

    # launch a new interactive session
    python

    >>> # save a new configuration
    >>> from kale.config import kfp_server_config
    >>> kfp_server_config.save_config({"host": "http://localhost:8081"})

[Note] - Any of the six configuration parameters can be adjusted in this way - any parameters you do not adjust will remain as the default

5. Verify that the KFP connection status has changed to Disconnected (you may need to refresh JupyterLab)
6. Find the kfp_server_config.json file on your local machine (it should be at home/.kale/kfp_server_config.json), and make sure it has been modified with the latest changes.

Unit Test

In development

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign stefanofioravanzo for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jesuino]

Hello Hannah,

Thanks for your PR, it seems that everything is on place for allowing us to make a fine configuration of the kfp.Client() creation!

I mentioned another place where the kfp.Client is called, would you please check my comment and let me know your thoughts?

Thanks!

[jesuino]

It is looking great and working well locally! I just have one final solution.

Thanks!

[jesuino]

LGTM!

[jesuino]

LGTM!

[hmtosi]

@ederign @StefanoFioravanzo this is ready for your final review/approval when you have a moment, thank you!

[ederign]

/hold I'll need some time to review this one

[google-oss-prow]

New changes are detected. LGTM label has been removed.

[hmtosi]

Hi @ada333 @jesuino, this is ready for review again. I have made some changes to the authentication security so that...

• secrets/tokens/cookies are no longer written directly to the disk through the normal workflow
• the config file has guardrails that prevent a user from accidentally writing these
• the unit tests verify these security measures
• the README.md is updated with some information about how to adjust authentication

---

I did the following checks on my local kale installation:

✅ Verify that Kale is available
-build extension and open JupyterLab
-see that the kale icon is there
-open a notebook and toggle kale to enable it

✅ Run a pipeline
-verify that the notebook opened in the last test has all kale metadata components
-hit "Compile and Run" and check that pipeline completes

✅ Assign new host
-open a terminal in the JupyterLab session
-start an interactive Python session and then run:

from kale.config import kfp_server_config
kfp_server_config.save_config({"host": "http://localhost:8081"})

-this saves successfully, and then the KFP connectivity check shows that KFP is suddenly unreachable
-reversing this and reassigning port=8080 also saves successfully, and KFP is reachable again

✅ Try to assign new cookies directly
-in the same interactive Python session, run:

kfp_server_config.save_config(
            	{
                	"auth_type": "dex",
                	"auth_config": {"cookies": "session=abc"},  # ← Should fail
            	}

-this fails with ValueError: auth_config contains fields that look like secrets
-the config file is not updated on my local machine

✅ Assign new token with environment variable
-in the same interactive Python session, run:

kfp_server_config.save_config(
            	{
                	"auth_type": "existing_bearer_token",
                	"auth_config": {"env_var": "KF_PIPELINES_TOKEN"},  # ← Should pass
            	}

-this succeeds with the message Saved KFP server config to /home/htosi/.config/kale/kfp_server_config.json
-checking the local config file, it is updated with these values
-the KFP connectivity status becomes Disconnected because we have not set the environment var value

---

Further functionality will be added with the UI ticket. One known issue is that running the kfp_server_config.save_config() function overwrites the current config value. Thus, if a user saves one parameter and then later saves a different parameter (ie. assigns a new host and then separately assigns a token env var), only the last one will be saved, and all others will be overwritten/set to default. This behavior will be handled in the UI ticket.