Update LMEvalJob CRD to pass secrets

Add the `envSecrets` field to pass the secrets.
Each of the EnvSecret could be either an API key
or a secret object reference.

Signed-off-by: Yihong Wang <[email protected]>

api/OpenAPI.yaml

@@ -1,4 +1,4 @@
-openapi: 3.1.0
+openapi: '3.1.0'
 info:
   title: LM Evaluation Harness API
   description: API for submitting, polling, and retrieving results of LM Evaluation Harness jobs.
@@ -56,6 +56,53 @@ paths:
                 include_path:
                   type: string
                   description: Path to include in the evaluation.
+                secrets:
+                  type: array
+                  description: Provide the secrets to run the evulation job
+                  items:
+                    type: object
+                    description: create environment variables to store the secrets or mount the secrets as files
+                    oneOf:
+                      - properties:
+                          mountPath:
+                            type: string
+                            description: where to mount the secret object to
+                          referenceObj:
+                            type: object
+                            description: use a secret object
+                            properties:
+                              name:
+                                type: string
+                                description: secret object's name
+                              files:
+                                type: array
+                                description: specify the keys in a secret object and the path
+                                items:
+                                  type: object
+                                  properties:
+                                    key:
+                                      type: string
+                                      description: specify the key of the secret object
+                                    path:
+                                      type: string
+                                      description: specify the file path
+                      - properties:
+                          env:
+                            type: string
+                            description: use the environment variable to access the secret
+                          key:
+                            type: string
+                            description: the secret value
+                          referenceObj:
+                            type: object
+                            description: use a secret object
+                            properties:
+                              name:
+                                type: string
+                                description: secret object's name
+                              key:
+                                type: string
+                                description: specify the key of the secret object
               required:
                 - model
                 - tasks

api/v1beta1/lmevaljob_types.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
@@ -59,9 +60,26 @@ type Arg struct {
 	Value string `json:"value,omitempty"`
 }
 
+type EnvSecret struct {
+	// Environment's name
+	Env string `json:"env"`
+	// The secret is from a secret object
+	// +optional
+	SecretRef *corev1.SecretKeySelector `json:"secretRef,omitempty"`
+	// The secret is from a plain text
+	// +optional
+	Secret *string `json:"secret,omitempty"`
+}
+
+type FileSecret struct {
+	// The secret object
+	SecretRef corev1.SecretVolumeSource `json:"secretRef,omitempty"`
+	// The path to mount the secret
+	MountPath string `json:"mountPath"`
+}
+
 // LMEvalJobSpec defines the desired state of LMEvalJob
 type LMEvalJobSpec struct {
-	// INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
 	// Important: Run "make" to regenerate code after modifying this file
 
 	// Model name
@@ -86,6 +104,11 @@ type LMEvalJobSpec struct {
 	// model, will be saved at per-document granularity
 	// +optional
 	LogSamples *bool `json:"logSamples,omitempty"`
+	// Assign secrets to the environment variables
+	// +optional
+	EnvSecrets []EnvSecret `json:"envSecrets,omitempty"`
+	// Use secrets as files
+	FileSecrets []FileSecret `json:"fileSecrets,omitempty"`
 }
 
 // LMEvalJobStatus defines the observed state of LMEvalJob