IBM Cloud Integration (#1593)

* IBM Cloud authentication process (#1592)

* created the ibm_cloud service to authenticate with

* preparing the tests

* added tests for ibm cloud authentication process

* fix lint

* fix authentication logger

* Local authentication refactor (#1595)

* mock backend renamed

* created local service

* added the channel as a parameter in the use case

* improved the tests to verify permissions in groups

* fix bug creating the provider

* Channel implementation in client (#1596)

* Channel implementation in client

* fix bug with settings configuration

* use get_headers in serverless client

* get_headers as static method

* include instance in files client

* move get_headers to all the requests

* moved get_headers to utils

* updated docstrings

* added the same param to ibm serverless client

* Configure the IBM Cloud env vars for Functions (#1597)

* fixed a bug in the client uploading functions

* setup channel and instance in the env vars

* updated references to old env vars

* use the new env vars in the client

* fix test

* fix lint and black

* fix tests

* fix enum value

* tests updated

* fix black and lint

* Improve the logic to manage authentication errors (#1599)

* improve logic with authentication failed exception

* fix linter

* implement the headers for 401 exception

* Empty commit

* update the interface for the channel

* restart docker-compose configuration

* restart docker-compose configuration

* Fix/save account (#1600)

* fix: IBMServerlessClient save_account

* fix lint

* fix docstring

* apply partial review suggestions

* configure environment variables in helm (#1603)

* New Group creation process for IBM Cloud (#1602)

* Store the access group separately from the id

* restart docker-compose configuration

* move custom group to inheritance one

* updated tests

---------

Co-authored-by: Pablo Aragón <pablo.aragon@ibm.com>

Author: Tansito

charts/qiskit-serverless/charts/gateway/templates/deployment.yaml

@@ -109,6 +109,12 @@ spec:
               value: {{ .Values.application.auth.token.url | quote }}
             - name: SETTINGS_TOKEN_AUTH_VERIFICATION_FIELD
               value: {{ .Values.application.auth.token.verificationField | quote }}
+            - name: IAM_IBM_CLOUD_BASE_URL
+              value: {{ .Values.application.auth.token.iamUrl | quote }}
+            - name: RESOURCE_CONTROLLER_IBM_CLOUD_BASE_URL
+              value: {{ .Values.application.auth.token.resourceControllerUrl | quote }}
+            - name: RESOURCE_PLANS_ID_ALLOWED
+              value: {{ .Values.application.auth.token.resourcePlansAllowed | quote }}
             - name: SETTINGS_AUTH_MOCKPROVIDER_REGISTRY
               value: {{ .Values.application.authMockproviderRegistry }}
             - name: RAY_CLUSTER_WORKER_REPLICAS
@@ -156,8 +162,6 @@ spec:
               value: {{ .Values.application.ray.openTelemetryCollector.host }}:{{ .Values.application.ray.openTelemetryCollector.port }}
             - name: OTEL_EXPORTER_OTLP_TRACES_INSECURE
               value: {{ .Values.application.ray.openTelemetryCollector.insecure | quote }}
-            - name: QISKIT_IBM_CHANNEL
-              value: {{ .Values.application.qiskitRuntime.channel }}
             - name: QISKIT_IBM_URL
               value: {{ .Values.application.qiskitRuntime.url }}
             - name: IQP_QCON_API_BASE_URL

charts/qiskit-serverless/charts/gateway/values.yaml

@@ -44,7 +44,6 @@ application:
     keepClusterOnComplete: False
     programTimeoutDays: 14
   qiskitRuntime:
-    channel: "ibm_quantum"
     url: "https://auth.quantum-computing.ibm.com/api"
   iqpQcon:
     url: "https://api-qcon.quantum.ibm.com/api"

client/qiskit_serverless/core/client.py

@@ -57,7 +57,11 @@ class BaseClient(JobService, RunService, JsonSerializable, ABC):
     """
 
     def __init__(  # pylint:  disable=too-many-positional-arguments
-        self, name: str, host: Optional[str] = None, token: Optional[str] = None
+        self,
+        name: str,
+        host: Optional[str] = None,
+        token: Optional[str] = None,
+        instance: Optional[str] = None,
     ):
         """
         Initialize a BaseClient instance.
@@ -66,10 +70,12 @@ def __init__(  # pylint:  disable=too-many-positional-arguments
             name: name of client
             host: host of client a.k.a managers host
             token: authentication token for manager
+            instance: IBM Cloud CRN
         """
         self.name = name
         self.host = host
         self.token = token
+        self.instance = instance
 
     @classmethod
     @abstractmethod

client/qiskit_serverless/core/clients/serverless_client.py

@@ -50,6 +50,7 @@
 )
 from qiskit_serverless.core.client import BaseClient
 from qiskit_serverless.core.decorators import trace_decorator_factory
+from qiskit_serverless.core.enums import Channel
 from qiskit_serverless.core.files import GatewayFilesClient
 from qiskit_serverless.core.job import (
     Job,
@@ -62,6 +63,7 @@
 )
 
 from qiskit_serverless.exception import QiskitServerlessException
+from qiskit_serverless.utils.http import get_headers
 from qiskit_serverless.utils.json import (
     safe_json_request_as_dict,
     safe_json_request_as_list,
@@ -95,6 +97,8 @@ def __init__(  # pylint:  disable=too-many-positional-arguments
         host: Optional[str] = None,
         version: Optional[str] = None,
         token: Optional[str] = None,
+        instance: Optional[str] = None,
+        channel: str = Channel.IBM_QUANTUM.value,
         verbose: bool = False,
     ):
         """
@@ -105,6 +109,8 @@ def __init__(  # pylint:  disable=too-many-positional-arguments
             host: host of gateway
             version: version of gateway
             token: authorization token
+            instance: IBM Cloud CRN
+            channel: identifies the method to use to authenticate the user
         """
         name = name or "gateway-client"
         host = host or os.environ.get(ENV_GATEWAY_PROVIDER_HOST)
@@ -121,30 +127,47 @@ def __init__(  # pylint:  disable=too-many-positional-arguments
                 "Authentication credentials must be provided in form of `token`."
             )
 
-        super().__init__(name, host, token)
+        try:
+            channel_enum = Channel(channel)
+        except ValueError as error:
+            raise QiskitServerlessException(
+                "Your channel value is not correct. Use one of the available channels: "
+                f"{Channel.LOCAL.value}, {Channel.IBM_QUANTUM.value}, {Channel.IBM_CLOUD.value}"
+            ) from error
+
+        if channel_enum is Channel.IBM_CLOUD and instance is None:
+            raise QiskitServerlessException(
+                "Authentication with IBM Cloud requires to pass the CRN as an instance."
+            )
+
+        super().__init__(name, host, token, instance)
         self.verbose = verbose
         self.version = version
-        self._verify_token(token)
+        self._verify_credentials()
 
-        self._files_client = GatewayFilesClient(self.host, self.token, self.version)
+        self._files_client = GatewayFilesClient(
+            self.host, self.token, self.version, self.instance
+        )
 
     @classmethod
     def from_dict(cls, dictionary: dict):
         return ServerlessClient(**dictionary)
 
-    def _verify_token(self, token: str):
-        """Verify token."""
+    def _verify_credentials(self):
+        """Verify against the API that the credentials are correct."""
         try:
             safe_json_request(
                 request=lambda: requests.get(
                     url=f"{self.host}/api/v1/programs/",
-                    headers={"Authorization": f"Bearer {token}"},
+                    headers=get_headers(token=self.token, instance=self.instance),
                     timeout=REQUESTS_TIMEOUT,
                 ),
                 verbose=self.verbose,
             )
         except QiskitServerlessException as reason:
-            raise QiskitServerlessException("Cannot verify token.") from reason
+            raise QiskitServerlessException(
+                "Credentials couldn't be verified."
+            ) from reason
 
     ####################
     ####### JOBS #######
@@ -161,7 +184,7 @@ def jobs(self, **kwargs) -> List[Job]:
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/jobs/",
                 params=kwargs,
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 timeout=REQUESTS_TIMEOUT,
             )
         )
@@ -200,7 +223,7 @@ def provider_jobs(self, function: QiskitFunction, **kwargs) -> List[Job]:
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/jobs/provider/",
                 params=kwargs,
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 timeout=REQUESTS_TIMEOUT,
             )
         )
@@ -216,7 +239,7 @@ def job(self, job_id: str) -> Optional[Job]:
         response_data = safe_json_request_as_dict(
             request=lambda: requests.get(
                 url,
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 timeout=REQUESTS_TIMEOUT,
             )
         )
@@ -266,7 +289,7 @@ def run(
                 request=lambda: requests.post(
                     url=url,
                     json=data,
-                    headers={"Authorization": f"Bearer {self.token}"},
+                    headers=get_headers(token=self.token, instance=self.instance),
                     timeout=REQUESTS_TIMEOUT,
                 )
             )
@@ -282,7 +305,7 @@ def status(self, job_id: str):
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/jobs/{job_id}/",
                 params={"with_result": "false"},
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 timeout=REQUESTS_TIMEOUT,
             )
         )
@@ -302,7 +325,7 @@ def stop(self, job_id: str, service: Optional[QiskitRuntimeService] = None):
         response_data = safe_json_request_as_dict(
             request=lambda: requests.post(
                 f"{self.host}/api/{self.version}/jobs/{job_id}/stop/",
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 timeout=REQUESTS_TIMEOUT,
                 json=data,
             )
@@ -315,7 +338,7 @@ def result(self, job_id: str):
         response_data = safe_json_request_as_dict(
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/jobs/{job_id}/",
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 timeout=REQUESTS_TIMEOUT,
             )
         )
@@ -328,7 +351,7 @@ def logs(self, job_id: str):
         response_data = safe_json_request_as_dict(
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/jobs/{job_id}/logs/",
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 timeout=REQUESTS_TIMEOUT,
             )
         )
@@ -368,12 +391,22 @@ def upload(self, program: QiskitFunction) -> Optional[RunnableQiskitFunction]:
             if program.image is not None:
                 # upload function with custom image
                 function_uploaded = _upload_with_docker_image(
-                    program=program, url=url, token=self.token, span=span, client=self
+                    program=program,
+                    url=url,
+                    token=self.token,
+                    span=span,
+                    client=self,
+                    instance=self.instance,
                 )
             elif program.entrypoint is not None:
                 # upload funciton with artifact
                 function_uploaded = _upload_with_artifact(
-                    program=program, url=url, token=self.token, span=span, client=self
+                    program=program,
+                    url=url,
+                    token=self.token,
+                    span=span,
+                    client=self,
+                    instance=self.instance,
                 )
             else:
                 raise QiskitServerlessException(
@@ -388,7 +421,7 @@ def functions(self, **kwargs) -> List[RunnableQiskitFunction]:
         response_data = safe_json_request_as_list(
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/programs",
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 params=kwargs,
                 timeout=REQUESTS_TIMEOUT,
             )
@@ -417,7 +450,7 @@ def function(
         response_data = safe_json_request_as_dict(
             request=lambda: requests.get(
                 f"{self.host}/api/{self.version}/programs/get_by_title/{title}",
-                headers={"Authorization": f"Bearer {self.token}"},
+                headers=get_headers(token=self.token, instance=self.instance),
                 params={"provider": provider},
                 timeout=REQUESTS_TIMEOUT,
             )
@@ -511,7 +544,13 @@ class IBMServerlessClient(ServerlessClient):
         client = IBMServerlessClient(token=<INSERT_IBM_QUANTUM_TOKEN>)
     """
 
-    def __init__(self, token: Optional[str] = None, name: Optional[str] = None):
+    def __init__(
+        self,
+        token: Optional[str] = None,
+        name: Optional[str] = None,
+        instance: Optional[str] = None,
+        channel: str = Channel.IBM_QUANTUM.value,
+    ):
         """
         Initialize a client with access to an IBMQ-provided remote cluster.
 
@@ -528,15 +567,24 @@ def __init__(self, token: Optional[str] = None, name: Optional[str] = None):
         Args:
             token: IBM quantum token
             name: Name of the account to load
+            instance: IBM Cloud CRN
+            channel: identifies the method to use to authenticate the user
         """
         token = token or QiskitRuntimeService(name=name).active_account().get("token")
-        super().__init__(token=token, host=IBM_SERVERLESS_HOST_URL)
+        super().__init__(
+            channel=channel,
+            token=token,
+            instance=instance,
+            host=IBM_SERVERLESS_HOST_URL,
+        )
 
     @staticmethod
     def save_account(
         token: Optional[str] = None,
         name: Optional[str] = None,
         overwrite: Optional[bool] = False,
+        instance: Optional[str] = None,
+        channel: str = Channel.IBM_QUANTUM.value,
     ) -> None:
         """
         Save the account to disk for future use.
@@ -545,12 +593,25 @@ def save_account(
             token: IBM Quantum API token
             name: Name of the account to save
             overwrite: ``True`` if the existing account is to be overwritten
+            instance: IBM Cloud CRN
+            channel: identifies the method to use to authenticate the user
         """
-        QiskitRuntimeService.save_account(token=token, name=name, overwrite=overwrite)
+        QiskitRuntimeService.save_account(
+            token=token,
+            name=name,
+            overwrite=overwrite,
+            instance=instance,
+            channel=channel,
+        )
 
 
-def _upload_with_docker_image(
-    program: QiskitFunction, url: str, token: str, span: Any, client: RunService
+def _upload_with_docker_image(  # pylint: disable=too-many-positional-arguments
+    program: QiskitFunction,
+    url: str,
+    token: str,
+    span: Any,
+    client: RunService,
+    instance: Optional[str],
 ) -> RunnableQiskitFunction:
     """Uploads function with custom docker image.
 
@@ -559,6 +620,7 @@ def _upload_with_docker_image(
         url (str): upload gateway url
         token (str): auth token
         span (Any): tracing span
+        instance (Optional[str]): IBM Cloud crn
 
     Returns:
         str: uploaded function name
@@ -575,7 +637,7 @@ def _upload_with_docker_image(
                 "env_vars": json.dumps(program.env_vars or {}),
                 "description": program.description,
             },
-            headers={"Authorization": f"Bearer {token}"},
+            headers=get_headers(token=token, instance=instance),
             timeout=REQUESTS_TIMEOUT,
         )
     )
@@ -587,8 +649,13 @@ def _upload_with_docker_image(
     return RunnableQiskitFunction.from_json(response_data)
 
 
-def _upload_with_artifact(
-    program: QiskitFunction, url: str, token: str, span: Any, client: RunService
+def _upload_with_artifact(  # pylint:  disable=too-many-positional-arguments
+    program: QiskitFunction,
+    url: str,
+    token: str,
+    span: Any,
+    client: RunService,
+    instance: Optional[str],
 ) -> RunnableQiskitFunction:
     """Uploads function with artifact.
 
@@ -597,6 +664,7 @@ def _upload_with_artifact(
         url (str): endpoint for gateway upload
         token (str): auth token
         span (Any): tracing span
+        instance (Optional[str]): IBM Cloud crn
 
     Raises:
         QiskitServerlessException: if no entrypoint or size of artifact is too large.
@@ -645,7 +713,7 @@ def _upload_with_artifact(
                         "description": program.description,
                     },
                     files={"artifact": file},
-                    headers={"Authorization": f"Bearer {token}"},
+                    headers=get_headers(token=token, instance=instance),
                     timeout=REQUESTS_TIMEOUT,
                 )
             )

client/qiskit_serverless/core/constants.py

@@ -35,6 +35,7 @@
 
 # auth
 ENV_JOB_GATEWAY_TOKEN = "ENV_JOB_GATEWAY_TOKEN"
+ENV_JOB_GATEWAY_INSTANCE = "ENV_JOB_GATEWAY_INSTANCE"
 ENV_JOB_GATEWAY_HOST = "ENV_JOB_GATEWAY_HOST"
 ENV_JOB_ID_GATEWAY = "ENV_JOB_ID_GATEWAY"
 ENV_JOB_ARGUMENTS = "ENV_JOB_ARGUMENTS"